Joomla! Component Event Booking 2.10.1 – SQL Injection - 体验盒子

作者： Persian Hack Team

日期： 2016-09-26

类别：

webapps

平台：

php

来源：https://www.exploit-db.com/exploits/40423/

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

######################

# Exploit Title : Joomla Event Booking Component - SQL Injection

# Exploit Author :Persian Hack Team

# Homepage : http://persian-team.ir

# Vendor Homepage : http://extensions.joomla.org/extension/event-booking

# Category [ Webapps ]

# Tested on [ Win ]

# Version : 2.10.1

# Date 2016/09/25

######################

#

# PoC

#=> Sql Injection :

# Date Parameter Vulnerable To SQL

# Demo :

# http://server/index.php?option=com_eventbooking&view=calendar&layout=weekly&date={SQL}&Itemid=354

#

# Video : http://persian-team.ir/showthread.php?tid=160&pid=291

######################

# Discovered by :Mojtaba MobhaM

# B3li3v3 M3 I will n3v3r St0p

# Greetz : T3NZOG4N & FireKernel & Dr.Askarzade & Masood Ostad & Dr.Koorangi &Milad Hacking & JOK3R $ Mr_Mask_Black And All Persian Hack Team Members

######################