Joomla En-Masse 6.4 SQL Injection

2016.06.16

Credit: Hamed Izadi

Risk: Medium

Local: No

Remote: Yes

CVE: N/A

CWE: CWE-89

Dork: inurl:component/enmasse/

# Exploit Title: Joomla com_enmasse - SQL Injection
# Author: [ Hamed Izadi ]
#IRAN
# Vendor Homepage : http://extensions.joomla.org/extensions/extension/social-web/social-buy/en-masse
# Category: [ Webapps ]
# Tested on: [ Win ]
# Versions: 5.1-6.4
# Date: 2016/06/15
# Google Dork: inurl:component/enmasse/
# PoC:
# id Parameter Vulnerable To SQL
# Demo:
# http://example.com/component/enmasse/term?tmpl=component&id=2%27
# Youtube: https://youtu.be/LB5qVnXhzXE
# L u Arg

References:

https://youtu.be/LB5qVnXhzXE

See this note in RAW Version

Vote for this issue:

50%

Thanks for you vote!

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.

Nick (*)

Email (*)

Video

Text (*)

(*) - required fields.

{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1

{{ x.comment }}

Joomla En-Masse 6.4 SQL Injection

Dork: inurl:component/enmasse/

References:

Thanks for you vote!

Thanks for you comment!Your message is in quarantine 48 hours.

Thanks for you comment!
Your message is in quarantine 48 hours.