+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Grayhat • Purple Team • Hybrid Security (https://hackforums.net/forumdisplay.php?fid=449)
+---- Forum: Website Hacking (https://hackforums.net/forumdisplay.php?fid=43)
+---- Thread: [Mass Exploit] Joomla 3.2 to 3.4 SQL Injection (/showthread.php?tid=5038530)
[Mass Exploit] Joomla 3.2 to 3.4 SQL Injection - makmaniac - Oct 28, 2015
Hello HF 🤝
I love to automate stuff. I wrote this demo exploit to automate SQL injection vulnerability in open source CMS joomla (3.2 to 3.4.4) found by Trust Wave Labs. CVE-2015-7297, CVE-2015-7857, and CVE-2015-7858 cover this SQL Injection vulnerability.
I have used Google Scraper and Mass Exploiter from one of my previous projects which works as a dork scanner and performs mass exploitation on hundreds of URLs in a matter of seconds.
Here's a preview.
[img=500x400]http://mukarramkhalid.com/wp-content/uploads/2015/10/joomla1.png[/img]
Requirements
- Python version 3.4.x or higher
- A third party package – Requests
GitHub Repository
Blog Post
Last Scan Results
Code
[+] Starting dork scanner for : inurl:"/component/tags/"
[+] Total URLs found : 452
[+] URLs written to urls.txt
[+] Trying Joomla SQL Injection exploit on 452 urls
....REMOVED....
....REMOVED....
....REMOVED....
Total URLs Scanned : 452
Vulnerable URLs Found : 66
Script Execution Time : 291.078248500824 secondsVideo Demo
Please check the blog post for some known issues in the script.
.
.
* - lilsamzy - Oct 29, 2015
thanks man u made it alot easier to use this exploit 👍
* - HaxOr❤ - Oct 29, 2015
Can you inject a specific list or it needs to be dorked first?
* - cruxxy - Oct 31, 2015
OMFG thankyou so much youre my hero <3
RE: [Mass Exploit] Joomla 3.2 to 3.4 SQL Injection - wiros4bleng - Nov 13, 2017
Wow! great. Thanks for share