Skip to content

Archives: Exploits

Joomla! Component Fields – SQLi Remote Code Execution (Metasploit)

Joomla! Component Alexandria Book Library 3.1.2 – ‘letter’ SQL Injection

Joomla! Component CheckList 1.1.1 – SQL Injection

Joomla! Component CW Tags 2.0.6 – SQL Injection

Joomla! Component Ek Rishta 2.9 – SQL Injection

Joomla! Component Advertisement Board 3.1.0 – ‘catname’ SQL Injection

Joomla! Component Aist 2.0 – ‘id’ SQL Injection

Joomla! Component AllVideos Reloaded 1.2.x – ‘divid’ SQL Injection

Joomla! Component ccNewsletter 2.x.x ‘id’ – SQL Injection

Joomla! Component DT Register 3.2.7 – ‘id’ SQL Injection

Joomla! Component Fastball 2.5 – ‘season’ SQL Injection

Joomla! Component File Download Tracker 3.0 – SQL Injection

Joomla! Component Form Maker 3.6.12 – SQL Injection

Joomla! Component Gallery WD 1.3.6 – SQL Injection

Joomla! Component Google Map Landkarten 4.2.3 – SQL Injection

Joomla! Component JquickContact 1.3.2.2.1 – SQL Injection

Joomla! Component JS Jobs 1.1.9 – SQL Injection

Joomla! Component JS Autoz 1.0.9 – SQL Injection

Joomla! Component JomEstate PRO 3.7 – ‘id’ SQL Injection

Joomla! Component jGive 2.0.9 – SQL Injection

Joomla! Component JB Bus 2.3 – ‘order_number’ SQL Injection

Joomla! Component InviteX 3.0.5 – ‘invite_type’ SQL Injection

Joomla! Component jLike 1.0 – Information Leak

Joomla! Component JE PayperVideo 3.0.0 – ‘usr_plan’ SQL Injection

Joomla! Component JEXTN Classified 1.0.0 – ‘sid’ SQL Injection

Joomla! Component JEXTN Reverse Auction 3.1.0 – SQL Injection

Joomla! Component Jimtawl 2.1.6 – Arbitrary File Upload

Joomla! Component JMS Music 1.1.1 – SQL Injection

Joomla! Component JEXTN Membership 3.1.0 – ‘usr_plan’ SQL Injection

Joomla! Component CP Event Calendar 3.0.1 – ‘id’ SQL Injection

Joomla! Component Easydiscuss < 4.0.21 - Cross-Site Scripting

Joomla! Component jCart for OpenCart 2.0 – ‘product_id’ SQL Injection

Drupal 7.x Module Services – Remote Code Execution

Drupal Module CODER 2.5 – Remote Command Execution (Metasploit)

Drupal Module Coder < 7.x-1.3/7.x-2.6 - Remote Code Execution

Drupal Module RESTWS 7.x – PHP Remote Code Execution (Metasploit)

OpenCart 2.1.0.2 < 2.2.0.0 - json_decode Function Remote Code Execution

Drupal < 7.34 - Denial of Service

Drupal 7.0 < 7.31 - 'Drupalgeddon' SQL Injection (Remote Code Execution)

Drupal 7.0 < 7.31 - 'Drupalgeddon' SQL Injection (Admin Session)

Drupal 7.0 < 7.31 - 'Drupalgeddon' SQL Injection (PoC) (Reset Password) (2)

Drupal 7.0 < 7.31 - 'Drupalgeddon' SQL Injection (Add Admin User)

Drupal 7.0 < 7.31 - 'Drupalgeddon' SQL Injection (PoC) (Reset Password) (1)

Mpay24 PrestaShop Payment Module 1.5 – Multiple Vulnerabilities

PrestaShop – ‘getSimilarManufacturer.php?id_manufacturer’ SQL Injection

OpenCart 1.5.6.1 – ‘openbay’ Multiple SQL Injections

PrestaShop – Multiple Cross-Site Request Forgery Vulnerabilities

Drupal Module CKEditor < 4.1WYSIWYG (Drupal 6.x/7.x) - Persistent Cross-Site Scripting

OpenCart – Cross-Site Request Forgery (Change User Password)

OpenCart 1.5.5.1 – ‘FileManager.php’ Directory Traversal Arbitrary File Access