Joomla! information disclosure - CVE-2023-23752 exploit

Exploit for CVE-2023-23752 (4.0.0 <= Joomla <= 4.2.7).

Usage

Before using the project we need to install the required packages (I recommend creating a virtual environment first)

pip install -r requierements.txt

Proof of Concept

To create a vulnerable environment we need to have docker installed

1. Build image:

docker-compose up --build

2. Once the image is created and running, go to http://127.0.0.1:4242/installation/index.php

3. Fill in the data:

Database type: Mysqli
Host: mysql
Db User: root
Db Password: holamundo

References

This is an exploit for the vulnerability CVE-2023-23752 found by Zewei Zhang of NSFOCUS TIANJI Lab.

Resources about the vulnerability:

• Discoverer advisory
• Joomla Advisory
• AttackerKB topic
• Vulnerability analysis
• Nuclei template
• Acceis POC

Warning

The content of this repository does not promote or encourage any illegal activity. All material provided here is solely for research and educational purposes.