Improper Access Control in Joomla! Webservice Endpoints

This repository is a standalone Go-based Joomla credential attack toolkit named joombrute, not tied to a larger exploit framework. It is a real exploit repository with multiple offensive modules targeting Joomla 3/4/5 authentication and pre-auth disclosure weaknesses. The main CLI entry point is cmd/joombrute/main.go with Cobra-based subcommands defined under cmd/joombrute/*. Core logic is split into internal packages: internal/joomla handles target normalization, login form parsing, version detection, and login outcome classification; internal/brute implements concurrent admin login bruteforce with per-worker cookie jars and retry/backoff logic; internal/recon implements CVE-2023-23752 unauthenticated API harvesting; internal/mfa implements both CVE-2023-23755 TOTP brute force and CVE-2025-25227 MFA bypass probing; internal/httpx provides HTTP client/session/proxy plumbing; internal/output provides console and JSONL reporting. Primary capabilities: (1) detect fingerprints Joomla versions using /administrator/manifests/files/joomla.xml, frontend generator meta tags, and admin markup; (2) enum exploits CVE-2023-23752 against /api/index.php/v1/users?public=true and /api/index.php/v1/config/application?public=true to disclose usernames, DB credentials, SMTP credentials, and app secret; (3) brute performs concurrent credential attacks against /administrator/ using parsed CSRF token names and session cookies, classifying outcomes as success, invalid, blocked, or mfa-required; (4) mfa-brute exploits CVE-2023-23755 by exhausting 6-digit TOTP codes against the captive MFA validation flow; (5) mfa-bypass probes CVE-2025-25227 by replaying a half-authenticated session against bypass candidate com_users views/tasks such as view=methods; and (6) chain automates detect -> enum -> brute -> MFA bypass pivot. The exploit is operational rather than just a PoC because it includes working attack logic, concurrency controls, retry handling, proxy/TLS options, structured output, and an end-to-end chain mode. It does not deliver a traditional shell payload; instead, its payload is authenticated HTTP interaction intended to obtain admin access or disclose secrets. The repository also includes a full lab environment under lab/ with Docker Compose, installer scripts, MFA seeding PHP, and TOTP helper code for reproducible testing against Joomla 3.10, 4.2.7, and 5.x. Test fixtures and unit/integration tests under testdata/ and internal/*_test.go validate parsing and exploit behavior. Overall purpose: automate Joomla reconnaissance and credential/MFA attacks across multiple CVEs and versions, with emphasis on admin access acquisition and post-password MFA defeat.

Small standalone exploit repository containing one Python script, a README, and a license file. The main file, CVE-2023-23752.py, is a Python proof-of-concept for CVE-2023-23752 affecting Joomla! versions 4.0.0 through 4.2.7. It is not part of a larger exploitation framework. The script uses the requests library to send two unauthenticated GET requests to vulnerable Joomla REST API endpoints: /api/index.php/v1/users?public=true and /api/index.php/v1/config/application?public=true. It parses the returned JSON and extracts user account metadata and application/database configuration values, including potentially sensitive database credentials. The exploit has no post-exploitation capability, persistence, shell access, or code execution; its purpose is purely information disclosure. Repository structure is minimal: the Python script implements argument parsing, HTTP requests, JSON parsing, extraction helpers, and console output formatting; the README documents vulnerability background, usage, examples, and mitigations. Overall, this is a valid web-based information disclosure exploit POC with straightforward operator-supplied targeting and console output of leaked data.

This repository is a small standalone Python proof-of-concept exploit for CVE-2023-23752 affecting Joomla!. It contains three files: a README describing the vulnerability and listing many Joomla REST API endpoints, a requirements.txt with Python dependencies, and the main exploit script joomla.py. The script is the only meaningful code entry point. joomla.py is an interactive scanner that supports single-target and bulk-target modes. It accepts a domain or IP, normalizes it to HTTP if no scheme is provided, and then requests the Joomla configuration API endpoint /api/index.php/v1/config/application?public=true. If the response contains expected fields such as dbtype, dbprefix, host, db, user, and password, the script extracts them with regex, prints them to the console, and saves them locally. In bulk mode it reads targets from a user-supplied file and writes raw responses and extracted credentials into the Results directory. The exploit capability is information disclosure rather than direct code execution. However, it leaks highly sensitive database credentials and configuration details that could enable follow-on compromise. The code does not deliver a shell or execute commands on the target. It is therefore best classified as an operational exploit for unauthenticated credential/configuration extraction. Notable implementation details: the script uses requests and colorama, disables urllib3 insecure request warnings, creates a Results directory automatically, and stores findings in Results/Configurations.txt plus per-target files. There are some coding issues and rough edges, such as an unnecessary initial GET to the base URL, inconsistent verify handling, duplicated result writing in bulk mode, and a malformed main branch expression for option 2. Despite that, the core exploit logic is clear and functional: probe the Joomla API configuration endpoint and parse leaked database settings.

This repository contains a proof-of-concept (PoC) exploit for CVE-2023-23752, an information disclosure vulnerability in Joomla! (tested on version 4.2.7). The main file, 'CVE-2023-23752.cpp', is a C++ program that prompts the user for a base URL of a target Joomla! instance, then sends an HTTP GET request to the endpoint '/api/index.php/v1/config/application?public=true'. If the target is vulnerable, the script parses the JSON response and extracts sensitive configuration details such as database username, password, type, name, and prefix. The exploit leverages libcurl for HTTP requests and nlohmann::json for JSON parsing. The README provides compilation instructions and prerequisites. No weaponized payload is included; the exploit is strictly for information disclosure and does not provide code execution or further compromise. The attack vector is network-based, requiring the attacker to have access to the target's web interface. The endpoint '/api/index.php/v1/config/application?public=true' is fingerprintable and central to the exploit's operation.

This repository is an exploit for CVE-2023-23752, an authentication bypass vulnerability in Joomla! that allows unauthenticated attackers to access sensitive configuration information via the Joomla! API. The main exploit script, 'joomla.py', is a Python 3 tool that can scan a single target or a list of targets for the vulnerability. It sends HTTP GET requests to the '/api/index.php/v1/config/application?public=true' endpoint and, if successful, extracts and displays database credentials and other sensitive information. The script saves results in the 'Results' directory. The README provides a comprehensive list of potentially vulnerable API endpoints, but the exploit focuses on the configuration endpoint. The repository includes a requirements.txt for dependencies. The exploit is operational and can be used for both single and mass scanning of Joomla! instances. No fake or destructive functionality is present; the tool is focused on information disclosure.

This repository is a Python-based exploit tool targeting Joomla installations vulnerable to CVE-2023-23752. The main script, cve-joomlaX.py, reads a list of target URLs from a user-specified file, appends the vulnerable API endpoint (/api/index.php/v1/config/application?public=true) to each, and sends HTTP GET requests. If the endpoint is exposed and returns configuration data, the script parses the response for database name, username, password, and host, saving these credentials to results.txt. The tool uses multithreading for efficiency and is intended for bulk scanning. The repository includes a README with usage instructions, a placeholder for the URL list, and an output file for results. The exploit is operational, providing real credential extraction from vulnerable Joomla sites.

This repository contains a Python proof-of-concept exploit for CVE-2023-23752, an unauthenticated information disclosure vulnerability in Joomla. The main script, CVE-2023-23752.py, allows the user to scan a single URL or a list of URLs for the vulnerability. It does so by sending a GET request to the endpoint /api/index.php/v1/config/application?public=true on the target Joomla instance. If the endpoint is accessible and the vulnerability is present, the script parses the response for sensitive information such as usernames and passwords and prints them to the console. The script supports multi-threaded scanning and outputs results to a file. The README provides usage instructions, a list of other potentially vulnerable Joomla API endpoints, and a disclaimer. The exploit is a POC and does not provide post-exploitation capabilities beyond information disclosure.

This repository provides a proof-of-concept exploit for CVE-2023-23752, an authentication bypass vulnerability in Joomla! versions 4.00 through 4.28. The main exploit is implemented in 'exploit.sh', a Bash script that targets the vulnerable Joomla! API endpoint '/api/index.php/v1/config/application?public=true'. The script can scan a single URL or multiple targets from a file, sending HTTP requests to the endpoint and parsing the JSON response for administrator and MySQL credentials. Extracted credentials are displayed and saved to 'Results/Credentials.txt'. The repository also contains 'anti-delete.php', which appears to be an obfuscated PHP script unrelated to the main exploit functionality. The exploit is network-based and does not require authentication, making it a significant risk for exposed Joomla! instances. The repository is structured with clear usage instructions in the README, a Bash exploit script, and an obfuscated PHP file.

This repository contains a Python proof-of-concept exploit for CVE-2023-23752, an improper access check vulnerability in Joomla versions 4.0.0 through 4.2.7. The main file, CVE-2023-23752.py, is a command-line tool that takes a target URL and attempts to access two unauthenticated API endpoints: '/api/index.php/v1/users?public=true' and '/api/index.php/v1/config/application?public=true'. If the target is vulnerable, the script extracts and displays usernames and passwords from the Joomla instance. The exploit leverages network-based HTTP GET requests and does not require authentication. The repository also includes a README.md with background information and usage disclaimers. The exploit is a functional PoC for information disclosure and does not provide post-exploitation capabilities.

This repository provides a Python proof-of-concept exploit for CVE-2023-23752, an unauthenticated information disclosure vulnerability in Joomla versions prior to 4.2.8. The main exploit file, exploit.py, takes a target URL as input and sends unauthenticated HTTP GET requests to two vulnerable Joomla API endpoints: one for user information and another for site configuration (including database credentials). The script parses and displays the extracted data in a readable format, optionally with colored output. The repository includes a docker-compose.yml file to help users set up a vulnerable Joomla 4.2.7 environment for testing. The exploit demonstrates the vulnerability's impact by showing how an attacker can obtain sensitive information without authentication. No payload for code execution is included; the exploit is strictly for information disclosure. The code is clear, well-structured, and intended for educational and testing purposes.

This repository is a Go-based exploit tool targeting CVE-2023-23752, an information disclosure vulnerability in Joomla CMS. The main exploit logic resides in main.go, which parses command-line arguments to accept a target URL and an endpoint type. The tool constructs a request to either /api/index.php/v1/config/application or /api/v1/config/application on the target Joomla instance, appending query parameters to maximize data returned. It sends an unauthenticated HTTP GET request, disables TLS verification, and parses the JSON response for sensitive configuration data such as database user, password, host, db name, and db prefix. The extracted information is printed to the console. The repository includes standard Go module files and a GitHub Actions workflow for building binaries across platforms. The exploit is operational, providing direct extraction of sensitive data if the target is vulnerable and accessible.

This repository contains a Bash script (exploit.sh) and a README.md file. The script targets Joomla! versions 4.0.0 to 4.2.8, exploiting an unauthenticated information disclosure vulnerability. It requires the user to provide the base URL of a Joomla! installation as an argument. The script then sends HTTP requests to two API endpoints: one to retrieve user information (including usernames, emails, and group memberships) and another to retrieve application configuration data. The responses are parsed using 'jq' to extract and display the relevant information. The exploit does not require authentication and demonstrates the vulnerability by disclosing sensitive data from the target Joomla! instance. The repository is structured simply, with the main exploit logic contained in a single Bash script.

This repository contains a Ruby exploit script (exploit.rb) targeting Joomla! versions 4.0.0 through 4.2.7, exploiting CVE-2023-23752. The exploit leverages unauthenticated access to specific Joomla! API endpoints to disclose sensitive information, including user account details and full application configuration (notably database credentials). The main script, exploit.rb, is a standalone Ruby program using the httpx, docopt, and paint gems for HTTP requests, argument parsing, and colored output, respectively. The script takes a base URL as input and queries two vulnerable endpoints: '/api/index.php/v1/users?public=true' and '/api/index.php/v1/config/application?public=true'. The responses are parsed and displayed to the user, revealing critical information that could be used for further attacks. The repository also includes a docker-compose.yml file for setting up a vulnerable Joomla! environment for testing, and a README.md with usage instructions and references. No fake or destructive code is present; the exploit is operational and focused on information disclosure.

This repository is a Python-based proof-of-concept exploit for CVE-2023-23752, a vulnerability in Joomla CMS. The exploit is designed to scan multiple targets (provided in 'target.txt') for the presence of the vulnerable API endpoint '/api/index.php/v1/config/application?public=true'. If the endpoint is accessible and the target is vulnerable, the script extracts sensitive configuration data such as usernames, passwords, and database names from the JSON response. The main entry point is 'run.py', which handles user input for the target list and thread count, then launches a threaded scan using the 'JoomlaCVE' class. Supporting modules in 'extra/' handle HTTP requests and response parsing. Results are saved in timestamped files under 'data/result/'. The repository includes a large list of potential targets and is structured for bulk scanning. No weaponized or post-exploitation payloads are present; the exploit is a POC focused on information disclosure.

This repository is a mass scanner and exploit tool for CVE-2023-23752, a vulnerability in Joomla CMS. The main script (run.py) allows the user to supply a list of target URLs and the number of threads for concurrent scanning. For each target, the tool constructs a request to the endpoint /api/index.php/v1/config/application?public=true, which, if the target is vulnerable, returns sensitive configuration data (such as database credentials). The tool parses the JSON response for expected keys related to credentials and writes successful results to a dated file in the data/result directory. The code is modular, with extra/parser.py handling response parsing and extra/requester.py managing HTTP sessions and user agents. The repository is a functional proof-of-concept exploit, not a detection script, and is designed for bulk exploitation of Joomla instances vulnerable to CVE-2023-23752.

This repository is a Python-based bulk scanner and exploit tool targeting Joomla installations vulnerable to CVE-2023-23752. The main script, TND.py, reads a list of target URLs from a user-supplied file and attempts to access the endpoint 'api/index.php/v1/config/application?public=true' on each target. If the endpoint is accessible and the target is vulnerable, the tool extracts sensitive configuration data (such as database credentials) and writes the results to a timestamped output file. The exploit uses multithreading for efficiency and requires the user to specify the number of threads and the input file containing target URLs. The repository includes a requirements.txt for dependencies and a README with basic usage instructions. No hardcoded payload is delivered; the exploit's main capability is unauthorized information disclosure from vulnerable Joomla sites.

This repository contains a Python 2.7 script (Jom.py) that exploits CVE-2023-23752, an improper access control vulnerability in Joomla! versions 4.0.0 through 4.2.7. The exploit targets the webservice endpoint '/api/index.php/v1/config/application?public=true' to retrieve sensitive database configuration information without authentication. The script reads a list of target URLs from a user-supplied file, sends HTTP GET requests to the vulnerable endpoint on each target, and parses the JSON response for database host, name, username, and password. Successful results are printed to the console and appended to 'res.txt'. The repository also includes a README.md with basic usage information and donation links. The exploit is operational, providing real credential extraction if the target is vulnerable.