Hands-On Web Penetration Testing with Metasploit

Joomla exploitation using Metasploit

Once all the enumeration and version detection is done, it's time for the exploitation. In this section, we will look at some of the ways that Joomla can be exploited. The first one is the well-known SQL injection vulnerability applied in Joomla to gain Remote Code Execution (RCE). A Metasploit module is available for this and we can use it by executing the use exploit/unix/webapp/joomla_comfields_sqli_rce command, as in the following screenshot:

Before running the exploit, let's see how it works.