64 lines
No EOL
2 KiB
Text
64 lines
No EOL
2 KiB
Text
############################################################
|
|
#
|
|
# Title : Joomla com_niceajaxpoll <= 1.3.0 SQL Injection Vulnerability
|
|
# Author : Patrick de Brouwer - @knickz0r
|
|
# NLSecurity - www.nlsecurity.org
|
|
#
|
|
# Dork : inurl:"/index.php?option=com_niceajaxpoll"
|
|
#
|
|
# Software : Joomla component Nice Ajax Poll <= 1.3.0
|
|
# http://dmitry.dn.ua/my-projects/304-nice-ajax-poll.html
|
|
#
|
|
# Vendor : Dima Kuprijanov
|
|
#
|
|
# Date : 2012-07-31
|
|
#
|
|
############################################################
|
|
|
|
+ -- --=[ 0x01 - Software description
|
|
|
|
Nice Ajax Poll is a component for the Joomla! CMS which all-
|
|
ows users to vote on certain questions or statements.
|
|
|
|
+ -- --=[ 0x02 - Vulnerability description
|
|
|
|
There is a SQL Injection vulnerability that can be called f-
|
|
rom within the website to perform the SQL Injection attack.
|
|
|
|
+ -- --=[ 0x03 - Impact
|
|
|
|
The impact of this vulnerability should be rated as critical
|
|
as it is possible to access the database and therefore retr-
|
|
eive user information such as usernames, passwords and other
|
|
data. When abused, hackers could gain access to the adminis-
|
|
trative interface of Joomla.
|
|
|
|
+ -- --=[ 0x04 - Affected versions
|
|
|
|
As of the source code, the version containint this vulnerab-
|
|
ility was version 1.3.0. It was not proven that the vulnera-
|
|
bility does not exist in newer or earlier versions. Therfore
|
|
the vulnerability is considered available in versions below
|
|
1.3.0.
|
|
|
|
+ -- --=[ 0x05 - Vendor contact trail
|
|
|
|
Contact has not been made with the author. Author will rece-
|
|
ive a copy of the vulnerability disclosure.
|
|
|
|
+ -- --=[ 0x06 - Proof of Concept (PoC)
|
|
|
|
In:
|
|
|
|
/components/com_niceajaxpoll/views/niceajaxpoll/tmpl/default.php
|
|
|
|
there is a call to:
|
|
|
|
index.php?option=com_niceajaxpoll&getpliseid="+id,
|
|
|
|
which is located on line 32. In practice this vulnerability
|
|
has been verified by exploiting the following:
|
|
|
|
/index.php?option=com_niceajaxpoll&getpliseid=1 OR 1=1
|
|
,-------
|
|
'- SQLi |