Blind Sql-Injection in Joomla 1.5 RC3

2007.12.07
Credit: beenudel1986
Risk: Medium
Local: No
Remote: Yes
CWE: CWE-89


CVSS Base Score: 7.5/10
Impact Subscore: 6.4/10
Exploitability Subscore: 10/10
Exploit range: Remote
Attack complexity: Low
Authentication: No required
Confidentiality impact: Partial
Integrity impact: Partial
Availability impact: Partial

Thanks to team of Darkc0de.com Blind Sql-Injection in Joomla 1.5 RC3 URL : http://localhost/index.php 1. Parameter = view The following changes were applied to the original request: ? Set parameter 'view's value to 'somechars'%20+%20'article' POC URL : http://localhost/index.php?option=com_content&view=somechars'%20+%20'art icle&id=25&Itemid=28 This test uses several different HTTP requests in order to verify the existence of a Blind SQL Injection vulnerability. The resulting test responses show that requests containing conditions with the same logical values were identical to the original valid response, and the responses with different values were not. This indicates that an SQL query is being executed at the back-end database, and that the injected values affect the original query 2. Parameter = task The following changes were applied to the original request: ? Set parameter 'task's value to 'somechars%27+%2B+%27search' POC URL : http://localhost/index.php?searchword=&task=somechars%27+%2B+%27search&o ption=com_search 3. Parameter = option The following changes were applied to the original request: ? Set parameter 'option's value to 'somechars%27+%2B+%27com_search' POC URL :http://localhost/index.php?searchword=&task=search&option=somechars%27+ %2B+%27com_search ~~~~~~~~~~mail : beenudel1986 (at) gmail (dot) com [email concealed]~~~~~~~~~~~~~~~~ greetz to : d3, baltazar , Zugzwang , icqbomber


Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2019, cxsecurity.com

 

Back to Top