Joomla Component Zoom Portfolio (id) Remote Sql Injection

vendor:

Zoom Portfolio

by:

Chip D3 Bi0s

N/A

CVSS

N/A

SQL Injection

CWE

Product Name: Zoom Portfolio

Affected Version From: 1.5

Affected Version To: 1.5

Patch Exists: N/A

Related CWE: N/A

CPE: N/A

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2010

Joomla Component Zoom Portfolio (id) Remote Sql Injection

A vulnerability exists in Zoom Portfolio, a Joomla Portfolio Component, which allows remote attackers to inject arbitrary SQL commands via the id parameter in a view=portfolio action to index.php.

Mitigation:

Input validation should be used to prevent SQL injection attacks.

Source

Exploit-DB raw data:

---------------------------------------------------------------------------------
Joomla Component Zoom Portfolio (id) Remote Sql Injection
---------------------------------------------------------------------------------

Author		: Chip D3 Bi0s
Group		: LatinHackTeam
Email & msn	: chipdebios@gmail.com
Date		: 23 August 2010
Critical Lvl	: Moderate
Impact		: Exposure of sensitive information
Where		: From Remote
---------------------------------------------------------------------------

Affected software description:
~~~~~~~~~~~~~~~~~~~~~~~~~~~

Application	: Zoom Portfolio --Joomla Portfolio Component
version		: 1.5 
Price		: $20.00 
Developer	: EGBZOOM
License		: GPLv2 or later           type  : Commercial
Date Added	: 21 August 2010
Download	: http://www.egbzoom.com/joomla-portfolio-component.html

Description     :

Zoom Portfolio enables you to display your portfolio in a "directory listing-like
presentation" with minimum effort.The Component has features like add category
add images,settings,add portfolio .Zoom Portfolio includes automatic thumbnail creation,
captioning, searching and more.It also includes the ability to modify and delete any
of your existing pages.
The Zoom Portfolio is an amazing example of what can be done online with your online
presence. It is directed at artists of all walks of life, it is very easy to install
and customize, and it is just simply stunning. 

-------------------------

How to exploit

http://127.0.0.1/path/index.php?option=com_zoomportfolio&view=portfolio&view=portfolio&id=[sql]

-------------------------

+++++++++++++++++++++++++++++++++++++++
[!] Produced in South America
+++++++++++++++++++++++++++++++++++++++