Joomla Component JE FAQ Pro : Multiple Remote Blind Sql Injection

vendor:

JE FAQ Pro

by:

Chip D3 Bi0s

N/A

CVSS

N/A

Multiple Blind SQL Injection

CWE

Product Name: JE FAQ Pro

Affected Version From: 1.5.0

Affected Version To: 1.5.0

Patch Exists: NO

Related CWE: N/A

CPE: a:jextn:je_faq_pro:1.5.0

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2010

Joomla Component JE FAQ Pro : Multiple Remote Blind Sql Injection

A vulnerability exists in JE FAQ Pro version 1.5.0 which allows an attacker to inject malicious SQL queries via the 'catid' parameter in the 'index.php' script. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code. Successful exploitation could result in the disclosure of sensitive information from the database.

Mitigation:

Input validation should be used to prevent SQL injection attacks. All user-supplied input should be validated and filtered before being used in SQL queries.

Source

Exploit-DB raw data:

---------------------------------------------------------------------------------
Joomla Component JE FAQ Pro : Multiple Remote Blind Sql Injection
---------------------------------------------------------------------------------

Author		: Chip D3 Bi0s
Group		: LatinHackTeam
Email & msn	: chipdebios[at]gmail[dot]com
Date		: 2010-08-30
Critical Lvl	: Moderate
Impact		: Exposure of sensitive information
Where		: From Remote
---------------------------------------------------------------------------

Affected software description:
~~~~~~~~~~~~~~~~~~~~~~~~~~~

Application	: JE FAQ Pro
version		: 1.5.0 
Price		: 1 year: 13.08$, 2 Year: 18.31$, 3 Year: 23.54$, 4 Year: 26.16$
Developer	: J Extension
License		: GPLv2 or later           type  : Commercial
Date Added	: 28 August 2010
Download	: http://www.jextn.com/joomla-faq-component-extensions-downloads/
Demo		: http://www.joomla-faq-demo.jextn.com/

Description     :

JE FAQ Pro is an easy to use but powerful and excellent FAQ management.
Our core competency from our front end and backend features will make you
to sit suitable because we take care of your needs in the FAQ Joomla component
needs. This is where we extending the suitability in Joomla. 



Multiple Blind SQL Injection

http://site/path/index.php?option=com_jefaqpro&view=category&layout=categorylist&catid=2[bsql]

http://site/path/index.php?option=com_jefaqpro&view=category&layout=categorylist&task=lists&catid=2[bsql]



+++++++++++++++++++++++++++++++++++++++
[!] Produced in South America
+++++++++++++++++++++++++++++++++++++++