Joomla Spider Form Maker - exploit.company

vendor:

Joomla Spider Form Maker

by:

Claudio Viviani

7,5

CVSS

HIGH

SQL Injection

CWE

Product Name: Joomla Spider Form Maker

Affected Version From: 3.4

Affected Version To: 3.4

Patch Exists: YES

Related CWE: N/A

CPE: a:web-dorado:joomla_spider_form_maker

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: Windows 7, Linux

2014

Joomla Spider Form Maker <= 3.4 SQL Injection

The 'id' variable in the URL is not sanitized, allowing for an attacker to inject malicious SQL code.

Mitigation:

Ensure that user input is properly sanitized and validated.

Source

Exploit-DB raw data:

######################

# Exploit Title : Joomla Spider Form Maker <= 3.4 SQL Injection

# Exploit Author : Claudio Viviani

# Vendor Homepage : http://web-dorado.com/

# Software Link : http://web-dorado.com/products/joomla-form.html

# Dork Google: inurl:com_formmaker
                   

# Date : 2014-09-07

# Tested on : Windows 7 / Mozilla Firefox
#             Linux / Mozilla Firefox

######################

# PoC Exploit:

http://localhost/index.php?option=com_formmaker&view=formmaker&id=[SQLi]


"id" variable is not sanitized.


######################

# Vulnerability Disclosure Timeline:

2014-09-07:  Discovered vulnerability
2014-09-09:  Vendor Notification
2014-09-10:  Vendor Response/Feedback
2014-09-10:  Vendor Fix/Patch
2014-09-10:  Public Disclosure

#####################

Discovered By : Claudio Viviani
                http://www.homelab.it
		
                info@homelab.it
                homelabit@protonmail.ch

                https://www.facebook.com/homelabit
                https://twitter.com/homelabit
                https://plus.google.com/+HomelabIt1/
                https://www.youtube.com/channel/UCqqmSdMqf_exicCe_DjlBww

#####################