Miniwork Studio Canteen Component for Joomla! SQL Injection and Local File Inclusion Vulnerabilities

vendor:

Canteen

by:

Unknown

7.5

CVSS

HIGH

SQL Injection, Local File Inclusion

89, 22

CWE

Product Name: Canteen

Affected Version From: Canteen 1.0

Affected Version To: Unknown

Patch Exists: NO

Related CWE:

CPE: a:minwork_studio:canteen:1.0

Metasploit:

Other Scripts:

Platforms Tested: Joomla!

2010

Miniwork Studio Canteen Component for Joomla! SQL Injection and Local File Inclusion Vulnerabilities

The Miniwork Studio Canteen component for Joomla! is prone to an SQL-injection vulnerability and a local file-include vulnerability because it fails to sufficiently sanitize user-supplied data. Attackers can exploit the SQL-injection vulnerability to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. An attacker can exploit the local file-include vulnerability using directory-traversal strings to view and execute arbitrary local files within the context of the webserver process. Information harvested may aid in further attacks.

Mitigation:

To mitigate these vulnerabilities, it is recommended to sanitize user-supplied data and implement proper input validation. Additionally, access controls should be enforced to prevent unauthorized access to sensitive files. Regular security updates and patches should be applied to ensure the latest fixes are in place.

Source

Exploit-DB raw data:

source: https://www.securityfocus.com/bid/41358/info

The Miniwork Studio Canteen component for Joomla! is prone to an SQL-injection vulnerability and a local file-include vulnerability because it fails to sufficiently sanitize user-supplied data.

Attackers can exploit the SQL-injection vulnerability to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

An attacker can exploit the local file-include vulnerability using directory-traversal strings to view and execute arbitrary local files within the context of the webserver process. Information harvested may aid in further attacks.

Canteen 1.0 is vulnerable; other versions may also be affected.

http://www.example.com/index.php?option=com_canteen&controller=../../../../../etc/passwd%00