header-logo
Suggest Exploit
vendor:
Xmap
by:
jdc
N/A
CVSS
N/A
Blind SQL Injection
89
CWE
Product Name: Xmap
Affected Version From: 1.2.11
Affected Version To: 1.2.11
Patch Exists: YES
Related CWE: N/A
CPE: N/A
Metasploit: N/A
Other Scripts: N/A
Tags: N/A
CVSS Metrics: N/A
Nuclei References: N/A
Nuclei Metadata: N/A
Platforms Tested: N/A
2011

Xmap 1.2.11 Joomla Component Blind SQL Injection

Versions prior to 1.2.12 suffer from a blind sql injection in the 'view' parameter, depending on Xmap's internal cache settings. POSTDATA: option=com_xmap&tmpl=component&Itemid=999&view=[SQL] 1.2.12 has been patched. Older versions with cache=off cannot be exploited in this fashion.

Mitigation:

Upgrade to version 1.2.12 or later
Source

Exploit-DB raw data:

# Exploit Title: Xmap 1.2.11 Joomla Component Blind SQL Injection
# Date: 12 July 2011
# Author: jdc
# Software Link:
http://joomlacode.org/gf/project/xmap/frs/?action=FrsReleaseBrowse&frs_package_id=3882
# Version: 1.2.11
# Fixed In: 1.2.12

Versions prior to 1.2.12 suffer from a blind sql injection in the "view"
parameter, depending on Xmap's internal cache settings.

POSTDATA: option=com_xmap&tmpl=component&Itemid=999&view=[SQL]

1.2.12 has been patched. Older versions with cache=off cannot be
exploited in this fashion.

Navigation

Suggest Exploit

Services By CQR