Joomla com_autartimonial Sqli Vulnerability

vendor:

AutarTimonial

by:

Sid3^effects aKa HaRi

7,5

CVSS

HIGH

SQL Injection

CWE

Product Name: AutarTimonial

Affected Version From: N/A

Affected Version To: N/A

Patch Exists: N/A

Related CWE: N/A

CPE: N/A

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2010

Joomla com_autartimonial Sqli Vulnerability

AutarTimonial consists of a component to manage testimonials, and a module displaying randomly a testimonial. This component has multilingual support. English and French are currently available. An attacker can exploit this vulnerability by sending malicious SQL queries to the vulnerable parameter 'limit' in the URL.

Mitigation:

Input validation should be used to prevent SQL injection attacks. Developers should also use parameterized queries to prevent SQL injection.

Source

Exploit-DB raw data:

######################################################################################################
Name :  Joomla com_autartimonial Sqli Vulnerability
Date : july 6,2010
Critical Level 	: HIGH
vendor URL :http://www.autartica.be/
Author : Sid3^effects aKa HaRi 
special thanks to : r0073r (inj3ct0r.com),L0rd CruSad3r,MaYur,MA1201,KeDar,Sonic,gunslinger_
greetz to :www.topsecure.net ,All ICW members and my friends :) luv y0 guyz 
#######################################################################################################
Description : 

AutarTimonial consists of a component to manage  testimonials, and a module displaying randomly a testimonial. This component has multilingual support .  English and French are currently available.

#######################################################################################################
Xploit :SQli Vulnerability

DEMO URL :http://www.site.com/index.php?option=com_autartimonial&view=autartimonial&limit=[sqli]

###############################################################################################################
# 0day no more 
# Sid3^effects