Joomla com_niceajaxpoll - exploit.company

vendor:

Nice Ajax Poll

by:

Patrick de Brouwer - @knickz0r, NLSecurity - www.nlsecurity.org

CVSS

CRITICAL

SQL Injection

CWE

Product Name: Nice Ajax Poll

Affected Version From: 1.3.0

Affected Version To: 1.3.0

Patch Exists: NO

Related CWE: N/A

CPE: a:dmitry_kuprijanov:nice_ajax_poll

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: Joomla!

2012

Joomla com_niceajaxpoll <= 1.3.0 SQL Injection Vulnerability

There is a SQL Injection vulnerability that can be called from within the website to perform the SQL Injection attack. The impact of this vulnerability should be rated as critical as it is possible to access the database and therefore retrieve user information such as usernames, passwords and other data. When abused, hackers could gain access to the administrative interface of Joomla.

Mitigation:

Ensure that user input is properly sanitized and validated before being used in SQL queries.

Source

Exploit-DB raw data:

############################################################
#
# Title    : Joomla com_niceajaxpoll <= 1.3.0 SQL Injection Vulnerability
# Author   : Patrick de Brouwer - @knickz0r
#            NLSecurity         - www.nlsecurity.org
#
# Dork     : inurl:"/index.php?option=com_niceajaxpoll"
#
# Software : Joomla component Nice Ajax Poll <= 1.3.0
#            http://dmitry.dn.ua/my-projects/304-nice-ajax-poll.html
#
# Vendor   : Dima Kuprijanov
#
# Date     : 2012-07-31
#
############################################################

+ -- --=[ 0x01 - Software description

Nice Ajax Poll is a component for the Joomla! CMS which all-
ows users to vote on certain questions or statements.

+ -- --=[ 0x02 - Vulnerability description

There is a SQL Injection vulnerability that can be called f-
rom within the website to perform the SQL Injection attack.

+ -- --=[ 0x03 - Impact

The impact of this vulnerability should be rated as critical
as it is possible to access the database and therefore retr-
eive user information such as usernames, passwords and other
data. When abused, hackers could gain access to the adminis-
trative interface of Joomla.

+ -- --=[ 0x04 - Affected versions

As of the source code, the version containint this vulnerab-
ility was version 1.3.0. It was not proven that the vulnera-
bility does not exist in newer or earlier versions. Therfore
the vulnerability is considered available  in versions below
1.3.0.

+ -- --=[ 0x05 - Vendor contact trail

Contact has not been made with the author. Author will rece-
ive a copy of the vulnerability disclosure.

+ -- --=[ 0x06 - Proof of Concept (PoC)

In:

  /components/com_niceajaxpoll/views/niceajaxpoll/tmpl/default.php

there is a call to:

  index.php?option=com_niceajaxpoll&getpliseid="+id,

which is located on line 32.  In practice this vulnerability
has been verified by exploiting the following:

/index.php?option=com_niceajaxpoll&getpliseid=1 OR 1=1
                                              ,-------
                                              '- SQLi