Joomla JPodium Component (com_jpodium) SQL-i Vulnerability

vendor:

JPodium

by:

RoAd_KiLlEr

7,5

CVSS

HIGH

SQL Injection

CWE

Product Name: JPodium

Affected Version From: 2.7.3

Affected Version To: 0.9.015

Patch Exists: YES

Related CWE: N/A

CPE: a:jpodium:jpodium

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: Win Xp Sp 2/3

2009

Joomla JPodium Component (com_jpodium) SQL-i Vulnerability

JPodium is a Joomla! component to manage and display sports results. The intended use is to keep track of race results for e.g. a cycling club portal. Of course it is not fixed to any kind of sports but more to a certain structure of race results. This means that every athlete has a class (e.g. age class like 'Master') attached and the results are listed per race in this classes. An attacker can exploit this vulnerability by sending malicious SQL queries to the vulnerable parameter 'Itemid' in the URL 'http://127.0.0.1/path/index.php?option=com_jpodium&view=races&Itemid='.

Mitigation:

Ensure that user input is properly sanitized and validated before being used in SQL queries.

Source

Exploit-DB raw data:

1                ###########################################           1
0               I'm **RoAd_KiLlEr**  member from Inj3ct0r Team         1
1                ###########################################           0
0-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-==-=-=-1

[+]Title               Joomla JPodium  Component  (com_jpodium)  SQL-i Vulnerability
[+]Author          **RoAd_KiLlEr**
[+]Contact        RoAd_KiLlEr[at]Khg-Crew[dot]Ws
[+]Tested on     Win Xp Sp 2/3
[+]Version          2.7.3
---------------------------------------------------------------------------
[~] Founded by **RoAd_KiLlEr**
[~] Team: Albanian Hacking Crew
[~] Contact: RoAd_KiLlEr[at]Khg-Crew[dot]Ws 
[~] Home: http://a-h-crew.net    
[~] Download App:http://www.jpodium.de/index.php?option=com_rokdownloads&view=file&task=download&id=31%3Acomponent-v-0-9&Itemid=3
[~] Version:  0.9.015
[~] Vendor: http://www.jpodium.de/
==========ExPl0iT3d by **RoAd_KiLlEr**==========

[+]Description:
JPodium is a Joomla! component to manage and display sports results. The intended use is to keep track of race results for e.g. a cycling club portal. Of course it is not fixed to any kind of sports but more to a certain structure of race results. This means that every athlete has a class (e.g. age class like "Master") attached and the results are listed per race in this classes.
=========================================

[+] Dork: inurl:"com_jpodium"

==========================================


[+].  SQL-i Vulnerability
=+=+=+=+=+=+=+=+=+

[Exploit]:  http://127.0.0.1/path/index.php?option=com_jpodium&view=races&Itemid= [SQL Injection] 



===========================================================================================
[!] Albanian Hacking Crew           
===========================================================================================
[!] **RoAd_KiLlEr**   
===========================================================================================
[!] MaiL: sukihack[at]gmail[dot]com
===========================================================================================
[!] Greetz To : Ton![w]indowS | X-n3t | b4cKd00r ~ | DarKHackeR. | The|DennY` | EaglE EyE | Lekosta | KHG | THE_1NV1S1BL3 & All Albanian/Kosova Hackers 
===========================================================================================
[!] Spec Th4nks:  r0073r  | indoushka from Dz-Ghost Team  | MaFFiTeRRoR | All  Inj3ct0r 31337 Members | And All My Friendz
===========================================================================================
[!] Red n'black i dress eagle on my chest
It's good to be an ALBANIAN
Keep my head up high for that flag I die
Im proud to be an ALBANIAN
===========================================================================================