SQL-i Vulnerability

vendor:

Phoca Gallery

by:

RoAd_KiLlEr

8,8

CVSS

HIGH

SQL Injection

CWE

Product Name: Phoca Gallery

Affected Version From: 2.7.3

Affected Version To: 2.7.3

Patch Exists: Yes

Related CWE: N/A

CPE: a:phoca:phoca_gallery

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: Joomla!

2009

Phoca Gallery is a Joomla! gallery - image gallery for Joomla! CMS. It includes component, modules and plugins and allows users to display images or Youtube videos in many different styles. An attacker can exploit this vulnerability by sending a malicious SQL query to the vulnerable parameter 'Itemid' in the URL http://server/path/index.php?option=com_phocagallery&view=categories&Itemid=[SQL Injection].

Mitigation:

The vendor has released a patch to address this vulnerability. Users should upgrade to the latest version of Phoca Gallery.

Source

Exploit-DB raw data:

---------------------------------------------------------------------------
[~] Founded by **RoAd_KiLlEr**
[~] Team: Albanian Hacking Crew
[~] Contact: RoAd_KiLlEr[at]Khg-Crew[dot]Ws 
[~] Home: http://a-h-crew.net    
[~] Download App:http://joomlacode.org/gf/download/frsrelease/12532/52585/com_phocagallery_v2.7.3.zip
[~] Vendor: http://www.phoca.cz
==========ExPl0iT3d by **RoAd_KiLlEr**==========

[+]Description:
Phoca Gallery is a Joomla! gallery - image gallery for Joomla! CMS. It includes component, modules and plugins and allows users to display images or Youtube videos in many different styles.
=========================================

[+] Dork: inurl:"com_phocagallery"

==========================================


[+].  SQL-i Vulnerability
=+=+=+=+=+=+=+=+=+

[Exploit]:  http://server/path/index.php?option=com_phocagallery&view=categories&Itemid=[SQL Injection] 



===========================================================================================
[!] Albanian Hacking Crew           
===========================================================================================
[!] **RoAd_KiLlEr**   
===========================================================================================
[!] MaiL: sukihack[at]gmail[dot]com
===========================================================================================
[!] Greetz To : Ton![w]indowS | X-n3t | b4cKd00r ~ | DarKHackeR. | The|DennY` | EaglE EyE | Lekosta | KHG | THE_1NV1S1BL3 & All Albanian/Kosova Hackers 
===========================================================================================
[!] Spec Th4nks: Inj3ct0r.com & r0073r  | indoushka from Dz-Ghost Team  | MaFFiTeRRoR | Sid3^effects | The_Exploited | And All My Friendz
===========================================================================================
[!] Red n'black i dress eagle on my chest
It's good to be an ALBANIAN
Keep my head up high for that flag I die
Im proud to be an ALBANIAN
===========================================================================================