bugtraq - Re: joomlacontenteditor (com_jce) BLIND sql injection vulnerability

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-Id: <83C970CE-15A4-4B54-9B74-72EF84ED92A3@brandonitconsulting.co.uk>
Date: Wed, 13 Apr 2011 11:52:09 +1200
From: Stephen Brandon <stephen@...ndonitconsulting.co.uk>
To: bugtraq@...urityfocus.com
Subject: Re: joomlacontenteditor (com_jce) BLIND sql injection vulnerability

This alert is bunk. There is no mention of "Itemid" in relation to database operations in the entire source code of com_jce, which there would need to be for blind sql injection.

The behaviour of the Itemid parameter in Joomla is complex and I won't go into all the details here. Suffice it to say that manipulating the Itemid to alternative valid Itemid values can change the content of the page, and changing to an invalid Itemid (such as a negative number) is equivalent to setting it to 0.

There is no SQL injection at play here, at least with core Joomla and the com_jce editor. Other 3rd-party extensions may vary.

Stephen Brandon
metamodpro.com


On 9 Apr 2011, at 04:28, eidelweiss@...dowslive.com wrote:

> ===================================================================
>  joomlacontenteditor (com_jce) BLIND sql injection vulnerability
> ===================================================================
> 
> Software:   joomlacontenteditor (com_jce)
> Vendor:     www.joomlacontenteditor.net
> Vuln Type:  BLind SQL Injection
> Download link:  http://www.joomlacontenteditor.net/downloads/editor/joomla15x/category/joomla-15-2 (check here)
> Author:     eidelweiss
> contact:    eidelweiss[at]windowslive[dot]com
> Home:       www.eidelweiss.info
> Dork:       inurl:"/index.php?option=com_jce"
> 
> 
> References: http://eidelweiss-advisories.blogspot.com/2011/04/joomlacontenteditor-comjce-blind-sql.html
> 
> 
> ===================================================================
> 
> Description:
> 
> JCE makes creating and editing Joomla!® 
> content easy Add a set of tools to your Joomla!® environment that give you the power to create the kind of content you want,
> without limitations, and without needing to know or learn HTML, XHTML, CSS... 
> 
> ===================================================================
> 
>    exploit & p0c
> 
> [!] index.php?option=com_jce&Itemid=[valid Itemid]
> 
>    Example p0c
> 
> [!] http://host/index.php?option=com_jce&Itemid=8    <= True
> [!] http://host/index.php?option=com_jce&Itemid=-8   <= False
> 
> 
> ====================================================================
> 
>    Nothing Impossible In This World Even Nobody`s Perfect
> 
> ===================================================================