Joomla Spider Form Maker <= 4.3 SQL Injection Vulnerability

######################

# Exploit Title : Joomla Spider Form Maker <= 4.3 SQLInjection

# Exploit Author : Claudio Viviani

# Vendor Homepage : http://web-dorado.com/

# Software Link : http://web-dorado.com/products/joomla-form.html

# Dork Google: inurl:com_formmaker
                   

# Date : 2014-09-07

# Tested on : Windows 7 / Mozilla Firefox
#             Linux / Mozilla Firefox

######################

# PoC Exploit:

http://localhost/index.php?option=com_formmaker&view=formmaker&id=[SQLi]


"id" variable is not sanitized.


######################

# Vulnerability Disclosure Timeline:

2014-09-07:  Discovered vulnerability
2014-09-09:  Vendor Notification
2014-09-10:  Vendor Response/Feedback
2014-09-10:  Vendor Fix/Patch
2014-09-10:  Public Disclosure

#####################

#  0day.today [2018-02-09]  #