Ascii for Breakfast » SQL Injection

The Joomla Hacking Compendium

valentin — Sun, 19 Dec 2010 16:38:21 +0000

Download The Joomla Hacking Compendium here.

With great pleasure I hereby announce the availability of the new “The Joomla Hacking Compendium”. It contains almost 1000 lines of pure knowledge and shows you the way to hack and protect Joomla.

It contains the following chapters:

0x01 - Purpose of this document
0x02 - Introduction
0x03 - The Basics of Joomla
0x04 - The Joomla core
0x05 - Joomla extensions
0x06 - Hacking Joomla
0x07 - SEO, our strongest enemy
0x08 - Examples for Joomla SQL injections
0x09 - Examples for Joomla local file inclusions
0x10 - Examples for Joomla remote file inclusions
0x11 - Examples for Joomla XSSs/CSRFs
0x12 - How to protect your Joomla
0x13 - Conclusion and a look at Joomla's feature
0x14 - How to stay informed (or: the latest vulnerabilities)
0x15 - Useful tools
0x16 - Greetings and THX

Please find an excerpt below:

::
:: 0x04 - The Joomla core
::

Before inspecting the Joomla component attack vendors we first have a
look at the core.

Download Joomla somewhere and extract all files. Open the file
libraries/phpinputfilter/inputfilter.php
and look at the code:
----------------------------------------
var $tagsArray; // default = empty array
var $attrArray; // default = empty array

var $tagsMethod; // default = 0
var $attrMethod; // default = 0

var $xssAuto; // default = 1
var $tagBlacklist = array ('applet', 'body', 'bgsound' [...]
var $attrBlacklist = array ('action', 'background'     [...]
----------------------------------------

As you can see, some filter methods of Joomla are based on blacklisting.
This knowledge can be used later to exploit potential vulnerabilities in
a better way. I find this method not very effective, btw.

While HTML tags containing "body" or "bgsound" will be filtered out
at input fields or URL parameters, they can be written in many ways,
e.g. like "bOdY" or "b o DY" etc. You are only limited by your
creativity and will find ways for tricking the blacklist of the
Joomla framework.

Another interesting part is this one (same file):
----------------------------------------
/*
* Is there a tag? If so it will certainly start with a '<'
*/
$tagOpen_start  = strpos($source, '<');
while ($tagOpen_start !== false)
{
/*
* Get some information about the tag we are processing
*/
$preTag            .= substr($postTag, 0, $tagOpen_start);
$postTag                = substr($postTag, $tagOpen_start);
----------------------------------------

As you can see they assume that an HTML tag being used in XSS attacks
starts with a "<". In fact, I never use this character and many
XSS cheatsheets suggest this, too. With this information in mind,
you can most likely avoid being detected by the filters. You can start
your XSS string with "><tag... for example.

If you want to you can continue looking. You will find other filter
methods and, at the end of the file, there are also built in
mechanics which should help to prevent SQL injection vulnerabilities:
[...]

OneOrZero AIMS v2.6.0 Members Edition Multiple Vulnerabilities

valentin — Sat, 13 Nov 2010 19:59:01 +0000

Please view the original advisory/exploit here.

The web app OneOrZero AIMS Members Edition suffers from multiple remote vulnerabilities.

SQL Injection
Multiple scripts and parameters are affected by remote SQL injection vulnerabilities.
You can also manipulate SQL queries with the help of various search fields of this
web app.

Some example URLs:
index.php?controller=app_oneorzerohelpdesk_main&subcontroller=search_management_manage&option=saved_search&global=1&id=[SQL Injection]
index.php?controller=app_oneorzerohelpdesk_main&subcontroller=search_management_manage&option=show_item_search&item_types=[SQL Injection]

Local File Inclusion
index.php?controller=[LFI]&subcontroller=app_oneorzerotimemanager_manage&option=show_report
This vulnerability can be tricky to exploit. If OpenBaseDir is set, you can at least
view files in the directory of this web software.

Joomla Component com_jsupport SQL Injection Vulnerability

valentin — Fri, 12 Nov 2010 23:20:30 +0000

Please view the original advisory/exploit here.

The Joomla component com_jsupport suffers from a remote SQL injection vulnerability.

This vulnerability can be found by viewing the component in the Joomla administrator
backend.

Examples:
administrator/index.php?option=com_jsupport&task=listTickets&alpha=[SQL Injection]
administrator/index.php?option=com_jsupport&task=listFaqs&alpha=[SQL Injection]

Zeeways Adserver Multiple Vulnerabilities

valentin — Sat, 06 Nov 2010 13:59:40 +0000

Please view the original file here.

Multiple vulnerabilities within the Zeeways Adserver were found.

>> SQL Injection
Multiple scripts with multiple parameters are affected from this vulnerability.

Example #1:
index.php?section=redir&affid=0&kid=0&zid=[SQL Injection]

Example #2:
Visit the "register" page index.php?section=user&action=register and enter your
SQLi string into the email field. Fill out the other fields with some
normal stuff (like test) and view your result.

>> Cross-Site Request Forgery
Visit the "register" page index.php?section=user&action=register and enter your
CSRF string into the email field. Fill out the other fields with some
normal stuff (like test) and view your result.

>> Local Installation Path Disclosure
Visit index.php?section=doc&action= and fill out the action parameter.

Example:
index.php?section=doc&action=test

>> Interesting error message
Visit index.php?section=doc&action=test and play around with both the section and
action parameters. You will notice that a local file inclusion is not possible
(especially when you look at the section variable), but still you will be able
to "inject" some stuff in the action parameter.
For example use
index.php?section=doc&action=#
to get no output.

This is not a real code injection vulnerability, but still some special control
characters affect the output of the website. Maybe you are able to trigger some
interesting stuff.

VideoDB Multiple Vulnerabilities

valentin — Sat, 09 Oct 2010 18:50:03 +0000

Please view the original advisory/exploit here.

The VideoDb script/application suffers from SQL Injection and Local File Inclusion vulnerabilities. Auth bypass maybe possible.

Joomla Component com_restaurantguide Multiple Vulnerabilities

valentin — Sat, 18 Sep 2010 13:42:28 +0000

Please view the original advisory/exploit here.

The Joomla component com_restaurantguide suffers from multiple vulnerabilities.

>> SQL Injection
index.php?option=com_restaurantguide&view=country&id=’&Itemid=69
(id parameter is vulnerable)

>> HTML/JS/VBS Code Injection (all input fields, also in the admin backend)
It is possible to inject HTML/JS/VBS code into the document although XSS filters are active. Simply end the current HTML tag and convert your code into decimal HTMl code without semicolons:
“>injected
(which is “>injected)
The code doesn’t get parsed, so it is not possible to exploit this weakness. However, including arbitrary plain text into the current website is possible. Dangerous!

>> Interesting stuff
a) Triggering various error messages in the admin panel is possible, e.g.:
administrator/index.php?option=com_restaurantguide&controller=restaurantitems&task=edit&cid[]=[try ' or -1 or an ID which does not exist]
Sometimes the code of the component gets displayed within the browser window when you try to trigger errors with different variables.

b) Playing around with the controller variable
administrator/index.php?option=com_restaurantguide&controller=../../../../../../../../../etc/passwd%00
(NOT a LFI vulnerability since the controller classes are defined in the source code, you just get different error messages.. nothing to exploit here..)

Joomla Component com_nkc SQL Injection Vulnerability

valentin — Sat, 11 Sep 2010 14:28:56 +0000

Please view the original advisory/exploit here.

The Joomla component “Racers Online” (com_nkc) suffers from a numeric SQL Injection vulnerability.

GaleriaSHQIP SQL Injection Vulnerability

valentin — Sat, 28 Aug 2010 10:01:17 +0000

Please download the original exploit/advisory here.

The image gallery script GaleriaSHQIP suffers from a remote SQL injection vulnerability.

Example URL
index.php?album_id=[SQL Injection]

Affected versions
1.0 full, the lite version may also contain such vulnerabilities

Joomla Component com_golfcourseguide SQL Injection Vulnerability

valentin — Fri, 23 Jul 2010 15:32:15 +0000

Please download/view the original advisory here.

The Joomla component com_golfcourseguide fails to sanitize the user input and therefore suffers from a remote SQL injection vulnerability.

Example URL
index.php?option=com_golfcourseguide&view=golfcourses&cid=1&id=[SQL Injection]

Versions affected
v0.9.6.0 beta, v1 beta

Specialist Bed and Breakfast Website SQL Injection Exploit released

valentin — Fri, 02 Jul 2010 23:26:39 +0000

Today I am releasing my Specialist Bed and Breakfast Website SQL Injection Exploit (remote).
[Download]

Description
The Specialist Bed and Breakfast Website SQL Injection Exploit takes advantage of a SQL injection vulnerability JaMbA discovered on 30th June 2010. The exploit source code also contains the table structure of the vulnerable product.

About the vulnerability
Learn more about the vulnerability here.

Features
- Check if provided URL is reachable
- Error handling for HTTP requests
- Display current database, MySQL user and the MySQL version
- Display the admin login data
- Easy to use (everything is simple and automated)
- User agent for HTTP requests

Additional information
Written in Python (less than 400 lines).

Usage example
python bed_and_breakfast_sploit.py – u “http://target/site/pages.php?fid=0,1,472&pp_id=84″

Disclaimer
Only use this tool to check websites you are allowed to test (e.g. for penetration testing). Never use this tool on foreign websites! Know and respect your local laws! I am not responsible if you cause any damage or run into trouble. This tool was written for educational purposes only.