Joomla! Component Techfolio 1.0 – SQL Injection
################################################################### Techfolio 1.0 Component Joomla SQL Injection ################################################################### Release Date Bug. 27-Oct-2011 Date Added. 30-Sep-2011 Vendor Notification Date. Never Product. Techfolio Platform. Joomla Affected versions. 1.0 Type. Non-Commercial Attack Vector. Sql Injection Solution Status. unpublished CVE reference. Not yet assigned Download. techdeluge.com/joomla-component/com_techfolio.zip I. BACKGROUND This component is made for portfolio purpose. Its easy to integrate and easy to made custom design. category based structure. this is base component we are in process with upgrade version also. with new feature and new functionality which is easy to integrate. we will launch it within 10 days. II. DESCRIPTION discovered a vulnerability in Techfolio, joomla component, vulnerability is SQL injection The parameters affected are: catid III. ANALYSIS file: /com_techfolio/frontend/models/techfoliodetail.php [29] $catid = $_GET['catid']; [30] if($catid!=''){ [31] $data = "SELECT * FROM #__techfolio WHERE catid = ".$catid; [32] }else{ [33] $data = "SELECT * FROM #__techfolio"; [34] } [35] $db->setQuery( $data ); [36] $data = $db->loadObjectList(); [37] [38] return $data; query to the variable $catid is not filtered IV. EXPLOITATION parameter [catid]: //index.php?option=com_techfolio&view=techfoliodetail&catid=1[SQL] [SQL]=injection sql Discovered by. Chris Russell |