Joomla! Component redSHOP 1.0.23.1 – Blind SQL Injection
RedShop 1.0.23.1 Joomla Component Blind SQL Injection Vulnerability Name RedShop Vendor http://redweb.dk Versions Affected 1.0.23.1 Author Salvatore Fresta aka Drosophila Website http://www.salvatorefresta.net Contact salvatorefresta [at] gmail [dot] com Date 2010-07-13 X. INDEX I. ABOUT THE APPLICATION II. DESCRIPTION III. ANALYSIS IV. SAMPLE CODE V. FIX I. ABOUT THE APPLICATION ________________________ RedShop is a popular and commercial Joomla component. It is a Content Creation Kit style of webshop / webshop tool where you got the most access ever given to any user to completely style around and change thier webshop, without alot more knowledge then HTML and a bit of CSS. II. DESCRIPTION _______________ A parameter in the search form is not properly sanitised before being used in a SQL query. III. ANALYSIS _____________ Summary: A) Blind SQL Injection A) Blind SQL Injection ______________________ The parameters viewform and id are not properly sanitised The parameter keyword is not properly sanitised before being used in a SQL query. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code. Successful exploitation requires that "magic_quotes_gpc" is disabled. IV. SAMPLE CODE _______________ A) Blind SQL Injection Copy and past the following lines in the search form: ' AND (SELECT(IF(ASCII(0x41) = 64,false,NULL))) OR ' ' AND (SELECT(IF(ASCII(0x41) = 65,true,NULL))) OR ' V. FIX ______ No fix. |