Joomla! Component MyHome – Blind SQL Injection
Name : Joomla com_myhome BSQLi Vulnerability Date : july 10,2010 Critical Level : HIGH vendor URL :http://www.unisoft.me/ Author : Sid3^effects aKa HaRi special thanks to : r0073r (inj3ct0r.com),L0rd CruSad3r,MaYur,MA1201,KeDar,Sonic,gunslinger_ greetz to :www.topsecure.net ,All ICW members and my friends :) luv y0 guyz ####################################################################################################### Description MyHome is a component for Joomla 1.5, for publishing houses within web sites. The visitor can search for a vehicle by setting selection filters in the Vertical search module or Horizontal search module or by clicking on a specific module by viewing the list of Hot Houses, etc. The list of houses can be grouped by price, contract type or category. The house main image and information are shown within the list of houses. By clicking on the [DETAILS] button for each house, all the information and images related to it will be shown. N.B. An house may have an unlimited number of images. Unlimited fields can be set up for each house. In the component configuration panel it is possible to create or delete any of the fields required for managing your fleet of houses. It is also possible to add fields later. The fields which can be created may be TEXT type or CHECK type. ####################################################################################################### Xploit: BSQLi Vulnerability DEMO URL : http://server/path/index.php?option=com_myhome&task=4&nidimm=[BSQLi] ####################################################################################################### # 0day no more # Sid3^effects |