Re: joomlacontenteditor (com_jce) BLIND sql injection vulnerability

[Stephen Brandon <stephen () brandonitconsulting co uk>]

This alert is bunk. There is no mention of "Itemid" in relation to database operations in the entire source code of 
com_jce, which there would need to be for blind sql injection.

The behaviour of the Itemid parameter in Joomla is complex and I won't go into all the details here. Suffice it to say 
that manipulating the Itemid to alternative valid Itemid values can change the content of the page, and changing to an 
invalid Itemid (such as a negative number) is equivalent to setting it to 0.

There is no SQL injection at play here, at least with core Joomla and the com_jce editor. Other 3rd-party extensions 
may vary.

Stephen Brandon
metamodpro.com


On 9 Apr 2011, at 04:28, eidelweiss () windowslive com wrote:

> ===================================================================
>  joomlacontenteditor (com_jce) BLIND sql injection vulnerability
> ===================================================================
>
> Software:   joomlacontenteditor (com_jce)
> Vendor:     www.joomlacontenteditor.net
> Vuln Type:  BLind SQL Injection
> Download link:  http://www.joomlacontenteditor.net/downloads/editor/joomla15x/category/joomla-15-2 (check here)
> Author:     eidelweiss
> contact:    eidelweiss[at]windowslive[dot]com
> Home:       www.eidelweiss.info
> Dork:       inurl:"/index.php?option=com_jce"
>
>
> References: http://eidelweiss-advisories.blogspot.com/2011/04/joomlacontenteditor-comjce-blind-sql.html
>
>
> ===================================================================
>
> Description:
>
> JCE makes creating and editing Joomla!® 
> content easy Add a set of tools to your Joomla!® environment that give you the power to create the kind of content 
> you want,
> without limitations, and without needing to know or learn HTML, XHTML, CSS... 
>
> ===================================================================
>
>    exploit & p0c
>
> [!] index.php?option=com_jce&Itemid=[valid Itemid]
>
>    Example p0c
>
> [!] http://host/index.php?option=com_jce&Itemid=8    <= True
> [!] http://host/index.php?option=com_jce&Itemid=-8   <= False
>
>
> ====================================================================
>
>    Nothing Impossible In This World Even Nobody`s Perfect
>
> ===================================================================