RedShop 1.0.23.1 Joomla Component Blind SQL Injection Vulnerability
Name RedShop
Vendor http://redweb.dk
Versions Affected 1.0.23.1
Author Salvatore Fresta aka Drosophila
Website http://www.salvatorefresta.net
Contact salvatorefresta [at] gmail [dot] com
Date 2010-07-13
X. INDEX
I. ABOUT THE APPLICATION
II. DESCRIPTION
III. ANALYSIS
IV. SAMPLE CODE
V. FIX
I. ABOUT THE APPLICATION
________________________
RedShop is a popular and commercial Joomla component.
It is a Content Creation Kit style of webshop / webshop
tool where you got the most access ever given to any user
to completely style around and change thier webshop,
without alot more knowledge then HTML and a bit of CSS.
II. DESCRIPTION
_______________
A parameter in the search form is not properly sanitised
before being used in a SQL query.
III. ANALYSIS
_____________
Summary:
A) Blind SQL Injection
A) Blind SQL Injection
______________________
The parameters viewform and id are not properly sanitised
The parameter keyword is not properly sanitised before
being used in a SQL query. This can be exploited to
manipulate SQL queries by injecting arbitrary SQL code.
Successful exploitation requires that "magic_quotes_gpc"
is disabled.
IV. SAMPLE CODE
_______________
A) Blind SQL Injection
Copy and past the following lines in the search form:
' AND (SELECT(IF(ASCII(0x41) = 64,false,NULL))) OR '
' AND (SELECT(IF(ASCII(0x41) = 65,true,NULL))) OR '
V. FIX
______
No fix.
