SQL Injection Vulnerability

[Iconify]

SOS
A new vulnerability has been discovered
http://www.exploit-db.com/exploits/14207/

[Iconify]

Really?
Are you sure?

[Jan]

Hi,

it is under supervision.

From the url which is taken as exploit:
http://server/path/index.php?option=com ... es&Itemid=[SQL Injection]

I cannot find any not protected Itemid section in Phoca Gallery:

Categories View:
::view.html.php
- line 155 - JRequest::getVar('Itemid', 0, '', 'int') - protected by integer
:: there is no controller for this view
:: model does not include any itemid request

PhocaGalleryRoute Class:
Both codes:

Code: Select all

$currentItemId    = JRequest::getVar('Itemid', 0, '', 'int');
     
      if(!$items) {
         return JRequest::getVar('Itemid', 0, '', 'int');
      }

are protected by integer.

So for now I see no place where the exploit can be used.

I will do more tests (but I looked at the whole categories view, route helper file and all the libraries).


Jan

[Klementz]

So for now I see no place where the exploit can be used.
I will do more tests (but I looked at the whole categories view, route helper file and all the libraries).

Thank you. I will keep a watch on this thread in case anything turns up.

[Iconify]

Nice.
Maybe it is false alarm after all

[pach]

I'll keep an eye on this thread too !
Some news ?

[Jan]

Hi,

no, still didn't find any way how the Itemid can be abused and didn't get any information about successfully using of this exploit.

The exploit is not verified in the database of the exploits.

Jan

[wojti]

Welcome
Jan see this JSST article on how to prevent SQL injection attacks, with particular emphasis on part Preventing XSS Attacks http://developer.joomla.org/security/ar ... tions.html
Greetings

[Jan]

Hi, maybe you don't understand the previous posts. I know how to protect the code. All Phoca Extensions are using the code which is described in the article. Some of Phoca Extensions are using more - e.g. Phoca Guestbook uses HTML purifier, etc.

The issue is reverse. There was not found any successful use of this exploit and I don't know any such. (means I don't know successful use of this exploit, but I know how to protect the code)

Jan

[Xbase]

Hello,
I use phoca gallery v2.7.3 and i have found a post on exploit-db .
i want to know the risk to use this component .
If this Exploit is Verified
and what is the solution to correct this Exploit.

Thx a lot for your answer i am very concerned about the problem

my source : http://www.exploit-db.com/exploits/14207/