CVE-2015-7342 - Multiple SQL Injection in JNews Joomla Component
1. Vulnerability Properties
- Title: Multiple SQL Injection in JNews Joomla Component
- CVE ID: CVE-2015-7342
- CVSSv3 Base Score: 6.6 (AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L)
- Vendor: Joobi
- Products: JNews Core(8.3.1)
- Advisory Release Date: 28 October 2015
- Advisory URL: https://labs.integrity.pt/advisories/cve-2015-7342
- Credits: Discovery by Fábio Pires <fp[at]integrity.pt>, Filipe Reis <fr[at]integrity.pt>, Vitor Oliveira <vo[at]integrity.pt>
2. Vulnerability Summary
JNews component is vulnerable to Multiple SQL Injection, inside the backoffice.
3. Technical Details
#1 – SQL Injection (error based):
To replicate the issue go to:
Administration > Components > JNews > Templates >
> upload thumbnail
- Upload a thumbnail and grab the request and inject into the filename parameter.
With this we get the following response (as you can see on the response we broke the SQL query):
Now we inject with our SQL query into the parameter filename:
And we get the response with the proof.
#2 – SQL Injection (error based):
To replicate the issue go to:
Administration > Components > JNews > Queue > Search Field
Do a search and grab the request, the injection point is the parameter mailingsearch:
With this we get the following response (as you can see on the response we broke the SQL query):
Now we inject with our SQL query into the parameter mailingsearch:
And we get the response with the proof.
#3 – SQL Injection (error based):
To replicate the issue go to:
Administration > Components > JNews > Subscribers > Search Field
Administration > Components > JNews > Newsletters > Search Field
Do a search and grab the request, the injection point is the parameter emailsearch:
With this we get the following response (as you can see on the response we broke the SQL query):
Now we inject with our SQL query into the parameter emailsearch:
And we get the response with the proof.
4. Vulnerable Versions
- JNews 8.3.1
5. Solution
- Update to JNews 8.5.0 or latest.
6. Vulnerability Timeline
- September 01, 2015 — Bug reported to Joobi
- September 02, 2015 — Joobi team acknowledges the vulnerability
- September 20, 2015 — Joobi team releases a new version
- October 28, 2015 — Public disclosure