Re: joomlacontenteditor (com_jce) BLIND sql injection vulnerability

[Stephen Brandon <stephen@xxxxxxxxxxxxxxxxxxxxxxxxx>]

This alert is bunk. There is no mention of "Itemid" in relation to database 
operations in the entire source code of com_jce, which there would need to be 
for blind sql injection.

The behaviour of the Itemid parameter in Joomla is complex and I won't go into 
all the details here. Suffice it to say that manipulating the Itemid to 
alternative valid Itemid values can change the content of the page, and 
changing to an invalid Itemid (such as a negative number) is equivalent to 
setting it to 0.

There is no SQL injection at play here, at least with core Joomla and the 
com_jce editor. Other 3rd-party extensions may vary.

Stephen Brandon
metamodpro.com


On 9 Apr 2011, at 04:28, eidelweiss@xxxxxxxxxxxxxxx wrote:

> ===================================================================
>  joomlacontenteditor (com_jce) BLIND sql injection vulnerability
> ===================================================================
> 
> Software:   joomlacontenteditor (com_jce)
> Vendor:     www.joomlacontenteditor.net
> Vuln Type:  BLind SQL Injection
> Download link:  
> http://www.joomlacontenteditor.net/downloads/editor/joomla15x/category/joomla-15-2
>  (check here)
> Author:     eidelweiss
> contact:    eidelweiss[at]windowslive[dot]com
> Home:       www.eidelweiss.info
> Dork:       inurl:"/index.php?option=com_jce"
> 
> 
> References: 
> http://eidelweiss-advisories.blogspot.com/2011/04/joomlacontenteditor-comjce-blind-sql.html
> 
> 
> ===================================================================
> 
> Description:
> 
> JCE makes creating and editing Joomla!® 
> content easy Add a set of tools to your Joomla!® environment that give you 
> the power to create the kind of content you want,
> without limitations, and without needing to know or learn HTML, XHTML, CSS... 
> 
> ===================================================================
> 
>    exploit & p0c
> 
> [!] index.php?option=com_jce&Itemid=[valid Itemid]
> 
>    Example p0c
> 
> [!] http://host/index.php?option=com_jce&Itemid=8    <= True
> [!] http://host/index.php?option=com_jce&Itemid=-8   <= False
> 
> 
> ====================================================================
> 
>    Nothing Impossible In This World Even Nobody`s Perfect
> 
> ===================================================================