J2Store v3.1.6, a Joomla! extension that adds basic store functionality to a Joomla! instance, suffered from two unauthenticated boolean-blind and error-based SQL injection vulnerabilities. Since February 2015, J2Store has had about 16,000 downloads as of this writing.

Technical Details

First vulnerability

The first vulnerability was in the sortby parameter within a request made while searching for products.

POST /index.php HTTP/1.1
Host: 192.168.1.3
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.10; rv:37.0) Gecko/20100101 Firefox/37.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Content-Type: application/x-www-form-urlencoded
Content-Length: 124

search=&sortby=product_name+DESC&option=com_j2store&view=products&task=browse&Itemid=115

Second vulnerability

The second vulnerability was in an advanced search multipart form request, within the manufacturer_ids parameters.

POST /index.php HTTP/1.1
Host: 192.168.1.3
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.10; rv:37.0) Gecko/20100101 Firefox/37.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Content-Type: multipart/form-data; boundary=---------------------------69182815810793866481457026727
Content-Length: 1023

-----------------------------69182815810793866481457026727
Content-Disposition: form-data; name="pricefrom"

0
-----------------------------69182815810793866481457026727
Content-Disposition: form-data; name="priceto"

521
-----------------------------69182815810793866481457026727
Content-Disposition: form-data; name="manufacturer_ids[]"

1
-----------------------------69182815810793866481457026727
Content-Disposition: form-data; name="option"

com_j2store
-----------------------------69182815810793866481457026727
Content-Disposition: form-data; name="view"

products
-----------------------------69182815810793866481457026727
Content-Disposition: form-data; name="task"

browse
-----------------------------69182815810793866481457026727
Content-Disposition: form-data; name="Itemid"

115
-----------------------------69182815810793866481457026727
Content-Disposition: form-data; name="9d0a4b9d6d4b46fc51d25844b91c2057"

1
-----------------------------69182815810793866481457026727--

Exploits

A Metasploit scanner module and two auxiliary modules are available on the ExploitHub store which will help you find and validate any vulnerable instances. A PCAP is included with each module.

Free Metasploit scanner module: https://exploithub.com/j2store-3-1-6-sql-injection-scanner.html Metasploit User/Password Enumeration auxiliary module: https://exploithub.com/j2store-3-1-6-user-password-enumeration-via-sql-injection.html Metasploit Arbitrary File Read auxiliary module: https://exploithub.com/j2store-3-1-6-arbitrary-file-read-via-sql-injection.html

Timeline

July 7 2015: Reported to vendor July 7 2015: Vendor response asking for details July 7 2015: Details sent July 7 2015: Vendor sends email saying the vulnerabilities were fixed and a new version will be out soon July 8 2015: Version 3.1.7 released, advisory released with modules