Author Topic: Hacking Joomla-- Tiny MCE Vulnerability  (Read 7055 times)

0 Members and 1 Guest are viewing this topic.

Offline xynolys

  • NULL
  • Posts: 1
  • Cookies: 0
  • Sharing is Fun.n should b done Free as in Freedom
    • View Profile
Hacking Joomla-- Tiny MCE Vulnerability
« on: May 26, 2012, 09:07:20 pm »
Hello Guys,
I just discovered a vuln in a website after scanning it with JoomScan and it says something related with  TinyMCE TinyBrowser addon multiple vulnerabilities.. So my question is how do i use this vullnerability to deface the site..
I would appreciate any help or post.....

Cheers
Still Learning.... :-)

Offline noob

  • Knight
  • **
  • Posts: 202
  • Cookies: 29
    • View Profile
Re: Hacking Joomla-- Tiny MCE Vulnerability
« Reply #1 on: May 27, 2012, 12:10:02 am »
Info -> Generic: htaccess.txt has not been renamed.
Versions Affected: Any
Check: /htaccess.txt
Exploit: Generic defenses implemented in .htaccess are not available, so exploiting is more likely to succeed.

Info -> Core: Frontend XSS - HTTP_REFERER not properly filtered Vulnerability
Versions effected: 1.5.11 <=
Check: /?1.5.11-x-http_ref
Exploit: An attacker can inject JavaScript or DHTML code that will be executed in the context of targeted user browser, allowing the attacker to steal cookies. HTTP_REFERER variable is not properly parsed.

Info -> Core: Frontend XSS - PHP_SELF not properly filtered Vulnerability
Versions effected: 1.5.11 <=
Check: /?1.5.11-x-php-s3lf
Exploit: An attacker can inject JavaScript code in a URL that will be executed in the context of targeted user browser.

Info -> Core: Admin Backend Cross Site Request Forgery Vulnerability
Versions effected: 1.0.13 <=
Check: /administrator/
Exploit: It requires an administrator to be logged in and to be tricked into a specially crafted webpage.

Info -> CoreComponent: com_banners Blind SQL Injection Vulnerability
Versions effected: N/A
Check: /components/com_banners/
Exploit: /index.php?option=com_banners&task=archivesection&id=0'+and+'1'='1::/index.php?option=com_banners&task=archivesection&id=0'+and+'1'='2