Joomla FireBoard component (com_fireboard) SQL injection and repair

Title: Joomla com_fireboard-SQL Injection Vulnerability
 
Affected Version 7.3
 
Program Introduction
Joomla is a free and open source content management system (CMS) for publishing content on the World
Wide Web and intranets and a model-view-controller (MVC) Web application framework that can also be
Used independently.
 
Joomla is written in PHP, uses object-oriented programming (OOP) techniques and software design
Patterns, stores data in a MySQL database, and schemdes features such as page caching,
RSS feeds, printable versions of pages, news flashes, blogs, polls, search, and support for language
Internationalization.
 
(For details, see the official homepage: http://en.wikipedia.org/wiki/Joomla)
 
 
Risks:
==========
The maid (sec-lab.ir) discovered a SQL Injection Vulnerability in
The com_fireboard module of the joomla CMS.
 
Summary:
==========
A SQL Injection vulnerability is detected in the com_fireboard module of the joomla Content Management System.
Remote attackers & low privileged user accounts can execute/inject own SQL commands to compromise the application dbms.
The vulnerability is located in the com_fireboard module with the bound vulnerable func fb _ parameter.
Successful exploitation of the vulnerability result in dbms (Server) or application (Web) compromise.
 
Vulnerable Module (s ):
[+] Index. php? Option = com_fireboard
 
Vulnerable Parameter (s ):
[+] Func fb _
 
 
Test proof:
========================
The SQL injection vulnerability can be exploited by remote attackers without user inter action & with low
Privileged user account. For demonstration or reproduce...
 
Dork (s ):
Inurl: "id =" & intext: "/com_fireboard /"
 
PoC:
A http://www.bkjia.com/index. php? Option = com_fireboard & Itemid = 0 & id = 1 & catid = 0 & func = fb_pdf '[SQL-INJECTION]
 
Reference (s ):
Xxx.com/index.php? Option = com_fireboard & Itemid = 0 & id = 1 & catid = 5 & func = fb_pdf '[SQL-INJECTION]
Xxx.com/2012/index.php? Option = com_fireboard & Itemid = 79 & id = 1 & catid = 2 & func = fb_pdf '[SQL-INJECTION]
Xxx.com/fireboard/index.php? Option = com_fireboard & Itemid = 38 & id = 22111 & catid = 16 & func = fb_pdf '[SQL-INJECTION]
Xxx.com/board/index.php? Option = com_fireboard & Itemid = 54 & id = 70122 & catid = 12 & func = fb_pdf '[SQL-INJECTION]
Xxx.com/jmfireboard/index.php? Option = com_fireboard & Itemid = 54 & id = 70122 & catid = 12 & func = fb_pdf '[SQL-INJECTION]
 
 
--
VULNERABILITY RESEARCH LABORATORY
LABORATORY RESEARCH TEAM
CONTACT: research@vulnerability-lab.com