Bug 162750 – www-apps/joomla Multiple SQL Injection Vulnerabilities

• Status: RESOLVED FIXED
• Product: Gentoo Security

[Description Executioner 2007-01-19 07:21:02 UTC]

He tests on 1.0.11 but says its fixed in SVN so I assume we're still vulnerable...  I'll check the source when I get a chance.

The other sql injection, is the same bug described bellow for Mambo 4.6.1 and
Joomla 1.0.11 . This has been solved in SVN version, but the SVN version has
another sql injection :
The 'catid' parameter is not checked properly in "_buildQuery()" function :

File components/com_weblinks/models/category.php, Line 209 :
:: $query = "SELECT *" .
:: "\n FROM #__weblinks" .
** "\n WHERE catid = $this->_id".
:: "\n AND published = 1" .
:: "\n AND archived = 0".
:: "\n ORDER BY $filter_order $filter_order_dir, ordering";

PoC : http://hacked/index.php?option=com_weblinks&catid=1%20SQLINJECTION



Reproducible: Didn't try




http://archives.neohapsis.com/archives/fulldisclosure/2007-01/0355.html

[Comment 1 Matthias Geerdsen (RETIRED) 2007-01-26 12:25:29 UTC]

could someone check this please? web-apps?

[Comment 2 Renat Lumpau (RETIRED) 2007-01-26 23:38:22 UTC]

version in the tree is 1.0.12

[Comment 3 Raphael Marichez (Falco) (RETIRED) 2007-02-10 19:45:25 UTC]

Thanks; closing since ~arched