DESCRIPTION:
A vulnerability has been reported in the Virtuemart Shipping by State
component for Joomla!, which can be exploited by malicious people to
bypass certain security restrictions.
An unspecified error exists related to permissions. No further
information is currently available.
SOLUTION:
Currently there is no known workaround.
PROVIDED AND/OR DISCOVERED BY:
Reported by the Joomla! VEL team.
ORIGINAL ADVISORY:
http://docs.joomla.org/Vulnerable_Extensions_List#Shipping_by_State_for_Virtuemart
DESCRIPTION:
Sammy Forgit has discovered a vulnerability in the Dione FileUploader
module for Joomla!, which can be exploited by malicious people to
compromise a vulnerable system.
The vulnerability is caused due to the
modules/mod_dionefileuploader/upload.php script allowing the upload
of files with arbitrary extensions to a folder inside the webroot.
This can be exploited to execute arbitrary PHP code by uploading a
malicious PHP script.
The vulnerability is confirmed in version 1.0.1. Other versions may
also be affected.
SOLUTION:
Restrict access to the modules/mod_dionefileuploader/upload.php
script (e.g. via .htaccess).
PROVIDED AND/OR DISCOVERED BY:
Sammy Forgit, OpenSysCom.
ORIGINAL ADVISORY:
OpenSysCom:
http://www.opensyscom.fr/Actualites/joomla-modules-dione-fileuploader-arbitrary-file-upload-vulnerability.html
DESCRIPTION:
Sammy Forgit has discovered a vulnerability in the Maian Media
component for Joomla!, which can be exploited by malicious people to
compromise a vulnerable system.
The vulnerability is caused due to the
administrator/components/com_maianmedia/utilities/charts/php-ofc-library/ofc_upload_image.php
script allowing the upload of files with arbitrary extensions to a
folder inside the webroot. This can be exploited to execute arbitrary
PHP code by uploading a malicious PHP script.
The vulnerability is confirmed in version 1.5.8.4. Other versions may
also be affected.
SOLUTION:
Restrict access to the
administrator/components/com_maianmedia/utilities/charts/php-ofc-library/ofc_upload_image.php
script (e.g. via .htaccess).
PROVIDED AND/OR DISCOVERED BY:
Sammy Forgit, OpenSysCom.
ORIGINAL ADVISORY:
http://www.opensyscom.fr/Actualites/joomla-components-maian-media-arbitrary-file-upload-vulnerability.html
ทีม Joomla! Project ได้ปล่อย Joomla 2.5.6 ออกมาให้ได้ใช้งานเป็นการเร่งด่วน รุ่นนี้แก้ไขปัญหามีความสำคัญสูงหลายจุดในรุ่น 2.5.5 ที่เพิ่งออกไป เป้าหมายที่ยิ่งใหญ่ของทีมผ่ายผลิต คือการให้ความช่วยเหลือต่อไปอย่างสม่ำเสมอ เพื่อชุมชน Joomla. ท่านสามารถเรียนรู้เพิ่มเติมเกี่ยวกับ Joomla! Developement ที่
