DESCRIPTION:
A vulnerability has been discovered in the QContacts component for
Joomla!, which can be exploited by malicious people to conduct SQL
injection attacks.
Input passed via the "filter_order" parameter to index.php (when
"option" is set to "com_qcontacts" and "filter_order_Dir" is set) is
not properly sanitised before being used in a SQL query. This can be
exploited to manipulate SQL queries by injecting arbitrary SQL code.
The vulnerability is confirmed in version 1.0.6. Other versions may
also be affected.
SOLUTION:
Edit the source code to ensure that input is properly sanitised.
PROVIDED AND/OR DISCOVERED BY:
Don
DESCRIPTION:
A vulnerability has been discovered in the JCE component for Joomla!,
which can be exploited by malicious users to compromise a vulnerable
system.
The vulnerability is caused due to the
editor/extensions/browser/file.php script not properly validating
uploaded files, which can be exploited to execute arbitrary PHP code
by uploading a PHP file with e.g. an appended ".gif" file extension.
Successful exploitation requires "Author" privileges.
The vulnerability is confirmed in version 2.0.17. Prior versions may
also be affected.
SOLUTION:
Update to version 2.0.19.
PROVIDED AND/OR DISCOVERED BY:
Reported by the vendor.
Additional information provided by Secunia Research.
ORIGINAL ADVISORY:
JCE:
http://www.joomlacontenteditor.net/news/item/jce-2018-released?category_id=32
DESCRIPTION:
Ismail Kaleem has discovered a vulnerability in the Fabrik component
for Joomla!, which can be exploited by malicious users to compromise
a vulnerable system.
The vulnerability is caused due to the models/importcsv.php script
improperly verifying uploaded files. This can be exploited to execute
arbitrary PHP code by uploading a PHP file.
Successful exploitation requires "Manager" privileges.
The vulnerability is confirmed in version 2.1. Prior versions may
also be affected.
SOLUTION:
Update to version 2.1.1.
PROVIDED AND/OR DISCOVERED BY:
Ismail Kaleem via Vulnerability Research Laboratory
ORIGINAL ADVISORY:
Fabrik:
http://www.ohloh.net/p/3417/commits/145749116
Vulnerability Research Laboratory:
http://www.vulnerability-lab.com/get_content.php?id=342
Joomla! ได้รับรางวัลจากผลการโหวต Open Source CMS ประจำปี 2011 จัดโดยสำนักพิมพ์ Packt Publishing ซึ่งได้ดำเนินการจัดประกวดมาตลอดทุกปี และปีนี้เป็นปีที่ 6 แล้ว โดยใน 6 ครั้งที่ประกวด Joomla! ได้กวาดรางวันนี้มาถึง 3 ครั้งได้แก่
