DESCRIPTION: A vulnerability has been discovered in the GCalendar component for Joomla, which can be exploited by malicious people to conduct SQL injection attacks.
Input passed via the "gcid" parameter to index.php (when "option" is set to "com_gcalendar" and "view" is set to "event") is not properly sanitised before being used in a SQL query. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code.
The vulnerability is confirmed in version 2.1.4. Other versions may also be affected.
SOLUTION: Edit the source code to ensure that input is properly sanitised.
DESCRIPTION: A vulnerability has been discovered in the iF Portfolio Nexus component for Joomla, which can be exploited by malicious users to conduct SQL injection attacks.
Input passed via the "id" parameter to index.php (when "option" is set to "com_if_nexus", "controller" is set to "sections", "genres", "categories", or "types", and "view" is set to "item") is not properly sanitised before being used in an SQL query. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code.
The vulnerability is confirmed in version 1.1. Other versions may also be affected.
SOLUTION: Edit the source code to ensure that input is properly sanitised.
DESCRIPTION: A vulnerability has been reported in the JoomClip component for Joomla, which can be exploited by malicious people to conduct SQL injection attacks.
Input passed via the "cat" parameter in index.php (if "option" is set to "com_joomclip" and "view" to "thumbs") is not properly sanitised before being used in an SQL query. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code.
SOLUTION: Edit the source code to ensure that input is properly sanitised.
Filter malicious characters and character sequences in a proxy.
DESCRIPTION: Some security issues have been reported in Joomla!, which can be exploited by malicious people to disclose version information and by malicious users to manipulate certain data.
1) An error in the handling of XML files can be exploited to view version information installed modules.
2) An unspecified error in the application can be exploited to replace front page articles of another user.
The security issues are reported in versions prior to 1.5.15.
SOLUTION: Update to version 1.5.15. Restrict access to XML files (e.g. via an ".htaccess" file).
PROVIDED AND/OR DISCOVERED BY: 1) The vendor credits WHK and Gergo Erdosi. 2) The vendor credits Hannes Papenberg.
ส่วนประกอบเสริมประจำเดือนนี้ครับ เป็นโมดูลแสดงข่าวล่าสุดจากเว็บไซต์ของเราเอง โดยเพิ่มความสามารถเรื่องแสดงจำนวนของหัวข้อข่าวตามจำนวนตัวอักษรที่ต้องการกำหนดให้แสดงครับ.
