SECUNIA ADVISORY ID:
SA33646

VERIFY ADVISORY:
http://secunia.com/advisories/33646/

CRITICAL:
Moderately critical

IMPACT:
Manipulation of data

WHERE:
>From remote

SOFTWARE:
Flash Magazine Deluxe (component for Joomla!)
http://secunia.com/advisories/product/21140/

DESCRIPTION:
TurkGuvenligi has reported a vulnerability in the Flash Magazine
Deluxe component for Joomla!, which can be exploited by malicious
people to conduct SQL injection attacks.

Input passed via the "mag_id" parameter in index.php (when "option"
is set to "com_flashmagazinedeluxe") is not properly sanitised before
being used in SQL queries. This can be exploited to manipulate SQL
queries by injecting arbitrary SQL code.

SOLUTION:
Edit the source code to ensure that input is properly sanitised.

PROVIDED AND/OR DISCOVERED BY:
TurkGuvenligi

ORIGINAL ADVISORY:
http://milw0rm.com/exploits/7881

SECUNIA ADVISORY ID: SA33612  VERIFY ADVISORY: http://secunia.com/advisories/33612/  CRITICAL: Moderately critical  IMPACT: Manipulation of data  WHERE: >From remote  SOFTWARE: BazaarBuilder Shopping Cart 5.x (component for Joomla!) http://secunia.com/advisories/product/21082/  DESCRIPTION: XaDoS has reported a vulnerability in the BazaarBuilder Shopping Cart component for Joomla!, which can be exploited by malicious people to conduct SQL injection attacks.  Input passed via the "cid" parameter in index.php (when "option" is set to "com_prod" and "task" is set to "products") is not properly sanitised before being used in SQL queries. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code.  This vulnerability is reported in version 5.0. Other versions may also be affected.  SOLUTION: Edit the source code to ensure that input is properly sanitised.  PROVIDED AND/OR DISCOVERED BY: XaDoS  ORIGINAL ADVISORY: http://milw0rm.com/exploits/7840 

SECUNIA ADVISORY ID:
SA33563

VERIFY ADVISORY:
http://secunia.com/advisories/33563/

CRITICAL:
Moderately critical

IMPACT:
Manipulation of data

WHERE:
>From remote

SOFTWARE:
Eventing 1.x (component for Joomla!)
http://secunia.com/advisories/product/21002/

DESCRIPTION:
Cyb3R-1st has reported a vulnerability in the Eventing component for
Joomla!, which can be exploited by malicious people to conduct SQL
injection attacks.

Input passed via the "catid" parameter in index.php (when "option" is
set to "com_eventing") is not properly sanitised before being used in
SQL queries. This can be exploited to manipulate SQL queries by
injecting arbitrary SQL code.

SOLUTION:
Edit the source code to ensure that input is properly sanitised.

PROVIDED AND/OR DISCOVERED BY:
Cyb3R-1st

ORIGINAL ADVISORY:
http://milw0rm.com/exploits/7793

SECUNIA ADVISORY ID:
SA33562

VERIFY ADVISORY:
http://secunia.com/advisories/33562/

CRITICAL:
Moderately critical

IMPACT:
Manipulation of data

WHERE:
>From remote

SOFTWARE:
RD-Autos 1.x (component for Joomla!)
http://secunia.com/advisories/product/21003/

DESCRIPTION:
H!tm@N has discovered a vulnerability in the RD-Autos component for
Joomla!, which can be exploited by malicious people to conduct SQL
injection attacks.

Input passed via the "id" parameter in index.php (when "option" is
set to "com_rdautos") is not properly sanitised before being used in
SQL queries. This can be exploited to manipulate SQL queries by
injecting arbitrary SQL code.

This vulnerability is confirmed in version 1.5.5. Other versions may
also be affected.

SOLUTION:
Edit the source code to ensure that input is properly sanitised.

PROVIDED AND/OR DISCOVERED BY:
H!tm@N

ORIGINAL ADVISORY:
http://milw0rm.com/exploits/7795

?

เชิญพบปะกับทีมงานจูมล่าลายไทย (ที่บูธ G9) และร่วมรับฟังการบรรยายจาก คุณอัครวุฒิ ตำราเรียง และ คุณพิศาล เชื้อชาติไชย (คนหลังเขา) ในงาน "ไทยแลนด์ อินเทอร์เน็ต เอ็กซ์โป 2009" ณ รอยัลพารากอน ฮอลล์ 1-3 ชั้น 5 ศูนย์การค้าสยามพารากอน ระหว่างวันที่ 30 มกราคม-1 กุมภาพันธ์ 2552 (ศุกร์-อาทิตย์) ตั้งแต่ เวลา 10.00-20.00 น. พิเศษ!!! สมัครฝึกอบรมหลักสูตร Joomla! Mastering Workshop ภายในงาน รับส่วนลด 30%

ดูรายละเอียดการจัดงานและลงทะเบียนเข้าร่วมสัมมนาฟรีที่? http://www.thailandinternetexpo.com

ลงทะเบียนสำรองที่นั่งงานสัมมนาฟรี >> คลิกที่นี่ <<

SECUNIA ADVISORY ID:
SA33459

VERIFY ADVISORY:
http://secunia.com/advisories/33459/

CRITICAL:
Moderately critical

IMPACT:
Manipulation of data

WHERE:
>From remote

SOFTWARE:
Fantasy Tournament 2009.1.5 (component for Joomla)
http://secunia.com/advisories/product/20970/

DESCRIPTION:
H!tm@N has reported some vulnerabilities in the Fantasy Tournament
Component for Joomla, which can be exploited by malicious people to
conduct SQL injection attacks.

1) Input passed via the "roundID" parameter in index.php (when
"option" is set to "com_fantasytournament" and when "func" is set to
"teamsByRound" or "managersByManager") is not properly sanitised
before being used in SQL queries. This can be exploited to manipulate
SQL queries by injecting arbitrary SQL code.

2) Input passed via the "managerID" parameter in index.php (when
"option" is set to "com_fantasytournament" and when "func" is set to
"managersByManager") is not properly sanitised before being used in
SQL queries. This can be exploited to manipulate SQL queries by
injecting arbitrary SQL code.

These vulnerabilities are reported in version 2009.1.5. Other
versions may also be affected.

SOLUTION:
Edit the source code to ensure that input is properly sanitised.

PROVIDED AND/OR DISCOVERED BY:
H!tm@N

ORIGINAL ADVISORY:
http://milw0rm.com/exploits/7777