Joomla! and Mambo Joomlearn LMS Component 'cat' Parameter SQL Injection Vulnerability

Bugtraq ID:	28586
Class:	Input Validation Error
CVE:	CVE-2008-4777
Remote:	Yes
Local:	No
Published:	Apr 03 2008 12:00AM
Updated:	May 07 2015 05:30PM
Credit:	The-0utl4w
Vulnerable:	Joomla Showroom Joomlearn LMS 0
Not Vulnerable:	Joomla Showroom Joomlearn LMS 2.6

Joomla! and Mambo Joomlearn LMS Component 'cat' Parameter SQL Injection Vulnerability

The Joomlearn LMS component for Joomla! and Mambo is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

Joomla! and Mambo Joomlearn LMS Component 'cat' Parameter SQL Injection Vulnerability

Attackers can use a browser to exploit this issue.

The following example URI is available:

http://www.example.com/index.php?option=com_lms&task=showTests&cat=-1 union select 1,concat(username,char(32),password),3,4,5,6,7 from jos_users/*

Joomla! and Mambo Joomlearn LMS Component 'cat' Parameter SQL Injection Vulnerability

Solution:
The vendor has released an update. Please see the references for more information.


Joomla Showroom Joomlearn LMS 0

• Joomla Showroom 1-Joomlearn-LMS-Basic-Edition_2.6.html
  http://joomlashowroom.com/index.php/View-details/Joomla-1.0-Extensions /1-Joomlearn-LMS-Basic-Edition.html

Joomla! and Mambo Joomlearn LMS Component 'cat' Parameter SQL Injection Vulnerability

References:

• JoomLearn LMS (Joomla Showroom)
  
• Mambo Homepage (Mambo)
  
• Joomla Component com_lms SQL Injection ([email protected])