BID:32263

Joomla! Multiple HTML Injection Vulnerabilities

Info

Joomla! Multiple HTML Injection Vulnerabilities

Bugtraq ID:	32263
Class:	Input Validation Error
CVE:	CVE-2008-6299
Remote:	Yes
Local:	No
Published:	Nov 10 2008 12:00AM
Updated:	Mar 10 2009 09:46PM
Credit:	Gergo Erdosi and Johan Janssens
Vulnerable:	Joomla Joomla 1.5.7 Joomla Joomla 1.5.6 Joomla Joomla 1.5.5 Joomla Joomla 1.5.4 Joomla Joomla 1.5.3 Joomla Joomla 1.5.2 Joomla Joomla 1.5.1 Joomla Joomla 1.5 Joomla Joomla 1.5.0 Beta

Not Vulnerable:	Joomla Joomla 1.5.8

Discussion

Joomla! Multiple HTML Injection Vulnerabilities

Joomla! is prone to multiple HTML-injection vulnerabilities because it fails to sufficiently sanitize user-supplied data.

Attacker-supplied HTML or JavaScript code could run in the context of the affected site, potentially allowing the attacker to steal cookie-based authentication credentials and to control how the site is rendered to the user; other attacks are also possible.

These issues affect versions prior to Joomla! 1.5.8.

Exploit / POC

Joomla! Multiple HTML Injection Vulnerabilities

Attackers can use a browser to exploit these issues.

Solution / Fix

Joomla! Multiple HTML Injection Vulnerabilities

Solution:
The vendor has released fixes. Please see the references for more information.

Joomla Joomla 1.5.0 Beta