Joomla! 'com_beamospetition' Component SQL Injection and Cross Site Scripting Vulnerabilities

Bugtraq ID:	33391
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Jan 21 2009 12:00AM
Updated:	Jan 23 2009 08:42PM
Credit:	vds_s
Vulnerable:	Arthur Konze com_beamospetition 1.0.12
Not Vulnerable:

Joomla! 'com_beamospetition' Component SQL Injection and Cross Site Scripting Vulnerabilities

The 'com_beamospetition' component for Joomla! is prone to an SQL-injection vulnerability and a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data.

Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

These issues affect 'com_beamospetition' 1.0.12; other versions may also be affected.

Joomla! 'com_beamospetition' Component SQL Injection and Cross Site Scripting Vulnerabilities

The following example URIs are available:

• /data/vulnerabilities/exploits/33391.html

Joomla! 'com_beamospetition' Component SQL Injection and Cross Site Scripting Vulnerabilities

Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Joomla! 'com_beamospetition' Component SQL Injection and Cross Site Scripting Vulnerabilities

References:

• com_beamospetition Homepage (Arthur Konze)
  
• Joomla component beamospetition 1.0.12 Sql Injection ([email protected])