Joomla! UIajaxIM Component Arbitrary Script Injection Vulnerability

Bugtraq ID:	35798
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Jul 24 2009 12:00AM
Updated:	Apr 08 2010 04:23PM
Credit:	599eme Man
Vulnerable:	Universal Informatique UIajaxIM 1.1
Not Vulnerable:	Universal Informatique UIajaxIM 1.4

Joomla! UIajaxIM Component Arbitrary Script Injection Vulnerability

The 'UIajaxIM' component for Joomla! is prone to a vulnerability that an attacker could exploit to execute arbitrary script code in the context of the webserver. The issue occurs because the component fails to properly sanitize user-supplied input.

Successful exploits may compromise the application.

UIajaxIM 1.1 is vulnerable; other versions may also be affected.

Joomla! UIajaxIM Component Arbitrary Script Injection Vulnerability

Attackers can exploit this issue via a browser.

The following example data is available:

• /data/vulnerabilities/exploits/35798.txt

Joomla! UIajaxIM Component Arbitrary Script Injection Vulnerability

Solution:
The vendor released UIajaxIM 1.4 to address this issue. Please see the references for details.


Universal Informatique UIajaxIM 1.1

• Universal Informatique UIajaxIM 1.4
  http://www.universal-informatique.com/communaute/telechargements.html? task=viewcategory&catid=6

Joomla! UIajaxIM Component Arbitrary Script Injection Vulnerability

References:

• UIajaxIM (Joomla)
  
• Vendor Homepage (Universal Informatique)