Almond Classifieds Component for Joomla! Cross-Site Scripting and SQL-Injection Vulnerabilities

Bugtraq ID:	35815
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Jul 27 2009 12:00AM
Updated:	Feb 11 2010 06:01PM
Credit:	Moudi
Vulnerable:	AlmondSoft.Com Almond Classifieds Component for Joomla! 7.5
Not Vulnerable:

Almond Classifieds Component for Joomla! Cross-Site Scripting and SQL-Injection Vulnerabilities

Almond Classifieds Component for Joomla! is prone to a cross-site scripting vulnerability and an SQL-injection vulnerability because the application fails to sufficiently sanitize user-supplied input.

A successful exploit may allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

Almond Classifieds Component for Joomla! 7.5 is vulnerable; other versions may also be affected.

Almond Classifieds Component for Joomla! Cross-Site Scripting and SQL-Injection Vulnerabilities

Attackers can use a browser to exploit the SQL-injection issue. To exploit a cross-site scripting vulnerability, an attacker must entice a victim to follow a malicious URI.

The following example URIs are available:

• /data/vulnerabilities/exploits/35815.txt

Almond Classifieds Component for Joomla! Cross-Site Scripting and SQL-Injection Vulnerabilities

Solution:
Updates are available. Please see the references for more information.

Almond Classifieds Component for Joomla! Cross-Site Scripting and SQL-Injection Vulnerabilities

References:

• Almond Classifieds Homepage (AlmondSoft.Com)
  
• Vulnerable Extensions List (Joomla!)