Joomla! 'com_jp_jobs' Component 'id' Parameter SQL Injection Vulnerability
BID:39191
Info
Joomla! 'com_jp_jobs' Component 'id' Parameter SQL Injection Vulnerability
| Bugtraq ID: | 39191 |
| Class: | Input Validation Error |
| CVE: |
CVE-2010-1350 |
| Remote: | Yes |
| Local: | No |
| Published: | Apr 05 2010 12:00AM |
| Updated: | Apr 13 2015 09:02PM |
| Credit: | Valentin Hoebel |
| Vulnerable: |
Joomla com_jp_jobs 1.4.1 |
| Not Vulnerable: |
Joomla com_jp_jobs 1.4.3 |
Discussion
Joomla! 'com_jp_jobs' Component 'id' Parameter SQL Injection Vulnerability
The 'com_jp_jobs' component for Joomla! is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.
Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
Versions prior to 'com_jp_jobs' 1.4.3 are vulnerable.
The 'com_jp_jobs' component for Joomla! is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.
Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
Versions prior to 'com_jp_jobs' 1.4.3 are vulnerable.
Exploit / POC
Joomla! 'com_jp_jobs' Component 'id' Parameter SQL Injection Vulnerability
Attackers can use a browser to exploit this issue.
The following example URI is available:
http://www.example.com/index.php?option=com_jp_jobs&view=detail&id=1+AND+1=2+UNION+SELECT+concat(user())--
Attackers can use a browser to exploit this issue.
The following example URI is available:
http://www.example.com/index.php?option=com_jp_jobs&view=detail&id=1+AND+1=2+UNION+SELECT+concat(user())--
Solution / Fix
Joomla! 'com_jp_jobs' Component 'id' Parameter SQL Injection Vulnerability
Solution:
The vendor released an update to address this issue. Please see the references for more information.
Joomla com_jp_jobs 1.4.1
Solution:
The vendor released an update to address this issue. Please see the references for more information.
Joomla com_jp_jobs 1.4.1
References
Joomla! 'com_jp_jobs' Component 'id' Parameter SQL Injection Vulnerability
References:
References:
- com_jp_jobs Homepage (Joomla)