Visitor Data Component for Joomla! 'X-Forwarded-For' Header Remote Command Execution Vulnerability

Bugtraq ID:	40075
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	May 11 2010 12:00AM
Updated:	May 11 2010 12:00AM
Credit:	Chip D3 Bi0s
Vulnerable:	Camp26 Visitor Data 1.1
Not Vulnerable:

Visitor Data Component for Joomla! 'X-Forwarded-For' Header Remote Command Execution Vulnerability

The Visitor Data Component for Joomla! is prone to a vulnerability that attackers can leverage to execute arbitrary commands. This issue occurs because the application fails to adequately sanitize user-supplied input.

Successful attacks can compromise the affected application and possibly the underlying computer.

Visitor Data 1.1 is vulnerable; other versions may also be affected.

Visitor Data Component for Joomla! 'X-Forwarded-For' Header Remote Command Execution Vulnerability

Attackers can exploit this issue with readily available tools.

Visitor Data Component for Joomla! 'X-Forwarded-For' Header Remote Command Execution Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Visitor Data Component for Joomla! 'X-Forwarded-For' Header Remote Command Execution Vulnerability

References:

• mod_VisitorData 1.1 Joomla! Remote Code Execution Remote Code Execution (r0i)
  
• VisitorData Homepage (Camp26)