JomSocial Joomla! Component Multiple HTML Injection Vulnerabilities

Bugtraq ID:	41010
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Jun 21 2010 12:00AM
Updated:	Jun 25 2010 03:18PM
Credit:	jdc
Vulnerable:	JomSocial JomSocial 1.6.288
Not Vulnerable:	JomSocial JomSocial 1.6.291

JomSocial Joomla! Component Multiple HTML Injection Vulnerabilities

JomSocial Joomla! component is prone to multiple HTML-injection vulnerabilities because the application fails to properly sanitize user-supplied input before using it in dynamically generated content.

Attacker-supplied HTML and script code would run in the context of the affected browser, potentially allowing the attacker to steal cookie-based authentication credentials or to control how the site is rendered to the user. Other attacks are also possible.

JomSocial 1.6.288 is vulnerable; other versions may also be affected.

JomSocial Joomla! Component Multiple HTML Injection Vulnerabilities

Attackers can use a browser to exploit these issues.

JomSocial Joomla! Component Multiple HTML Injection Vulnerabilities

Solution:
The vendor released an update. Please see the references for more information,.

JomSocial Joomla! Component Multiple HTML Injection Vulnerabilities

References:

• JomSocial Homepage (JomSocial)
  
• Joomla! Homepage (Joomla!)
  
• Security Patch for JomSocial 1.5 and 1.6 (JomSocial)
  
• Security patch for JomSocial 1.6.x (JomSocial)