OrdaSoft BookLibrary Books from same author Component for Joomla! SQL Injection Vulnerability

Bugtraq ID:	41350
Class:	Input Validation Error
CVE:	CVE-2010-2851
Remote:	Yes
Local:	No
Published:	Jul 05 2010 12:00AM
Updated:	Apr 13 2015 09:02PM
Credit:	Secunia Research
Vulnerable:	OrdaSoft BookLibrary Books from same author 1.5
Not Vulnerable:	OrdaSoft BookLibrary Books from same author 1.5_2010_06_25

OrdaSoft BookLibrary Books from same author Component for Joomla! SQL Injection Vulnerability

The BookLibrary Books from same author component for Joomla! is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

Versions prior to BookLibrary Books from same author 1.5_2010_06_25 are vulnerable.

OrdaSoft BookLibrary Books from same author Component for Joomla! SQL Injection Vulnerability

Attackers can use a browser to exploit this issue.

OrdaSoft BookLibrary Books from same author Component for Joomla! SQL Injection Vulnerability

Solution:
Updates are available. Please see the references for details.

OrdaSoft BookLibrary Books from same author Component for Joomla! SQL Injection Vulnerability

References:

• Details for BookLibrary Books from same author module, version 1.5 (OrdaSoft)
  
• Secunia Research: Joomla BookLibrary From Same Author Module "id" SQL Injection (Secunia Research )
  
• Secunia Research: Joomla BookLibrary From Same Author Module "id" SQL Injection (Secunia Research)