Joomla! SQL Error Information Disclosure Vulnerability

Bugtraq ID:	44674
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Nov 05 2010 12:00AM
Updated:	Nov 05 2010 12:00AM
Credit:	YGN Ethical Hacker Group
Vulnerable:	Joomla Joomla 1.5.21 Joomla Joomla 1.5.20 Joomla Joomla 1.5.19 Joomla Joomla 1.5.18 Joomla Joomla 1.5.17 Joomla Joomla 1.5.16 Joomla Joomla 1.5.15 Joomla Joomla 1.5.14 Joomla Joomla 1.5.13 Joomla Joomla 1.5.12 Joomla Joomla 1.5.11 Joomla Joomla 1.5.10 Joomla Joomla 1.5.9 Joomla Joomla 1.5.8 Joomla Joomla 1.5.7 Joomla Joomla 1.5.6 Joomla Joomla 1.5.5 Joomla Joomla 1.5.4 Joomla Joomla 1.5.3 Joomla Joomla 1.5.2 Joomla Joomla 1.5.1
Not Vulnerable:	Joomla Joomla 1.5.22

Joomla! SQL Error Information Disclosure Vulnerability

Joomla! is prone to an information-disclosure vulnerability due to an SQL error.

Exploiting this issue can allow attackers to gain access to sensitive information contained in the application's database. Successful exploits may lead to other attacks.

Versions prior to Joomla! 1.5.22 are vulnerable.

Joomla! SQL Error Information Disclosure Vulnerability

Attackers can use a browser to exploit this issue.

The following screenshots are available to demonstrate this issue:

http://yehg.net/lab/pr0js/advisories/joomla/core/1.5.21/sql_injection/sqli_(filter_order)_front.jpg
http://yehg.net/lab/pr0js/advisories/joomla/core/1.5.21/sql_injectio /sqli_%28filter_order_Dir%29_front.jpg
http://yehg.net/lab/pr0js/advisories/joomla/core/1.5.21/sql_injectio /sqli_%28filter_order_Dir%29_back.jpg

Joomla! SQL Error Information Disclosure Vulnerability

Solution:
The vendor released an update to address this issue. Please see the references for more information.

Joomla! SQL Error Information Disclosure Vulnerability

References:

• [20101101] - Core - XSS Vulnerabilities (Joomla!)
  
• Joomla! Homepage (Joomla )
  
• Joomla 1.5.21 | Potential SQL Injection Flaws (YGN Ethical Hacker Group )