Joomla! BookLibrary Component 'searchtext' Parameter SQL Injection Vulnerability
BID:46929
Info
Joomla! BookLibrary Component 'searchtext' Parameter SQL Injection Vulnerability
| Bugtraq ID: | 46929 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Mar 21 2011 12:00AM |
| Updated: | Mar 21 2011 12:00AM |
| Credit: | Marc Doudiet |
| Vulnerable: |
OrdaSoft BookLibrary 2.0 |
| Not Vulnerable: | |
Discussion
Joomla! BookLibrary Component 'searchtext' Parameter SQL Injection Vulnerability
The BookLibrary component for Joomla! is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.
Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
BookLibrary 2.0 is vulnerable; other versions may also be affected.
The BookLibrary component for Joomla! is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.
Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
BookLibrary 2.0 is vulnerable; other versions may also be affected.
Exploit / POC
Joomla! BookLibrary Component 'searchtext' Parameter SQL Injection Vulnerability
Attackers can use a browser to exploit this issue.
Attackers can use a browser to exploit this issue.
Solution / Fix
Joomla! BookLibrary Component 'searchtext' Parameter SQL Injection Vulnerability
Solution:
Vendor updates are available. Please see the references for more information.
Solution:
Vendor updates are available. Please see the references for more information.
References
Joomla! BookLibrary Component 'searchtext' Parameter SQL Injection Vulnerability
References:
References:
- SECURITY UPGRADE INSTRUCTIONS for BOOK LIBRARY (Ordasoft)
- Vendor Homepage (Ordasoft)