Joomla CCBoard SQL Injection and Arbitrary File Upload Vulnerabilities

Bugtraq ID:	48108
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Jun 06 2011 12:00AM
Updated:	Jun 06 2011 12:00AM
Credit:	KedAns-Dz
Vulnerable:	Joomla CCBoard 0
Not Vulnerable:

Joomla CCBoard SQL Injection and Arbitrary File Upload Vulnerabilities

http://www.noticeboardpro.com/notice-board-pro-copyright.htmlJoomla CCBoard is prone to an SQL-injection vulnerability and an arbitrary-file-upload vulnerability because it fails to sanitize user-supplied data.

Exploiting these issues could allow an attacker to compromise the application, execute arbitrary code, access or modify data, or exploit latent vulnerabilities in the underlying database.

Joomla CCBoard SQL Injection and Arbitrary File Upload Vulnerabilities

An attacker can use a browser to exploit these issues.

The following example URI is available:

http://www.example.com/index.php?option=com_ccboard&view=postlist&forum=1&topic=2

Joomla CCBoard SQL Injection and Arbitrary File Upload Vulnerabilities

Solution:
Currently, we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Joomla CCBoard SQL Injection and Arbitrary File Upload Vulnerabilities

References:

• Joomla Homepage (Joomla)
  
• Product Homepage (Code Classic)