Joomla! Joomsport Component SQL Injection and Arbitrary File Upload Vulnerabilities

Bugtraq ID:	53944
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Jun 11 2012 12:00AM
Updated:	Jun 11 2012 12:00AM
Credit:	KedAns-Dz
Vulnerable:	Joomla Joomsport 0
Not Vulnerable:

Joomla! Joomsport Component SQL Injection and Arbitrary File Upload Vulnerabilities

The Joomsport component for Joomla! is prone to an SQL-injection vulnerability and an arbitrary file-upload vulnerability because it fails to sanitize user-supplied data.

Exploiting these issues could allow an attacker to compromise the application, execute arbitrary code, access or modify data, or exploit latent vulnerabilities in the underlying database.

Joomla! Joomsport Component SQL Injection and Arbitrary File Upload Vulnerabilities

An attacker can use a browser to exploit these issues.

The following example code is available:

• /data/vulnerabilities/exploits/53944.txt

Joomla! Joomsport Component SQL Injection and Arbitrary File Upload Vulnerabilities

Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Joomla! Joomsport Component SQL Injection and Arbitrary File Upload Vulnerabilities

References:

• Joomla HomePage (Joomla)
  
• Joomsport Homepage (Joomla)