Jojo CMS 'X-Forwarded-For' HTTP header SQL-Injection Vulnerability

Bugtraq ID:	59934
Class:	Input Validation Error
CVE:	CVE-2013-3081
Remote:	Yes
Local:	No
Published:	May 15 2013 12:00AM
Updated:	May 15 2013 12:00AM
Credit:	High-Tech Bridge SA
Vulnerable:	Jojo Open Source Content Management System Jojo CMS 1.2
Not Vulnerable:	Jojo Open Source Content Management System Jojo CMS 1.2.2

Jojo CMS 'X-Forwarded-For' HTTP header SQL-Injection Vulnerability

Jojo CMS is prone to an SQL-injection vulnerability because it fails to sanitize user-supplied input.

A successful exploit may allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

Jojo CMS 1.2 is vulnerable; other versions may also be affected.

Jojo CMS 'X-Forwarded-For' HTTP header SQL-Injection Vulnerability

Attackers can exploit this issue by enticing an unsuspecting victim to follow a malicious URI.

The following example data is available:

• /data/vulnerabilities/exploits/59934.txt

Jojo CMS 'X-Forwarded-For' HTTP header SQL-Injection Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

Jojo CMS 'X-Forwarded-For' HTTP header SQL-Injection Vulnerability

References:

• Jojo CMS Homepage (Jojo Open Source Content Management System.)
  
• HTB23153: Multiple Vulnerabilities in Jojo CMS (High-Tech Bridge)