Joomla Component Com_Rapidrecipe Multiple SQL Injection Vulnerability

Overview

» IDS/IPS Signatures

Security Sites

iPolicy Networks Security Advisory


Date Discovered:	02/13/2008
Severity:	High
Applications Affected	Joomla with Com_rapidrecipe 1.6.7 and previous

Synopsis

SQL injection vulnerability has been identified in Joomla with Com_rapidrecipe 1.6.7 and previous

Recommended Actions

Upgrade with latest patch.
http://www.joomla.org/

Threat Analysis

Joomla is an open source content management system that will help user`s to build websites and other online applications. It consist of lot of modules and components. Content management system(CMS) is a computer software system for organizing and facilitating collaborative creation of documents and other contents. A CMS is frequently a web application used for managing web sites and web contents.RapidRecipe is a fully customizable Recipe Administration Component developed with the Chef or Food and Beverage Professional in Mind.

Multiple SQL injection vulnerabilities have been identified in Joomla with com_rapidrecipe 1.6.7 and prior. This issue is due to a failure in the index.php to properly sanitize user-supplied input through user_id and category_id parameter.An attacker can take advantage of this issue to execute arbitrary sql commands.

References

http://nvd.nist.gov/nvd.cfm?cvename=CVE-2008-0754
http://en.securitylab.ru/nvd/313236.php
http://www.joomla.org/

Write-up by: Vinod Sharma

Security Sites

“iPolicy is one of the most visionary firewall vendors in the firewall Magic Quadrant. Its architecture of a central session processing engine and multiple content blades that are able to block based on signatures, rules and so on is the closest to the network security ideal.”

Greg Young, John Pescatore
Magic Quadrant for Network Firewalls, 2H04, Gartner

| | | | | | | | |