DESCRIPTION:
Stefan Schurtz has discovered a vulnerability in Joomla!, which can
be exploited by malicious people to conduct cross-site scripting
attacks.
Input passed via the URL to index.php is not properly sanitised in
modules/mod_languages/tmpl/default.php before being returned to the
user. This can be exploited to execute arbitrary HTML and script code
in a user's browser session in context of an affected site.
Successful exploitation requires the Language Switcher module to be
enabled (not enabled by default).
The vulnerability is confirmed in version 2.5.6. Other versions may
also be affected.
SOLUTION:
No official solution is currently available.
PROVIDED AND/OR DISCOVERED BY:
Stefan Schurtz
ORIGINAL ADVISORY:
http://www.darksecurity.de/advisories/2012/SSCHADV2012-014.txt
DESCRIPTION:
A vulnerability has been reported in the Virtuemart Shipping by State
component for Joomla!, which can be exploited by malicious people to
bypass certain security restrictions.
An unspecified error exists related to permissions. No further
information is currently available.
SOLUTION:
Currently there is no known workaround.
PROVIDED AND/OR DISCOVERED BY:
Reported by the Joomla! VEL team.
ORIGINAL ADVISORY:
http://docs.joomla.org/Vulnerable_Extensions_List#Shipping_by_State_for_Virtuemart
DESCRIPTION:
Sammy Forgit has discovered a vulnerability in the Dione FileUploader
module for Joomla!, which can be exploited by malicious people to
compromise a vulnerable system.
The vulnerability is caused due to the
modules/mod_dionefileuploader/upload.php script allowing the upload
of files with arbitrary extensions to a folder inside the webroot.
This can be exploited to execute arbitrary PHP code by uploading a
malicious PHP script.
The vulnerability is confirmed in version 1.0.1. Other versions may
also be affected.
SOLUTION:
Restrict access to the modules/mod_dionefileuploader/upload.php
script (e.g. via .htaccess).
PROVIDED AND/OR DISCOVERED BY:
Sammy Forgit, OpenSysCom.
ORIGINAL ADVISORY:
OpenSysCom:
http://www.opensyscom.fr/Actualites/joomla-modules-dione-fileuploader-arbitrary-file-upload-vulnerability.html
ทีม Joomla! Project ได้ปล่อย Joomla 2.5.6 ออกมาให้ได้ใช้งานเป็นการเร่งด่วน รุ่นนี้แก้ไขปัญหามีความสำคัญสูงหลายจุดในรุ่น 2.5.5 ที่เพิ่งออกไป เป้าหมายที่ยิ่งใหญ่ของทีมผ่ายผลิต คือการให้ความช่วยเหลือต่อไปอย่างสม่ำเสมอ เพื่อชุมชน Joomla. ท่านสามารถเรียนรู้เพิ่มเติมเกี่ยวกับ Joomla! Developement ที่
