PT-2009-4956 · Joomla · Jobline

Manhluat93 · Publicado 2009-07-20 · Atualizado 2017-09-19 · CVE-2009-2554

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Jobline (com jobline) versions 1.1.2.2 through 1.3.1 and possibly earlier versions

Description The issue allows remote attackers to execute arbitrary SQL commands via the search parameter in a results action to "index.php", which invokes the search method from the searchJobPostings function in "jobline.php". This is a SQL injection vulnerability in the search method in jobline.class.php, a component for Joomla!.

Recommendations For versions 1.1.2.2 through 1.3.1 and possibly earlier versions, consider disabling the search function in jobline.class.php until a patch is available. Restrict access to the search parameter in the results action to "index.php" to minimize the risk of exploitation. Avoid using the search parameter in the affected API endpoint until the issue is resolved.

Exploit

Correção

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2009-2554

Produtos afetados

Jobline

Referências · 6

• 🔥 http://securityfocus.com/bid/35728 · Exploit
• 🔥 https://exploit-db.com/exploits/9187 · Exploit
• 🔥 http://exploit-db.com/exploits/9187 · Exploit
• https://exchange.xforce.ibmcloud.com/vulnerabilities/51811 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2009-2554 · Nota de Segurança
• http://secunia.com/advisories/35877 · Aviso do Fabricante