PT-2011-1743 · Joomla · Com Jscalendar

Drosophila + 1 · Publicado 2011-04-27 · Atualizado 2017-08-17 · CVE-2010-4795

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Joomla! component com jscalendar versions 1.5.1 through 1.5.4

Description The issue allows remote attackers to execute arbitrary SQL commands. This is achieved by exploiting the ev id parameter in a details action to the "index.php" endpoint.

Recommendations For versions 1.5.1 through 1.5.4, avoid using the ev id parameter in the details action to the "index.php" endpoint until a fix is available. Consider restricting access to the com jscalendar component to minimize the risk of exploitation.

Exploit

Correção

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2010-4795

Produtos afetados

Com Jscalendar

Referências · 8

• 🔥 https://exploit-db.com/exploits/15224 · Exploit
• 🔥 http://adv.salvatorefresta.net/JS_Calendar_1.5.1_Joomla_Component_Multiple_Remote_Vulnerabilities-09102010.txt · Exploit
• 🔥 http://exploit-db.com/exploits/15224 · Exploit
• 🔥 http://securityfocus.com/bid/43902 · Exploit
• http://secunia.com/advisories/41766 · Aviso do Fabricante
• http://securityreason.com/securityalert/8223 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2010-4795 · Nota de Segurança
• https://exchange.xforce.ibmcloud.com/vulnerabilities/62379 · Nota