PT-2005-4525 · Joomla · Joomla!

Published 2005-11-23 · Updated 2017-07-11 · CVE-2005-3772

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Joomla! versions prior to 1.0.4

Description The issue allows remote attackers to execute arbitrary SQL commands. This can be achieved via the Itemid variable in the Polls modules and multiple unspecified methods in the mosDBTable class.

Recommendations For versions prior to 1.0.4, update to version 1.0.4 or later to resolve the issue. As a temporary workaround, consider restricting access to the Polls modules and limiting the use of the mosDBTable class until a patch is applied. Avoid using the Itemid variable in affected modules until the issue is resolved.

Fix

Related Identifiers

CVE-2005-3772

Affected Products

Joomla!

References · 10

• https://nvd.nist.gov/vuln/detail/CVE-2005-3772 · Security Note
• http://secunia.com/advisories/17675 · Vendor Advisory
• http://securityfocus.com/bid/15526 · Patch
• http://vupen.com/english/advisories/2005/2526 · Note
• http://joomla.org/content/view/499/66 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-3772 · Note
• http://osvdb.org/21042 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/23178 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/23177 · Note
• http://osvdb.org/21043 · Note