Joomla! JRequest Initialization Bug Lets Remote Users Inject Characters into Variables

	Keep Track of the Latest Vulnerabilities with SecurityTracker!

SecurityTracker Alert ID: 1020843

SecurityTracker URL: http://securitytracker.com/id/1020843

CVE Reference: CVE-2008-4105 (Links to External Site)

Updated: Sep 25 2008

Original Entry Date: Sep 10 2008

Impact: Modification of user information

Fix Available: Yes Vendor Confirmed: Yes

Version(s): 1.5.x prior to 1.5.7

Description: A vulnerability was reported in Joomla!. A remote user can modify certain variables.

The system does not properly initialize variables set with JRequest::setVar. A remote user can inject characters into the returned data.

Andrew Eddie reported this vulnerability.

Impact: A remote user can modify certain variables.

Solution: The vendor has issued a fixed version (1.5.7).

The vendor's advisory is available at:

http://developer.joomla.org/security/news/271-20080901-core-jrequest-variable-injection.html

Vendor URL: www.joomla.org/announcements/release-news/5212-joomla-157-security-release-now-available.html (Links to External Site)

Cause: Access control error

Underlying OS: Linux (Any), UNIX (Any), Windows (Any)

Message History: None.

Date: Wed, 10 Sep 2008 00:11:45 -0400
Subject: Joomla!


http://developer.joomla.org/security/news/271-20080901-core-jrequest-variable-injection.html