The following security advisory is sent to the securiteam mailing list, and can
be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion
The SecuriTeam alerts list - Free, Accurate, Independent.
Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html
- - - - - - - - -
Joomla Component Jom Comment SQL Injection Vulnerability
------------------------------------------------------------------------
SUMMARY
<http://www.azrul.com/> Jom Comment, "an advanced AJAX based comment
system for Joomla! CMS presents a slick finish to your website,
feature-rich and compatible with your existing system, all packaged in an
easy-to-use nifty component". A vulnerability in the way Jom Comment works
allows remote attackers to cause the product to execute arbitrary SQL
statements.
DETAILS
Vulnerable Systems:
* Jom Comment version 2.0 Build 345 (released 2007-12-12)
Immune Systems:
* Jom Comment version 2.2
The Joomla! component Jom Comment is vulnerable to SQL injection because
it fails to properly sanitize user-supplied input. An attacker can exploit
this vulnerability using common SQL injection techniques to compromise
data contained in the Joomla! / MySQL database. Data includes the
username, password hash, and password salt of every application user
including the site administrator.
ADDITIONAL INFORMATION
The information has been provided by <mailto:Ian.E.Green@nab.com.au> Ian
E Green.
========================================
This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to:
list-unsubscribe@securiteam.com
In order to subscribe to the mailing list, simply forward this email to:
list-subscribe@securiteam.com
====================
====================
DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any
kind.
In no event shall we be liable for any damages whatsoever including direct,
indirect, incidental, consequential, loss of business profits or special
damages.
