Description

Trustwave SpiderLabs researcher Asaf Orpani has discovered an SQL injection vulnerability in versions 3.2 through 3.4.4 of Joomla!, a popular open-source Content Management System (CMS). Combining that vulnerability with other security weaknesses, our Trustwave SpiderLabs researchers are able to gain full administrative access to any vulnerable Joomla site.

Remediation

Upgrade to Joomla! version 3.4.5.

References

Joomla SQL Injection Vulnerability

Joomla! 3.4.5 Released

[20151001] - Core - SQL Injection

Related Vulnerabilities

WordPress Plugin Contact Form to DB by BestWebSoft-Messages Database For WordPress SQL Injection (1.7.1)

WordPress Plugin AdRotate-Ad manager & AdSense Ads 'track' Parameter SQL Injection (3.6.5)

WordPress Plugin Gallery transformation SQL Injection (1.0)

WordPress Plugin ImageDrop 'ImageDrop.php' Blind SQL Injection (1.1.2)

WordPress Plugin WP Support Plus Responsive Ticket System SQL Injection (7.1.4)

Severity

High

Classification

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Tags

SQL Injection CWE-89 CVE-2015-7297 CVE-2015-7857 CVE-2015-7858