SNS Vulnerability

Joomla Third-Party Plugins Multiple Vulnerabilities

Description

(#Several vulnerabilities were reported in Joomla third-party modules:#- Huge IT Video Gallery: cross-site scripting#- Event Booking: SQL injection via the parameter "date"#- Huge IT Googlemaps: multiple SQL injections#- Remository: information disclosure via the parameter "com_remository"#- Huge IT Slider: SQL injection#- Huge-IT Portfolio Gallery: SQL injection (CVE-2016-1000124).##Proofs of concept are available.)

Vulnerable Products

Vulnerable Software:
Joomla (OSM Development Team) -

Solution

No solution for the moment.

CVE

CVE-2016-1000124

References

- Joomla : Huge IT Video Gallery,1.1.1,XSS (Cross Site Scripting)
https://vel.joomla.org/live-vel/1879-huge-it-video-gallery-1-1-1-xss-cross-site-scripting
- 0day : Joomla Event Booking 2.10.1 Component - SQL Injection Vulnerability
http://0day.today/exploit/24833
- Joomla : Huge IT Googlemaps,1.0.9,SQL Injection
https://vel.joomla.org/live-vel/1880-huge-it-googlemaps-1-0-9-sql-injection
- cxsecurity : Joomla com_remository Component - Full Path Disclosure Vulnerability
https://cxsecurity.com/issue/WLB-2016090208
- vapidlabs : Unauthenticated SQL Injection in Huge-IT Portfolio Gallery Plugin v1.0.6
http://www.vapidlabs.com/advisory.php?v=170

Vulnerability Manager Detection

IPS Protection

ASQ Engine alarm	Available Since
SQL injection Prevention - GET : suspicious OR statement in URL	3.2.0
SQL injection Prevention - GET : suspicious combination of 'OR' or 'AND' statements in URL	3.2.0
SQL injection Prevention - GET : suspicious CREATE statement in URL	3.2.0
SQL injection Prevention - GET : suspicious CAST statement in URL	3.2.0
SQL injection Prevention - GET : suspicious OPENROWSET statement in URL	3.2.0
SQL injection Prevention - GET : suspicious DECLARE statement in URL	3.2.0
SQL injection Prevention - GET : suspicious OPENQUERY statement in URL	3.2.0
SQL injection Prevention - GET : suspicious shutdown statement in URL	3.2.0
SQL injection Prevention - GET : suspicious UNION SELECT statement in URL	3.2.0
SQL injection Prevention - GET : possible database version probing	3.2.0
SQL injection Prevention - GET : suspicious UPDATE SET statement in URL	3.2.0
SQL injection Prevention - GET : suspicious SELECT statement in URL	3.2.0
SQL injection Prevention - GET : suspicious INSERT statement in URL	3.2.0
SQL injection Prevention - GET : suspicious DROP statement in URL	3.2.0
SQL injection Prevention - GET : suspicious EXEC statement in URL	3.2.0
SQL injection Prevention - GET : block comment delimiters in URL	3.2.0
SQL injection Prevention - POST : suspicious UPDATE statement in data	5.0.0
SQL injection Prevention - POST : suspicious SELECT statement in data	5.0.0
SQL injection Prevention - POST : suspicious DECLARE statement in data	5.0.0
SQL injection Prevention - POST : suspicious OPENROWSET statement in data	5.0.0
SQL injection Prevention - POST : suspicious OPENQUERY statement in data	5.0.0
SQL injection Prevention - GET : suspicious combination of 'select' and 'sleep' statements in URL	5.0.0
SQL injection Prevention - POST : suspicious CAST statement in data	5.0.0
SQL injection Prevention - GET : Evasion attempt with CAST and EXEC statements	5.0.0
SQL injection Prevention - POST : suspicious EXEC statement in data	5.0.0
SQL injection Prevention - POST : suspicious CREATE statement in data	5.0.0
SQL injection Prevention - POST : suspicious INSERT statement in data	5.0.0
CMS plugin - Full Path Disclosure Vulnerability	5.0.0
SQL injection Prevention - GET : Authentication bypass attempt with OR statement	5.0.0
SQL injection Prevention - POST : suspicious DROP statement in data	5.0.0
SQL injection Prevention - POST : suspicious HAVING statement in data	5.0.0
SQL injection Prevention - POST : suspicious UNION statement in data	5.0.0
SQL injection Prevention - POST : suspicious OR statement in data	5.0.0
SQL injection Prevention - POST : possible version probing in data	5.0.0
SQL injection Prevention - GET : suspicious SQL keywords in URL	5.0.0

Risk level

Moderate

Vulnerability First Public Report Date

2016-09-28

Target Type

Server

Possible exploit

Remote