Joomla Third-Party Plugins Multiple Vulnerabilities


Description   (#Several vulnerabilities were reported in Joomla's plugins:#- JooCart: SQL injection triggerable via "product_id" parameter of the "index.php?option=com_opencart&route=product/product" web page#- jCart for OpenCart: SQL injection triggerable via "product_id" parameter of the "index.php?option=com_jcart&route=product/product" web page#- OrdaSoft CCK: SQL injection#- Smart related articles: SQL injection and cross-site scripting#- Extra Search: SQL injection triggerable via "establename" parameter in multiple web pages#- Modern Booking: SQL injection triggerable via "coupon" parameter of the "modern-booking-slots?task=saveorder" web page#- FocalPoint: SQL injection triggerable via "id" parameter of the "index.php?option=com_focalpoint&view=location" web page#- Kunena: cross-site scripting in multiple pages.##Proofs of concept are available.)
     
Vulnerable Products   Vulnerable Software:
Joomla (OSM Development Team) -
     
Solution   - Kunena: 5.0.5.
     
CVE  
     
References   - Exploit-DB : Joomla! Component JooCart 2.x - 'product_id' Parameter SQL Injection
https://www.exploit-db.com/exploits/41641/
- Exploit-DB : Joomla! Component jCart for OpenCart 2.0 - 'product_id' Parameter SQL Injection
https://www.exploit-db.com/exploits/41642/
- Joomla : OrdaSoft CCK,2.0.4,SQL Injection
https://vel.joomla.org/live-vel/1960-ordasoft-cck-2-0-1-sql-injection
- Joomla : Smart related articles ,1.1,SQL Injection and XSS
https://vel.joomla.org/live-vel/1952-smart-related-articles-1-1-sql-injection
- Exploit-DB : Joomla! Component Extra Search 2.2.8 - 'establename' Parameter SQL Injection
https://www.exploit-db.com/exploits/41663/
- Exploit-DB : Joomla! Component Modern Booking 1.0 - 'coupon' Parameter SQL Injection
https://www.exploit-db.com/exploits/41673/
- 0day.today : Joomla FocalPoint 1.2.3 SQL Injection Vulnerability
http://0day.today/exploit/27412
     
Vulnerability Manager Detection   No
     
IPS Protection  
ASQ Engine alarm Available Since
SQL injection Prevention - GET : suspicious OR statement in URL
3.2.0
SQL injection Prevention - GET : suspicious combination of 'OR' or 'AND' statements in URL
3.2.0
SQL injection Prevention - GET : suspicious CREATE statement in URL
3.2.0
SQL injection Prevention - GET : suspicious CAST statement in URL
3.2.0
SQL injection Prevention - GET : suspicious OPENROWSET statement in URL
3.2.0
SQL injection Prevention - GET : suspicious DECLARE statement in URL
3.2.0
SQL injection Prevention - GET : suspicious OPENQUERY statement in URL
3.2.0
SQL injection Prevention - GET : suspicious shutdown statement in URL
3.2.0
SQL injection Prevention - GET : suspicious UNION SELECT statement in URL
3.2.0
SQL injection Prevention - GET : possible database version probing
3.2.0
SQL injection Prevention - GET : suspicious UPDATE SET statement in URL
3.2.0
SQL injection Prevention - GET : suspicious SELECT statement in URL
3.2.0
SQL injection Prevention - GET : suspicious INSERT statement in URL
3.2.0
SQL injection Prevention - GET : suspicious DROP statement in URL
3.2.0
SQL injection Prevention - GET : suspicious EXEC statement in URL
3.2.0
SQL injection Prevention - GET : block comment delimiters in URL
3.2.0
SQL injection Prevention - GET : suspicious combination of 'select' and 'sleep' statements in URL
5.0.0
SQL injection Prevention - GET : Evasion attempt with CAST and EXEC statements
5.0.0
SQL injection Prevention - GET : Authentication bypass attempt with OR statement
5.0.0
SQL injection Prevention - GET : suspicious SQL keywords in URL
5.0.0
     


 
 
 
 
 Risk level 
Moderate 

 Vulnerability First Public Report Date 
2017-03-16 

 Target Type 
Client 

 Possible exploit 
Remote