[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

New vulnerabilities in plugin DS-Syndicate for Joomla

Hello Bugtraq!

I want to warn you about new security vulnerabilities in plugin DS-Syndicate for Joomla. It's my second advisory for DS-Syndicate.

Advisory: New vulnerabilities in DS-Syndicate for Joomla
URL: http://websecurity.com.ua/4224/
Affected products: all versions of DS-Syndicate for Joomla.

22.05.2010 - found vulnerabilities.
22.05.2010 - disclosed at my site.
23.05.2010 - informed developer (but as I wrote before, he didn't more support this plugin).

These are Full path disclosure, Cross-Site Scripting and Directory Traversal vulnerabilities.

Full path disclosure:


Even this FPD take place in the same script and in the same parameter, but it shows a little more information then previous FPD and it appears not in one, but in two scripts at once. So it needed to fix separately.

XSS (via SQLi + FPD):


At XSS (via SQLi) the code will not execute in browser (because xml is shown), but at XSS (via SQLi + FPD) the code will execute in browser (because html is shown). Only via SQL Injection it's not possible to conduct XSS attack, because the code isn't executing in browser, but at using together SQLi and FPD it's possible to conduct XSS attack.

Directory Traversal:

For writing of any files, particularly PHP scripts, and also for overwriting any files at the server (at disabled magic quotes):


File available: http://site/1.php

For writing of xml-files - for conducting of XSS (via XML) and LFI attacks, and also for overwriting of xml-files at the server:


File available: http://site/1.xml

For writing of PHP scripts and other files, and also for conducting of XSS and LFI attacks it's needed to use one from parameters 2, 3, 6 or 18 of SQL query.


Note, that developer of the plugin don't support it anymore, so users of the
plugin need to fix it by themselves.

Best wishes & regards,
Administrator of Websecurity web site