[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Vulnerabilities in Joomla

Hello Bugtraq!

I want to warn you about Insufficient Anti-automation and Abuse of
Functionality vulnerabilities in Joomla. Vulnerabilities exist in component
com_contact, which is a core component of Joomla.

SecurityVulns ID: 11272.

Affected products:

Vulnerable are all versions of Joomla with corresponding functionality
(Joomla! 1.5.22 and previous versions).


In details about such vulnerabilities, about sending of spam via web sites
and creating of spam-botnets it's possible to read in my article Sending
spam via sites and creating spam-botnets

Insufficient Anti-automation (WASC-21):


There is no protection at contact page from automated requests (captcha).

Abuse of Functionality (WASC-42):


Option "E-mail a copy of this message to your own address" at contact page
allows to send spam from the site to arbitrary e-mails. And with using of
Insufficient Anti-automation vulnerability it's possible to send spam from
the site in automated manner on a large scale.


2010.09.16 - announced at my site.
2010.09.18 - informed developers.
2010.09.22 - developers thanked, but ignored to fix these holes in their
2010.09.22 - gave additional arguments to developers to fix these holes.
2010.11.27 - disclosed at my site.

I mentioned about these vulnerabilities at my site

Best wishes & regards,
Administrator of Websecurity web site