Joomla! 1.x ~ 1.0.15 Cross Site Scripting (XSS)

[yehgnet]

As Joomla! 1.x has been at the end of Life since 2009-07-22, I think this bug will not be fixed.

As you know, this has been existing since the release of Joomla 1.0.15, 22-February-2008 23:00 UTC. It's as old as nearly 3 years.

Unfortunately, we regret we neglected to test Joomla 1.0.15 within its Life time.

However, concerned webmasters can now be aware of this flaw. It would be too unethical for us to hide this flaw.

The "ordering" parameter in a core module,com_search, is not properly sanitized and thus vulnerable to XSS. By leveraging this vulnerability, attackers can compromise currently logged-in user/administrator session and impersonate arbitrary user actions available under /administrator/ functions. As the vulnerability is based on the core module, it affects both classic and customized Joomla! 1.0.x based web sites.


PROOF-OF-CONCEPT

Code: Select all

http://attacker.in/joomla1015/index.php?option=com_search&searchword=xss&searchphrase=any&ordering=newest%22%20onmousemove=alert%28document.cookie%29%20style=position:fixed;top:0;left:0;width:100%;height:100%;%22

From

http://yehg.net/lab/pr0js/advisories/joomla/core/[joomla_1.0.x~15]_cross_site_scripting

[mandville]

noted your report on a retired EOL product 24 hours after you minimal report to the JSST.

[mandville]

The vulnerability mentioned is not known to exist in any current supported release. Please ensure you are using the latest version of Joomla!

[natecovington]

Ok, so does this vulnerability actually exist? If so, what is the fix/patch? It's no secret that there are a number of Joomla 1.0 sites floating around...

[edit]just read that this only exists when administrator is logged in? - not quite as urgent as I first read through this post?[/edit]

[thefactory]

This vulnerability seems to be real. At least the proof of concept worked on an J1.0.15 installation i had.

This patch fixed the issue:

http://www.joomlaportal.de/sicherheit/2 ... ility.html

It's a german forum, but you can easy get the idea

[brian]

I can confirm the vulnerability

I can confirm that the patch available at joomlaportal fixed the vulnerability