Vulnerable Memory Book! Component SQL Injection and LFI

[fw116]

Description:
Some vulnerabilities have been reported in the Memory Book! component for Joomla!, which can be exploited by malicious users to conduct SQL injection attacks and potentially compromise a vulnerable system.

1) Input passed to the event description when adding a new event is not properly sanitised before being used in SQL queries. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code.

Successful exploitation may require a valid user account.

2) The security issue is caused due to the application improperly validating uploaded files. This can be exploited to execute arbitrary PHP code by uploading a PHP file with e.g. an appended ".jpg" file extension.

Successful exploitation may require a valid user account that Apache is not configured to handle the mime-type for uploadable media files.

[lafrance]

Description:
Some vulnerabilities have been reported in the Memory Book! component for Joomla!, which can be exploited by malicious users to conduct SQL injection attacks and potentially compromise a vulnerable system.

1) Input passed to the event description when adding a new event is not properly sanitised before being used in SQL queries. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code.

Successful exploitation may require a valid user account.

2) The security issue is caused due to the application improperly validating uploaded files. This can be exploited to execute arbitrary PHP code by uploading a PHP file with e.g. an appended ".jpg" file extension.

Successful exploitation may require a valid user account that Apache is not configured to handle the mime-type for uploadable media files.

Thank you for the information.
Trying to replicate exploit so far cannot confirm it.

[fw116]

you got a PM

[lafrance]

got it thank youu

was added on Dec 27 http://docs.joomla.org/Vulnerable_Extensions_List

[fw116]

got it thank youu

was added on Dec 27 http://docs.joomla.org/Vulnerable_Extensions_List

ok,

do you have a update link ? so we can provide a solution ?

because it's still "unsolved" also on secunia...

[lafrance]

got it thank youu

was added on Dec 27 http://docs.joomla.org/Vulnerable_Extensions_List

ok,

do you have a update link ? so we can provide a solution ?

because it's still "unsolved" also on secunia...

As far as I know there as been no fixes at this time.
we added this Multiple Vulnerabilities. requires: magic quotes OFF, user account

However contact with developer sometime is slow to response I still waiting for a major dev to reply about 1 security issues from Novemeber and he just disregard any emails attempts.

If were lucky they contact us or it update to jed then we update our list.

FYI lately the new exploit are spam and need to be taken with a grain of salt work on 1 for over one hour and none of the exploit work try others also the same try it on all version none work.

That one reason if you do not see it on VEL it spam report from exploit.db or as nothing to do with joomla even if they use joomla in the name.

Hope this help,thank you for Pm

[jeffchannell]

lafrance: good luck contacting MemoryBook's dev...

-- jdc

[lafrance]

lafrance: good luck contacting MemoryBook's dev...

-- jdc

Hello !

Yes a same so many developer just disregard there extension exploit and worst refuse to removed Then and new users get exploited..
Same Same on them

[jeffchannell]

Well I know I couldn't find it...

[lafrance]

Well I know I couldn't find it...

Just maybe if you stop slapping yourself you could find it