Acunetix Web Vulnerability Scanner high vulnerability alert

[Smile]

Hi, I tried Acunetix Web Vulnerability Scanner v5 on my clean joomla 1.0.15 install.

I got High Vulnerability alert: I was thinking Joomla was more secure??

Blind SQL/XPath injection:

The POST variable text is vulnerable
/component/option,com_contact/Itemid,3/

The POST variable op is vulnerable
/component/option,com_contact/Itemid,42/

The POST variable name is vulnerable
/component/option,com_contact/Itemid,99999999/

The post variable task is vulnerable
/content/category/1/17/2/

The post variable task is vulnerable
/content/category/5/15/32/

The post variable task is vulnerable
/content/category/5/15/37/

The post variable task is vulnerable
/content/category/5/16/32/
/content/category/5/16/37/

The post variable task is vulnerable

The GET variable submit is vulnerable
/index.php

[Smile]

Try the scanner on your site too, can theese problems be fixed and how?

http://www.acunetix.com/cross-site-scri ... canner.htm

[kardinol]

"The issues detected were of major impact. If users/hackers would have found the security holes, they could have hacked an entire Joomla! site." - Robin Muilwijk, member of the Quality and Testing Team, Joomla!

Code: Select all

http://www.acunetix.com/blog/case-studies/joomla/

[Tonie]

This post was more than six years old.

[mandville]

Topic locked due to age relevance