Security report

[spikespiegel]

Just updated to J3.8.6 and received this from my server:


Hello,

XXXXXXX has detected software vulnerabilities in PHP scripts on your web hosting package. To prevent system abuse resulting from exploitation of these vulnerabilities, these should be addressed as quickly as possible. This concerns the following vulnerabilities:

Code injection vulnerability in Joomla (The lack of type casting of a variable in SQL statement lead to a SQL injection vulnerability in the User Notes list view)
/home/XXXXXXXXX/public_html/administrator/components/com_users/models/notes.php

These are scheduled to be automatically patched with in 48 hours. However you can take actions such as updating the install to address these.


For further information please see YYYYYYYY

[fcoulter]

Code injection vulnerability in Joomla (The lack of type casting of a variable in SQL statement lead to a SQL injection vulnerability in the User Notes list view)
/home/XXXXXXXXX/public_html/administrator/components/com_users/models/notes.php

This is the issue that was patched in version 3.8.6, the version that you have just updated to.

I suggest that you point this out to your hosts.

[spikespiegel]

So it means everything is ok?

[pmleconte]

Hi,

If you take a look at 3.8.6 notes.php, you'll see that all sql requests are "casted".

Compare it with 3.8.5 and you'll see small differences (line 116 and after) : categoryId is now casted before making "where " command. In 3.8.5, it was "protected" by a "if is_scalar" , which gave the same result....

Pascal

[fcoulter]

Yes, everything is OK.