製品・ソフトウェアに関する情報

JVN脆弱性詳細

Joomla! および Mambo 用の webhosting.php における SQL インジェクションの脆弱性

Title	Joomla! および Mambo 用の webhosting.php における SQL インジェクションの脆弱性
Summary	Joomla! および Mambo 用の webhosting.php の Webhosting コンポーネント (com_webhosting) モジュールには、SQL インジェクションの脆弱性が存在します。
Possible impacts	第三者により、index.php への catid パラメータを介して、任意の SQL コマンドを実行される可能性があります。
Solution	ベンダ情報および参考情報を参照して適切な対策を実施してください。
Publication Date	April 7, 2009, midnight
Registration Date	Dec. 20, 2012, 7:10 p.m.
Last Update	Dec. 20, 2012, 7:10 p.m.

Affected System

wh-com

com webhosting 1.1 RC7 未満

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2008-6653	http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-6653
National Vulnerability Database (NVD)
2	CVE-2008-6653	http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2008-6653

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-89	https://jvndb.jvn.jp/ja/cwe/CWE-89.html

ベンダー情報

No	Name	URL
wh-com
1	Top Page	http://www.joomisp.com/en/

Change Log

No	Changed Details	Date of change
0	[2012年12月20日] 掲載	Feb. 17, 2018, 10:37 a.m.

NVD Vulnerability Information

CVE-2008-6653

Summary	SQL injection vulnerability in webhosting.php in the Webhosting Component (com_webhosting) module before 1.1 RC7 for Joomla! and Mambo allows remote attackers to execute arbitrary SQL commands via the catid parameter to index.php.
Publication Date	April 7, 2009, 11:17 p.m.
Registration Date	Jan. 29, 2021, 1:50 p.m.
Last Update	Sept. 29, 2017, 10:33 a.m.

Affected software configurations

Configuration1	or higher	or less	more than	less than
cpe:2.3:a:wh-com:com_webhosting:0.5:beta::::::
cpe:2.3:a:wh-com:com_webhosting:0.5.3:beta::::::
cpe:2.3:a:wh-com:com_webhosting:0.5.4:beta::::::
cpe:2.3:a:wh-com:com_webhosting:0.5.5:beta::::::
cpe:2.3:a:wh-com:com_webhosting:0.5.6:beta::::::
cpe:2.3:a:wh-com:com_webhosting:1.0:stable::::::
cpe:2.3:a:wh-com:com_webhosting:1.0.1:stable::::::
cpe:2.3:a:wh-com:com_webhosting:1.1:alpha::::::
cpe:2.3:a:wh-com:com_webhosting:1.1:beta::::::
cpe:2.3:a:wh-com:com_webhosting:1.1:rc1::::::
cpe:2.3:a:wh-com:com_webhosting:1.1:rc2::::::
cpe:2.3:a:wh-com:com_webhosting:1.1:rc3::::::
cpe:2.3:a:wh-com:com_webhosting:1.1:rc4::::::
cpe:2.3:a:wh-com:com_webhosting:1.1:rc5::::::
cpe:2.3:a:wh-com:com_webhosting::rc6::::::*		1.1

Related information, measures and tools

No	URL	refsource	タグ
1	http://forum.wh-com.de/index.php?topic=497.0	CONFIRM	Vendor Advisory
2	http://osvdb.org/50423	OSVDB
3	http://www.securityfocus.com/bid/29000	BID	Exploit
4	https://exchange.xforce.ibmcloud.com/vulnerabilities/42124	XF
5	https://www.exploit-db.com/exploits/5527	EXPLOIT-DB

Common Vulnerabilities List

No	CWE	Name	URL
1	CWE-89	SQLインジェクション	https://cwe.mitre.org/data/definitions/89.html

Configuration1	or higher	or less	more than	less than
cpe:2.3:a:wh-com:com_webhosting:0.5:beta::::::
cpe:2.3:a:wh-com:com_webhosting:0.5.3:beta::::::
cpe:2.3:a:wh-com:com_webhosting:0.5.4:beta::::::
cpe:2.3:a:wh-com:com_webhosting:0.5.5:beta::::::
cpe:2.3:a:wh-com:com_webhosting:0.5.6:beta::::::
cpe:2.3:a:wh-com:com_webhosting:1.0:stable::::::
cpe:2.3:a:wh-com:com_webhosting:1.0.1:stable::::::
cpe:2.3:a:wh-com:com_webhosting:1.1:alpha::::::
cpe:2.3:a:wh-com:com_webhosting:1.1:beta::::::
cpe:2.3:a:wh-com:com_webhosting:1.1:rc1::::::
cpe:2.3:a:wh-com:com_webhosting:1.1:rc2::::::
cpe:2.3:a:wh-com:com_webhosting:1.1:rc3::::::
cpe:2.3:a:wh-com:com_webhosting:1.1:rc4::::::
cpe:2.3:a:wh-com:com_webhosting:1.1:rc5::::::
cpe:2.3:a:wh-com:com_webhosting::rc6::::::*		1.1