製品・ソフトウェアに関する情報

JVN脆弱性詳細

Joomla! における SQL インジェクションの脆弱性

Title	Joomla! における SQL インジェクションの脆弱性
Summary	Joomla! には、SQL インジェクションの脆弱性が存在します。
Possible impacts	第三者により、以下のパラメータを介して、任意の SQL コマンドを実行される可能性があります。 (1) index.php への com_weblinks category action 内の filter_order パラメータ (2) filter_order_Dir パラメータ (3) administrator/index.php の com_messages action 内の filter_order_Dir パラメータ
Solution	ベンダより正式な対策が公開されています。ベンダ情報を参照して適切な対策を実施してください。
Publication Date	Nov. 4, 2010, midnight
Registration Date	March 27, 2012, 6:42 p.m.
Last Update	March 27, 2012, 6:42 p.m.

Affected System

Joomla!

Joomla! 1.5.22 未満の 1.5.x

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2010-4166	http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-4166
National Vulnerability Database (NVD)
2	CVE-2010-4166	http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2010-4166

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-89	https://jvndb.jvn.jp/ja/cwe/CWE-89.html

ベンダー情報

No	Name	URL
joomla
1	[20101101] - Core - XSS Vulnerabilities	http://developer.joomla.org/security/news/9-security/10-core-security/323-20101101-core-sqli-info-disclosurevulnerabilities.html

Change Log

No	Changed Details	Date of change
0	[2012年03月27日] 掲載	Feb. 17, 2018, 10:37 a.m.

NVD Vulnerability Information

CVE-2010-4166

Summary	Multiple SQL injection vulnerabilities in Joomla! 1.5.x before 1.5.22 allow remote attackers to execute arbitrary SQL commands via (1) the filter_order parameter in a com_weblinks category action to index.php, (2) the filter_order_Dir parameter in a com_weblinks category action to index.php, or (3) the filter_order_Dir parameter in a com_messages action to administrator/index.php.
Publication Date	Jan. 19, 2011, 3:03 a.m.
Registration Date	Jan. 29, 2021, 11:08 a.m.
Last Update	Nov. 21, 2024, 10:20 a.m.

Affected software configurations

Related information, measures and tools

No	URL	タグ
1	http://archives.neohapsis.com/archives/fulldisclosure/2010-10/0514.html
2	http://archives.neohapsis.com/archives/fulldisclosure/2010-10/0514.html
3	http://developer.joomla.org/security/news/9-security/10-core-security/323-20101101-core-sqli-info-disclosurevulnerabilities.html
4	http://developer.joomla.org/security/news/9-security/10-core-security/323-20101101-core-sqli-info-disclosurevulnerabilities.html
5	http://openwall.com/lists/oss-security/2010/11/12/5
6	http://openwall.com/lists/oss-security/2010/11/12/5
7	http://openwall.com/lists/oss-security/2010/11/12/6
8	http://openwall.com/lists/oss-security/2010/11/12/6
9	http://secunia.com/advisories/42133	Vendor Advisory
10	http://secunia.com/advisories/42133	Vendor Advisory
11	http://yehg.net/lab/pr0js/advisories/joomla/core/1.5.21/sql_injection/sqli_%28filter_order%29_front.jpg
12	http://yehg.net/lab/pr0js/advisories/joomla/core/1.5.21/sql_injection/sqli_%28filter_order%29_front.jpg
13	http://yehg.net/lab/pr0js/advisories/joomla/core/1.5.21/sql_injection/sqli_%28filter_order_Dir%29_back.jpg	Exploit
14	http://yehg.net/lab/pr0js/advisories/joomla/core/1.5.21/sql_injection/sqli_%28filter_order_Dir%29_back.jpg	Exploit
15	http://yehg.net/lab/pr0js/advisories/joomla/core/1.5.21/sql_injection/sqli_%28filter_order_Dir%29_front.jpg	Exploit
16	http://yehg.net/lab/pr0js/advisories/joomla/core/1.5.21/sql_injection/sqli_%28filter_order_Dir%29_front.jpg	Exploit

Common Vulnerabilities List

No	CWE	Name	URL
1	CWE-89	SQLインジェクション	https://cwe.mitre.org/data/definitions/89.html