NVD Vulnerability Detail

CVE-2010-4696

Summary	Multiple SQL injection vulnerabilities in Joomla! 1.5.x before 1.5.22 allow remote attackers to execute arbitrary SQL commands via the (1) filter_order or (2) filter_order_Dir parameter in a com_contact action to index.php, a different vulnerability than CVE-2010-4166. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Publication Date	Jan. 19, 2011, 3:03 a.m.
Registration Date	Jan. 29, 2021, 11:09 a.m.
Last Update	Nov. 21, 2024, 10:21 a.m.

Affected software configurations

Related information, measures and tools

No	URL	タグ
1	http://developer.joomla.org/security/news/9-security/10-core-security/323-20101101-core-sqli-info-disclosurevulnerabilities.html
2	http://openwall.com/lists/oss-security/2010/11/12/5
3	http://openwall.com/lists/oss-security/2010/11/12/6
4	http://secunia.com/advisories/42133	Vendor Advisory
5	http://developer.joomla.org/security/news/9-security/10-core-security/323-20101101-core-sqli-info-disclosurevulnerabilities.html
6	http://secunia.com/advisories/42133	Vendor Advisory
7	http://openwall.com/lists/oss-security/2010/11/12/6
8	http://openwall.com/lists/oss-security/2010/11/12/5

Common Vulnerabilities List

No	CWE	Name	URL
1	CWE-89	SQLインジェクション	https://cwe.mitre.org/data/definitions/89.html

JVN Vulnerability Information

Joomla! における SQL インジェクションの脆弱性

Title	Joomla! における SQL インジェクションの脆弱性
Summary	Joomla! には、SQL インジェクションの脆弱性が存在します。本脆弱性は、CVE-2010-4166 とは異なる脆弱性です。
Possible impacts	第三者により、index.php への com_contact action 内のfilter_order または filter_order_Dir パラメータを介して、任意の SQL コマンドを実行される可能性があります。
Solution	ベンダより正式な対策が公開されています。ベンダ情報を参照して適切な対策を実施してください。
Publication Date	Nov. 4, 2010, midnight
Registration Date	March 27, 2012, 6:42 p.m.
Last Update	March 27, 2012, 6:42 p.m.

Affected System

Joomla!

Joomla! 1.5.22 未満の 1.5.x

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2010-4696	http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-4696
National Vulnerability Database (NVD)
2	CVE-2010-4696	http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2010-4696

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-89	https://jvndb.jvn.jp/ja/cwe/CWE-89.html

ベンダー情報

No	Name	URL
joomla
1	[20101101] - Core - XSS Vulnerabilities	http://developer.joomla.org/security/news/9-security/10-core-security/323-20101101-core-sqli-info-disclosurevulnerabilities.html

Change Log

No	Changed Details	Date of change
0	[2012年03月27日] 掲載	Feb. 17, 2018, 10:37 a.m.