Actu
Vigil@nce: Joomla, Cross Site Scripting via ordering
January 2011 by Vigil@nce
This bulletin was written by Vigil@nce : http://vigilance.fr/
SYNTHESIS OF THE VULNERABILITY
An attacker can use the "ordering" parameter of com_search, in
order to generate a Cross Site Scripting in Joomla.
– Severity: 2/4
– Creation date: 06/01/2011
IMPACTED PRODUCTS
– Joomla!
DESCRIPTION OF THE VULNERABILITY
The com_search module of Joomla is used by the search feature.
The "ordering" parameters of com_search defines the sorting order
of results. However, this parameter is not filtered before being
displayed in the HTML result page.
An attacker can therefore use the "ordering" parameter, in order
to generate a Cross Site Scripting in Joomla.
ACCESS TO THE COMPLETE VIGIL@NCE BULLETIN
http://vigilance.fr/vulnerability/Joomla-Cross-Site-Scripting-via-ordering-10250
