3 Vulnerability in "Smart related articles" extension 1.1 for Joomla!.

gistfile1.txt

> [Description]
> The "Smart related articles" extension 1.1 for Joomla! has XSS in dialog.php (n_art,type in GET Method).
>
> ------------------------------------------
>
> [Additional Information]
> this vulnerability reported to Joomla extensions Site.
> https://extensions.joomla.org/extension/smart-related-articles/
> https://vel.joomla.org/live-vel/1952-smart-related-articles-1-1-sql-injection
>
> ------------------------------------------
>
> [Vulnerability Type]
> Cross Site Scripting (XSS)
>
> ------------------------------------------
>
> [Vendor of Product]
> joomla extensions - Iacopo Guarneri
>
> ------------------------------------------
>
> [Affected Product Code Base]
> Smart related articles - 1.0
>
> ------------------------------------------
>
> [Affected Component]
> Joomla_root_path/plugins/editors-xtd/smartrelatedarticles/dialog.php
> n_art,type in GET Method.
>
> ------------------------------------------
>
> [Attack Type]
> Remote
>
> ------------------------------------------
>
> [Reference]
> https://extensions.joomla.org/extension/smart-related-articles/
> https://vel.joomla.org/live-vel/1952-smart-related-articles-1-1-sql-injection
>
> ------------------------------------------
>
> [Has vendor confirmed or acknowledged the vulnerability?]
> true
>
> ------------------------------------------
>
> [Discoverer]
> APA Center at University Of birjand

Use CVE-2017-7626.


> [Description]
> The "Smart related articles" extension 1.1 for Joomla! does not prevent direct requests to dialog.php
> (there is a missing _JEXEC check).
>
> ------------------------------------------
>
> [Additional Information]
> this vulnerability reported to Joomla extensions Site.
> https://extensions.joomla.org/extension/smart-related-articles/
> https://vel.joomla.org/live-vel/1952-smart-related-articles-1-1-sql-injection
>
> ------------------------------------------
>
> [Vulnerability Type]
> Incorrect Access Control
>
> ------------------------------------------
>
> [Vendor of Product]
> joomla extensions - Iacopo Guarneri
>
> ------------------------------------------
>
> [Affected Product Code Base]
> Smart related articles - 1.0
>
> ------------------------------------------
>
> [Affected Component]
> Direct Access to dialog.php
> Joomla_root_path/plugins/editors-xtd/smartrelatedarticles/dialog.php
> define('_JEXEC', 1 );
> defined('_JEXEC') or die;
>
> ------------------------------------------
>
> [Attack Type]
> Remote
>
> ------------------------------------------
>
> [Reference]
> https://extensions.joomla.org/extension/smart-related-articles/
> https://vel.joomla.org/live-vel/1952-smart-related-articles-1-1-sql-injection
>
> ------------------------------------------
>
> [Has vendor confirmed or acknowledged the vulnerability?]
> true
>
> ------------------------------------------
>
> [Discoverer]
> APA Center at University Of birjand

Use CVE-2017-7627.


> [Description]
> The "Smart related articles" extension 1.1 for Joomla! has SQL injection in dialog.php
> (attacker must use search_cats variable in POST method to exploit this vulnerability).
>
> ------------------------------------------
>
> [Additional Information]
> this vulnerability reported to Joomla extensions Site.
> https://extensions.joomla.org/extension/smart-related-articles/
> https://vel.joomla.org/live-vel/1952-smart-related-articles-1-1-sql-injection
>
> ------------------------------------------
>
> [Vulnerability Type]
> SQL Injection
>
> ------------------------------------------
>
> [Vendor of Product]
> joomla extensions - Iacopo Guarneri
>
> ------------------------------------------
>
> [Affected Product Code Base]
> Smart related articles - 1.0
>
> ------------------------------------------
>
> [Affected Component]
> http://joomla-site/plugins/editors-xtd/smartrelatedarticles/dialog.php
>
> attacker must used search_cats variable in POST method to exploit this vulnerability.
>
> ------------------------------------------
>
> [Attack Type]
> Remote
>
> ------------------------------------------
>
> [Reference]
> https://extensions.joomla.org/extension/smart-related-articles/
> https://vel.joomla.org/live-vel/1952-smart-related-articles-1-1-sql-injection
>
> ------------------------------------------
>
> [Has vendor confirmed or acknowledged the vulnerability?]
> true
>
> ------------------------------------------
>
> [Discoverer]
> APA Center at University Of birjand

Use CVE-2017-7628.