Unpatched Mambo And Joomla CMSs Threatened by SQL Injection Attacks

CGIDir
Tuesday, July 4, 2006; 07:33 AM

Security flaws have been found in the Mambo and Joomla content management systems, according to research and analysis firm Netcraft (netcraft.com). Developers of the two projects are advising users to install upgrades or security patches immediately, as both are vulnerable to SQL injection attacks.

Both Joomla and MamboAre derived from the same code base. Both open source projects use the PHP scripting language and MySQL database. The popular applications are frequently targeted by Internet criminals seeking to break into Web servers for use in botnets, phishing scams and distributed denial of service attacks.

The Internet Storm Center says it is receiving reports that older versions of Mambo are being actively targeted and exploited using unpatched vulnerabilities. Ideally, user input in Web forms is sanitized - checked to ensure that users are not attempting to introduce code to give instructions to the Web server.