Múltiples fallas en Joomla 1.5.9 + PoC [Instalacion de una shell]

[AlbertoBSD]

Muy bueno para que no se anden con rodeos de no reparar errores por mínimos que sean.

Felicidades, y por cierto que la musica de fondo del video esta genial.

Saludos

[WHK]

Me ha llegado el correo con la actualización.

Sistema actualizado y los problemas corregidos (por el momento). creo que con esto concluye este post, si alguien tiene dudas co cosas relacionadas puede postearlo con toda libertad.

Joomla! Security News
   

[20090302] - Core - com_content XSS

Posted: 25 Mar 2009 10:08 AM PDT

    * Project: Joomla!
    * SubProject: com_content
    * Severity: Low
    * Versions: 1.5.9 and all previous 1.5 releases
    * Exploit type: XSS
    * Reported Date: 2009-March-12
    * Fixed Date: 2009-March-27

Description

A XSS vulnerability exists in the category view of com_content.
Affected Installs

All 1.5.x installs prior to and including 1.5.9 are affected.
Solution

Upgrade to latest Joomla! version (1.5.10 or newer).
Contact

The JSST at the Joomla! Security Center.

[20090301] - Core - Multiple XSS/CSRF

Posted: 25 Mar 2009 10:02 AM PDT

    * Project: Joomla!
    * SubProject: Multiple
    * Severity: Moderate
    * Versions: 1.5.9 and all previous 1.5 releases
    * Exploit type: XSS and CSRV
    * Reported Date: 2009-February-15
    * Fixed Date: 2009-March-27

Description

A series of XSS and CSRF faults exist in the administrator application.  Affected administrator components include com_admin, com_media, com_search.  Both com_admin and com_search contain XSS vulnerabilities, and com_media contains 2 CSRF vulnerabilities. 
Affected Installs

All 1.5.x installs prior to and including 1.5.9 are affected.  The com_search XSS vulnerability requires that "Gather Search Statistics" be enabled to be exploitable (Disabled by default).
Solution

Upgrade to latest Joomla! version (1.5.10 or newer).
Contact

The JSST at the Joomla! Security Center.
You are subscribed to email updates from Joomla! Developer - Vulnerability News
To stop receiving these emails, you may unsubscribe now.   Email delivery powered by Google
Inbox too full? (feed) Subscribe to the feed version of Joomla! Developer - Vulnerability News in a feed reader.
If you prefer to unsubscribe via postal mail, write to: Joomla! Developer - Vulnerability News, c/o Google, 20 W Kinzie, Chicago IL USA 60610