Sunday, 29 November 2009 20:05
The Joomla component Lyften Bloggie was recently exposed to suffer from an SQL Injection vulnerability. Since I had a current client that was running this software, with no fix in sight, I decided to take matters into my own hands and patch this. And, in the spirit of open source, I thought I'd share the fix with everyone.
The exploit in question uses the URL parameter "author" to inject SQL commands, and as far as I can tell that parameter is an integer value. To plug this hole, I simply changed line 41 of components/com_lyftenbloggie/models/lyftenbloggie.php to use JRequest's getInt() method instead of the more generic getVar().
Original Code:
$this->_author = JRequest::getVar( 'author' );
Patched Code:
$this->_author = JRequest::getInt( 'author' );
UPDATE: It seems the folks over at Lyften have finally published an official fix!
Last Updated on Monday, 28 December 2009 15:45
Comments (10)
Add your comment
Featured Extensions
$5.00
FREE You Save: $5.00 |
$10.00
FREE You Save: $10.00 |
$1.00
FREE You Save: $1.00 |
$3.00
FREE You Save: $3.00 |
Latest Articles
Most Popular
The Joomla!® name is used under a limited license from Open Source Matters in the United States and other countries. Jeff Channell is not affiliated with or endorsed by Open Source Matters or the Joomla!® Project.
Cart
Your Cart is currently empty.
Keywords
Template Info
-
Name
Circles -
Creation Date
06/28/09 -
Author
Jeff Channell -
Author Email
me@jeffchannell.com -
Author URL
http://jeffchannell.com -
Version
0.0.2 -
Description
Circles
Although until the Devs address rest of the issues in Lyften I'm not going to re-install.
Having being blasted a number of times from these little bastards, we tried out a firewall system for joomla back at ver j1.0.8 and today we are at j1.5.10 and must say, THANK the lord for this little baby. Need more info, just look up jfirewall and you won't regret it.
We've seen quite a few of these attacks on LB and we are running this even with the few quirks it has where these little muck-a-lucks are blocked out with no damage to our site as of yet, the firewall has done its job and done it well.