Joomla Jom Comment Component Unspecified SQL Injection

SECUNIA ADVISORY ID:
SA29820

VERIFY ADVISORY:
http://secunia.com/advisories/29820/

CRITICAL:
Moderately critical

IMPACT:
Manipulation of data

WHERE:
>From remote

SOFTWARE:
Jom Comment 2.x (component for Joomla)
http://secunia.com/product/18419/

DESCRIPTION:
Security Assurance Team of the National Australia Bank have reported
a vulnerability in the Jom Comment component for Joomla!, which can
be exploited by malicious people to conduct SQL injection attacks.

Input passed to unspecified parameters is not properly sanitised
before being used in SQL queries. This can be exploited to manipulate
SQL queries by injecting arbitrary SQL code.

The vulnerability is reported in version 2.0 build 345. Other
versions may also be affected.

SOLUTION:
Update to version 2.2.

PROVIDED AND/OR DISCOVERED BY:
Security Assurance Team of the National Australia Bank