Joomla BookLibrary Component Multiple SQL Injection Vulnerabilities

SECUNIA ADVISORY ID:
SA40131

VERIFY ADVISORY:
Secunia.com
http://secunia.com/advisories/40131/
Customer Area (Credentials Required)
https://ca.secunia.com/?page=viewadvisory&vuln_id=40131

RELEASE DATE:
2010-07-01
DESCRIPTION:
Secunia Research has discovered multiple vulnerabilities in the
BookLibrary component for Joomla, which can be exploited by malicious
people to conduct SQL injection attacks.

1) Input passed via the "bid[]" parameter to index.php (when "option"
is set to "com_booklibrary" and "task" is set to "lend_request") is
not properly sanitised before being used in a SQL query. This can be
exploited to manipulate SQL queries by injecting arbitrary SQL code.

2) Input passed via the "bid[]" parameter to index.php (when "option"
is set to "com_booklibrary" and "task" is set to "save_lend_request")
is not properly sanitised before being used in a SQL query. This can
be exploited to manipulate SQL queries by injecting arbitrary SQL
code.

Successful exploitation requires that "magic_quotes_gpc" is
disabled.

3) Input passed via the "id" parameter to index.php (when "option" is
set to "com_booklibrary" and "task" is set to "mdownload" or
"downitsf") is not properly sanitised before being used in a SQL
query. This can be exploited to manipulate SQL queries by injecting
arbitrary SQL code.

4) Input passed via the "searchtext" parameter to index.php (when
"option" is set to "com_booklibrary" and "task" is set to "search")
is not properly sanitised before being used in a SQL query. This can
be exploited to manipulate SQL queries by injecting arbitrary SQL
code.

Successful exploitation requires that "magic_quotes_gpc" is
disabled.

The vulnerabilities are confirmed in version 1.5.3 Basic. Other
versions may also be affected.

SOLUTION:
Update to version 1.5.3_2010_06_20.

PROVIDED AND/OR DISCOVERED BY:
Secunia Research