Joomla! ALFContact Component Multiple Cross-Site Scripting Vulnerabilities

SECUNIA ADVISORY ID:
SA46668

VERIFY ADVISORY:
Secunia.com
http://secunia.com/advisories/46668/
Customer Area (Credentials Required)
https://ca.secunia.com/?page=viewadvisory&vuln_id=46668

RELEASE DATE:
2011-11-11
DESCRIPTION:
Jose Carlos de Arriba has discovered multiple vulnerabilities in the
ALFContact component for Joomla!, which can be exploited by malicious
people to conduct cross-site scripting attacks.

1) Input passed to the "emailto_id" and "extravalue" parameters in
index.php (when "option" is set to "com_alfcontact") is not properly
sanitised before being returned to the user. This can be exploited to
execute arbitrary HTML and script code in a user's browser session in
context of an affected site.

Successful exploitation of this vulnerability requires the victim
user is running a browser which executes certain JavaScript
statements from style tags (e.g. Internet Explorer 6).

2)Input passed to the "name", "email", and "subject" parameters in
index.php (when "option" is set to "com_alfcontact") is not properly
sanitised before being returned to the user. This can be exploited to
execute arbitrary HTML and script code in a user's browser session in
context of an affected site.

The vulnerabilities are confirmed in version 1.9.3. Prior versions
may also be affected.

SOLUTION:
Update to version 1.9.4.

PROVIDED AND/OR DISCOVERED BY:
Jose Carlos de Arriba, Foreground Security

ORIGINAL ADVISORY:
ALFContact:
http://alfsoft.com/alfcontact

Jose Carlos de Arriba:
http://archives.neohapsis.com/archives/fulldisclosure/2011-11/0140.html