lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  PHC 
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [day] [month] [year] [list]
Date: Sun, 28 Nov 2010 19:59:27 +0200
From: "MustLive" <>
To: <>
Subject: Vulnerabilities in Joomla

Hello Bugtraq!

I want to warn you about Insufficient Anti-automation and Abuse of
Functionality vulnerabilities in Joomla. Vulnerabilities exist in component
com_contact, which is a core component of Joomla.

SecurityVulns ID: 11272.

Affected products:

Vulnerable are all versions of Joomla with corresponding functionality
(Joomla! 1.5.22 and previous versions).


In details about such vulnerabilities, about sending of spam via web sites
and creating of spam-botnets it's possible to read in my article Sending
spam via sites and creating spam-botnets

Insufficient Anti-automation (WASC-21):


There is no protection at contact page from automated requests (captcha).

Abuse of Functionality (WASC-42):


Option "E-mail a copy of this message to your own address" at contact page
allows to send spam from the site to arbitrary e-mails. And with using of
Insufficient Anti-automation vulnerability it's possible to send spam from
the site in automated manner on a large scale.


2010.09.16 - announced at my site.
2010.09.18 - informed developers.
2010.09.22 - developers thanked, but ignored to fix these holes in their
2010.09.22 - gave additional arguments to developers to fix these holes.
2010.11.27 - disclosed at my site.

I mentioned about these vulnerabilities at my site

Best wishes & regards,
Administrator of Websecurity web site 

Powered by blists - more mailing lists