Security Experts:

Connect with us

Hi, what are you looking for?



Security Flaws Patched in Joomla, Drupal

The developers of the popular content management systems (CMSs) Joomla and Drupal have released updates that address various types of security vulnerabilities.

The developers of the popular content management systems (CMSs) Joomla and Drupal have released updates that address various types of security vulnerabilities.

Drupal 7.41, released on Wednesday, patches an open redirect flaw that has been rated “less critical.” The security hole, which exists in the Overlay module of the Drupal core, affects all 7.x versions of the CMS prior to 7.41.

“The Overlay module in Drupal core displays administrative pages as a layer over the current page (using JavaScript), rather than replacing the page in the browser window. The Overlay module does not sufficiently validate URLs prior to displaying their contents, leading to an open redirect vulnerability,” Drupal developers wrote in an advisory.

The flaw only affects users that have the “Access to administrative overlay” permission, and only if the Overlay module is enabled.

The developers of Joomla announced on Thursday the availability of version 3.4.5, which addresses several vulnerabilities and brings security improvements to the UploadShield system.

The most serious of the patched flaws is a SQL injection reported by Asaf Orpani of Trustwave and Netanel Rubin of PerimeterX. The issue and various of its mutations have been assigned the following CVE identifiers: CVE-2015-7297, CVE-2015-7857 and CVE-2015-7858.

“CVE-2015-7857 enables an unauthorized remote user to gain administrator privileges by hijacking the administrator session. Following exploitation of the vulnerability, the attacker may gain full control of the web site and execute additional attacks,” Trustwave explained in a blog post describing the technical details of the issue.

Researchers discovered that one of the PHP files in Joomla’s “administrator” folder is plagued by a SQL injection flaw that allows an attacker to send a specially crafted request to obtain an administrator session key from the targeted website’s database. The session key can be added to a request to access the “administrator” folder, which gives the attacker admin access to the site’s control panel. The weakness affects Joomla 3.2.0 through 3.4.4.

In addition to the SQL injection, Joomla 3.4.5 fixes a couple of ACL violations related to inadequate checks in the com_contenthistory and com_content components, which provide potential read access to data that should be restricted.

Written By

Eduard Kovacs (@EduardKovacs) is a contributing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.

Click to comment

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

Join this webinar to learn best practices that organizations can use to improve both their resilience to new threats and their response times to incidents.


Join this live webinar as we explore the potential security threats that can arise when third parties are granted access to a sensitive data or systems.


Expert Insights

Related Content


Less than a week after announcing that it would suspended service indefinitely due to a conflict with an (at the time) unnamed security researcher...

Risk Management

The supply chain threat is directly linked to attack surface management, but the supply chain must be known and understood before it can be...


Apple has released updates for macOS, iOS and Safari and they all include a WebKit patch for a zero-day vulnerability tracked as CVE-2023-23529.

Application Security

Drupal released updates that resolve four vulnerabilities in Drupal core and three plugins.

Cloud Security

VMware vRealize Log Insight vulnerability allows an unauthenticated attacker to take full control of a target system.

IoT Security

Lexmark warns of a remote code execution (RCE) vulnerability impacting over 120 printer models, for which PoC code has been published.

Application Security

A CSRF vulnerability in the source control management (SCM) service Kudu could be exploited to achieve remote code execution in multiple Azure services.


Patch Tuesday: Microsoft warns vulnerability (CVE-2023-23397) could lead to exploitation before an email is viewed in the Preview Pane.