The developers of the popular content management systems (CMSs) Joomla and Drupal have released updates that address various types of security vulnerabilities.
Drupal 7.41, released on Wednesday, patches an open redirect flaw that has been rated “less critical.” The security hole, which exists in the Overlay module of the Drupal core, affects all 7.x versions of the CMS prior to 7.41.
“The Overlay module in Drupal core displays administrative pages as a layer over the current page (using JavaScript), rather than replacing the page in the browser window. The Overlay module does not sufficiently validate URLs prior to displaying their contents, leading to an open redirect vulnerability,” Drupal developers wrote in an advisory.
The flaw only affects users that have the “Access to administrative overlay” permission, and only if the Overlay module is enabled.
The developers of Joomla announced on Thursday the availability of version 3.4.5, which addresses several vulnerabilities and brings security improvements to the UploadShield system.
The most serious of the patched flaws is a SQL injection reported by Asaf Orpani of Trustwave and Netanel Rubin of PerimeterX. The issue and various of its mutations have been assigned the following CVE identifiers: CVE-2015-7297, CVE-2015-7857 and CVE-2015-7858.
“CVE-2015-7857 enables an unauthorized remote user to gain administrator privileges by hijacking the administrator session. Following exploitation of the vulnerability, the attacker may gain full control of the web site and execute additional attacks,” Trustwave explained in a blog post describing the technical details of the issue.
Researchers discovered that one of the PHP files in Joomla’s “administrator” folder is plagued by a SQL injection flaw that allows an attacker to send a specially crafted request to obtain an administrator session key from the targeted website’s database. The session key can be added to a request to access the “administrator” folder, which gives the attacker admin access to the site’s control panel. The weakness affects Joomla 3.2.0 through 3.4.4.
In addition to the SQL injection, Joomla 3.4.5 fixes a couple of ACL violations related to inadequate checks in the com_contenthistory and com_content components, which provide potential read access to data that should be restricted.
